[Bccorb]

Part of fells-code/seamless-auth-api#383

Adds operate/migrate-from-cognito.mdx, the Amazon Cognito counterpart to the Auth0 migration page: export with ListUsers (paged, with a resumable loop), groups via ListUsersInGroup, a jq conversion to the seamless migrate csv headers, import with --source cognito, cutover with the user pool as an OIDC provider linked on sub, enrollment, retirement, and a Cognito-specific "What You Give Up" table (identity pools and AWS credentials, groups to IAM roles, API Gateway/ALB/Amplify integrations, Lambda triggers, SAML, managed login, M2M, AWS compliance programs). Also adds one link each from migrate-users.mdx and migrate-from-auth0.mdx.

Verification

• npm run lint, npm run typecheck, npm run build pass; the page is in dist/llms.txt and the sitemap; internal anchors resolve.
• The export loop and group map were run in bash and zsh with AWS CLI 2.32 against a local mock of the ListUsers/ListGroups/ListUsersInGroup endpoints (confirms the CLI emits NextToken with --max-items and resumes with --starting-token).
• The jq conversion was run on synthetic list-users output (local, federated Google_, unconfirmed, disabled, phone-only, missing Attributes, duplicate email) and the CSV was parsed with seamless-cli origin/main parseCsvRecords, resolveColumns, and prepareRows: all rows valid.
• Seamless Auth claims checked against seamless-auth-api origin/main (oauthService.ts: ID token algorithms, client_secret in body, nonce, PKCE, email_verified: false refusal, externalId linking) and @seamless-auth/types (import row schema, role name pattern, provider config schema).

Sources

• ListUsers API: https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.html
• list-users CLI: https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/list-users.html
• ListUsersInGroup API: https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsersInGroup.html
• UserType: https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserType.html
• Quotas (UserList 30 RPS, not adjustable): https://docs.aws.amazon.com/cognito/latest/developerguide/quotas.html
• User profiles export guidance, limitations (no passwords, sub): https://docs.aws.amazon.com/solutions/latest/cognito-user-profiles-export-reference-architecture/guidance-components.html
• User attributes (sub fixed, aliases): https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html
• ID token: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.html
• Endpoints and OIDC issuer: https://docs.aws.amazon.com/cognito/latest/developerguide/federation-endpoints.html
• Token endpoint (client_secret_post, PKCE, invalid_grant on email_verified read): https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html
• Third-party sign-in (federated usernames, IdP groups): https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html
• Linking federated users: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation-consolidate-users.html
• Passkeys in Cognito: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow-methods.html
• What You Give Up links: identity pools, groups, Lambda triggers, SAML IdPs, managed login, resource servers, compliance validation (all under https://docs.aws.amazon.com/cognito/latest/developerguide/)