@atlasauth/backend 0.24.0 → 0.25.0

package/dist/migration-bridge.js

@@ -4,7 +4,9 @@ exports.migrationExchangePath = migrationExchangePath;
 exports.migrationBapiExchangePath = migrationBapiExchangePath;
 exports.exchangeMigrationSession = exchangeMigrationSession;
 exports.parseCookieHeader = parseCookieHeader;
+exports.readPocketBaseCookieToken = readPocketBaseCookieToken;
 exports.readSupabaseAccessToken = readSupabaseAccessToken;
+exports.readSupabaseRefreshToken = readSupabaseRefreshToken;
 exports.bridgeCookieConfig = bridgeCookieConfig;
 exports.createMigrationBridge = createMigrationBridge;
 const migration_presets_1 = require("./migration-presets");
@@ -135,11 +137,35 @@ function decodeBase64Url(s) {
     const bytes = Uint8Array.from(bin, (c) => c.charCodeAt(0));
     return new TextDecoder().decode(bytes);
 }
+/** The token in the PocketBase JS SDK's `authStore.exportToCookie()` cookie (`pb_auth`: JSON `{ token, record }`). */
+function readPocketBaseCookieToken(raw) {
+    if (!raw)
+        return undefined;
+    try {
+        const v = JSON.parse(raw.startsWith('%7B') || raw.startsWith('%7b') ? decodeURIComponent(raw) : raw);
+        return typeof v?.token === 'string' && v.token ? v.token : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Supabase SSR cookie: `sb-<ref>-auth-token` (or chunks `.0`, `.1`, … joined in
  * order), the value JSON or `base64-` + base64url(JSON), holding `access_token`.
  */
 function readSupabaseAccessToken(cookies, baseName) {
+    return readSupabaseCookieField(cookies, baseName, 'access_token');
+}
+/**
+ * The refresh token in the same cookie (`refresh_token`, or the second entry
+ * of the older auth-helpers array): what the `supabase_refresh_token`
+ * session-table preset looks up among the sessions a dump of
+ * auth.refresh_tokens imported.
+ */
+function readSupabaseRefreshToken(cookies, baseName) {
+    return readSupabaseCookieField(cookies, baseName, 'refresh_token');
+}
+function readSupabaseCookieField(cookies, baseName, field) {
     let raw = cookies[baseName];
     if (raw === undefined) {
         const chunks = [];
@@ -154,7 +180,7 @@ function readSupabaseAccessToken(cookies, baseName) {
         if (text.startsWith('base64-'))
             text = decodeBase64Url(text.slice('base64-'.length));
         const parsed = JSON.parse(text);
-        const token = Array.isArray(parsed) ? parsed[0] : parsed?.access_token;
+        const token = Array.isArray(parsed) ? parsed[field === 'access_token' ? 0 : 1] : parsed?.[field];
         return typeof token === 'string' && token ? token : undefined;
     }
     catch {
@@ -243,7 +269,7 @@ function createMigrationBridge(options) {
         for (const pattern of config.cookies) {
             const names = pattern.includes('*') ? Object.keys(cookies).filter((n) => (0, migration_presets_1.cookieNameMatches)(pattern, n)).sort() : [pattern];
             for (const name of names) {
-                const token = config.format === 'supabase' ? readSupabaseAccessToken(cookies, name) : cookies[name];
+                const token = config.format === 'supabase' ? readSupabaseAccessToken(cookies, name) : config.format === 'supabase_refresh' ? readSupabaseRefreshToken(cookies, name) : config.format === 'pocketbase' ? readPocketBaseCookieToken(cookies[name]) : cookies[name];
                 if (token)
                     return { token, fromAtlasCookie: name === '__session' };
             }

package/dist/migration-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"migration-bridge.js","sourceRoot":"","sources":["../src/migration-bridge.ts"],"names":[],"mappings":";;AA0BA,sDAEC;AAGD,8DAEC;AAmDD,4DAmDC;AAsED,8CAUC;AAyBD,0DAiBC;AAGD,gDAsCC;AAOD,sDAwGC;AAxZD,2DAAkI;AAElI;;;;;;;;;;;;;;;;;GAiBG;AAEH,kCAAkC;AAClC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAErD,mDAAmD;AACnD,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO,yBAAyB,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;AACxE,CAAC;AAED,+DAA+D;AAC/D,SAAgB,yBAAyB,CAAC,MAAc;IACtD,OAAO,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;AACjE,CAAC;AA2CD,MAAM,cAAc,GAA6B,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAErK;;;;;GAKG;AACI,KAAK,UAAU,wBAAwB,CAAC,OAAwC;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,YAAY;QACtB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QAChH,CAAC,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClF,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,aAAa,GAAG,UAAU,OAAO,CAAC,SAAS,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACtE,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACnE,CAAC;IACD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAC7C,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAUxC,CAAC;IACT,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;IAC7K,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,iBAAiB,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,qBAAqB,IAAI,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,EAAE,CAAC;QACjJ,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC;IACxD,IAAI,OAAO,IAAK,cAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAiC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC1J,2GAA2G;IAC3G,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzE,CAAC;AA2DD,sFAAsF;AACtF,MAAM,KAAK,GAA6B,CAAC,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAElI,SAAS,MAAM,CAAC,OAAkB,EAAE,IAAY;IAC9C,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU;QAAE,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC9I,MAAM,MAAM,GAAG,OAAwD,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,2EAA2E;AAC3E,SAAgB,iBAAiB,CAAC,YAAuC;IACvE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAsB,CAAC;QACzE,OAAO,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,OAA+B,EAAE,QAAgB;IACvF,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACrC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,MAAqC,EAAE,YAAY,CAAC;QACvG,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAgB,kBAAkB,CAAC,OAAyI;IAC1K,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,IAAA,4CAAwB,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3G,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,GAAgB,KAAK,CAAC;IAChC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAA,gDAA4B,EAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAC3E,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;YACpB,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC;YACvB,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;YACvB,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YAClB,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;YACxC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;YAC7F,MAAM,CAAC,GAAG,IAAA,4CAAwB,EAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,KAAK,GAAG,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9E,MAAM,GAAG,CAAC,EAAE,WAAW,IAAI,KAAK,CAAC;YACjC,MAAM,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;YAC5B,iBAAiB,GAAG,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACvD,IAAI,OAAO,CAAC,gBAAgB;QAAE,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;SAC1D,IAAI,OAAO,CAAC,WAAW;QAAE,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAC1D,OAAO;QACL,OAAO;QACP,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;QACrC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM;QAChC,iBAAiB,EAAE,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrE,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAG,CAAC,OAA+B,EAAkB,EAAE;QACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,IAAI,IAAA,qCAAiB,EAAC,OAAO,EAAE,IAAI,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/B,IAAI;YACJ,KAAK,EAAE,EAAE;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,CAAC;gBACT,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF;SACF,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,OAA+B,EAAE,OAA+B,EAAoE,EAAE;QAC7J,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAiB,EAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3H,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACpG,IAAI,KAAK;oBAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YACrE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9G,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,KAAK,UAAU,MAAM,CAAC,OAA+B;QAC1D,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,uEAAuE;QACvE,IAAI,OAAO,CAAC,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAClD,6EAA6E;QAC7E,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,gCAAgC;QAChC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1F,CAAC;aAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/F,IAAI,YAAY;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;YAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC;YAChD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;YACpE,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACzF,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACnH,GAAG,GAAG;iBACP;aACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAC1B,eAAe,EAAE,CAAC,GAAW,EAAE,EAAE;oBAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzB,CAAC;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1H,CAAC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,YAAY,CAAC,OAAkB;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACpE,CAAC"}
+{"version":3,"file":"migration-bridge.js","sourceRoot":"","sources":["../src/migration-bridge.ts"],"names":[],"mappings":";;AA0BA,sDAEC;AAGD,8DAEC;AAmDD,4DAmDC;AAsED,8CAUC;AAsBD,8DAQC;AAMD,0DAEC;AAQD,4DAEC;AAsBD,gDAsCC;AAOD,sDAwGC;AAjbD,2DAAkI;AAElI;;;;;;;;;;;;;;;;;GAiBG;AAEH,kCAAkC;AAClC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAErD,mDAAmD;AACnD,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO,yBAAyB,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;AACxE,CAAC;AAED,+DAA+D;AAC/D,SAAgB,yBAAyB,CAAC,MAAc;IACtD,OAAO,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;AACjE,CAAC;AA2CD,MAAM,cAAc,GAA6B,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAErK;;;;;GAKG;AACI,KAAK,UAAU,wBAAwB,CAAC,OAAwC;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,YAAY;QACtB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QAChH,CAAC,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClF,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,aAAa,GAAG,UAAU,OAAO,CAAC,SAAS,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACtE,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACnE,CAAC;IACD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAC7C,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAUxC,CAAC;IACT,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;IAC7K,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,iBAAiB,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,qBAAqB,IAAI,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,EAAE,CAAC;QACjJ,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC;IACxD,IAAI,OAAO,IAAK,cAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAiC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC1J,2GAA2G;IAC3G,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzE,CAAC;AA2DD,sFAAsF;AACtF,MAAM,KAAK,GAA6B,CAAC,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAElI,SAAS,MAAM,CAAC,OAAkB,EAAE,IAAY;IAC9C,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU;QAAE,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC9I,MAAM,MAAM,GAAG,OAAwD,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,2EAA2E;AAC3E,SAAgB,iBAAiB,CAAC,YAAuC;IACvE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAsB,CAAC;QACzE,OAAO,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,sHAAsH;AACtH,SAAgB,yBAAyB,CAAC,GAAuB;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAwB,CAAC;QAC5H,OAAO,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,OAA+B,EAAE,QAAgB;IACvF,OAAO,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,OAA+B,EAAE,QAAgB;IACxF,OAAO,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,uBAAuB,CAAC,OAA+B,EAAE,QAAgB,EAAE,KAAuC;IACzH,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACrC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,MAAyC,EAAE,CAAC,KAAK,CAAC,CAAC;QACrI,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAgB,kBAAkB,CAAC,OAAyI;IAC1K,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,IAAA,4CAAwB,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3G,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,GAAgB,KAAK,CAAC;IAChC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAA,gDAA4B,EAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAC3E,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;YACpB,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC;YACvB,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;YACvB,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YAClB,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;YACxC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;YAC7F,MAAM,CAAC,GAAG,IAAA,4CAAwB,EAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,KAAK,GAAG,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9E,MAAM,GAAG,CAAC,EAAE,WAAW,IAAI,KAAK,CAAC;YACjC,MAAM,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;YAC5B,iBAAiB,GAAG,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACvD,IAAI,OAAO,CAAC,gBAAgB;QAAE,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;SAC1D,IAAI,OAAO,CAAC,WAAW;QAAE,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAC1D,OAAO;QACL,OAAO;QACP,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;QACrC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM;QAChC,iBAAiB,EAAE,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrE,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAG,CAAC,OAA+B,EAAkB,EAAE;QACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,IAAI,IAAA,qCAAiB,EAAC,OAAO,EAAE,IAAI,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/B,IAAI;YACJ,KAAK,EAAE,EAAE;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,CAAC;gBACT,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF;SACF,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,OAA+B,EAAE,OAA+B,EAAoE,EAAE;QAC7J,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAiB,EAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3H,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACjQ,IAAI,KAAK;oBAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YACrE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9G,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,KAAK,UAAU,MAAM,CAAC,OAA+B;QAC1D,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,uEAAuE;QACvE,IAAI,OAAO,CAAC,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAClD,6EAA6E;QAC7E,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,gCAAgC;QAChC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1F,CAAC;aAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/F,IAAI,YAAY;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;YAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC;YAChD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;YACpE,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACzF,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACnH,GAAG,GAAG;iBACP;aACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAC1B,eAAe,EAAE,CAAC,GAAW,EAAE,EAAE;oBAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzB,CAAC;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1H,CAAC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,YAAY,CAAC,OAAkB;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACpE,CAAC"}

package/dist/migration-presets-g3.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationBridgePreset } from './migration-presets';
+export declare const G3_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g3.js

@@ -0,0 +1,254 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.G3_BRIDGE_PRESETS = void 0;
+/**
+ * Bridge presets for Firebase / Identity Platform, Supabase, Amazon Cognito,
+ * Azure AD B2C, Entra External ID, Appwrite, PocketBase and Nhost, checked against each vendor's
+ * token documentation. Registered (replacing the starters) at the end of
+ * migration-presets.ts; only a type is imported from there, so there is no
+ * import cycle at runtime.
+ *
+ * A vendor whose browser SDK keeps the session in localStorage / IndexedDB
+ * (Firebase, Amplify, MSAL, Supabase SPA, Nhost) has no cookie for a server
+ * middleware to read: the browser helpers in `@atlasauth/js`
+ * (`exchangeMigrationBrowserSession` with the vendor readers) pick the token up
+ * there and call the Frontend API exchange.
+ */
+/** Short-lived vendor tokens nobody refreshes after the switch: accept them (once) for a week past `exp`. */
+const WEEK = 7 * 24 * 3600;
+exports.G3_BRIDGE_PRESETS = [
+    {
+        id: 'firebase',
+        label: 'Firebase Authentication / Identity Platform (ID tokens)',
+        mode: 'jwt',
+        vars: { project_id: 'Firebase / Google Cloud project id' },
+        jwt: {
+            issuer: 'https://securetoken.google.com/{project_id}',
+            keysUrl: 'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com',
+            audience: ['{project_id}'],
+            algorithms: ['RS256'],
+            // `sub` and `user_id` both carry the uid. Firebase ID tokens have no jti:
+            // the whole token is spent in the single-use ledger.
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name' },
+            // ID tokens live an hour and the Firebase SDK refreshes them; after the switch nothing does.
+            expiredGraceSeconds: WEEK,
+        },
+        // Firebase keeps sessions in IndexedDB; `__session` is the cookie apps behind
+        // Firebase Hosting conventionally copy the ID token into.
+        cookies: ['__session'],
+        sharesAtlasCookie: true,
+        bearer: true,
+        notes: 'Identity Platform tenants sign with the same issuer (the tenant is the firebase.tenant claim); export each tenant into its own organization. Browser sessions (IndexedDB) are exchanged with readFirebaseBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'firebase_session_cookie',
+        label: 'Firebase session cookies (Admin SDK createSessionCookie)',
+        mode: 'jwt',
+        vars: { project_id: 'Firebase / Google Cloud project id' },
+        defaults: { cookie_name: 'session' },
+        jwt: {
+            issuer: 'https://session.firebase.google.com/{project_id}',
+            keysUrl: 'https://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys',
+            keysFormat: 'x509',
+            audience: ['{project_id}'],
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name' },
+        },
+        cookies: ['{cookie_name}', '__session'],
+        sharesAtlasCookie: true,
+        notes: 'Session cookies live up to two weeks and verify against the x509 key map; set cookie_name when your app named it something else.',
+    },
+    {
+        id: 'supabase',
+        label: 'Supabase Auth (hosted)',
+        mode: 'jwt',
+        vars: { project_ref: 'Project ref (the subdomain of <ref>.supabase.co)' },
+        jwt: {
+            issuer: 'https://{project_ref}.supabase.co/auth/v1',
+            keysUrl: 'https://{project_ref}.supabase.co/auth/v1/.well-known/jwks.json',
+            audience: ['authenticated'],
+            // ES256/RS256 with the new signing keys; HS256 with the legacy JWT secret (stored in the bridge settings).
+            algorithms: ['ES256', 'RS256', 'HS256'],
+            // `amr` is a list of { method, timestamp } objects and `aal` a level, so
+            // the second factor is not mapped: Atlas applies its own MFA policy.
+            claims: { subject: 'sub', email: 'email', sessionKey: 'session_id' },
+            expiredGraceSeconds: WEEK,
+            allowSharedSecret: true,
+        },
+        cookies: ['sb-{project_ref}-auth-token'],
+        tokenFormat: 'supabase',
+        clearCookies: ['sb-{project_ref}-auth-token', 'sb-{project_ref}-auth-token.*', 'sb-{project_ref}-auth-token-code-verifier'],
+        bearer: true,
+        notes: 'Anonymous users (is_anonymous) are refused like any user the import did not create.',
+    },
+    {
+        id: 'supabase_refresh_token',
+        label: 'Supabase Auth (refresh tokens from a dump)',
+        mode: 'session_table',
+        vars: { project_ref: 'Project ref (the subdomain of <ref>.supabase.co)' },
+        // The export keys each live auth.refresh_tokens row by sha256(token): the
+        // refresh token in the SSR cookie finds it however long the user was away
+        // (the supabase JWT preset covers access tokens up to a week past expiry).
+        cookies: ['sb-{project_ref}-auth-token'],
+        tokenFormat: 'supabase_refresh',
+        clearCookies: ['sb-{project_ref}-auth-token', 'sb-{project_ref}-auth-token.*', 'sb-{project_ref}-auth-token-code-verifier'],
+        notes: 'Needs a dump of auth.refresh_tokens taken close to cutover. Refresh tokens Supabase issued after the dump are not known: keep the supabase preset for those, or re-import.',
+    },
+    {
+        id: 'supabase_self_hosted',
+        label: 'Supabase Auth (self-hosted or custom domain)',
+        mode: 'jwt',
+        vars: { auth_url: 'The Auth URL (https://db.example.com/auth/v1)', cookie_name: 'The SSR cookie name (sb-<first label of the host>-auth-token)' },
+        jwt: {
+            issuer: '{auth_url}',
+            keysUrl: '{auth_url}/.well-known/jwks.json',
+            audience: ['authenticated'],
+            algorithms: ['ES256', 'RS256', 'HS256'],
+            claims: { subject: 'sub', email: 'email', sessionKey: 'session_id' },
+            expiredGraceSeconds: WEEK,
+            allowSharedSecret: true,
+        },
+        cookies: ['{cookie_name}'],
+        tokenFormat: 'supabase',
+        clearCookies: ['{cookie_name}', '{cookie_name}.*'],
+        bearer: true,
+    },
+    {
+        id: 'cognito',
+        label: 'Amazon Cognito (ID tokens)',
+        mode: 'jwt',
+        vars: { region: 'AWS region (us-east-1)', user_pool_id: 'User pool id (us-east-1_AbCdEf)', client_id: 'App client id' },
+        jwt: {
+            issuer: 'https://cognito-idp.{region}.amazonaws.com/{user_pool_id}',
+            keysUrl: 'https://cognito-idp.{region}.amazonaws.com/{user_pool_id}/.well-known/jwks.json',
+            // ID tokens carry aud = the app client id (access tokens carry client_id and no aud).
+            audience: ['{client_id}'],
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'origin_jti' },
+            // ID tokens live an hour by default; Amplify refreshed them.
+            expiredGraceSeconds: WEEK,
+        },
+        // @aws-amplify/adapter-nextjs keeps the tokens in cookies named like Amplify's localStorage keys.
+        cookies: ['CognitoIdentityServiceProvider.{client_id}.*.idToken'],
+        clearCookies: ['CognitoIdentityServiceProvider.{client_id}.*'],
+        bearer: true,
+        notes: 'Users are matched on sub (the export keys users by sub). SPA sessions in localStorage are exchanged with readAmplifyBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'azure_ad_b2c',
+        label: 'Azure AD B2C (ID tokens)',
+        mode: 'jwt',
+        vars: {
+            tenant: 'Tenant name (contoso for contoso.b2clogin.com)',
+            tenant_id: 'Directory (tenant) id GUID',
+            policy: 'The user flow / custom policy that issued the tokens (B2C_1_signupsignin)',
+            client_id: 'Application (client) id',
+        },
+        jwt: {
+            issuer: 'https://{tenant}.b2clogin.com/{tenant_id}/v2.0/',
+            keysUrl: 'https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/{policy}/discovery/v2.0/keys',
+            audience: ['{client_id}'],
+            algorithms: ['RS256'],
+            // B2C's sub is the user's object id by default, which the Graph export uses as the user id.
+            claims: { subject: 'sub', name: 'name' },
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Keys are published per policy: run one bridge per user flow that issued tokens. MSAL keeps tokens in browser storage (encrypted from msal-browser v4): exchange v2/v3 caches with readMsalBrowserSession from @atlasauth/js; v4 apps rely on lazy migration.',
+    },
+    {
+        id: 'entra_external_id',
+        label: 'Microsoft Entra External ID (ID tokens)',
+        mode: 'jwt',
+        vars: {
+            tenant: 'Tenant subdomain (contoso for contoso.ciamlogin.com)',
+            tenant_id: 'Directory (tenant) id GUID',
+            client_id: 'Application (client) id',
+        },
+        jwt: {
+            issuer: 'https://{tenant_id}.ciamlogin.com/{tenant_id}/v2.0',
+            keysUrl: 'https://{tenant}.ciamlogin.com/{tenant_id}/discovery/v2.0/keys',
+            audience: ['{client_id}'],
+            algorithms: ['RS256'],
+            // `sub` differs per application; `oid` is the directory object id the Graph export keys users by.
+            claims: { subject: 'oid', email: 'email', name: 'name', sessionKey: 'uti' },
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'MSAL keeps tokens in browser storage (encrypted from msal-browser v4): exchange v2/v3 caches with readMsalBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'appwrite',
+        label: 'Appwrite (session cookie, checked with Appwrite)',
+        mode: 'remote',
+        vars: { endpoint_url: 'API endpoint including /v1 (https://cloud.appwrite.io/v1, or your own)', project_id: 'Project id' },
+        // Appwrite keeps only a hash of each session secret, so sessions cannot be
+        // exported or verified offline: Atlas asks Appwrite who the session is. The
+        // cookie value (base64 of {id, secret}) is what X-Appwrite-Session takes.
+        remote: {
+            url: '{endpoint_url}/account',
+            method: 'GET',
+            headers: { 'x-appwrite-project': '{project_id}', 'x-appwrite-session': '{token}' },
+            subjectPath: '$id',
+            emailPath: 'email',
+            emailVerifiedPath: 'emailVerification',
+            namePath: 'name',
+        },
+        // a_session_<project id, lowercased> and its _legacy twin.
+        cookies: ['a_session_*'],
+        notes: 'The browser must send the Appwrite cookie to your app, so this works when Appwrite is on a subdomain of your app (custom domain) or your app does SSR with the session secret in its own cookie (pass its name as cookieNames). Client-only apps keep the session in localStorage (cookieFallback): exchange it with readAppwriteBrowserSession from @atlasauth/js. Keep the Appwrite project running for the bridge window.',
+    },
+    {
+        id: 'pocketbase',
+        label: 'PocketBase (auth token, checked with PocketBase)',
+        mode: 'remote',
+        vars: { url: 'PocketBase URL (https://pb.example.com)' },
+        defaults: { collection: 'users' },
+        // Tokens are signed with a per-user tokenKey plus a per-collection secret, so
+        // nothing outside PocketBase can verify one: auth-refresh vouches for it.
+        remote: {
+            url: '{url}/api/collections/{collection}/auth-refresh',
+            method: 'POST',
+            headers: { authorization: '{token}' },
+            subjectPath: 'record.id',
+            emailPath: 'record.email',
+            emailVerifiedPath: 'record.verified',
+            namePath: 'record.name',
+        },
+        // pb_auth is the cookie the JS SDK's authStore.exportToCookie() writes (JSON with the token).
+        cookies: ['pb_auth'],
+        tokenFormat: 'pocketbase',
+        notes: 'Client-only apps keep the token in localStorage (pocketbase_auth): exchange it with readPocketBaseBrowserSession from @atlasauth/js. Keep PocketBase running for the bridge window.',
+    },
+    {
+        id: 'nhost',
+        label: 'Nhost (refresh tokens)',
+        mode: 'session_table',
+        // The export stores sha256(refresh token) — exactly what auth.refresh_tokens keeps.
+        cookies: ['nhostRefreshToken'],
+        clearCookies: ['nhostRefreshToken', 'nhostRefreshTokenExpiresAt', 'nhostSession'],
+        notes: 'SPA sessions keep the refresh token in localStorage (nhostRefreshToken): exchange them with readNhostBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'nhost_jwt',
+        label: 'Nhost (access tokens)',
+        mode: 'jwt',
+        vars: { auth_url: 'The Auth URL (https://<subdomain>.auth.<region>.nhost.run/v1)' },
+        // Legacy Hasura Auth signs with iss "hasura-auth"; current versions use the server URL.
+        defaults: { issuer: 'hasura-auth' },
+        jwt: {
+            issuer: '{issuer}',
+            keysUrl: '{auth_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'HS256', 'HS512'],
+            claims: { subject: 'sub', sessionKey: 'jti' },
+            expiredGraceSeconds: WEEK,
+            // Most projects sign with the shared HASURA_GRAPHQL_JWT_SECRET key.
+            allowSharedSecret: true,
+        },
+        cookies: [],
+        bearer: true,
+    },
+];
+//# sourceMappingURL=migration-presets-g3.js.map

package/dist/migration-presets-g3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-presets-g3.js","sourceRoot":"","sources":["../src/migration-presets-g3.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;GAYG;AAEH,6GAA6G;AAC7G,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEd,QAAA,iBAAiB,GAAqC;IACjE;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,yDAAyD;QAChE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE;QAC1D,GAAG,EAAE;YACH,MAAM,EAAE,6CAA6C;YACrD,OAAO,EAAE,2FAA2F;YACpG,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,0EAA0E;YAC1E,qDAAqD;YACrD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;YACzF,6FAA6F;YAC7F,mBAAmB,EAAE,IAAI;SAC1B;QACD,8EAA8E;QAC9E,0DAA0D;QAC1D,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,6OAA6O;KAChP;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,0DAA0D;QACjE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE;QAC1D,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;QACpC,GAAG,EAAE;YACH,MAAM,EAAE,kDAAkD;YAC1D,OAAO,EAAE,uEAAuE;YAChF,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;SAC1F;QACD,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;QACvC,iBAAiB,EAAE,IAAI;QACvB,KAAK,EAAE,kIAAkI;KAC1I;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,wBAAwB;QAC/B,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE;QACzE,GAAG,EAAE;YACH,MAAM,EAAE,2CAA2C;YACnD,OAAO,EAAE,iEAAiE;YAC1E,QAAQ,EAAE,CAAC,eAAe,CAAC;YAC3B,2GAA2G;YAC3G,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE;YACpE,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACxC,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,CAAC,6BAA6B,EAAE,+BAA+B,EAAE,2CAA2C,CAAC;QAC3H,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,qFAAqF;KAC7F;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,4CAA4C;QACnD,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACxC,WAAW,EAAE,kBAAkB;QAC/B,YAAY,EAAE,CAAC,6BAA6B,EAAE,+BAA+B,EAAE,2CAA2C,CAAC;QAC3H,KAAK,EAAE,4KAA4K;KACpL;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EAAE,8CAA8C;QACrD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,+CAA+C,EAAE,WAAW,EAAE,+DAA+D,EAAE;QACjJ,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,QAAQ,EAAE,CAAC,eAAe,CAAC;YAC3B,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE;YACpE,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAClD,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,YAAY,EAAE,iCAAiC,EAAE,SAAS,EAAE,eAAe,EAAE;QACvH,GAAG,EAAE;YACH,MAAM,EAAE,2DAA2D;YACnE,OAAO,EAAE,iFAAiF;YAC1F,sFAAsF;YACtF,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE;YACnH,6DAA6D;YAC7D,mBAAmB,EAAE,IAAI;SAC1B;QACD,kGAAkG;QAClG,OAAO,EAAE,CAAC,sDAAsD,CAAC;QACjE,YAAY,EAAE,CAAC,8CAA8C,CAAC;QAC9D,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,wJAAwJ;KAChK;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,MAAM,EAAE,gDAAgD;YACxD,SAAS,EAAE,4BAA4B;YACvC,MAAM,EAAE,2EAA2E;YACnF,SAAS,EAAE,yBAAyB;SACrC;QACD,GAAG,EAAE;YACH,MAAM,EAAE,iDAAiD;YACzD,OAAO,EAAE,qFAAqF;YAC9F,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,4FAA4F;YAC5F,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;YACxC,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,8PAA8P;KACjQ;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,yCAAyC;QAChD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,MAAM,EAAE,sDAAsD;YAC9D,SAAS,EAAE,4BAA4B;YACvC,SAAS,EAAE,yBAAyB;SACrC;QACD,GAAG,EAAE;YACH,MAAM,EAAE,oDAAoD;YAC5D,OAAO,EAAE,gEAAgE;YACzE,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,kGAAkG;YAClG,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;YAC3E,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,8IAA8I;KACtJ;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,kDAAkD;QACzD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,EAAE,YAAY,EAAE,wEAAwE,EAAE,UAAU,EAAE,YAAY,EAAE;QAC1H,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,EAAE;YACN,GAAG,EAAE,wBAAwB;YAC7B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,oBAAoB,EAAE,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE;YAClF,WAAW,EAAE,KAAK;YAClB,SAAS,EAAE,OAAO;YAClB,iBAAiB,EAAE,mBAAmB;YACtC,QAAQ,EAAE,MAAM;SACjB;QACD,2DAA2D;QAC3D,OAAO,EAAE,CAAC,aAAa,CAAC;QACxB,KAAK,EACH,8ZAA8Z;KACja;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,kDAAkD;QACzD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,EAAE,GAAG,EAAE,yCAAyC,EAAE;QACxD,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;QACjC,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,EAAE;YACN,GAAG,EAAE,iDAAiD;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE;YACrC,WAAW,EAAE,WAAW;YACxB,SAAS,EAAE,cAAc;YACzB,iBAAiB,EAAE,iBAAiB;YACpC,QAAQ,EAAE,aAAa;SACxB;QACD,8FAA8F;QAC9F,OAAO,EAAE,CAAC,SAAS,CAAC;QACpB,WAAW,EAAE,YAAY;QACzB,KAAK,EAAE,qLAAqL;KAC7L;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,wBAAwB;QAC/B,IAAI,EAAE,eAAe;QACrB,oFAAoF;QACpF,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,YAAY,EAAE,CAAC,mBAAmB,EAAE,4BAA4B,EAAE,cAAc,CAAC;QACjF,KAAK,EAAE,yIAAyI;KACjJ;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,+DAA+D,EAAE;QACnF,wFAAwF;QACxF,QAAQ,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;QACnC,GAAG,EAAE;YACH,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,mBAAmB,EAAE,IAAI;YACzB,oEAAoE;YACpE,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;CACF,CAAC"}

package/dist/migration-presets-g4/authentik.d.ts

@@ -0,0 +1,14 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * authentik. An application's OAuth2/OpenID provider signs its ID and access
+ * tokens with the signing key chosen on the provider (RS256 / ES256). The
+ * issuer is per provider and ends in a slash — `iss` is compared as a string,
+ * so the template restores the slash the variable resolver trims:
+ *   https://auth.example.com/application/o/<application slug>/
+ * with the keys at `<issuer>jwks/`.
+ *
+ * `sub` depends on the provider's "Subject mode" (hashed user id by default);
+ * the export keys users by the same mode, so the two agree. `sid` is authentik's
+ * session id (a hash), shared by every token of one sign-in.
+ */
+export declare const AUTHENTIK_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/authentik.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTHENTIK_BRIDGE_PRESETS = void 0;
+/**
+ * authentik. An application's OAuth2/OpenID provider signs its ID and access
+ * tokens with the signing key chosen on the provider (RS256 / ES256). The
+ * issuer is per provider and ends in a slash — `iss` is compared as a string,
+ * so the template restores the slash the variable resolver trims:
+ *   https://auth.example.com/application/o/<application slug>/
+ * with the keys at `<issuer>jwks/`.
+ *
+ * `sub` depends on the provider's "Subject mode" (hashed user id by default);
+ * the export keys users by the same mode, so the two agree. `sid` is authentik's
+ * session id (a hash), shared by every token of one sign-in.
+ */
+exports.AUTHENTIK_BRIDGE_PRESETS = [
+    {
+        id: 'authentik',
+        label: 'authentik (OAuth2 / OpenID provider tokens)',
+        mode: 'jwt',
+        vars: { issuer: "The provider's issuer URL without the trailing slash (https://auth.example.com/application/o/<application slug>)", client_id: "The provider's client id (the tokens' aud)" },
+        jwt: {
+            issuer: '{issuer}/',
+            keysUrl: '{issuer}/jwks/',
+            audience: ['{client_id}'],
+            // A provider without a signing key signs HS256 with its client secret: no public keys exist for it.
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256', 'ES384'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid', mfa: 'amr:mfa' },
+        },
+        // authentik is the identity provider, not the app: the app's own OIDC client library keeps the token
+        // (next-auth, passport-openidconnect, oauth2-proxy). Pass it as a bearer token or from your own extractor.
+        cookies: [],
+        bearer: true,
+        notes: 'Set the provider\'s Subject mode to the one the export used (hashed user id by default; the export records it). The provider needs a signing key: tokens signed with the client secret (HS256) cannot be verified from public keys. With the "global" issuer mode, point the preset at the per-provider URL anyway: the keys are served there.',
+    },
+];
+//# sourceMappingURL=authentik.js.map

package/dist/migration-presets-g4/authentik.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentik.js","sourceRoot":"","sources":["../../src/migration-presets-g4/authentik.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;GAWG;AACU,QAAA,wBAAwB,GAAqC;IACxE;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,6CAA6C;QACpD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,kHAAkH,EAAE,SAAS,EAAE,4CAA4C,EAAE;QAC7L,GAAG,EAAE;YACH,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,oGAAoG;YACpG,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE;SAC7H;QACD,qGAAqG;QACrG,2GAA2G;QAC3G,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,gVAAgV;KACnV;CACF,CAAC"}

package/dist/migration-presets-g4/fusionauth.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+export declare const FUSIONAUTH_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/fusionauth.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FUSIONAUTH_BRIDGE_PRESETS = void 0;
+/**
+ * FusionAuth. The access token (`app.at` cookie, or the Bearer token an API
+ * client holds) is a JWT whose `iss` is the TENANT's issuer string: `acme.com`
+ * by default (what `issuer_name` takes), or an https URL when the tenant was
+ * set up that way (the `fusionauth_url_issuer` preset takes the base URL).
+ * Keys come from `/.well-known/jwks.json` and publish only asymmetric keys:
+ * a tenant still on the default HS256 signing key has to switch the
+ * application's access-token key to an RSA or EC key before the bridge can
+ * verify its tokens. `sub` is the FusionAuth user id the export keys users by,
+ * `sid` the SSO session, `amr` lists `mfa` after a second factor.
+ */
+const WEEK = 7 * 24 * 3600;
+const CLAIMS = { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid', mfa: 'amr:mfa' };
+exports.FUSIONAUTH_BRIDGE_PRESETS = [
+    {
+        id: 'fusionauth',
+        label: 'FusionAuth (access token, tenant issuer such as acme.com)',
+        mode: 'jwt',
+        vars: { base_url: 'FusionAuth URL (https://auth.example.com)', issuer_name: 'The tenant issuer (Tenants → General → Issuer, `acme.com` by default)' },
+        jwt: {
+            issuer: '{issuer_name}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'],
+            claims: CLAIMS,
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: ['app.at'],
+        clearCookies: ['app.at', 'app.rt', 'app.idt', 'app.match_hint', 'app.locale', 'app.ssoToken'],
+        bearer: true,
+        notes: 'The application must sign access tokens with an RSA or EC key (a default HS256 key has no public JWKS entry).',
+    },
+    {
+        id: 'fusionauth_url_issuer',
+        label: 'FusionAuth (access token, tenant issuer is the https URL)',
+        mode: 'jwt',
+        vars: { base_url: 'FusionAuth URL, also the tenant issuer (https://auth.example.com)' },
+        jwt: {
+            issuer: '{base_url}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'],
+            claims: CLAIMS,
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: ['app.at'],
+        clearCookies: ['app.at', 'app.rt', 'app.idt', 'app.match_hint', 'app.locale', 'app.ssoToken'],
+        bearer: true,
+    },
+];
+//# sourceMappingURL=fusionauth.js.map

package/dist/migration-presets-g4/fusionauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fusionauth.js","sourceRoot":"","sources":["../../src/migration-presets-g4/fusionauth.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;GAUG;AACH,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3B,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAEvH,QAAA,yBAAyB,GAAqC;IACzE;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,2DAA2D;QAClE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,2CAA2C,EAAE,WAAW,EAAE,uEAAuE,EAAE;QACrJ,GAAG,EAAE;YACH,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,MAAM,EAAE,MAAM;YACd,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,CAAC;QAC7F,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,+GAA+G;KACvH;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE,2DAA2D;QAClE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,mEAAmE,EAAE;QACvF,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,MAAM,EAAE,MAAM;YACd,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,CAAC;QAC7F,MAAM,EAAE,IAAI;KACb;CACF,CAAC"}

package/dist/migration-presets-g4/hanko.d.ts

@@ -0,0 +1,12 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * Hanko. The backend signs a session JWT (RS256, a rotating key set at
+ * `/.well-known/jwks.json` on the public API) and writes it to the `hanko`
+ * cookie (`cookie.name`); the frontend SDK and hanko-elements read the same
+ * token. Claims: `sub` (the user's id — what the export keys users by),
+ * `session_id`, `exp`, `iat`, `aud`, `iss` (when `session.issuer` is set) and
+ * `email` / `username`. `email` is an object (`address`, `is_primary`,
+ * `is_verified`), so it is not mapped to a claim; the imported user already
+ * holds the addresses.
+ */
+export declare const HANKO_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/hanko.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HANKO_BRIDGE_PRESETS = void 0;
+/**
+ * Hanko. The backend signs a session JWT (RS256, a rotating key set at
+ * `/.well-known/jwks.json` on the public API) and writes it to the `hanko`
+ * cookie (`cookie.name`); the frontend SDK and hanko-elements read the same
+ * token. Claims: `sub` (the user's id — what the export keys users by),
+ * `session_id`, `exp`, `iat`, `aud`, `iss` (when `session.issuer` is set) and
+ * `email` / `username`. `email` is an object (`address`, `is_primary`,
+ * `is_verified`), so it is not mapped to a claim; the imported user already
+ * holds the addresses.
+ */
+exports.HANKO_BRIDGE_PRESETS = [
+    {
+        id: 'hanko',
+        label: 'Hanko (session JWT, issuer = the API URL)',
+        mode: 'jwt',
+        vars: { base_url: 'The Hanko API URL (https://<project id>.hanko.io, or your own https://hanko.example.com)' },
+        jwt: {
+            issuer: '{base_url}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256'],
+            claims: { subject: 'sub', sessionKey: 'session_id' },
+        },
+        cookies: ['hanko'],
+        bearer: true,
+        sharesAtlasCookie: false,
+        notes: 'Hanko Cloud sets iss to the project URL. Self-hosted: use hanko_jwt when session.issuer is something else. The cookie is named by cookie.name in Hanko\'s config (default hanko).',
+    },
+    {
+        id: 'hanko_jwt',
+        label: 'Hanko (session JWT, custom issuer)',
+        mode: 'jwt',
+        vars: { base_url: 'The Hanko API URL (keys are read from /.well-known/jwks.json)', issuer: "The session.issuer you configured (the token's iss)" },
+        jwt: {
+            issuer: '{issuer}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256'],
+            claims: { subject: 'sub', sessionKey: 'session_id' },
+        },
+        cookies: ['hanko'],
+        bearer: true,
+    },
+];
+//# sourceMappingURL=hanko.js.map

package/dist/migration-presets-g4/hanko.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hanko.js","sourceRoot":"","sources":["../../src/migration-presets-g4/hanko.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAAqC;IACpE;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,2CAA2C;QAClD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,0FAA0F,EAAE;QAC9G,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACzD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE;SACrD;QACD,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,MAAM,EAAE,IAAI;QACZ,iBAAiB,EAAE,KAAK;QACxB,KAAK,EACH,mLAAmL;KACtL;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,oCAAoC;QAC3C,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,+DAA+D,EAAE,MAAM,EAAE,qDAAqD,EAAE;QAClJ,GAAG,EAAE;YACH,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACzD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE;SACrD;QACD,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,MAAM,EAAE,IAAI;KACb;CACF,CAAC"}

package/dist/migration-presets-g4/keycloak.d.ts

@@ -0,0 +1,16 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * Keycloak. Its browser adapter (keycloak-js) keeps the access / ID / refresh
+ * tokens in memory, and server adapters (keycloak-connect, NextAuth's Keycloak
+ * provider) keep them server-side or inside an encrypted cookie, so the token
+ * an integrator can hand the bridge is the access or ID token itself (Bearer
+ * header or the `exchangeMigrationBrowserSession` browser helper). The
+ * `KEYCLOAK_IDENTITY` cookie is signed with the realm's own HMAC secret and is
+ * never accepted.
+ *
+ * Access tokens live five minutes by default and nobody refreshes them after
+ * the switch, so a validly signed token is accepted (once) for a week past `exp`.
+ * Keycloak 16 and older serve under `/auth`: pass `base_url` as
+ * `https://sso.example.com/auth`.
+ */
+export declare const KEYCLOAK_BRIDGE_PRESETS: readonly MigrationBridgePreset[];