@atlasauth/cli 0.25.0 → 0.25.1

package/dist/index.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BETTER_AUTH_MIGRATION_STEPS = exports.migrateBetterAuth = exports.translateBetterAuth = exports.planConfigImport = exports.migrate = exports.manifestPath = exports.writeManifest = exports.readManifest = exports.deliverSecret = exports.productDir = exports.renderDotenv = exports.parseDotenv = exports.readEnvFile = exports.writeSecretFile = exports.referrals = exports.client = exports.envCommand = exports.preflight = exports.init = exports.pages = exports.actions = exports.defineConfig = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
+/**
+ * Library surface of `@atlasauth/cli`. The package ships a bin (`atlas`), but
+ * exporting the pieces lets the handlers be unit-tested with injected deps and
+ * lets another tool embed the CLI (e.g. `create-atlas-app`) without spawning a
+ * child process.
+ */
+var run_1 = require("./run");
+Object.defineProperty(exports, "run", { enumerable: true, get: function () { return run_1.run; } });
+var context_1 = require("./context");
+Object.defineProperty(exports, "defaultContext", { enumerable: true, get: function () { return context_1.defaultContext; } });
+var config_http_1 = require("./config-http");
+Object.defineProperty(exports, "createConfigHttp", { enumerable: true, get: function () { return config_http_1.createConfigHttp; } });
+Object.defineProperty(exports, "isNotFound", { enumerable: true, get: function () { return config_http_1.isNotFound; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "CliError", { enumerable: true, get: function () { return errors_1.CliError; } });
+var io_1 = require("./io");
+Object.defineProperty(exports, "defaultIO", { enumerable: true, get: function () { return io_1.defaultIO; } });
+Object.defineProperty(exports, "captureIO", { enumerable: true, get: function () { return io_1.captureIO; } });
+var config_1 = require("./config");
+Object.defineProperty(exports, "FileConfigStore", { enumerable: true, get: function () { return config_1.FileConfigStore; } });
+Object.defineProperty(exports, "MemoryConfigStore", { enumerable: true, get: function () { return config_1.MemoryConfigStore; } });
+Object.defineProperty(exports, "defaultConfigPath", { enumerable: true, get: function () { return config_1.defaultConfigPath; } });
+var prompt_1 = require("./prompt");
+Object.defineProperty(exports, "defaultPrompter", { enumerable: true, get: function () { return prompt_1.defaultPrompter; } });
+var version_1 = require("./version");
+Object.defineProperty(exports, "getVersion", { enumerable: true, get: function () { return version_1.getVersion; } });
+// The individual command handlers, exported for direct testing/embedding.
+var auth_1 = require("./commands/auth");
+Object.defineProperty(exports, "login", { enumerable: true, get: function () { return auth_1.login; } });
+Object.defineProperty(exports, "logout", { enumerable: true, get: function () { return auth_1.logout; } });
+Object.defineProperty(exports, "whoami", { enumerable: true, get: function () { return auth_1.whoami; } });
+var users_1 = require("./commands/users");
+Object.defineProperty(exports, "users", { enumerable: true, get: function () { return users_1.users; } });
+var orgs_1 = require("./commands/orgs");
+Object.defineProperty(exports, "orgs", { enumerable: true, get: function () { return orgs_1.orgs; } });
+var api_keys_1 = require("./commands/api-keys");
+Object.defineProperty(exports, "apiKeys", { enumerable: true, get: function () { return api_keys_1.apiKeys; } });
+var webhooks_1 = require("./commands/webhooks");
+Object.defineProperty(exports, "webhooks", { enumerable: true, get: function () { return webhooks_1.webhooks; } });
+var sessions_1 = require("./commands/sessions");
+Object.defineProperty(exports, "sessions", { enumerable: true, get: function () { return sessions_1.sessions; } });
+var config_2 = require("./commands/config");
+Object.defineProperty(exports, "config", { enumerable: true, get: function () { return config_2.config; } });
+var define_config_1 = require("./define-config");
+Object.defineProperty(exports, "defineConfig", { enumerable: true, get: function () { return define_config_1.defineConfig; } });
+var actions_1 = require("./commands/actions");
+Object.defineProperty(exports, "actions", { enumerable: true, get: function () { return actions_1.actions; } });
+var pages_1 = require("./commands/pages");
+Object.defineProperty(exports, "pages", { enumerable: true, get: function () { return pages_1.pages; } });
+var init_1 = require("./commands/init");
+Object.defineProperty(exports, "init", { enumerable: true, get: function () { return init_1.init; } });
+var project_commands_1 = require("./commands/project-commands");
+Object.defineProperty(exports, "preflight", { enumerable: true, get: function () { return project_commands_1.preflight; } });
+Object.defineProperty(exports, "envCommand", { enumerable: true, get: function () { return project_commands_1.envCommand; } });
+Object.defineProperty(exports, "client", { enumerable: true, get: function () { return project_commands_1.client; } });
+var referrals_1 = require("./commands/referrals");
+Object.defineProperty(exports, "referrals", { enumerable: true, get: function () { return referrals_1.referrals; } });
+var secrets_1 = require("./secrets");
+Object.defineProperty(exports, "writeSecretFile", { enumerable: true, get: function () { return secrets_1.writeSecretFile; } });
+Object.defineProperty(exports, "readEnvFile", { enumerable: true, get: function () { return secrets_1.readEnvFile; } });
+Object.defineProperty(exports, "parseDotenv", { enumerable: true, get: function () { return secrets_1.parseDotenv; } });
+Object.defineProperty(exports, "renderDotenv", { enumerable: true, get: function () { return secrets_1.renderDotenv; } });
+Object.defineProperty(exports, "productDir", { enumerable: true, get: function () { return secrets_1.productDir; } });
+Object.defineProperty(exports, "deliverSecret", { enumerable: true, get: function () { return secrets_1.deliverSecret; } });
+var project_1 = require("./project");
+Object.defineProperty(exports, "readManifest", { enumerable: true, get: function () { return project_1.readManifest; } });
+Object.defineProperty(exports, "writeManifest", { enumerable: true, get: function () { return project_1.writeManifest; } });
+Object.defineProperty(exports, "manifestPath", { enumerable: true, get: function () { return project_1.manifestPath; } });
+var migrate_1 = require("./commands/migrate");
+Object.defineProperty(exports, "migrate", { enumerable: true, get: function () { return migrate_1.migrate; } });
+var config_3 = require("./commands/config");
+Object.defineProperty(exports, "planConfigImport", { enumerable: true, get: function () { return config_3.planConfigImport; } });
+var translate_1 = require("./migrate/better-auth/translate");
+Object.defineProperty(exports, "translateBetterAuth", { enumerable: true, get: function () { return translate_1.translateBetterAuth; } });
+var orchestrator_1 = require("./migrate/better-auth/orchestrator");
+Object.defineProperty(exports, "migrateBetterAuth", { enumerable: true, get: function () { return orchestrator_1.migrateBetterAuth; } });
+Object.defineProperty(exports, "BETTER_AUTH_MIGRATION_STEPS", { enumerable: true, get: function () { return orchestrator_1.STEPS; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,iDAAiE;AAAxD,6GAAA,YAAY,OAAA;AACrB,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gEAA4E;AAAnE,6GAAA,SAAS,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,0GAAA,MAAM,OAAA;AACtC,kDAAiD;AAAxC,sGAAA,SAAS,OAAA;AAClB,qCAOmB;AANjB,0GAAA,eAAe,OAAA;AACf,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA;AAKd,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,4CAA0F;AAAjF,0GAAA,gBAAgB,OAAA;AACzB,6DAA+H;AAAtH,gHAAA,mBAAmB,OAAA;AAC5B,mEAA6G;AAApG,iHAAA,iBAAiB,OAAA;AAAE,2HAAA,KAAK,OAA+B"}

package/dist/io.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The two sinks every command writes through, named so tests can capture
+ * output instead of spying on `console`. `out` is the data channel (tables,
+ * JSON, the answer a script would pipe); `err` is for diagnostics, prompts'
+ * echoes and error messages — exactly the stdout/stderr split a `--json`
+ * consumer relies on to parse stdout cleanly.
+ */
+export interface IO {
+    out(text: string): void;
+    err(text: string): void;
+}
+/** The real IO: a trailing newline is added so callers pass bare lines. */
+export declare function defaultIO(stdout?: NodeJS.WriteStream, stderr?: NodeJS.WriteStream): IO;
+/** An in-memory IO for tests, exposing the captured lines plus joined views. */
+export interface CaptureIO extends IO {
+    readonly outLines: string[];
+    readonly errLines: string[];
+    stdout(): string;
+    stderr(): string;
+}
+export declare function captureIO(): CaptureIO;

package/dist/io.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultIO = defaultIO;
+exports.captureIO = captureIO;
+/** The real IO: a trailing newline is added so callers pass bare lines. */
+function defaultIO(stdout = process.stdout, stderr = process.stderr) {
+    return {
+        out(text) {
+            stdout.write(text + '\n');
+        },
+        err(text) {
+            stderr.write(text + '\n');
+        },
+    };
+}
+function captureIO() {
+    const outLines = [];
+    const errLines = [];
+    return {
+        outLines,
+        errLines,
+        out: (text) => void outLines.push(text),
+        err: (text) => void errLines.push(text),
+        stdout: () => outLines.join('\n'),
+        stderr: () => errLines.join('\n'),
+    };
+}
+//# sourceMappingURL=io.js.map

package/dist/io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.js","sourceRoot":"","sources":["../src/io.ts"],"names":[],"mappings":";;AAaA,8BAYC;AAUD,8BAWC;AAlCD,2EAA2E;AAC3E,SAAgB,SAAS,CACvB,SAA6B,OAAO,CAAC,MAAM,EAC3C,SAA6B,OAAO,CAAC,MAAM;IAE3C,OAAO;QACL,GAAG,CAAC,IAAI;YACN,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,CAAC,IAAI;YACN,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAUD,SAAgB,SAAS;IACvB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACvC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACjC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC"}

package/dist/migrate/appwrite/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const appwritePlugin: MigrationPlugin;

package/dist/migrate/appwrite/plugin.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appwritePlugin = void 0;
+const appwrite_1 = require("../export/appwrite");
+const appwrite_config_1 = require("../export/appwrite-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const project_files_1 = require("../export/project-files");
+/**
+ * `atlas migrate appwrite` — an Appwrite project (Cloud or self-hosted): auth
+ * settings from appwrite.json and the project document, users with their
+ * hashes and hash options, identities, MFA recovery codes, teams, memberships
+ * and invitations through the Server API (an API key on this machine), the
+ * `appwrite` remote bridge (Appwrite vouches for a live session once), lazy
+ * migration through the Account API for anyone the export missed, and the
+ * `appwrite` codemod.
+ */
+const ENDPOINT = { flag: '--appwrite-endpoint', env: 'APPWRITE_ENDPOINT', label: 'the Appwrite API endpoint including /v1 (default https://cloud.appwrite.io/v1)', required: false };
+const PROJECT_ID = { flag: '--appwrite-project-id', env: 'APPWRITE_PROJECT_ID', label: 'the Appwrite project id', required: true };
+const API_KEY = { flag: '--appwrite-api-key', env: 'APPWRITE_API_KEY', label: 'an Appwrite API key with users.read and teams.read', required: true, secret: true };
+const RECOVERY_CODES = { flag: '--appwrite-recovery-codes', env: 'APPWRITE_RECOVERY_CODES', label: 'true to export MFA recovery codes', required: false };
+const SKIP_TEAMS = { flag: '--appwrite-skip-teams', env: 'APPWRITE_SKIP_TEAMS', label: 'true to leave teams out', required: false };
+const CONFIG_FILE = { flag: '--appwrite-config', env: 'APPWRITE_CONFIG_FILE', label: 'appwrite.json (after appwrite pull settings)', required: false };
+const PROJECT_FILE = { flag: '--appwrite-project-file', env: 'APPWRITE_PROJECT_FILE', label: 'the project document (appwrite projects get --project-id <id> --json)', required: false };
+function endpointOf(p) {
+    return (p.credential(ENDPOINT) ?? appwrite_1.APPWRITE_CLOUD).trim().replace(/\/+$/, '');
+}
+exports.appwritePlugin = {
+    vendor: 'appwrite',
+    source: 'appwrite',
+    label: 'Appwrite',
+    help: 'Move an Appwrite project: its auth methods, session and password settings and OAuth providers as Atlas config; its users with their password hashes (Argon2, bcrypt, scrypt, Firebase scrypt, MD5, SHA, phpass), labels, prefs, OAuth identities, MFA recovery codes, teams, memberships and invitations; a zero-logout bridge that asks Appwrite about each live session once; lazy migration for anyone left; and the code. Your API key stays on this machine.',
+    config: {
+        reads: 'appwrite.json (appwrite pull settings) and, for OAuth providers, the project document (appwrite projects get --json)',
+        credentials: [CONFIG_FILE, PROJECT_FILE, ENDPOINT, { ...PROJECT_ID, required: false }],
+        async translate(p) {
+            const file = (0, project_files_1.projectFile)(p, CONFIG_FILE, ['appwrite.json', 'appwrite.config.json']);
+            const projectText = (0, plugin_kit_1.localFile)(p, PROJECT_FILE, 'text');
+            if (!file && !projectText)
+                throw new errors_1.CliError('Appwrite: no appwrite.json in this folder. Run appwrite pull settings, or pass --set appwrite-config=<file> / --set appwrite-project-file=<appwrite projects get --json output>.');
+            let project;
+            if (projectText) {
+                try {
+                    project = JSON.parse(projectText);
+                }
+                catch {
+                    throw new errors_1.CliError('Appwrite: the project document is not JSON (use appwrite projects get --project-id <id> --json).');
+                }
+            }
+            return (0, plugin_kit_1.vendorStep)('Appwrite', async () => (0, appwrite_config_1.translateAppwriteConfig)({ file, project, endpoint: p.credential(ENDPOINT), projectId: p.credential({ ...PROJECT_ID, required: false }) }));
+        },
+    },
+    export: {
+        reads: 'the Appwrite Server API (users with hashes, identities, MFA, teams and memberships)',
+        credentials: [ENDPOINT, PROJECT_ID, API_KEY, RECOVERY_CODES, SKIP_TEAMS],
+        limits: [
+            'TOTP secrets are encrypted at rest and Appwrite has no API to read them: those users enrol an authenticator app again. Recovery codes move with --set appwrite-recovery-codes=true.',
+            'Sessions are stored as hashes and cannot be exported: the appwrite bridge preset asks Appwrite about each live session once instead.',
+            'A SHA hash imported into Appwrite without a version is ambiguous (SHA3-512 on 1.x, SHA-256 on 2.x): the export picks by digest length and warns.',
+            'OAuth access and refresh tokens are not exported: users keep their link and re-consent when your app next calls the provider.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('Appwrite', () => (0, appwrite_1.exportAppwrite)({
+                endpoint: endpointOf(p),
+                projectId: (0, plugin_kit_1.need)(p, PROJECT_ID),
+                apiKey: (0, plugin_kit_1.need)(p, API_KEY),
+                recoveryCodes: (0, project_files_1.truthyCredential)(p, RECOVERY_CODES),
+                skipTeams: (0, project_files_1.truthyCredential)(p, SKIP_TEAMS),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'appwrite',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const endpoint = p.credential(ENDPOINT);
+            if (endpoint || !vars.endpoint_url)
+                vars.endpoint_url = endpointOf(p);
+            const project = p.credential({ ...PROJECT_ID, required: false });
+            if (project)
+                vars.project_id = project;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'appwrite',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const endpoint = p.credential(ENDPOINT);
+            if (endpoint || !config.endpoint)
+                config.endpoint = endpointOf(p);
+            const project = p.credential({ ...PROJECT_ID, required: false });
+            if (project)
+                config.project_id = project;
+            return config;
+        },
+    },
+    codemod: 'appwrite',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/appwrite/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/appwrite/plugin.ts"],"names":[],"mappings":";;;AAAA,iDAAoE;AACpE,+DAAoE;AACpE,yCAAwC;AAExC,qDAAmF;AACnF,2DAAwE;AAExE;;;;;;;;GAQG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,gFAAgF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrM,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACnJ,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,oDAAoD,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnL,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1K,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpJ,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvK,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,uEAAuE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAExM,SAAS,UAAU,CAAC,CAAgB;IAClC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,yBAAc,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAEY,QAAA,cAAc,GAAoB;IAC7C,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,mcAAmc;IACzc,MAAM,EAAE;QACN,KAAK,EAAE,sHAAsH;QAC7H,WAAW,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACtF,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,IAAA,2BAAW,EAAC,CAAC,EAAE,WAAW,EAAE,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACpF,MAAM,WAAW,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,iBAAQ,CAAC,kLAAkL,CAAC,CAAC;YAClO,IAAI,OAA4C,CAAC;YACjD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAA4B,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,iBAAQ,CAAC,kGAAkG,CAAC,CAAC;gBACzH,CAAC;YACH,CAAC;YACD,OAAO,IAAA,uBAAU,EAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CACvC,IAAA,yCAAuB,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAC1I,CAAC;QACJ,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qFAAqF;QAC5F,WAAW,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC;QACxE,MAAM,EAAE;YACN,qLAAqL;YACrL,sIAAsI;YACtI,kJAAkJ;YAClJ,+HAA+H;SAChI;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAC5C,IAAA,yBAAc,EAAC;gBACb,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;gBACvB,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC;gBAC9B,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC;gBACxB,aAAa,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,cAAc,CAAC;gBAClD,SAAS,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,UAAU,CAAC;gBAC1C,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,UAAU;QAClB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY;gBAAE,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,OAAO;gBAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,OAAO;gBAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,UAAU;CACpB,CAAC"}

package/dist/migrate/auth0/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const auth0Plugin: MigrationPlugin;

package/dist/migrate/auth0/plugin.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auth0Plugin = void 0;
+const auth0_1 = require("../export/auth0");
+const auth0_config_1 = require("../export/auth0-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const vendor_http_1 = require("../export/vendor-http");
+/**
+ * `atlas migrate auth0` (also Okta Customer Identity Cloud) — the tenant's
+ * settings through the Management API, users through a users-export job (or
+ * an export file), the password hashes and MFA secrets from Auth0 support's
+ * encrypted export when the owner has it, the `auth0` bridge preset (the ID
+ * token in the app session, verified against the tenant's JWKS) and lazy
+ * migration through the password-realm grant for every other password.
+ */
+const DOMAIN = { flag: '--auth0-domain', env: 'AUTH0_DOMAIN', label: 'your Auth0 domain (tenant.us.auth0.com)', required: true };
+const MGMT_CLIENT_ID = { flag: '--auth0-mgmt-client-id', env: 'AUTH0_MGMT_CLIENT_ID', label: 'the client id of a machine-to-machine app authorized for the Management API', required: false };
+const MGMT_CLIENT_SECRET = { flag: '--auth0-mgmt-client-secret', env: 'AUTH0_MGMT_CLIENT_SECRET', label: 'that app\'s client secret', required: false, secret: true };
+const MGMT_TOKEN = { flag: '--auth0-mgmt-token', env: 'AUTH0_MGMT_TOKEN', label: 'a Management API token', required: false, secret: true };
+const CLIENT_ID = { flag: '--auth0-client-id', env: 'AUTH0_CLIENT_ID', label: 'your application\'s client id (the ID token audience)', required: false };
+const CLIENT_SECRET = { flag: '--auth0-client-secret', env: 'AUTH0_CLIENT_SECRET', label: 'your application\'s client secret (for a confidential application)', required: false, secret: true };
+const CONNECTION = { flag: '--auth0-connection', env: 'AUTH0_CONNECTION', label: 'the database connection', required: false };
+const USERS_FILE = { flag: '--auth0-users-file', env: 'AUTH0_USERS_FILE', label: 'a users export file (NDJSON or JSON)', required: false };
+const HASHES_FILE = { flag: '--auth0-hashes-file', env: 'AUTH0_HASHES_FILE', label: 'the decrypted password-hash export from Auth0 support', required: false };
+const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id passkeys were registered for', required: false };
+function domainOf(p) {
+    return (0, plugin_kit_1.hostOf)((0, plugin_kit_1.need)(p, DOMAIN));
+}
+/** The Management API, with a token or client credentials (asked for on this machine, sent only to Auth0). */
+function managementHttp(p, domain) {
+    const token = p.credential(MGMT_TOKEN);
+    const clientId = p.credential(MGMT_CLIENT_ID);
+    const clientSecret = p.credential(MGMT_CLIENT_SECRET);
+    if (!token && !(clientId && clientSecret)) {
+        throw new errors_1.CliError('Auth0: pass a Management API token (--auth0-mgmt-token / AUTH0_MGMT_TOKEN), or the client id and secret of a machine-to-machine app authorized for it (AUTH0_MGMT_CLIENT_ID, AUTH0_MGMT_CLIENT_SECRET).');
+    }
+    let bearer = token;
+    return new vendor_http_1.VendorHttp({
+        vendor: 'Auth0',
+        baseUrl: `https://${domain}/api/v2`,
+        headers: async () => ({ authorization: `Bearer ${(bearer ??= await (0, auth0_1.managementToken)(domain, { domain, clientId, clientSecret }, p.fetch))}` }),
+        fetchImpl: p.fetch,
+    });
+}
+exports.auth0Plugin = {
+    vendor: 'auth0',
+    source: 'auth0',
+    label: 'Auth0',
+    help: 'Move an Auth0 (Okta Customer Identity Cloud) tenant: its connections, MFA, password policy, applications, APIs, roles and organizations as Atlas config; its users (export job), identities, organizations, members, roles and invitations, plus password hashes and MFA secrets from the encrypted export Auth0 support provides; a zero-logout bridge; lazy migration for every password you do not have; and the code. Management credentials stay on this machine.',
+    config: {
+        reads: 'your Auth0 tenant via the Management API',
+        credentials: [DOMAIN, MGMT_TOKEN, MGMT_CLIENT_ID, MGMT_CLIENT_SECRET],
+        async translate(p) {
+            const domain = domainOf(p);
+            const snap = await (0, plugin_kit_1.vendorStep)('Auth0', () => (0, auth0_config_1.fetchAuth0Config)(managementHttp(p, domain), domain));
+            return (0, auth0_config_1.translateAuth0Config)(snap);
+        },
+    },
+    export: {
+        reads: 'the Auth0 Management API (users-export job, organizations, roles) and the support hash export (--auth0-hashes-file)',
+        credentials: [DOMAIN, MGMT_TOKEN, MGMT_CLIENT_ID, MGMT_CLIENT_SECRET, USERS_FILE, HASHES_FILE, CONNECTION],
+        limits: [
+            'Password hashes and MFA secrets never come out of the Management API: Auth0 support exports them on request (paid plans, encrypted to your PGP key). Pass the decrypted file with --auth0-hashes-file; without it, passwords move by lazy migration.',
+            'Users-export jobs are not available on the Free plan: export from the dashboard (or the User Import / Export extension) and pass the file with --auth0-users-file.',
+            'Passkey private keys never leave the authenticator; with --authentication-methods the public credentials are exported and keep working when your Atlas domain matches the relying party (--rp-id).',
+            'Sessions are not exported: the auth0 bridge preset exchanges the ID token from the app session.',
+        ],
+        async run(p, writer, resume) {
+            const domain = domainOf(p);
+            const usersText = (0, plugin_kit_1.localFile)(p, USERS_FILE, 'text');
+            const token = p.credential(MGMT_TOKEN);
+            const clientId = p.credential(MGMT_CLIENT_ID);
+            const clientSecret = p.credential(MGMT_CLIENT_SECRET);
+            if (!usersText && !token && !(clientId && clientSecret)) {
+                throw new errors_1.CliError('Auth0: pass Management API credentials (AUTH0_MGMT_TOKEN, or AUTH0_MGMT_CLIENT_ID and AUTH0_MGMT_CLIENT_SECRET), or a users export file (--auth0-users-file).');
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('Auth0', () => (0, auth0_1.exportAuth0)({
+                domain,
+                token,
+                clientId,
+                clientSecret,
+                usersText,
+                hashesText: (0, plugin_kit_1.localFile)(p, HASHES_FILE, 'text'),
+                connectionId: p.credential(CONNECTION),
+                authenticationMethods: (0, plugin_kit_1.flag)(p, 'authentication-methods'),
+                rpId: p.credential(RP_ID),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'auth0',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const domain = p.credential({ ...DOMAIN, required: false });
+            if (domain)
+                vars.domain = (0, plugin_kit_1.hostOf)(domain);
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                vars.client_id = clientId;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'auth0',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const domain = p.credential({ ...DOMAIN, required: false });
+            if (domain)
+                config.domain = (0, plugin_kit_1.hostOf)(domain);
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                config.client_id = clientId;
+            const connection = p.credential(CONNECTION);
+            if (connection)
+                config.connection = connection;
+            return config;
+        },
+        secret: CLIENT_SECRET,
+    },
+    codemod: 'auth0',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/auth0/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/auth0/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAA+D;AAC/D,yDAAgF;AAChF,yCAAwC;AAExC,qDAAiG;AACjG,uDAAmD;AAEnD;;;;;;;GAOG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACjJ,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,6EAA6E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9M,MAAM,kBAAkB,GAAmB,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACtL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3J,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzK,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChN,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9I,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3J,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpK,SAAS,QAAQ,CAAC,CAAgB;IAChC,OAAO,IAAA,mBAAM,EAAC,IAAA,iBAAI,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,8GAA8G;AAC9G,SAAS,cAAc,CAAC,CAAgB,EAAE,MAAc;IACtD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,iBAAQ,CAAC,yMAAyM,CAAC,CAAC;IAChO,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,WAAW,MAAM,SAAS;QACnC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,MAAM,KAAK,MAAM,IAAA,uBAAe,EAAC,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7I,SAAS,EAAE,CAAC,CAAC,KAAK;KACnB,CAAC,CAAC;AACL,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,wcAAwc;IAC9c,MAAM,EAAE;QACN,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,CAAC;QACrE,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAgB,EAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAClG,OAAO,IAAA,mCAAoB,EAAC,IAAI,CAAC,CAAC;QACpC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qHAAqH;QAC5H,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC;QAC1G,MAAM,EAAE;YACN,sPAAsP;YACtP,oKAAoK;YACpK,oMAAoM;YACpM,iGAAiG;SAClG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAC9C,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,iBAAQ,CAAC,+JAA+J,CAAC,CAAC;YACtL,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CACzC,IAAA,mBAAW,EAAC;gBACV,MAAM;gBACN,KAAK;gBACL,QAAQ;gBACR,YAAY;gBACZ,SAAS;gBACT,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;gBAC7C,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACtC,qBAAqB,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,wBAAwB,CAAC;gBACxD,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACzB,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,IAAA,mBAAM,EAAC,MAAM,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO;QACf,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAA,mBAAM,EAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC1C,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,UAAU;gBAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;YAC/C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,aAAa;KACtB;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/authentik/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const authentikPlugin: MigrationPlugin;

package/dist/migrate/authentik/plugin.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authentikPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const authentik_1 = require("../export/authentik");
+const authentik_config_1 = require("../export/authentik-config");
+const tables_1 = require("../export/frameworks/tables");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate authentik` — a self-hosted authentik: its blueprint file (or
+ * the settings objects through the API) as Atlas config; users with their
+ * Django password digests (PBKDF2, bcrypt, Argon2, scrypt), social and SAML
+ * source links, groups and RBAC roles, API and app-password tokens, TOTP
+ * seeds, recovery codes, SMS / email factors and WebAuthn passkeys from a
+ * dump of authentik's own PostgreSQL tables made on this machine; the
+ * `authentik` bridge preset (an OAuth2 provider's token becomes an Atlas
+ * session); lazy migration through authentik's flow executor when only the API
+ * is available; and the code. Nothing here connects to the database.
+ */
+const DUMP = { flag: '--authentik-dump', env: 'AUTHENTIK_DUMP_DIR', label: 'a folder of authentik table dumps (authentik_core_user.csv, authentik_core_group.json, …)', required: false };
+const URL_ = { flag: '--authentik-url', env: 'AUTHENTIK_URL', label: 'the authentik URL (https://auth.example.com)', required: false };
+const TOKEN = { flag: '--authentik-token', env: 'AUTHENTIK_TOKEN', label: 'an authentik API token (Directory → Tokens, intent API)', required: false, secret: true };
+const BLUEPRINT = { flag: '--authentik-blueprint', env: 'AUTHENTIK_BLUEPRINT', label: 'a blueprint YAML file (ak export_blueprint)', required: false };
+const SUB_MODE = { flag: '--authentik-sub-mode', env: 'AUTHENTIK_SUB_MODE', label: `the provider's Subject mode (${authentik_1.AUTHENTIK_SUB_MODES.join(', ')}); default: the mode the providers in the dump use, else hashed_user_id`, required: false };
+const INSTALL_ID = { flag: '--authentik-install-id', env: 'AUTHENTIK_INSTALL_ID', label: 'the install id (SELECT id FROM authentik_install_id), when the dump lacks that table', required: false };
+const GROUPS_AS = { flag: '--authentik-groups-as', env: 'AUTHENTIK_GROUPS_AS', label: 'roles (default), organizations or skip: what authentik groups become', required: false };
+const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id for passkeys registered before authentik stored one (your authentik host)', required: false };
+const TRUST_EMAILS = { flag: '--authentik-trust-emails', env: 'AUTHENTIK_TRUST_EMAILS', label: '"true" to treat every email address as verified (authentik has no verified flag)', required: false };
+const OAUTH_TOKENS = { flag: '--authentik-oauth-tokens', env: 'AUTHENTIK_OAUTH_TOKENS', label: '"include" to carry the stored upstream OAuth access tokens of social links', required: false };
+const ISSUER = { flag: '--authentik-issuer', env: 'AUTHENTIK_ISSUER', label: "the provider's issuer URL (https://auth.example.com/application/o/<application slug>)", required: false };
+const CLIENT_ID = { flag: '--authentik-client-id', env: 'AUTHENTIK_CLIENT_ID', label: "the OAuth2 provider's client id (the tokens' aud)", required: false };
+const FLOW_SLUG = { flag: '--authentik-flow-slug', env: 'AUTHENTIK_FLOW_SLUG', label: 'the authentication flow slug for lazy migration (default default-authentication-flow)', required: false };
+const LAZY_SUB_MODES = ['hashed_user_id', 'user_id', 'user_username', 'user_email'];
+function subMode(p) {
+    const raw = p.credential(SUB_MODE)?.trim().toLowerCase();
+    if (!raw)
+        return undefined;
+    if (!authentik_1.AUTHENTIK_SUB_MODES.includes(raw))
+        throw new errors_1.CliError(`authentik: --set authentik-sub-mode takes ${authentik_1.AUTHENTIK_SUB_MODES.join(', ')} (got ${raw}).`);
+    return raw;
+}
+const baseUrl = (p) => p.credential(URL_)?.trim().replace(/\/+$/, '');
+exports.authentikPlugin = {
+    vendor: 'authentik',
+    source: 'authentik',
+    label: 'authentik',
+    help: "Move authentik: a blueprint file (or the settings objects through the API) as Atlas config; users with their password digests, social and SAML identities, groups and roles, tokens, authenticator apps, recovery codes and passkeys from a dump of authentik's own tables made with psql; a zero-logout bridge for an OAuth2 provider's tokens; lazy migration through authentik's flows when you only have the API; and the code. Database access stays on this machine.",
+    config: {
+        reads: 'a blueprint YAML file, or the settings objects through the authentik API',
+        credentials: [BLUEPRINT, URL_, TOKEN],
+        async translate(p) {
+            const url = baseUrl(p);
+            const file = p.credential(BLUEPRINT);
+            if (file) {
+                const text = (0, plugin_kit_1.localFile)(p, BLUEPRINT, 'text');
+                return (0, authentik_config_1.translateAuthentikConfig)(await (0, plugin_kit_1.vendorStep)('authentik', async () => (0, authentik_config_1.snapshotFromBlueprint)(text, file, url)));
+            }
+            const token = p.credential(TOKEN);
+            if (url && token)
+                return (0, authentik_config_1.translateAuthentikConfig)(await (0, plugin_kit_1.vendorStep)('authentik', () => (0, authentik_config_1.fetchAuthentikConfig)({ baseUrl: url, token, fetchImpl: p.fetch })));
+            throw new errors_1.CliError('authentik: pass a blueprint file (--set authentik-blueprint=<file>, from `ak export_blueprint`), or the authentik URL and an API token to read the settings through the API.');
+        },
+    },
+    export: {
+        reads: "a dump of authentik's tables (psql \\copy of authentik_core_user, groups, tokens, source links, authenticator devices …) or the authentik API",
+        credentials: [DUMP, URL_, TOKEN, SUB_MODE, INSTALL_ID, GROUPS_AS, RP_ID, TRUST_EMAILS, OAUTH_TOKENS],
+        limits: [
+            'The API never returns password hashes, TOTP seeds, recovery codes or WebAuthn public keys: dump the database tables to move them. The API export has users, groups, roles, source links and API token keys only; passwords then move by lazy migration and authenticator users enrol again.',
+            'authentik has no verified-email flag: addresses are verified only when the user attribute email_verified is true, or with --set authentik-trust-emails=true.',
+            'Users are keyed by the `sub` your providers hand out (the Subject mode; hashed_user_id by default, which needs the install id): the export reads it from the dump, and warns when providers disagree.',
+            'Service accounts, outpost accounts and recovery or verification tokens do not move; LDAP, Kerberos and other directory source links stay with their directory.',
+            'Passkeys only work on the domain they were registered for; devices registered before authentik stored an RP id need --set rp-id=<your authentik host>.',
+        ],
+        async run(p, writer, resume) {
+            const dump = p.credential(DUMP);
+            const url = baseUrl(p);
+            const token = dump ? undefined : p.credential(TOKEN);
+            if (!dump && !(url && token)) {
+                throw new errors_1.CliError('authentik: pass a folder of table dumps (--set authentik-dump=<folder>), or the authentik URL and an API token for an export without password hashes.');
+            }
+            const groups = p.credential(GROUPS_AS)?.trim().toLowerCase();
+            if (groups && !['roles', 'organizations', 'skip'].includes(groups))
+                throw new errors_1.CliError(`authentik: --set authentik-groups-as takes roles, organizations or skip (got ${groups}).`);
+            const set = await (0, plugin_kit_1.vendorStep)('authentik', () => (0, authentik_1.exportAuthentik)({
+                tables: dump ? (0, tables_1.readDumpDir)((0, node_path_1.resolve)(dump)) : undefined,
+                baseUrl: url,
+                token,
+                subMode: subMode(p),
+                installId: p.credential(INSTALL_ID),
+                groupsAs: groups,
+                rpId: p.credential(RP_ID),
+                trustEmails: p.credential(TRUST_EMAILS)?.toLowerCase() === 'true',
+                oauthTokens: p.credential(OAUTH_TOKENS) === 'include',
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'authentik',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const issuer = p.credential(ISSUER);
+            if (issuer)
+                vars.issuer = issuer.trim().replace(/\/+$/, '');
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                vars.client_id = clientId.trim();
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'authentik',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const url = baseUrl(p);
+            if (url)
+                config.base_url = url;
+            const flow = p.credential(FLOW_SLUG);
+            if (flow)
+                config.flow_slug = flow.trim();
+            const mode = subMode(p);
+            if (mode) {
+                if (!LAZY_SUB_MODES.includes(mode))
+                    throw new errors_1.CliError(`authentik: lazy migration reads the user from a session, which has no ${mode}: use ${LAZY_SUB_MODES.join(', ')}, or move users with the database export.`);
+                config.sub_mode = mode;
+            }
+            return config;
+        },
+    },
+    codemod: 'authentik',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/authentik/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/authentik/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,mDAAkG;AAClG,iEAAmH;AACnH,wDAA0D;AAC1D,qDAA6E;AAG7E;;;;;;;;;;GAUG;AAEH,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,2FAA2F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1M,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvJ,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,yDAAyD,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,6CAA6C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvK,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,gCAAgC,+BAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,yEAAyE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9P,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,sFAAsF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnN,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,sEAAsE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAChM,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,yGAAyG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjN,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,kFAAkF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrN,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,4EAA4E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/M,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,uFAAuF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxM,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,mDAAmD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,uFAAuF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEjN,MAAM,cAAc,GAAsB,CAAC,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;AAEvG,SAAS,OAAO,CAAC,CAAgB;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAE,+BAAyC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,6CAA6C,+BAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC/K,OAAO,GAAuB,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAgB,EAAsB,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE5F,QAAA,eAAe,GAAoB;IAC9C,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,4cAA4c;IACld,MAAM,EAAE;QACN,KAAK,EAAE,0EAA0E;QACjF,WAAW,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC;QACrC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAE,CAAC;gBAC9C,OAAO,IAAA,2CAAwB,EAAC,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,wCAAqB,EAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YACrH,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,GAAG,IAAI,KAAK;gBAAE,OAAO,IAAA,2CAAwB,EAAC,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAA,uCAAoB,EAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1J,MAAM,IAAI,iBAAQ,CAAC,8KAA8K,CAAC,CAAC;QACrM,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,+IAA+I;QACtJ,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC;QACpG,MAAM,EAAE;YACN,6RAA6R;YAC7R,8JAA8J;YAC9J,uMAAuM;YACvM,gKAAgK;YAChK,wJAAwJ;SACzJ;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,iBAAQ,CAAC,uJAAuJ,CAAC,CAAC;YAC9K,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7D,IAAI,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,iBAAQ,CAAC,gFAAgF,MAAM,IAAI,CAAC,CAAC;YACnL,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,GAAG,EAAE,CAC7C,IAAA,2BAAe,EAAC;gBACd,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACrD,OAAO,EAAE,GAAG;gBACZ,KAAK;gBACL,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACnC,QAAQ,EAAE,MAAwD;gBAClE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACzB,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,KAAK,MAAM;gBACjE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,SAAS;gBACrD,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,WAAW;QACnB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,WAAW;QACnB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,IAAI;gBAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,iBAAQ,CAAC,yEAAyE,IAAI,SAAS,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACnN,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YACzB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,WAAW;CACrB,CAAC"}

package/dist/migrate/azure-ad-b2c/plugin.d.ts

@@ -0,0 +1,8 @@
+import { type AzureKind } from '../export/azure';
+import { type AzureConfigSnapshot } from '../export/azure-config';
+import type { MigrationPlugin } from '../framework/plugin';
+/** The B2C custom policy files of a folder (`*.xml`), for the config report. */
+export declare function readPolicyDir(dir: string): AzureConfigSnapshot['policies'];
+/** The plugin for one of the two Microsoft customer-identity products. */
+export declare function azurePlugin(kind: AzureKind): MigrationPlugin;
+export declare const azureAdB2cPlugin: MigrationPlugin;