@atlasauth/backend 0.22.0 → 0.24.0

package/dist/migration-bridge.js

@@ -0,0 +1,328 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrationExchangePath = migrationExchangePath;
+exports.migrationBapiExchangePath = migrationBapiExchangePath;
+exports.exchangeMigrationSession = exchangeMigrationSession;
+exports.parseCookieHeader = parseCookieHeader;
+exports.readSupabaseAccessToken = readSupabaseAccessToken;
+exports.bridgeCookieConfig = bridgeCookieConfig;
+exports.createMigrationBridge = createMigrationBridge;
+const migration_presets_1 = require("./migration-presets");
+/**
+ * Moving to Atlas from ANY auth vendor without signing anyone out — the
+ * vendor-neutral zero-logout bridge (Better Auth's `betterAuthBridge` is now an
+ * alias of this with `source: 'better_auth'`).
+ *
+ * During the migration window a returning user still carries the old vendor's
+ * session cookie (or bearer token). The bridge reads it, exchanges it ONCE with
+ * Atlas (`POST /v1/migrations/{source}/exchange` with the secret key, or the
+ * Frontend API twin `POST /v1/client/migrations/{source}/exchange`), sets the
+ * Atlas session as your own first-party cookies and clears the old ones. Atlas
+ * verifies the old token (a JWT against the vendor's keys, or an opaque token
+ * against the sessions you imported) and runs the normal sign-in path on it —
+ * MFA policy included.
+ *
+ * Framework-neutral: {@link createMigrationBridge} returns a decision with the
+ * cookies to set and clear; the Next.js middleware and the Express / Fastify /
+ * Hono adapters render it (`migrationBridge({ source })`).
+ */
+/** Default Backend API origin. */
+const DEFAULT_BAPI_URL = 'https://api.atlasauth.net';
+/** The Frontend API exchange path for a source. */
+function migrationExchangePath(source) {
+    return `/v1/client/migrations/${encodeURIComponent(source)}/exchange`;
+}
+/** The Backend API (secret-key) exchange path for a source. */
+function migrationBapiExchangePath(source) {
+    return `/v1/migrations/${encodeURIComponent(source)}/exchange`;
+}
+const KNOWN_REFUSALS = ['closed', 'invalid', 'signature_invalid', 'expired', 'reused', 'user_unavailable', 'user_unknown', 'rate_limited'];
+/**
+ * Exchange an old vendor session for an Atlas session, server to server
+ * (`delivery: "body"`). Never throws: a transport failure is
+ * `{ kind: 'refused', outcome: 'unavailable' }`, so the caller keeps the old
+ * cookie and tries again on a later request.
+ */
+async function exchangeMigrationSession(options) {
+    const doFetch = options.fetchImpl ?? fetch;
+    const viaSecretKey = Boolean(options.secretKey);
+    const url = viaSecretKey
+        ? `${(options.bapiBaseUrl ?? DEFAULT_BAPI_URL).replace(/\/+$/, '')}${migrationBapiExchangePath(options.source)}`
+        : new URL(migrationExchangePath(options.source), options.fapiOrigin).toString();
+    const headers = { 'content-type': 'application/json' };
+    if (viaSecretKey) {
+        headers.authorization = `Bearer ${options.secretKey}`;
+        if (options.clientIp)
+            headers['x-atlas-client-ip'] = options.clientIp;
+        if (options.userAgent)
+            headers['x-atlas-client-user-agent'] = options.userAgent;
+    }
+    else {
+        headers['x-publishable-key'] = options.publishableKey;
+        if (options.userAgent)
+            headers['user-agent'] = options.userAgent;
+    }
+    let res;
+    try {
+        res = await doFetch(url, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+                token: options.token,
+                ...(viaSecretKey ? {} : { delivery: 'body' }),
+                ...(options.remember === false ? { remember: false } : {}),
+            }),
+        });
+    }
+    catch {
+        return { kind: 'refused', outcome: 'unavailable', status: 0 };
+    }
+    const data = (await res.json().catch(() => null));
+    if (res.ok && data?.object === 'session_tokens' && data.jwt && data.refresh_token) {
+        return { kind: 'session', jwt: data.jwt, refreshToken: data.refresh_token, sessionId: data.session_id ?? '', userId: data.user_id ?? '', expiresIn: data.expires_in ?? 0 };
+    }
+    if (res.ok && data?.object === 'sign_in_attempt' && data.id && (data.status === 'needs_second_factor' || data.status === 'needs_mfa_enrollment')) {
+        return { kind: 'needs_mfa', attemptId: data.id, status: data.status };
+    }
+    if (res.status === 429)
+        return { kind: 'refused', outcome: 'rate_limited', status: 429 };
+    const outcome = data?.errors?.[0]?.meta?.bridge_outcome;
+    if (outcome && KNOWN_REFUSALS.includes(outcome))
+        return { kind: 'refused', outcome: outcome, status: res.status };
+    // Anything else (a 5xx, a guard refusal, an unparsable body) is not a verdict on the old session: keep it.
+    return { kind: 'refused', outcome: 'unavailable', status: res.status };
+}
+/** Refusals that say the old session will never exchange: its cookies are cleared. */
+const FINAL = ['invalid', 'signature_invalid', 'expired', 'reused', 'user_unavailable', 'user_unknown'];
+function header(headers, name) {
+    if (typeof headers.get === 'function')
+        return headers.get(name) ?? undefined;
+    const record = headers;
+    const value = record[name] ?? record[name.toLowerCase()];
+    return Array.isArray(value) ? value.join('; ') : value;
+}
+/** Parse a Cookie header into name → raw value (first occurrence wins). */
+function parseCookieHeader(cookieHeader) {
+    const out = {};
+    if (!cookieHeader)
+        return out;
+    for (const part of cookieHeader.split(';')) {
+        const i = part.indexOf('=');
+        if (i <= 0)
+            continue;
+        const name = part.slice(0, i).trim();
+        if (name && !(name in out))
+            out[name] = part.slice(i + 1).trim();
+    }
+    return out;
+}
+/** The unverified `iss` of a compact JWT (routing only; Atlas verifies). */
+function peekIss(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        const json = JSON.parse(decodeBase64Url(parts[1]));
+        return typeof json.iss === 'string' ? json.iss : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function decodeBase64Url(s) {
+    const b64 = s.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(s.length / 4) * 4, '=');
+    const bin = atob(b64);
+    const bytes = Uint8Array.from(bin, (c) => c.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+}
+/**
+ * Supabase SSR cookie: `sb-<ref>-auth-token` (or chunks `.0`, `.1`, … joined in
+ * order), the value JSON or `base64-` + base64url(JSON), holding `access_token`.
+ */
+function readSupabaseAccessToken(cookies, baseName) {
+    let raw = cookies[baseName];
+    if (raw === undefined) {
+        const chunks = [];
+        for (let i = 0; cookies[`${baseName}.${i}`] !== undefined; i++)
+            chunks.push(cookies[`${baseName}.${i}`]);
+        if (!chunks.length)
+            return undefined;
+        raw = chunks.join('');
+    }
+    try {
+        let text = decodeURIComponent(raw);
+        if (text.startsWith('base64-'))
+            text = decodeBase64Url(text.slice('base64-'.length));
+        const parsed = JSON.parse(text);
+        const token = Array.isArray(parsed) ? parsed[0] : parsed?.access_token;
+        return typeof token === 'string' && token ? token : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Resolve the cookie names / format / bearer flag the bridge uses for its source. */
+function bridgeCookieConfig(options) {
+    const presetId = options.preset ?? ((0, migration_presets_1.getMigrationBridgePreset)(options.source) ? options.source : undefined);
+    let cookies = [];
+    let clear = [];
+    let format = 'raw';
+    let bearer = false;
+    let sharesAtlasCookie = false;
+    let issuer = null;
+    if (presetId) {
+        try {
+            const r = (0, migration_presets_1.resolveMigrationBridgePreset)(presetId, options.presetVars ?? {});
+            cookies = r.cookies;
+            clear = r.clearCookies;
+            format = r.tokenFormat;
+            bearer = r.bearer;
+            sharesAtlasCookie = r.sharesAtlasCookie;
+            issuer = r.issuer;
+        }
+        catch {
+            // A preset whose cookie names need variables the app did not pass: only explicit names work.
+            const p = (0, migration_presets_1.getMigrationBridgePreset)(presetId);
+            cookies = (p?.cookies ?? []).filter((c) => !c.includes('{'));
+            clear = (p?.clearCookies ?? p?.cookies ?? []).filter((c) => !c.includes('{'));
+            format = p?.tokenFormat ?? 'raw';
+            bearer = p?.bearer === true;
+            sharesAtlasCookie = p?.sharesAtlasCookie === true;
+        }
+    }
+    if (options.cookieNames)
+        cookies = options.cookieNames;
+    if (options.clearCookieNames)
+        clear = options.clearCookieNames;
+    else if (options.cookieNames)
+        clear = options.cookieNames;
+    return {
+        cookies,
+        clear,
+        format: options.tokenFormat ?? format,
+        bearer: options.bearer ?? bearer,
+        sharesAtlasCookie: sharesAtlasCookie || cookies.includes('__session'),
+        issuer,
+    };
+}
+/**
+ * The bridge as a function of a request's headers. Call it from middleware
+ * before your normal auth check; it does nothing (no network) for a request
+ * without an old session, or with an Atlas session already present.
+ */
+function createMigrationBridge(options) {
+    const secure = options.secure !== false;
+    const config = bridgeCookieConfig(options);
+    const clearOld = (present) => {
+        const names = new Set();
+        for (const pattern of config.clear) {
+            if (!pattern.includes('*')) {
+                names.add(pattern);
+                continue;
+            }
+            for (const name of Object.keys(present))
+                if ((0, migration_presets_1.cookieNameMatches)(pattern, name))
+                    names.add(name);
+        }
+        return [...names].map((name) => ({
+            name,
+            value: '',
+            options: {
+                path: '/',
+                maxAge: 0,
+                ...(options.oldCookieDomain ? { domain: options.oldCookieDomain } : {}),
+                ...(name.startsWith('__Secure-') || name.startsWith('__Host-') ? { secure: true } : {}),
+            },
+        }));
+    };
+    const readToken = async (request, cookies) => {
+        if (options.extractToken) {
+            const t = await options.extractToken({ cookies, headers: request.headers });
+            return t ? { token: t, fromAtlasCookie: false } : undefined;
+        }
+        for (const pattern of config.cookies) {
+            const names = pattern.includes('*') ? Object.keys(cookies).filter((n) => (0, migration_presets_1.cookieNameMatches)(pattern, n)).sort() : [pattern];
+            for (const name of names) {
+                const token = config.format === 'supabase' ? readSupabaseAccessToken(cookies, name) : cookies[name];
+                if (token)
+                    return { token, fromAtlasCookie: name === '__session' };
+            }
+        }
+        if (config.bearer) {
+            const auth = header(request.headers, 'authorization');
+            const m = auth ? /^Bearer\s+(.+)$/i.exec(auth.trim()) : null;
+            if (m && config.issuer && peekIss(m[1]) === config.issuer)
+                return { token: m[1], fromAtlasCookie: false };
+        }
+        return undefined;
+    };
+    return async function bridge(request) {
+        const cookies = parseCookieHeader(header(request.headers, 'cookie'));
+        const found = await readToken(request, cookies);
+        if (!found)
+            return { action: 'none' };
+        // Already on Atlas: an Atlas refresh cookie means the switch happened.
+        if (cookies.__atlas_rt)
+            return { action: 'none' };
+        // `__session` is Atlas's own cookie name, and a few vendors (Clerk, Firebase
+        // Hosting, nextjs-auth0) use it too. A token read from it is the vendor's
+        // only when it carries the vendor's issuer (which needs the preset's
+        // variables); otherwise an Atlas session (a JWT with another issuer) means
+        // the user is already on Atlas.
+        if (found.fromAtlasCookie) {
+            if (!config.issuer || peekIss(found.token) !== config.issuer)
+                return { action: 'none' };
+        }
+        else if (cookies.__session) {
+            const iss = peekIss(cookies.__session);
+            const atlasSession = !config.sharesAtlasCookie || (iss !== undefined && iss !== config.issuer);
+            if (atlasSession)
+                return { action: 'none' };
+        }
+        const result = await exchangeMigrationSession({
+            source: options.source,
+            fapiOrigin: options.fapiOrigin,
+            publishableKey: options.publishableKey,
+            token: found.token,
+            fetchImpl: options.fetchImpl,
+            userAgent: header(request.headers, 'user-agent'),
+            secretKey: options.secretKey,
+            bapiBaseUrl: options.bapiBaseUrl,
+            clientIp: request.ip ?? clientIpFrom(request.headers),
+        });
+        if (result.kind === 'session') {
+            const old = clearOld(cookies).filter((c) => c.name !== '__session');
+            return {
+                action: 'signed_in',
+                session: result,
+                cookies: [
+                    { name: '__session', value: result.jwt, options: { path: '/', sameSite: 'lax', secure } },
+                    { name: '__atlas_rt', value: result.refreshToken, options: { path: '/', httpOnly: true, sameSite: 'lax', secure } },
+                    ...old,
+                ],
+            };
+        }
+        if (result.kind === 'needs_mfa') {
+            return {
+                action: 'needs_mfa',
+                attemptId: result.attemptId,
+                status: result.status,
+                cookies: clearOld(cookies),
+                continuationUrl: (url) => {
+                    const next = new URL(url);
+                    next.searchParams.set('__atlas_attempt', result.attemptId);
+                    next.searchParams.set('__atlas_status', result.status);
+                    return next.toString();
+                },
+            };
+        }
+        return { action: 'refused', outcome: result.outcome, cookies: FINAL.includes(result.outcome) ? clearOld(cookies) : [] };
+    };
+}
+/** The client IP a proxy in front of your server recorded (first X-Forwarded-For hop, or X-Real-IP). */
+function clientIpFrom(headers) {
+    const xff = header(headers, 'x-forwarded-for');
+    const first = xff?.split(',')[0]?.trim();
+    return first || header(headers, 'x-real-ip')?.trim() || undefined;
+}
+//# sourceMappingURL=migration-bridge.js.map

package/dist/migration-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-bridge.js","sourceRoot":"","sources":["../src/migration-bridge.ts"],"names":[],"mappings":";;AA0BA,sDAEC;AAGD,8DAEC;AAmDD,4DAmDC;AAsED,8CAUC;AAyBD,0DAiBC;AAGD,gDAsCC;AAOD,sDAwGC;AAxZD,2DAAkI;AAElI;;;;;;;;;;;;;;;;;GAiBG;AAEH,kCAAkC;AAClC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAErD,mDAAmD;AACnD,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO,yBAAyB,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;AACxE,CAAC;AAED,+DAA+D;AAC/D,SAAgB,yBAAyB,CAAC,MAAc;IACtD,OAAO,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;AACjE,CAAC;AA2CD,MAAM,cAAc,GAA6B,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAErK;;;;;GAKG;AACI,KAAK,UAAU,wBAAwB,CAAC,OAAwC;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,YAAY;QACtB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QAChH,CAAC,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClF,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,aAAa,GAAG,UAAU,OAAO,CAAC,SAAS,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACtE,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACnE,CAAC;IACD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAC7C,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAUxC,CAAC;IACT,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;IAC7K,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,iBAAiB,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,qBAAqB,IAAI,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,EAAE,CAAC;QACjJ,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC;IACxD,IAAI,OAAO,IAAK,cAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAiC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC1J,2GAA2G;IAC3G,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzE,CAAC;AA2DD,sFAAsF;AACtF,MAAM,KAAK,GAA6B,CAAC,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAElI,SAAS,MAAM,CAAC,OAAkB,EAAE,IAAY;IAC9C,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU;QAAE,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC9I,MAAM,MAAM,GAAG,OAAwD,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,2EAA2E;AAC3E,SAAgB,iBAAiB,CAAC,YAAuC;IACvE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAsB,CAAC;QACzE,OAAO,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,OAA+B,EAAE,QAAgB;IACvF,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACrC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,MAAqC,EAAE,YAAY,CAAC;QACvG,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAgB,kBAAkB,CAAC,OAAyI;IAC1K,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,IAAA,4CAAwB,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3G,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,GAAgB,KAAK,CAAC;IAChC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAA,gDAA4B,EAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAC3E,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;YACpB,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC;YACvB,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;YACvB,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YAClB,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;YACxC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;YAC7F,MAAM,CAAC,GAAG,IAAA,4CAAwB,EAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,KAAK,GAAG,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9E,MAAM,GAAG,CAAC,EAAE,WAAW,IAAI,KAAK,CAAC;YACjC,MAAM,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;YAC5B,iBAAiB,GAAG,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACvD,IAAI,OAAO,CAAC,gBAAgB;QAAE,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;SAC1D,IAAI,OAAO,CAAC,WAAW;QAAE,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAC1D,OAAO;QACL,OAAO;QACP,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;QACrC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM;QAChC,iBAAiB,EAAE,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrE,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAG,CAAC,OAA+B,EAAkB,EAAE;QACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,IAAI,IAAA,qCAAiB,EAAC,OAAO,EAAE,IAAI,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/B,IAAI;YACJ,KAAK,EAAE,EAAE;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,CAAC;gBACT,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF;SACF,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,OAA+B,EAAE,OAA+B,EAAoE,EAAE;QAC7J,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAiB,EAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3H,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACpG,IAAI,KAAK;oBAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YACrE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9G,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,KAAK,UAAU,MAAM,CAAC,OAA+B;QAC1D,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,uEAAuE;QACvE,IAAI,OAAO,CAAC,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAClD,6EAA6E;QAC7E,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,gCAAgC;QAChC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1F,CAAC;aAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/F,IAAI,YAAY;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;YAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC;YAChD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;YACpE,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACzF,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACnH,GAAG,GAAG;iBACP;aACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAC1B,eAAe,EAAE,CAAC,GAAW,EAAE,EAAE;oBAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzB,CAAC;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1H,CAAC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,YAAY,CAAC,OAAkB;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACpE,CAAC"}

package/dist/migration-presets.d.ts

@@ -0,0 +1,150 @@
+/**
+ * ZERO-LOGOUT BRIDGE PRESETS — per vendor, how an old session is recognised.
+ *
+ * Shared by the Atlas API (which verifies the token and resolves the user) and
+ * the SDK middleware (which knows which cookie / header carries it), so both
+ * read one table. Pure data plus a few string templates: safe on every runtime.
+ *
+ * Three modes:
+ *   - `jwt`: the vendor's session (or a token inside it) is a JWT. Atlas
+ *     verifies it against the vendor's issuer and keys (JWKS, or an X.509 map
+ *     like Firebase session cookies use), maps `claims.subject` to the imported
+ *     user (`external_id` = the source user id), and spends `claims.sessionKey`
+ *     (`jti` / `sid`, falling back to the whole token) in the single-use ledger.
+ *   - `session_table`: an opaque token; Atlas looks up sha256(token) among the
+ *     sessions imported in the migration bundle.
+ *   - `remote`: the vendor's session can only be checked by asking the vendor
+ *     with the user's own token (Appwrite, PocketBase): Atlas calls
+ *     `remote.url` with the token filled into `{token}` and reads the subject
+ *     (and profile) from the JSON answer by dot path.
+ *
+ * Templates use `{var}` placeholders filled from the bridge settings'
+ * `preset_vars` (e.g. `{domain}`, `{region}`); {@link resolveMigrationBridgePreset}
+ * refuses a template with a missing variable.
+ *
+ * Vendor tracks register their preset (or refine the starter below) with
+ * {@link registerMigrationBridgePreset}; a test checks every preset resolves.
+ */
+export interface MigrationBridgeClaims {
+    /** Claim holding the source user id (default `sub`). */
+    subject: string;
+    email?: string;
+    emailVerified?: string;
+    name?: string;
+    /** Claim whose value spends the token in the single-use ledger (`jti`, `sid`); the whole token when absent. */
+    sessionKey?: string;
+    /**
+     * How the vendor says a second factor was passed: `amr:mfa` (the `amr` array
+     * contains `mfa`), `acr:<value>`, or `claim:<name>` (a truthy claim).
+     */
+    mfa?: string;
+}
+/**
+ * How the middleware gets the token out of the cookie: `raw` (the cookie value
+ * is the token), `supabase` (Supabase SSR's `base64-` JSON cookie, possibly
+ * chunked `.0`/`.1`, holding `access_token`), or a custom extractor a vendor
+ * track registers on the middleware side.
+ */
+export type TokenFormat = 'raw' | 'supabase' | (string & {});
+export interface MigrationBridgePreset {
+    id: string;
+    label: string;
+    mode: 'jwt' | 'session_table' | 'remote';
+    /** Variables the templates need, with a one-line hint each. */
+    vars?: Record<string, string>;
+    /** Optional variables and their defaults. */
+    defaults?: Record<string, string>;
+    jwt?: {
+        issuer: string;
+        /** Where the keys are. Omitted → OIDC discovery from the issuer. */
+        keysUrl?: string;
+        /** `jwks` (default) or `x509` (a `{ kid: PEM certificate }` map). */
+        keysFormat?: 'jwks' | 'x509';
+        /** Expected `aud` template(s); unchecked when absent. */
+        audience?: string[];
+        algorithms: string[];
+        claims: MigrationBridgeClaims;
+        /**
+         * Accept a validly signed token this many seconds past `exp` (each one still
+         * exchanges once). For vendors whose cookie holds a short-lived token that
+         * their client SDK refreshes and nothing refreshes after the switch. 0 by default.
+         */
+        expiredGraceSeconds?: number;
+        /** The vendor may sign with a shared secret (HS256) instead of keys (Supabase legacy JWT secret). */
+        allowSharedSecret?: boolean;
+    };
+    /**
+     * Mode `remote`: the vendor call that vouches for a token. Templates take the
+     * preset variables; `{token}` is the presented token and is filled only at
+     * call time, by the server.
+     */
+    remote?: MigrationBridgeRemote;
+    /**
+     * Cookies that may carry the token, most specific first. `*` matches any run
+     * of characters (Amplify names cookies per client id and username).
+     */
+    cookies: string[];
+    tokenFormat?: TokenFormat;
+    /** Read `Authorization: Bearer` too (API clients holding the old token). */
+    bearer?: boolean;
+    /** Cookies to clear once exchanged (defaults to `cookies`). */
+    clearCookies?: string[];
+    /**
+     * The cookie name collides with Atlas's own (`__session`): the middleware
+     * only treats it as the old vendor's when the token's `iss` is the vendor's.
+     */
+    sharesAtlasCookie?: boolean;
+    /** Integrator-facing notes (what must be configured at the vendor, caveats). */
+    notes?: string;
+}
+/** How a `remote` preset asks the vendor about a token. */
+export interface MigrationBridgeRemote {
+    /** URL template (`{var}` from the preset variables, `{token}` at call time). */
+    url: string;
+    method: 'GET' | 'POST';
+    /** Header templates, e.g. `{ authorization: 'Bearer {token}' }`. */
+    headers?: Record<string, string>;
+    /** Body template (POST). */
+    body?: string;
+    /** Dot path into the JSON answer holding the source user id (`record.id`, `$id`). */
+    subjectPath: string;
+    emailPath?: string;
+    emailVerifiedPath?: string;
+    namePath?: string;
+}
+export declare function registerMigrationBridgePreset(preset: MigrationBridgePreset, options?: {
+    replace?: boolean;
+}): void;
+export declare function getMigrationBridgePreset(id: string): MigrationBridgePreset | undefined;
+export declare function listMigrationBridgePresets(): MigrationBridgePreset[];
+/** The bridge settings a preset resolves to, every template filled in. */
+export interface ResolvedBridgePreset {
+    preset: string;
+    mode: 'jwt' | 'session_table' | 'remote';
+    issuer: string | null;
+    keysUrl: string | null;
+    keysFormat: 'jwks' | 'x509';
+    audience: string[] | null;
+    algorithms: string[];
+    claims: MigrationBridgeClaims;
+    expiredGraceSeconds: number;
+    cookies: string[];
+    tokenFormat: TokenFormat;
+    bearer: boolean;
+    clearCookies: string[];
+    sharesAtlasCookie: boolean;
+    /** Mode `remote`: the vendor call, preset variables filled, `{token}` left for the server. */
+    remote: MigrationBridgeRemote | null;
+}
+export declare class PresetVariableError extends Error {
+    readonly variable: string;
+    constructor(variable: string, message: string);
+}
+/**
+ * Fill a preset's templates. Throws {@link PresetVariableError} for a missing or
+ * malformed variable. Values are trimmed; a trailing slash on a URL-ish value
+ * is removed (`https://example.com/` → `https://example.com`).
+ */
+export declare function resolveMigrationBridgePreset(id: string, rawVars?: Record<string, string>): ResolvedBridgePreset;
+/** Does a cookie name match a preset pattern (`*` = any run of characters)? */
+export declare function cookieNameMatches(pattern: string, name: string): boolean;