@atlasauth/backend 0.24.0 → 0.26.0

package/dist/migration-presets-g3.js

@@ -0,0 +1,254 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.G3_BRIDGE_PRESETS = void 0;
+/**
+ * Bridge presets for Firebase / Identity Platform, Supabase, Amazon Cognito,
+ * Azure AD B2C, Entra External ID, Appwrite, PocketBase and Nhost, checked against each vendor's
+ * token documentation. Registered (replacing the starters) at the end of
+ * migration-presets.ts; only a type is imported from there, so there is no
+ * import cycle at runtime.
+ *
+ * A vendor whose browser SDK keeps the session in localStorage / IndexedDB
+ * (Firebase, Amplify, MSAL, Supabase SPA, Nhost) has no cookie for a server
+ * middleware to read: the browser helpers in `@atlasauth/js`
+ * (`exchangeMigrationBrowserSession` with the vendor readers) pick the token up
+ * there and call the Frontend API exchange.
+ */
+/** Short-lived vendor tokens nobody refreshes after the switch: accept them (once) for a week past `exp`. */
+const WEEK = 7 * 24 * 3600;
+exports.G3_BRIDGE_PRESETS = [
+    {
+        id: 'firebase',
+        label: 'Firebase Authentication / Identity Platform (ID tokens)',
+        mode: 'jwt',
+        vars: { project_id: 'Firebase / Google Cloud project id' },
+        jwt: {
+            issuer: 'https://securetoken.google.com/{project_id}',
+            keysUrl: 'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com',
+            audience: ['{project_id}'],
+            algorithms: ['RS256'],
+            // `sub` and `user_id` both carry the uid. Firebase ID tokens have no jti:
+            // the whole token is spent in the single-use ledger.
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name' },
+            // ID tokens live an hour and the Firebase SDK refreshes them; after the switch nothing does.
+            expiredGraceSeconds: WEEK,
+        },
+        // Firebase keeps sessions in IndexedDB; `__session` is the cookie apps behind
+        // Firebase Hosting conventionally copy the ID token into.
+        cookies: ['__session'],
+        sharesAtlasCookie: true,
+        bearer: true,
+        notes: 'Identity Platform tenants sign with the same issuer (the tenant is the firebase.tenant claim); export each tenant into its own organization. Browser sessions (IndexedDB) are exchanged with readFirebaseBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'firebase_session_cookie',
+        label: 'Firebase session cookies (Admin SDK createSessionCookie)',
+        mode: 'jwt',
+        vars: { project_id: 'Firebase / Google Cloud project id' },
+        defaults: { cookie_name: 'session' },
+        jwt: {
+            issuer: 'https://session.firebase.google.com/{project_id}',
+            keysUrl: 'https://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys',
+            keysFormat: 'x509',
+            audience: ['{project_id}'],
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name' },
+        },
+        cookies: ['{cookie_name}', '__session'],
+        sharesAtlasCookie: true,
+        notes: 'Session cookies live up to two weeks and verify against the x509 key map; set cookie_name when your app named it something else.',
+    },
+    {
+        id: 'supabase',
+        label: 'Supabase Auth (hosted)',
+        mode: 'jwt',
+        vars: { project_ref: 'Project ref (the subdomain of <ref>.supabase.co)' },
+        jwt: {
+            issuer: 'https://{project_ref}.supabase.co/auth/v1',
+            keysUrl: 'https://{project_ref}.supabase.co/auth/v1/.well-known/jwks.json',
+            audience: ['authenticated'],
+            // ES256/RS256 with the new signing keys; HS256 with the legacy JWT secret (stored in the bridge settings).
+            algorithms: ['ES256', 'RS256', 'HS256'],
+            // `amr` is a list of { method, timestamp } objects and `aal` a level, so
+            // the second factor is not mapped: Atlas applies its own MFA policy.
+            claims: { subject: 'sub', email: 'email', sessionKey: 'session_id' },
+            expiredGraceSeconds: WEEK,
+            allowSharedSecret: true,
+        },
+        cookies: ['sb-{project_ref}-auth-token'],
+        tokenFormat: 'supabase',
+        clearCookies: ['sb-{project_ref}-auth-token', 'sb-{project_ref}-auth-token.*', 'sb-{project_ref}-auth-token-code-verifier'],
+        bearer: true,
+        notes: 'Anonymous users (is_anonymous) are refused like any user the import did not create.',
+    },
+    {
+        id: 'supabase_refresh_token',
+        label: 'Supabase Auth (refresh tokens from a dump)',
+        mode: 'session_table',
+        vars: { project_ref: 'Project ref (the subdomain of <ref>.supabase.co)' },
+        // The export keys each live auth.refresh_tokens row by sha256(token): the
+        // refresh token in the SSR cookie finds it however long the user was away
+        // (the supabase JWT preset covers access tokens up to a week past expiry).
+        cookies: ['sb-{project_ref}-auth-token'],
+        tokenFormat: 'supabase_refresh',
+        clearCookies: ['sb-{project_ref}-auth-token', 'sb-{project_ref}-auth-token.*', 'sb-{project_ref}-auth-token-code-verifier'],
+        notes: 'Needs a dump of auth.refresh_tokens taken close to cutover. Refresh tokens Supabase issued after the dump are not known: keep the supabase preset for those, or re-import.',
+    },
+    {
+        id: 'supabase_self_hosted',
+        label: 'Supabase Auth (self-hosted or custom domain)',
+        mode: 'jwt',
+        vars: { auth_url: 'The Auth URL (https://db.example.com/auth/v1)', cookie_name: 'The SSR cookie name (sb-<first label of the host>-auth-token)' },
+        jwt: {
+            issuer: '{auth_url}',
+            keysUrl: '{auth_url}/.well-known/jwks.json',
+            audience: ['authenticated'],
+            algorithms: ['ES256', 'RS256', 'HS256'],
+            claims: { subject: 'sub', email: 'email', sessionKey: 'session_id' },
+            expiredGraceSeconds: WEEK,
+            allowSharedSecret: true,
+        },
+        cookies: ['{cookie_name}'],
+        tokenFormat: 'supabase',
+        clearCookies: ['{cookie_name}', '{cookie_name}.*'],
+        bearer: true,
+    },
+    {
+        id: 'cognito',
+        label: 'Amazon Cognito (ID tokens)',
+        mode: 'jwt',
+        vars: { region: 'AWS region (us-east-1)', user_pool_id: 'User pool id (us-east-1_AbCdEf)', client_id: 'App client id' },
+        jwt: {
+            issuer: 'https://cognito-idp.{region}.amazonaws.com/{user_pool_id}',
+            keysUrl: 'https://cognito-idp.{region}.amazonaws.com/{user_pool_id}/.well-known/jwks.json',
+            // ID tokens carry aud = the app client id (access tokens carry client_id and no aud).
+            audience: ['{client_id}'],
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'origin_jti' },
+            // ID tokens live an hour by default; Amplify refreshed them.
+            expiredGraceSeconds: WEEK,
+        },
+        // @aws-amplify/adapter-nextjs keeps the tokens in cookies named like Amplify's localStorage keys.
+        cookies: ['CognitoIdentityServiceProvider.{client_id}.*.idToken'],
+        clearCookies: ['CognitoIdentityServiceProvider.{client_id}.*'],
+        bearer: true,
+        notes: 'Users are matched on sub (the export keys users by sub). SPA sessions in localStorage are exchanged with readAmplifyBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'azure_ad_b2c',
+        label: 'Azure AD B2C (ID tokens)',
+        mode: 'jwt',
+        vars: {
+            tenant: 'Tenant name (contoso for contoso.b2clogin.com)',
+            tenant_id: 'Directory (tenant) id GUID',
+            policy: 'The user flow / custom policy that issued the tokens (B2C_1_signupsignin)',
+            client_id: 'Application (client) id',
+        },
+        jwt: {
+            issuer: 'https://{tenant}.b2clogin.com/{tenant_id}/v2.0/',
+            keysUrl: 'https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/{policy}/discovery/v2.0/keys',
+            audience: ['{client_id}'],
+            algorithms: ['RS256'],
+            // B2C's sub is the user's object id by default, which the Graph export uses as the user id.
+            claims: { subject: 'sub', name: 'name' },
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Keys are published per policy: run one bridge per user flow that issued tokens. MSAL keeps tokens in browser storage (encrypted from msal-browser v4): exchange v2/v3 caches with readMsalBrowserSession from @atlasauth/js; v4 apps rely on lazy migration.',
+    },
+    {
+        id: 'entra_external_id',
+        label: 'Microsoft Entra External ID (ID tokens)',
+        mode: 'jwt',
+        vars: {
+            tenant: 'Tenant subdomain (contoso for contoso.ciamlogin.com)',
+            tenant_id: 'Directory (tenant) id GUID',
+            client_id: 'Application (client) id',
+        },
+        jwt: {
+            issuer: 'https://{tenant_id}.ciamlogin.com/{tenant_id}/v2.0',
+            keysUrl: 'https://{tenant}.ciamlogin.com/{tenant_id}/discovery/v2.0/keys',
+            audience: ['{client_id}'],
+            algorithms: ['RS256'],
+            // `sub` differs per application; `oid` is the directory object id the Graph export keys users by.
+            claims: { subject: 'oid', email: 'email', name: 'name', sessionKey: 'uti' },
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'MSAL keeps tokens in browser storage (encrypted from msal-browser v4): exchange v2/v3 caches with readMsalBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'appwrite',
+        label: 'Appwrite (session cookie, checked with Appwrite)',
+        mode: 'remote',
+        vars: { endpoint_url: 'API endpoint including /v1 (https://cloud.appwrite.io/v1, or your own)', project_id: 'Project id' },
+        // Appwrite keeps only a hash of each session secret, so sessions cannot be
+        // exported or verified offline: Atlas asks Appwrite who the session is. The
+        // cookie value (base64 of {id, secret}) is what X-Appwrite-Session takes.
+        remote: {
+            url: '{endpoint_url}/account',
+            method: 'GET',
+            headers: { 'x-appwrite-project': '{project_id}', 'x-appwrite-session': '{token}' },
+            subjectPath: '$id',
+            emailPath: 'email',
+            emailVerifiedPath: 'emailVerification',
+            namePath: 'name',
+        },
+        // a_session_<project id, lowercased> and its _legacy twin.
+        cookies: ['a_session_*'],
+        notes: 'The browser must send the Appwrite cookie to your app, so this works when Appwrite is on a subdomain of your app (custom domain) or your app does SSR with the session secret in its own cookie (pass its name as cookieNames). Client-only apps keep the session in localStorage (cookieFallback): exchange it with readAppwriteBrowserSession from @atlasauth/js. Keep the Appwrite project running for the bridge window.',
+    },
+    {
+        id: 'pocketbase',
+        label: 'PocketBase (auth token, checked with PocketBase)',
+        mode: 'remote',
+        vars: { url: 'PocketBase URL (https://pb.example.com)' },
+        defaults: { collection: 'users' },
+        // Tokens are signed with a per-user tokenKey plus a per-collection secret, so
+        // nothing outside PocketBase can verify one: auth-refresh vouches for it.
+        remote: {
+            url: '{url}/api/collections/{collection}/auth-refresh',
+            method: 'POST',
+            headers: { authorization: '{token}' },
+            subjectPath: 'record.id',
+            emailPath: 'record.email',
+            emailVerifiedPath: 'record.verified',
+            namePath: 'record.name',
+        },
+        // pb_auth is the cookie the JS SDK's authStore.exportToCookie() writes (JSON with the token).
+        cookies: ['pb_auth'],
+        tokenFormat: 'pocketbase',
+        notes: 'Client-only apps keep the token in localStorage (pocketbase_auth): exchange it with readPocketBaseBrowserSession from @atlasauth/js. Keep PocketBase running for the bridge window.',
+    },
+    {
+        id: 'nhost',
+        label: 'Nhost (refresh tokens)',
+        mode: 'session_table',
+        // The export stores sha256(refresh token) — exactly what auth.refresh_tokens keeps.
+        cookies: ['nhostRefreshToken'],
+        clearCookies: ['nhostRefreshToken', 'nhostRefreshTokenExpiresAt', 'nhostSession'],
+        notes: 'SPA sessions keep the refresh token in localStorage (nhostRefreshToken): exchange them with readNhostBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'nhost_jwt',
+        label: 'Nhost (access tokens)',
+        mode: 'jwt',
+        vars: { auth_url: 'The Auth URL (https://<subdomain>.auth.<region>.nhost.run/v1)' },
+        // Legacy Hasura Auth signs with iss "hasura-auth"; current versions use the server URL.
+        defaults: { issuer: 'hasura-auth' },
+        jwt: {
+            issuer: '{issuer}',
+            keysUrl: '{auth_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'HS256', 'HS512'],
+            claims: { subject: 'sub', sessionKey: 'jti' },
+            expiredGraceSeconds: WEEK,
+            // Most projects sign with the shared HASURA_GRAPHQL_JWT_SECRET key.
+            allowSharedSecret: true,
+        },
+        cookies: [],
+        bearer: true,
+    },
+];
+//# sourceMappingURL=migration-presets-g3.js.map

package/dist/migration-presets-g3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-presets-g3.js","sourceRoot":"","sources":["../src/migration-presets-g3.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;GAYG;AAEH,6GAA6G;AAC7G,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEd,QAAA,iBAAiB,GAAqC;IACjE;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,yDAAyD;QAChE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE;QAC1D,GAAG,EAAE;YACH,MAAM,EAAE,6CAA6C;YACrD,OAAO,EAAE,2FAA2F;YACpG,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,0EAA0E;YAC1E,qDAAqD;YACrD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;YACzF,6FAA6F;YAC7F,mBAAmB,EAAE,IAAI;SAC1B;QACD,8EAA8E;QAC9E,0DAA0D;QAC1D,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,6OAA6O;KAChP;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,0DAA0D;QACjE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE;QAC1D,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;QACpC,GAAG,EAAE;YACH,MAAM,EAAE,kDAAkD;YAC1D,OAAO,EAAE,uEAAuE;YAChF,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;SAC1F;QACD,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;QACvC,iBAAiB,EAAE,IAAI;QACvB,KAAK,EAAE,kIAAkI;KAC1I;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,wBAAwB;QAC/B,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE;QACzE,GAAG,EAAE;YACH,MAAM,EAAE,2CAA2C;YACnD,OAAO,EAAE,iEAAiE;YAC1E,QAAQ,EAAE,CAAC,eAAe,CAAC;YAC3B,2GAA2G;YAC3G,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE;YACpE,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACxC,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,CAAC,6BAA6B,EAAE,+BAA+B,EAAE,2CAA2C,CAAC;QAC3H,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,qFAAqF;KAC7F;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,4CAA4C;QACnD,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACxC,WAAW,EAAE,kBAAkB;QAC/B,YAAY,EAAE,CAAC,6BAA6B,EAAE,+BAA+B,EAAE,2CAA2C,CAAC;QAC3H,KAAK,EAAE,4KAA4K;KACpL;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EAAE,8CAA8C;QACrD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,+CAA+C,EAAE,WAAW,EAAE,+DAA+D,EAAE;QACjJ,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,QAAQ,EAAE,CAAC,eAAe,CAAC;YAC3B,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE;YACpE,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAClD,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,YAAY,EAAE,iCAAiC,EAAE,SAAS,EAAE,eAAe,EAAE;QACvH,GAAG,EAAE;YACH,MAAM,EAAE,2DAA2D;YACnE,OAAO,EAAE,iFAAiF;YAC1F,sFAAsF;YACtF,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE;YACnH,6DAA6D;YAC7D,mBAAmB,EAAE,IAAI;SAC1B;QACD,kGAAkG;QAClG,OAAO,EAAE,CAAC,sDAAsD,CAAC;QACjE,YAAY,EAAE,CAAC,8CAA8C,CAAC;QAC9D,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,wJAAwJ;KAChK;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,MAAM,EAAE,gDAAgD;YACxD,SAAS,EAAE,4BAA4B;YACvC,MAAM,EAAE,2EAA2E;YACnF,SAAS,EAAE,yBAAyB;SACrC;QACD,GAAG,EAAE;YACH,MAAM,EAAE,iDAAiD;YACzD,OAAO,EAAE,qFAAqF;YAC9F,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,4FAA4F;YAC5F,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;YACxC,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,8PAA8P;KACjQ;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,yCAAyC;QAChD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,MAAM,EAAE,sDAAsD;YAC9D,SAAS,EAAE,4BAA4B;YACvC,SAAS,EAAE,yBAAyB;SACrC;QACD,GAAG,EAAE;YACH,MAAM,EAAE,oDAAoD;YAC5D,OAAO,EAAE,gEAAgE;YACzE,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,kGAAkG;YAClG,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;YAC3E,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,8IAA8I;KACtJ;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,kDAAkD;QACzD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,EAAE,YAAY,EAAE,wEAAwE,EAAE,UAAU,EAAE,YAAY,EAAE;QAC1H,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,EAAE;YACN,GAAG,EAAE,wBAAwB;YAC7B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,oBAAoB,EAAE,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE;YAClF,WAAW,EAAE,KAAK;YAClB,SAAS,EAAE,OAAO;YAClB,iBAAiB,EAAE,mBAAmB;YACtC,QAAQ,EAAE,MAAM;SACjB;QACD,2DAA2D;QAC3D,OAAO,EAAE,CAAC,aAAa,CAAC;QACxB,KAAK,EACH,8ZAA8Z;KACja;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,kDAAkD;QACzD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,EAAE,GAAG,EAAE,yCAAyC,EAAE;QACxD,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;QACjC,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,EAAE;YACN,GAAG,EAAE,iDAAiD;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE;YACrC,WAAW,EAAE,WAAW;YACxB,SAAS,EAAE,cAAc;YACzB,iBAAiB,EAAE,iBAAiB;YACpC,QAAQ,EAAE,aAAa;SACxB;QACD,8FAA8F;QAC9F,OAAO,EAAE,CAAC,SAAS,CAAC;QACpB,WAAW,EAAE,YAAY;QACzB,KAAK,EAAE,qLAAqL;KAC7L;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,wBAAwB;QAC/B,IAAI,EAAE,eAAe;QACrB,oFAAoF;QACpF,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,YAAY,EAAE,CAAC,mBAAmB,EAAE,4BAA4B,EAAE,cAAc,CAAC;QACjF,KAAK,EAAE,yIAAyI;KACjJ;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,+DAA+D,EAAE;QACnF,wFAAwF;QACxF,QAAQ,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;QACnC,GAAG,EAAE;YACH,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,mBAAmB,EAAE,IAAI;YACzB,oEAAoE;YACpE,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;CACF,CAAC"}

package/dist/migration-presets-g4/authentik.d.ts

@@ -0,0 +1,14 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * authentik. An application's OAuth2/OpenID provider signs its ID and access
+ * tokens with the signing key chosen on the provider (RS256 / ES256). The
+ * issuer is per provider and ends in a slash — `iss` is compared as a string,
+ * so the template restores the slash the variable resolver trims:
+ *   https://auth.example.com/application/o/<application slug>/
+ * with the keys at `<issuer>jwks/`.
+ *
+ * `sub` depends on the provider's "Subject mode" (hashed user id by default);
+ * the export keys users by the same mode, so the two agree. `sid` is authentik's
+ * session id (a hash), shared by every token of one sign-in.
+ */
+export declare const AUTHENTIK_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/authentik.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTHENTIK_BRIDGE_PRESETS = void 0;
+/**
+ * authentik. An application's OAuth2/OpenID provider signs its ID and access
+ * tokens with the signing key chosen on the provider (RS256 / ES256). The
+ * issuer is per provider and ends in a slash — `iss` is compared as a string,
+ * so the template restores the slash the variable resolver trims:
+ *   https://auth.example.com/application/o/<application slug>/
+ * with the keys at `<issuer>jwks/`.
+ *
+ * `sub` depends on the provider's "Subject mode" (hashed user id by default);
+ * the export keys users by the same mode, so the two agree. `sid` is authentik's
+ * session id (a hash), shared by every token of one sign-in.
+ */
+exports.AUTHENTIK_BRIDGE_PRESETS = [
+    {
+        id: 'authentik',
+        label: 'authentik (OAuth2 / OpenID provider tokens)',
+        mode: 'jwt',
+        vars: { issuer: "The provider's issuer URL without the trailing slash (https://auth.example.com/application/o/<application slug>)", client_id: "The provider's client id (the tokens' aud)" },
+        jwt: {
+            issuer: '{issuer}/',
+            keysUrl: '{issuer}/jwks/',
+            audience: ['{client_id}'],
+            // A provider without a signing key signs HS256 with its client secret: no public keys exist for it.
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256', 'ES384'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid', mfa: 'amr:mfa' },
+        },
+        // authentik is the identity provider, not the app: the app's own OIDC client library keeps the token
+        // (next-auth, passport-openidconnect, oauth2-proxy). Pass it as a bearer token or from your own extractor.
+        cookies: [],
+        bearer: true,
+        notes: 'Set the provider\'s Subject mode to the one the export used (hashed user id by default; the export records it). The provider needs a signing key: tokens signed with the client secret (HS256) cannot be verified from public keys. With the "global" issuer mode, point the preset at the per-provider URL anyway: the keys are served there.',
+    },
+];
+//# sourceMappingURL=authentik.js.map

package/dist/migration-presets-g4/authentik.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentik.js","sourceRoot":"","sources":["../../src/migration-presets-g4/authentik.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;GAWG;AACU,QAAA,wBAAwB,GAAqC;IACxE;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,6CAA6C;QACpD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,kHAAkH,EAAE,SAAS,EAAE,4CAA4C,EAAE;QAC7L,GAAG,EAAE;YACH,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,oGAAoG;YACpG,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE;SAC7H;QACD,qGAAqG;QACrG,2GAA2G;QAC3G,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,gVAAgV;KACnV;CACF,CAAC"}

package/dist/migration-presets-g4/fusionauth.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+export declare const FUSIONAUTH_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/fusionauth.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FUSIONAUTH_BRIDGE_PRESETS = void 0;
+/**
+ * FusionAuth. The access token (`app.at` cookie, or the Bearer token an API
+ * client holds) is a JWT whose `iss` is the TENANT's issuer string: `acme.com`
+ * by default (what `issuer_name` takes), or an https URL when the tenant was
+ * set up that way (the `fusionauth_url_issuer` preset takes the base URL).
+ * Keys come from `/.well-known/jwks.json` and publish only asymmetric keys:
+ * a tenant still on the default HS256 signing key has to switch the
+ * application's access-token key to an RSA or EC key before the bridge can
+ * verify its tokens. `sub` is the FusionAuth user id the export keys users by,
+ * `sid` the SSO session, `amr` lists `mfa` after a second factor.
+ */
+const WEEK = 7 * 24 * 3600;
+const CLAIMS = { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid', mfa: 'amr:mfa' };
+exports.FUSIONAUTH_BRIDGE_PRESETS = [
+    {
+        id: 'fusionauth',
+        label: 'FusionAuth (access token, tenant issuer such as acme.com)',
+        mode: 'jwt',
+        vars: { base_url: 'FusionAuth URL (https://auth.example.com)', issuer_name: 'The tenant issuer (Tenants → General → Issuer, `acme.com` by default)' },
+        jwt: {
+            issuer: '{issuer_name}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'],
+            claims: CLAIMS,
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: ['app.at'],
+        clearCookies: ['app.at', 'app.rt', 'app.idt', 'app.match_hint', 'app.locale', 'app.ssoToken'],
+        bearer: true,
+        notes: 'The application must sign access tokens with an RSA or EC key (a default HS256 key has no public JWKS entry).',
+    },
+    {
+        id: 'fusionauth_url_issuer',
+        label: 'FusionAuth (access token, tenant issuer is the https URL)',
+        mode: 'jwt',
+        vars: { base_url: 'FusionAuth URL, also the tenant issuer (https://auth.example.com)' },
+        jwt: {
+            issuer: '{base_url}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'],
+            claims: CLAIMS,
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: ['app.at'],
+        clearCookies: ['app.at', 'app.rt', 'app.idt', 'app.match_hint', 'app.locale', 'app.ssoToken'],
+        bearer: true,
+    },
+];
+//# sourceMappingURL=fusionauth.js.map

package/dist/migration-presets-g4/fusionauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fusionauth.js","sourceRoot":"","sources":["../../src/migration-presets-g4/fusionauth.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;GAUG;AACH,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3B,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAEvH,QAAA,yBAAyB,GAAqC;IACzE;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,2DAA2D;QAClE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,2CAA2C,EAAE,WAAW,EAAE,uEAAuE,EAAE;QACrJ,GAAG,EAAE;YACH,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,MAAM,EAAE,MAAM;YACd,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,CAAC;QAC7F,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,+GAA+G;KACvH;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE,2DAA2D;QAClE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,mEAAmE,EAAE;QACvF,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,MAAM,EAAE,MAAM;YACd,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,CAAC;QAC7F,MAAM,EAAE,IAAI;KACb;CACF,CAAC"}

package/dist/migration-presets-g4/hanko.d.ts

@@ -0,0 +1,12 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * Hanko. The backend signs a session JWT (RS256, a rotating key set at
+ * `/.well-known/jwks.json` on the public API) and writes it to the `hanko`
+ * cookie (`cookie.name`); the frontend SDK and hanko-elements read the same
+ * token. Claims: `sub` (the user's id — what the export keys users by),
+ * `session_id`, `exp`, `iat`, `aud`, `iss` (when `session.issuer` is set) and
+ * `email` / `username`. `email` is an object (`address`, `is_primary`,
+ * `is_verified`), so it is not mapped to a claim; the imported user already
+ * holds the addresses.
+ */
+export declare const HANKO_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/hanko.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HANKO_BRIDGE_PRESETS = void 0;
+/**
+ * Hanko. The backend signs a session JWT (RS256, a rotating key set at
+ * `/.well-known/jwks.json` on the public API) and writes it to the `hanko`
+ * cookie (`cookie.name`); the frontend SDK and hanko-elements read the same
+ * token. Claims: `sub` (the user's id — what the export keys users by),
+ * `session_id`, `exp`, `iat`, `aud`, `iss` (when `session.issuer` is set) and
+ * `email` / `username`. `email` is an object (`address`, `is_primary`,
+ * `is_verified`), so it is not mapped to a claim; the imported user already
+ * holds the addresses.
+ */
+exports.HANKO_BRIDGE_PRESETS = [
+    {
+        id: 'hanko',
+        label: 'Hanko (session JWT, issuer = the API URL)',
+        mode: 'jwt',
+        vars: { base_url: 'The Hanko API URL (https://<project id>.hanko.io, or your own https://hanko.example.com)' },
+        jwt: {
+            issuer: '{base_url}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256'],
+            claims: { subject: 'sub', sessionKey: 'session_id' },
+        },
+        cookies: ['hanko'],
+        bearer: true,
+        sharesAtlasCookie: false,
+        notes: 'Hanko Cloud sets iss to the project URL. Self-hosted: use hanko_jwt when session.issuer is something else. The cookie is named by cookie.name in Hanko\'s config (default hanko).',
+    },
+    {
+        id: 'hanko_jwt',
+        label: 'Hanko (session JWT, custom issuer)',
+        mode: 'jwt',
+        vars: { base_url: 'The Hanko API URL (keys are read from /.well-known/jwks.json)', issuer: "The session.issuer you configured (the token's iss)" },
+        jwt: {
+            issuer: '{issuer}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256'],
+            claims: { subject: 'sub', sessionKey: 'session_id' },
+        },
+        cookies: ['hanko'],
+        bearer: true,
+    },
+];
+//# sourceMappingURL=hanko.js.map

package/dist/migration-presets-g4/hanko.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hanko.js","sourceRoot":"","sources":["../../src/migration-presets-g4/hanko.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAAqC;IACpE;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,2CAA2C;QAClD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,0FAA0F,EAAE;QAC9G,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACzD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE;SACrD;QACD,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,MAAM,EAAE,IAAI;QACZ,iBAAiB,EAAE,KAAK;QACxB,KAAK,EACH,mLAAmL;KACtL;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,oCAAoC;QAC3C,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,+DAA+D,EAAE,MAAM,EAAE,qDAAqD,EAAE;QAClJ,GAAG,EAAE;YACH,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACzD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE;SACrD;QACD,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,MAAM,EAAE,IAAI;KACb;CACF,CAAC"}

package/dist/migration-presets-g4/keycloak.d.ts

@@ -0,0 +1,16 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * Keycloak. Its browser adapter (keycloak-js) keeps the access / ID / refresh
+ * tokens in memory, and server adapters (keycloak-connect, NextAuth's Keycloak
+ * provider) keep them server-side or inside an encrypted cookie, so the token
+ * an integrator can hand the bridge is the access or ID token itself (Bearer
+ * header or the `exchangeMigrationBrowserSession` browser helper). The
+ * `KEYCLOAK_IDENTITY` cookie is signed with the realm's own HMAC secret and is
+ * never accepted.
+ *
+ * Access tokens live five minutes by default and nobody refreshes them after
+ * the switch, so a validly signed token is accepted (once) for a week past `exp`.
+ * Keycloak 16 and older serve under `/auth`: pass `base_url` as
+ * `https://sso.example.com/auth`.
+ */
+export declare const KEYCLOAK_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/keycloak.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEYCLOAK_BRIDGE_PRESETS = void 0;
+/**
+ * Keycloak. Its browser adapter (keycloak-js) keeps the access / ID / refresh
+ * tokens in memory, and server adapters (keycloak-connect, NextAuth's Keycloak
+ * provider) keep them server-side or inside an encrypted cookie, so the token
+ * an integrator can hand the bridge is the access or ID token itself (Bearer
+ * header or the `exchangeMigrationBrowserSession` browser helper). The
+ * `KEYCLOAK_IDENTITY` cookie is signed with the realm's own HMAC secret and is
+ * never accepted.
+ *
+ * Access tokens live five minutes by default and nobody refreshes them after
+ * the switch, so a validly signed token is accepted (once) for a week past `exp`.
+ * Keycloak 16 and older serve under `/auth`: pass `base_url` as
+ * `https://sso.example.com/auth`.
+ */
+exports.KEYCLOAK_BRIDGE_PRESETS = [
+    {
+        id: 'keycloak',
+        label: 'Keycloak (access or ID token)',
+        mode: 'jwt',
+        vars: { base_url: 'Keycloak base URL (https://sso.example.com; add /auth for Keycloak 16 and older)', realm: 'Realm name' },
+        jwt: {
+            issuer: '{base_url}/realms/{realm}',
+            keysUrl: '{base_url}/realms/{realm}/protocol/openid-connect/certs',
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256', 'ES384'],
+            // sub = the Keycloak user id (what the realm export keys users by); sid = the SSO session id.
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid', mfa: 'acr:2' },
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Use the access token or the ID token (both carry sub, email, sid). Realm keys must publish a signing algorithm from the list (the default RS256 does; HS512 keys are never accepted). A step-up login raises the acr claim to 2 when you map levels of authentication to "2"; otherwise an MFA sign-in is not marked.',
+    },
+];
+//# sourceMappingURL=keycloak.js.map

package/dist/migration-presets-g4/keycloak.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak.js","sourceRoot":"","sources":["../../src/migration-presets-g4/keycloak.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;GAaG;AACU,QAAA,uBAAuB,GAAqC;IACvE;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,+BAA+B;QACtC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,kFAAkF,EAAE,KAAK,EAAE,YAAY,EAAE;QAC3H,GAAG,EAAE;YACH,MAAM,EAAE,2BAA2B;YACnC,OAAO,EAAE,yDAAyD;YAClE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,8FAA8F;YAC9F,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;YAC1H,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,uTAAuT;KAC1T;CACF,CAAC"}

package/dist/migration-presets-g4/logto.d.ts

@@ -0,0 +1,12 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * Logto. The tenant's OIDC issuer is `{endpoint}/oidc` (`https://auth.example.com/oidc`,
+ * `https://abc123.logto.app/oidc` on Logto Cloud); its signing keys are at
+ * `/oidc/jwks` and default to ES384. The token to exchange is the application's
+ * ID token (`aud` = the Logto application id) — what `@logto/*` SDKs keep in
+ * the app's own session. The SDKs store that session encrypted with the app's
+ * cookie secret (or in the server's session store), so no cookie is named here:
+ * hand the middleware a token extractor that opens the session locally, or send
+ * the ID token as a bearer token from the client.
+ */
+export declare const LOGTO_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/logto.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOGTO_BRIDGE_PRESETS = void 0;
+/**
+ * Logto. The tenant's OIDC issuer is `{endpoint}/oidc` (`https://auth.example.com/oidc`,
+ * `https://abc123.logto.app/oidc` on Logto Cloud); its signing keys are at
+ * `/oidc/jwks` and default to ES384. The token to exchange is the application's
+ * ID token (`aud` = the Logto application id) — what `@logto/*` SDKs keep in
+ * the app's own session. The SDKs store that session encrypted with the app's
+ * cookie secret (or in the server's session store), so no cookie is named here:
+ * hand the middleware a token extractor that opens the session locally, or send
+ * the ID token as a bearer token from the client.
+ */
+exports.LOGTO_BRIDGE_PRESETS = [
+    {
+        id: 'logto',
+        label: 'Logto',
+        mode: 'jwt',
+        vars: {
+            base_url: 'Your Logto endpoint (https://auth.example.com or https://abc123.logto.app)',
+            client_id: 'The id of your Logto application (the audience of its ID tokens)',
+        },
+        jwt: {
+            issuer: '{base_url}/oidc',
+            keysUrl: '{base_url}/oidc/jwks',
+            audience: ['{client_id}'],
+            algorithms: ['ES384', 'ES256', 'RS256', 'PS256', 'EdDSA'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid' },
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Exchange the ID token. Logto SDK sessions are encrypted with your cookie secret (or kept in your session store): pass the middleware a token extractor that reads the idToken from the session locally. API access tokens carry the API resource as their audience and are not accepted here.',
+    },
+];
+//# sourceMappingURL=logto.js.map

package/dist/migration-presets-g4/logto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logto.js","sourceRoot":"","sources":["../../src/migration-presets-g4/logto.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAAqC;IACpE;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,QAAQ,EAAE,4EAA4E;YACtF,SAAS,EAAE,kEAAkE;SAC9E;QACD,GAAG,EAAE;YACH,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,sBAAsB;YAC/B,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACzD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;SAC7G;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,+RAA+R;KAClS;CACF,CAAC"}

package/dist/migration-presets-g4/ory.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+export declare const ORY_BRIDGE_PRESETS: readonly MigrationBridgePreset[];