@atlasauth/cli 0.10.0 → 0.12.0

package/dist/migrate/export/kinde-descope-config.d.ts

@@ -0,0 +1,38 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { type VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate kinde config` — what Kinde's Management API exposes:
+ * applications (callback and logout URLs), connections (social and
+ * enterprise), roles and permissions, and registered APIs. Kinde does not
+ * expose its authentication settings (password, MFA, session lifetimes) by
+ * API: the report lists them as manual, with where to find them.
+ */
+export interface KindeConfigSnapshot {
+    domain: string;
+    applications: Array<Obj & {
+        redirects?: string[];
+    }>;
+    connections: Obj[];
+    roles: Array<Obj & {
+        permissions?: Obj[];
+    }>;
+    permissions: Obj[];
+    apis: Obj[];
+}
+export declare function fetchKindeConfig(http: VendorHttp, domain: string): Promise<KindeConfigSnapshot>;
+export declare function translateKindeConfig(snap: KindeConfigSnapshot): TranslationResult;
+/**
+ * `atlas migrate descope config` — a Descope project's password settings,
+ * roles and permissions (management key, on this machine). Flows, connectors
+ * and styles are Descope-specific: reported as manual. Tenant SSO moves with
+ * the data export.
+ */
+export interface DescopeConfigSnapshot {
+    projectId: string;
+    passwordSettings: Obj | null;
+    roles: Obj[];
+    permissions: Obj[];
+}
+export declare function fetchDescopeConfig(http: VendorHttp, projectId: string): Promise<DescopeConfigSnapshot>;
+export declare function translateDescopeConfig(snap: DescopeConfigSnapshot): TranslationResult;

package/dist/migrate/export/kinde-descope-config.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchKindeConfig = fetchKindeConfig;
+exports.translateKindeConfig = translateKindeConfig;
+exports.fetchDescopeConfig = fetchDescopeConfig;
+exports.translateDescopeConfig = translateDescopeConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function optional(fn, fallback) {
+    try {
+        return await fn();
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
+            return fallback;
+        throw err;
+    }
+}
+async function fetchKindeConfig(http, domain) {
+    const list = (path, key) => optional(async () => (0, record_set_1.objs)((await http.get(path)).body?.[key]), []);
+    const applications = (await list('/applications?page_size=500', 'applications'));
+    for (const a of applications) {
+        const raw = await optional(async () => (await http.get(`/applications/${(0, record_set_1.str)(a.id)}/auth_redirect_urls`)).body?.redirect_urls, undefined);
+        const urls = Array.isArray(raw) ? raw : [];
+        a.redirects = urls.map((u) => (typeof u === 'string' ? u : (0, record_set_1.isObj)(u) ? ((0, record_set_1.str)(u.redirect_url) ?? (0, record_set_1.str)(u.url)) : undefined)).filter((u) => !!u);
+    }
+    const roles = (await list('/roles?page_size=500', 'roles'));
+    for (const r of roles)
+        r.permissions = await list(`/roles/${(0, record_set_1.str)(r.id)}/permissions?page_size=500`, 'permissions');
+    return {
+        domain,
+        applications,
+        connections: await list('/connections?page_size=500', 'connections'),
+        roles,
+        permissions: await list('/permissions?page_size=500', 'permissions'),
+        apis: await list('/apis', 'apis'),
+    };
+}
+function translateKindeConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    for (const c of snap.connections) {
+        const strategy = (0, record_set_1.str)(c.strategy) ?? '';
+        const name = (0, record_set_1.str)(c.display_name) ?? (0, record_set_1.str)(c.name) ?? strategy;
+        if (strategy === 'email:password' || strategy === 'username:password') {
+            b.set('strategies.password', true);
+            if (strategy === 'username:password')
+                b.set('strategies.username', true);
+            b.add('mapped', 'authentication', `connection ${name}`, 'Password sign-in; hashes move with Kinde\'s "All data" export.', 'auth_config.strategies.password');
+        }
+        else if (strategy === 'email:otp' || strategy === 'username:otp') {
+            b.set('strategies.emailCode', true);
+            b.add('mapped', 'authentication', `connection ${name}`, 'Passwordless email code.', 'auth_config.strategies.emailCode');
+        }
+        else if (strategy === 'phone:otp') {
+            b.set('strategies.phoneCode', true);
+            b.add('mapped', 'authentication', `connection ${name}`, 'SMS code.', 'auth_config.strategies.phoneCode');
+        }
+        else if (/^(saml|wsfed|oauth2:(azure_ad|microsoft_entra))/.test(strategy)) {
+            b.add('mapped', 'enterprise', `connection ${name} (${strategy})`, 'Moves with the data export as an Atlas SSO connection (add the client secret / confirm the certificate after the import).', 'sso_connections');
+        }
+        else if (strategy.startsWith('oauth2:')) {
+            const key = (0, translate_kit_1.socialKey)(strategy);
+            if (key)
+                b.socialProvider({ atlasKey: key, vendorName: name, area: 'authentication', setting: `connection ${name} (${strategy})` });
+            else
+                b.add('manual', 'authentication', `connection ${name} (${strategy})`, 'No built-in Atlas provider: add it as a custom OAuth provider.', 'custom_oauth_providers');
+        }
+        else if (strategy) {
+            b.add('manual', 'authentication', `connection ${name} (${strategy})`, 'Review this connection by hand.');
+        }
+    }
+    const redirects = new Set();
+    for (const a of snap.applications)
+        for (const u of a.redirects ?? [])
+            redirects.add(u);
+    for (const url of redirects)
+        b.push('redirect_urls', { url });
+    if (redirects.size)
+        b.add('mapped', 'applications', 'allowed callback URLs', `${redirects.size} callback URL(s).`, 'redirect_urls');
+    for (const a of snap.applications)
+        if ((0, record_set_1.str)(a.type) === 'm2m')
+            b.add('manual', `applications ${(0, record_set_1.str)(a.name) ?? (0, record_set_1.str)(a.id)}`, 'type m2m', 'Machine-to-machine application: create an Atlas M2M client.', 'oauth_clients');
+    for (const p of snap.permissions) {
+        const key = (0, record_set_1.str)(p.key);
+        if (key)
+            b.push('permissions', { key, name: (0, record_set_1.str)(p.name) ?? key, description: (0, record_set_1.str)(p.description) ?? '' });
+    }
+    for (const r of snap.roles) {
+        const key = (0, record_set_1.str)(r.key);
+        if (!key)
+            continue;
+        const atlasKey = `org:${(0, translate_kit_1.keyOf)(key.replace(/^org:/, ''))}`;
+        b.roles[key] = atlasKey;
+        b.push('roles', { key: atlasKey, name: (0, record_set_1.str)(r.name) ?? key, description: (0, record_set_1.str)(r.description) ?? '', permissions: (r.permissions ?? []).map((p) => (0, record_set_1.str)(p.key)).filter((p) => !!p) });
+    }
+    if (snap.roles.length)
+        b.add('mapped', 'roles', 'roles', `${snap.roles.length} organization role(s) with permissions (Kinde roles apply inside organizations).`, 'roles');
+    for (const api of snap.apis) {
+        const audience = (0, record_set_1.str)(api.audience);
+        if (audience && !audience.endsWith('/api')) {
+            b.push('resource_servers', { identifier: audience, name: (0, record_set_1.str)(api.name) ?? audience, scopes: [] });
+            b.add('mapped', 'APIs', `apis ${(0, record_set_1.str)(api.name) ?? audience}`, `Access tokens keep "aud": "${audience}".`, `resource_servers ${audience}`);
+        }
+    }
+    for (const [setting, where] of [
+        ['multi-factor authentication', 'Settings → Environment → Multi-factor auth'],
+        ['password rules and breached-password checks', 'Settings → Environment → Authentication'],
+        ['session and token lifetimes', 'Applications → <app> → Tokens'],
+        ['feature flags', 'Feature flags (no Atlas counterpart: keep them in your own flag service)'],
+    ]) {
+        b.add('manual', 'settings not in the API', setting, `Kinde does not expose this by API; copy it from Kinde (${where}).`);
+    }
+    return b.result(`Kinde business ${snap.domain}`, { bridge: { preset: 'kinde', vars: { domain: snap.domain } } });
+}
+async function fetchDescopeConfig(http, projectId) {
+    return {
+        projectId,
+        passwordSettings: await optional(async () => (await http.get('/v1/mgmt/password/settings')).body ?? null, null),
+        roles: await optional(async () => (0, record_set_1.objs)((await http.get('/v1/mgmt/role/all')).body?.roles), []),
+        permissions: await optional(async () => (0, record_set_1.objs)((await http.get('/v1/mgmt/permission/all')).body?.permissions), []),
+    };
+}
+function translateDescopeConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const pw = snap.passwordSettings;
+    if (pw && (0, record_set_1.isObj)(pw)) {
+        b.set('strategies.password', pw.enabled !== false);
+        b.add('mapped', 'password', 'enabled', pw.enabled === false ? 'Password sign-in off.' : 'Password sign-in. Descope keeps hashes (Argon2id) unless its support exports them: the descope lazy-migration preset moves each password on first sign-in.', 'auth_config.strategies.password');
+        if (typeof pw.minLength === 'number') {
+            b.set('passwordPolicy.minLength', Math.max(8, pw.minLength));
+            b.add(pw.minLength < 8 ? 'differs' : 'mapped', 'password', 'minLength', `${pw.minLength}${pw.minLength < 8 ? ' (Atlas requires at least 8)' : ''}.`, 'auth_config.passwordPolicy.minLength');
+        }
+        if (['lowercase', 'uppercase', 'number', 'nonAlphanumeric'].some((k) => pw[k] === true))
+            b.add('differs', 'password', 'character classes', 'Atlas follows NIST 800-63B (length and breached-password checks, no character-class rules).', 'auth_config.passwordPolicy');
+        if (pw.expiration === true)
+            b.add('manual', 'password', 'expiration', 'Atlas does not expire passwords.');
+        if (pw.reuse === true)
+            b.add('manual', 'password', 'reuse', 'Atlas does not keep a password history.');
+        if (pw.lock === true)
+            b.add('mapped', 'password', 'lock', `Descope locks after ${pw.lockAttempts ?? '?'} attempts; Atlas throttles failed sign-ins per account and IP.`, 'auth_config.rateLimit');
+    }
+    for (const p of snap.permissions) {
+        const name = (0, record_set_1.str)(p.name);
+        if (name)
+            b.push('permissions', { key: (0, translate_kit_1.keyOf)(name), name, description: (0, record_set_1.str)(p.description) ?? '' });
+    }
+    const seen = new Set();
+    for (const r of snap.roles) {
+        const name = (0, record_set_1.str)(r.name);
+        if (!name || (0, record_set_1.str)(r.tenantId))
+            continue;
+        const key = (0, translate_kit_1.keyOf)(name);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        b.roles[name] = key;
+        b.push('roles', { key, name, description: (0, record_set_1.str)(r.description) ?? '', permissions: (0, record_set_1.strs)(r.permissionNames).map(translate_kit_1.keyOf) });
+    }
+    if (seen.size)
+        b.add('mapped', 'authorization', 'roles', `${seen.size} role(s) (project roles become app roles; the same keys seat tenant members).`, 'roles');
+    const tenantRoles = snap.roles.filter((r) => (0, record_set_1.str)(r.tenantId)).length;
+    if (tenantRoles)
+        b.add('differs', 'authorization', 'tenant-scoped roles', `${tenantRoles} role(s) defined inside one tenant: they move with the data export as that organization's custom roles.`, 'roles');
+    b.add('manual', 'flows', 'flows and screens', 'Descope flows (sign-up-or-in, step-up, MFA screens) are replaced by Atlas\'s hosted pages and components; recreate custom steps (forms, connectors) as Atlas actions.', 'actions');
+    b.add('manual', 'authentication methods', 'magic link / OTP / social / passkeys', 'Descope does not expose its enabled authentication methods by API: turn the same ones on in Atlas (strategies, oauth_providers).', 'auth_config.strategies');
+    return b.result(`Descope project ${snap.projectId}`, {
+        bridge: { preset: 'descope', vars: { project_id: snap.projectId } },
+        lazy: { preset: 'descope', config: { project_id: snap.projectId } },
+    });
+}
+//# sourceMappingURL=kinde-descope-config.js.map

package/dist/migrate/export/kinde-descope-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kinde-descope-config.js","sourceRoot":"","sources":["../../../src/migrate/export/kinde-descope-config.ts"],"names":[],"mappings":";;AAiCA,4CAkBC;AAED,oDA0DC;AAiBD,gDAOC;AAED,wDAsCC;AA7KD,6CAAgE;AAChE,mDAAkE;AAClE,+CAAgE;AAEhE,KAAK,UAAU,QAAQ,CAAI,EAAoB,EAAE,QAAW;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC3F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAoBM,KAAK,UAAU,gBAAgB,CAAC,IAAgB,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAW,CAAC,CAAC;IAC7H,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,6BAA6B,EAAE,cAAc,CAAC,CAAwC,CAAC;IACxH,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,iBAAiB,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,SAAoB,CAAC,CAAC;QACzJ,MAAM,IAAI,GAAc,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1J,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAiC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IAClH,OAAO;QACL,MAAM;QACN,YAAY;QACZ,WAAW,EAAE,MAAM,IAAI,CAAC,4BAA4B,EAAE,aAAa,CAAC;QACpE,KAAK;QACL,WAAW,EAAE,MAAM,IAAI,CAAC,4BAA4B,EAAE,aAAa,CAAC;QACpE,IAAI,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,IAAyB;IAC5D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC5D,IAAI,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YACtE,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,QAAQ,KAAK,mBAAmB;gBAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACzE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,cAAc,IAAI,EAAE,EAAE,gEAAgE,EAAE,iCAAiC,CAAC,CAAC;QAC/J,CAAC;aAAM,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACnE,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,cAAc,IAAI,EAAE,EAAE,0BAA0B,EAAE,kCAAkC,CAAC,CAAC;QAC1H,CAAC;aAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,cAAc,IAAI,EAAE,EAAE,WAAW,EAAE,kCAAkC,CAAC,CAAC;QAC3G,CAAC;aAAM,IAAI,iDAAiD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5E,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,IAAI,KAAK,QAAQ,GAAG,EAAE,2HAA2H,EAAE,iBAAiB,CAAC,CAAC;QACpN,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,QAAQ,CAAC,CAAC;YAChC,IAAI,GAAG;gBAAE,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,IAAI,KAAK,QAAQ,GAAG,EAAE,CAAC,CAAC;;gBAC/H,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,cAAc,IAAI,KAAK,QAAQ,GAAG,EAAE,gEAAgE,EAAE,wBAAwB,CAAC,CAAC;QACzK,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,cAAc,IAAI,KAAK,QAAQ,GAAG,EAAE,iCAAiC,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvF,KAAK,MAAM,GAAG,IAAI,SAAS;QAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,IAAI,SAAS,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,uBAAuB,EAAE,GAAG,SAAS,CAAC,IAAI,mBAAmB,EAAE,eAAe,CAAC,CAAC;IACpI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,6DAA6D,EAAE,eAAe,CAAC,CAAC;IACtN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG;YAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAU,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,QAAQ,GAAG,OAAO,IAAA,qBAAK,EAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAU,CAAC,CAAC;IACzM,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,kFAAkF,EAAE,OAAO,CAAC,CAAC;IAC1K,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAU,CAAC,CAAC;YAC1G,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,EAAE,8BAA8B,QAAQ,IAAI,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAC;QAC3I,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,6BAA6B,EAAE,4CAA4C,CAAC;QAC7E,CAAC,6CAA6C,EAAE,yCAAyC,CAAC;QAC1F,CAAC,6BAA6B,EAAE,+BAA+B,CAAC;QAChE,CAAC,eAAe,EAAE,0EAA0E,CAAC;KACrF,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,OAAO,EAAE,0DAA0D,KAAK,IAAI,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AACnH,CAAC;AAiBM,KAAK,UAAU,kBAAkB,CAAC,IAAgB,EAAE,SAAiB;IAC1E,OAAO;QACL,SAAS;QACT,gBAAgB,EAAE,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,4BAA4B,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,IAAkB,CAAC;QAClI,KAAK,EAAE,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAW,CAAC;QAC5G,WAAW,EAAE,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,yBAAyB,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAW,CAAC;KAC/H,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,IAA2B;IAChE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC;IACjC,IAAI,EAAE,IAAI,IAAA,kBAAK,EAAC,EAAE,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;QACnD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,4JAA4J,EAAE,iCAAiC,CAAC,CAAC;QACzR,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACrC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS,GAAG,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;QAC/L,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,6FAA6F,EAAE,4BAA4B,CAAC,CAAC;QACxQ,IAAI,EAAE,CAAC,UAAU,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,kCAAkC,CAAC,CAAC;QAC1G,IAAI,EAAE,CAAC,KAAK,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,yCAAyC,CAAC,CAAC;QACvG,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,YAAY,IAAI,GAAG,gEAAgE,EAAE,uBAAuB,CAAC,CAAC;IACpM,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI;YAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAA,qBAAK,EAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAU,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,SAAS;QACvC,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,qBAAK,CAAC,EAAU,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,IAAI,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,+EAA+E,EAAE,OAAO,CAAC,CAAC;IAC/J,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACrE,IAAI,WAAW;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,qBAAqB,EAAE,GAAG,WAAW,yGAAyG,EAAE,OAAO,CAAC,CAAC;IAC5M,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,uKAAuK,EAAE,SAAS,CAAC,CAAC;IAClO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,wBAAwB,EAAE,sCAAsC,EAAE,kIAAkI,EAAE,wBAAwB,CAAC,CAAC;IAChP,OAAO,CAAC,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,SAAS,EAAE,EAAE;QACnD,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;QACnE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;KACpE,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/kinde.d.ts

@@ -0,0 +1,57 @@
+import type { PasswordHash, UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export kinde` — Kinde onto the canonical bundle models.
+ *
+ * Two sources, merged by Kinde user id (`kp_…`):
+ *   - Kinde's DATA EXPORT (Settings → Business → Details → Export data). Choose
+ *     "All data" to include password hashes (owners approve it; the file is
+ *     available once). It downloads as an AES-256-CTR encrypted `.dat` with a
+ *     Key and IV shown at download; this command decrypts it locally, or takes
+ *     the already decrypted zip / `users.ndjson`. Each user carries
+ *     `password: { hashed_password, hashing_algorithm, hashing_config }`;
+ *   - the Management API (a machine-to-machine application's client id +
+ *     secret, on this machine): organizations with their members and roles,
+ *     roles with permissions, and enterprise connections.
+ *
+ * Kinde has no password-verifying API (no password grant), so there is no
+ * lazy migration from Kinde: the data export is the way passwords move.
+ * Kinde does not export second-factor secrets; users re-enrol. Sessions are
+ * Kinde-issued JWTs, bridged by the `kinde` bridge preset.
+ */
+export interface KindeExportOptions {
+    /** `https://acme.kinde.com` (KINDE_ISSUER_URL / KINDE_DOMAIN). */
+    domain?: string;
+    clientId?: string;
+    clientSecret?: string;
+    /** The encrypted `.dat` export, with the Key and IV Kinde showed at download (hex). */
+    encryptedExport?: {
+        data: Buffer;
+        key: string;
+        iv: string;
+    };
+    /** The decrypted export zip. */
+    zip?: Buffer;
+    /** `users.ndjson` text, when extracted already. */
+    usersNdjson?: string;
+    organizationsNdjson?: string;
+    /** Include Kinde's default organization (every user is a member of it). */
+    includeDefaultOrganization?: boolean;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** AES-256-CTR, the scheme of Kinde's `.dat` export (`openssl aes-256-ctr -d -nosalt -K <key> -iv <iv>`). */
+export declare function decryptKindeExport(data: Buffer, keyHex: string, ivHex: string): Buffer;
+export declare function exportKinde(opts: KindeExportOptions): Promise<RecordSet>;
+/** One Kinde user (export row and/or API row) → a user record. */
+export declare function mapKindeUser(u: Obj, set?: RecordSet): UserRecord | null;
+/**
+ * Kinde's exported `password` object → the bundle's password hash. Kinde
+ * stores bcrypt; users imported into Kinde keep the algorithm they came with
+ * (crypt, md5, sha256, wordpress, pbkdf2, firebase-scrypt, aspnet-identity-v2).
+ */
+export declare function kindePasswordHash(p: Obj): PasswordHash | {
+    reason: string;
+};
+export declare function m2mToken(base: string, opts: KindeExportOptions): Promise<string>;

package/dist/migrate/export/kinde.js

@@ -0,0 +1,333 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decryptKindeExport = decryptKindeExport;
+exports.exportKinde = exportKinde;
+exports.mapKindeUser = mapKindeUser;
+exports.kindePasswordHash = kindePasswordHash;
+exports.m2mToken = m2mToken;
+const node_crypto_1 = require("node:crypto");
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+const zip_1 = require("./zip");
+/** AES-256-CTR, the scheme of Kinde's `.dat` export (`openssl aes-256-ctr -d -nosalt -K <key> -iv <iv>`). */
+function decryptKindeExport(data, keyHex, ivHex) {
+    const key = Buffer.from(keyHex.trim(), 'hex');
+    const iv = Buffer.from(ivHex.trim(), 'hex');
+    if (key.length !== 32)
+        throw new Error('The Kinde export Key must be 64 hex characters (AES-256).');
+    if (iv.length !== 16)
+        throw new Error('The Kinde export Initialization Vector must be 32 hex characters.');
+    const d = (0, node_crypto_1.createDecipheriv)('aes-256-ctr', key, iv);
+    return Buffer.concat([d.update(data), d.final()]);
+}
+async function exportKinde(opts) {
+    const set = new record_set_1.RecordSet();
+    const progress = opts.onProgress ?? (() => undefined);
+    // ── the data export (users + passwords) ──
+    let usersText = opts.usersNdjson;
+    let orgsText = opts.organizationsNdjson;
+    if (opts.encryptedExport || opts.zip) {
+        const zip = opts.zip ?? decryptKindeExport(opts.encryptedExport.data, opts.encryptedExport.key, opts.encryptedExport.iv);
+        if (zip.readUInt32LE(0) !== 0x04034b50)
+            throw new Error('The decrypted Kinde export is not a zip: check the Key and IV.');
+        const files = (0, zip_1.readZip)(zip);
+        usersText ??= (0, zip_1.zipFile)(files, 'users.ndjson')?.toString('utf8');
+        orgsText ??= (0, zip_1.zipFile)(files, 'organizations.ndjson')?.toString('utf8');
+        if (usersText === undefined)
+            throw new Error('The Kinde export has no users.ndjson.');
+    }
+    const exported = usersText !== undefined ? ndjson(usersText) : [];
+    const online = Boolean(opts.domain && opts.clientId && opts.clientSecret);
+    if (!online && usersText === undefined) {
+        throw new Error('Kinde export needs the data export file (with its Key and IV) and/or a machine-to-machine application (domain, client id, secret).');
+    }
+    const base = opts.domain ? `https://${opts.domain.replace(/^https?:\/\//, '').replace(/\/+$/, '')}` : '';
+    let token;
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'Kinde',
+        baseUrl: `${base}/api/v1`,
+        headers: async () => ({ authorization: `Bearer ${(token ??= await m2mToken(base, opts))}` }),
+        fetchImpl: opts.fetchImpl,
+        sleep: opts.sleep,
+    });
+    // ── organizations ──
+    progress('organizations');
+    const orgCodes = new Set();
+    let defaultOrg;
+    const orgRows = online ? await tokenAll(http, '/organizations?page_size=500', 'organizations') : orgsText ? ndjson(orgsText) : [];
+    for (const o of orgRows) {
+        const code = (0, record_set_1.str)(o.code) ?? (0, record_set_1.str)(o.organization_code);
+        const name = (0, record_set_1.str)(o.name);
+        if (!code || !name)
+            continue;
+        // The API flags it; the export file does not, so it is known there by Kinde's default name.
+        if (o.is_default === true || (o.is_default === undefined && name === 'Default Organization'))
+            defaultOrg = code;
+        if (code === defaultOrg && !opts.includeDefaultOrganization)
+            continue;
+        orgCodes.add(code);
+        set.add('organization', (0, record_set_1.compact)({ id: code, name, slug: (0, record_set_1.str)(o.handle), created_at: (0, record_set_1.str)(o.created_on) }));
+    }
+    if (defaultOrg && !opts.includeDefaultOrganization) {
+        set.warn(`Kinde's default organization (${defaultOrg}) holds every user and was not exported as an organization (pass --kinde-include-default-org to keep it).`);
+    }
+    // ── roles ──
+    const roleById = new Map();
+    if (online) {
+        progress('roles');
+        for (const r of await tokenAll(http, '/roles?page_size=500', 'roles')) {
+            const id = (0, record_set_1.str)(r.id);
+            const key = (0, record_set_1.str)(r.key);
+            if (!id || !key)
+                continue;
+            roleById.set(id, key);
+            const permissions = (await tokenAll(http, `/roles/${id}/permissions?page_size=500`, 'permissions')).map((p) => (0, record_set_1.str)(p.key)).filter((p) => !!p);
+            set.add('role', (0, record_set_1.compact)({ key, name: (0, record_set_1.str)(r.name), description: (0, record_set_1.str)(r.description), scope: 'organization', permissions }), key);
+        }
+    }
+    // ── users: the export (with passwords) first, the API fills the rest ──
+    progress('users');
+    const users = new Map();
+    for (const u of exported)
+        if ((0, record_set_1.str)(u.id))
+            users.set(u.id, u);
+    if (online) {
+        for (const u of await tokenAll(http, '/users?page_size=500&expand=organizations,identities', 'users')) {
+            const id = (0, record_set_1.str)(u.id);
+            if (!id)
+                continue;
+            users.set(id, { ...u, ...(users.get(id) ?? {}) });
+        }
+    }
+    let withPassword = 0;
+    for (const u of users.values()) {
+        const user = mapKindeUser(u, set);
+        if (!user) {
+            set.omit('user', 'no email, phone number or username');
+            continue;
+        }
+        if (user.password)
+            withPassword++;
+        set.add('user', user);
+        // Without API access, memberships come from the export's organization codes.
+        if (!online) {
+            for (const code of (0, record_set_1.strs)(u.organizations)) {
+                if (orgCodes.has(code))
+                    set.add('membership', { organization_id: code, user_id: user.id, role: 'member' }, `${code}:${user.id}`);
+            }
+        }
+    }
+    if (exported.length === 0) {
+        set.warn('No data export given: password hashes come only from Kinde\'s data export ("All data"). Without them users set a new password (Kinde has no API to verify one).');
+    }
+    else if (withPassword === 0) {
+        set.warn('The data export has no passwords: request "All data" (not "All data except passwords") to carry them.');
+    }
+    // ── memberships with roles ──
+    if (online) {
+        progress('organization members');
+        const userIds = new Set(set.list('user').map((u) => u.id));
+        for (const code of orgCodes) {
+            for (const m of await tokenAll(http, `/organizations/${code}/users?page_size=500`, 'organization_users')) {
+                const uid = (0, record_set_1.str)(m.id);
+                if (!uid || !userIds.has(uid))
+                    continue;
+                const role = (0, record_set_1.strs)(m.roles)[0] ?? 'member';
+                set.add('membership', (0, record_set_1.compact)({ organization_id: code, user_id: uid, role, created_at: (0, record_set_1.str)(m.joined_on) }), `${code}:${uid}`);
+                if ((0, record_set_1.strs)(m.roles).length > 1)
+                    set.warn('Some organization members hold several Kinde roles; Atlas seats each member with one role (the first).');
+            }
+        }
+        progress('connections');
+        await addConnections(set, http);
+    }
+    set.warn('Kinde does not export second-factor secrets or passkeys: those users re-enrol in Atlas.');
+    set.manifest = { origin: base || null, providers: [...new Set(set.list('identity').map((i) => i.provider))].sort() };
+    return set;
+}
+/** One Kinde user (export row and/or API row) → a user record. */
+function mapKindeUser(u, set) {
+    const id = (0, record_set_1.str)(u.id);
+    if (!id)
+        return null;
+    const identities = (0, record_set_1.objs)(u.identities);
+    const email = ((0, record_set_1.str)(u.email) ?? (0, record_set_1.str)(u.preferred_email))?.toLowerCase();
+    const emailIdentity = identities.find((i) => (0, record_set_1.str)(i.type) === 'email' && (0, record_set_1.str)(i.identity)?.toLowerCase() === email);
+    const phone = (0, record_set_1.e164)(u.phone) ?? (0, record_set_1.e164)(identities.find((i) => (0, record_set_1.str)(i.type) === 'phone')?.identity);
+    const username = (0, record_set_1.str)(u.username) ?? (0, record_set_1.str)(identities.find((i) => (0, record_set_1.str)(i.type) === 'username')?.identity);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails: email
+            ? [{ email, verified: u.email_verified === true || emailIdentity?.is_confirmed === true || (u.email_verified === undefined && identities.some((i) => (0, record_set_1.str)(i.type)?.startsWith('oauth2:'))), primary: true }]
+            : [],
+        phones: phone ? [{ phone, verified: false, primary: !email }] : [],
+        username,
+        first_name: (0, record_set_1.str)(u.first_name),
+        last_name: (0, record_set_1.str)(u.last_name),
+        image_url: (0, record_set_1.str)(u.picture),
+        banned: u.is_suspended === true ? true : undefined,
+        private_metadata: (0, record_set_1.bag)((0, record_set_1.compact)({ kinde_external_id: (0, record_set_1.str)(u.external_id) ?? (0, record_set_1.str)(u.provided_id) })),
+        created_at: (0, record_set_1.str)(u.created_on),
+        last_sign_in_at: (0, record_set_1.str)(u.last_signed_in),
+    });
+    if ((0, record_set_1.isObj)(u.password)) {
+        const mapped = kindePasswordHash(u.password);
+        if ('reason' in mapped)
+            set?.omit('password', mapped.reason);
+        else
+            user.password = mapped;
+    }
+    const social = identities.filter((i) => (0, record_set_1.str)(i.type)?.startsWith('oauth2:'));
+    if (social.length)
+        set?.omit('identity', "Kinde does not export social accounts' provider user ids: they relink by verified email on first social sign-in", social.length);
+    return user.emails?.length || user.phones?.length || user.username ? user : null;
+}
+/**
+ * Kinde's exported `password` object → the bundle's password hash. Kinde
+ * stores bcrypt; users imported into Kinde keep the algorithm they came with
+ * (crypt, md5, sha256, wordpress, pbkdf2, firebase-scrypt, aspnet-identity-v2).
+ */
+function kindePasswordHash(p) {
+    const hash = (0, record_set_1.str)(p.hashed_password);
+    if (!hash)
+        return { reason: 'empty Kinde password hash' };
+    const algorithm = ((0, record_set_1.str)(p.hashing_algorithm) ?? '').toLowerCase().replace(/_/g, '-');
+    const config = (0, record_set_1.isObj)(p.hashing_config) ? p.hashing_config : {};
+    const salt = (0, record_set_1.str)(config.salt);
+    const position = ((0, record_set_1.str)(config.salt_position) ?? (0, record_set_1.str)(config.salt_location) ?? (0, record_set_1.str)(config.position) ?? 'suffix').toLowerCase();
+    switch (algorithm) {
+        case '':
+        case 'bcrypt':
+            return { algorithm: 'bcrypt', hash };
+        case 'crypt':
+        case 'wordpress':
+        case 'phpass':
+            // Self-describing ($1$, $5$, $6$, $2y$, $P$): the registry recognises them.
+            return { algorithm: 'auto', hash };
+        case 'md5':
+        case 'sha256':
+            if (!salt)
+                return { algorithm, hash, params: { encoding: /^[0-9a-f]+$/i.test(hash) ? 'hex' : 'base64' } };
+            return {
+                algorithm: `${algorithm}_salted`,
+                hash,
+                salt,
+                params: { encoding: /^[0-9a-f]+$/i.test(hash) ? 'hex' : 'base64', salt_position: position === 'prefix' ? 'prefix' : 'suffix' },
+            };
+        case 'pbkdf2': {
+            if (hash.includes('$'))
+                return { algorithm: 'auto', hash };
+            const iterations = Number(config.iterations ?? config.rounds);
+            if (!salt || !Number.isInteger(iterations))
+                return { reason: 'Kinde pbkdf2 hash without salt or iterations' };
+            return {
+                algorithm: 'pbkdf2',
+                hash,
+                salt,
+                params: { digest: (0, record_set_1.str)(config.digest)?.toLowerCase() ?? 'sha256', iterations, ...((0, record_set_1.str)(config.salt_encoding) ? { salt_encoding: (0, record_set_1.str)(config.salt_encoding) } : {}) },
+            };
+        }
+        case 'firebase-scrypt': {
+            const signer = (0, record_set_1.str)(config.signer_key) ?? (0, record_set_1.str)(config.base64_signer_key);
+            if (!signer)
+                return { reason: 'Kinde firebase-scrypt hash without the project signer key' };
+            return {
+                algorithm: 'scrypt_firebase',
+                hash,
+                salt: salt ?? '',
+                params: {
+                    signer_key: signer,
+                    salt_separator: (0, record_set_1.str)(config.salt_separator) ?? (0, record_set_1.str)(config.base64_salt_separator) ?? 'Bw==',
+                    rounds: Number(config.rounds ?? 8),
+                    mem_cost: Number(config.mem_cost ?? config.memory_cost ?? 14),
+                },
+            };
+        }
+        case 'aspnet-identity-v2':
+        case 'aspnet-identity-v3':
+            return { algorithm: 'aspnet_identity', hash };
+        default:
+            return { reason: `Kinde password algorithm "${algorithm}" is not supported` };
+    }
+}
+async function addConnections(set, http) {
+    let conns;
+    try {
+        conns = await tokenAll(http, '/connections?page_size=500', 'connections');
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 404))
+            return;
+        throw err;
+    }
+    for (const c of conns) {
+        const id = (0, record_set_1.str)(c.id);
+        const strategy = (0, record_set_1.str)(c.strategy) ?? '';
+        if (!id || !/^(saml|wsfed|oidc|oauth2:(azure_ad|microsoft_entra|okta|google_workspace))/.test(strategy))
+            continue;
+        let detail = c;
+        try {
+            const { body } = await http.get(`/connections/${id}`);
+            detail = (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.connection) ? body.connection : (0, record_set_1.isObj)(body) ? body : c;
+        }
+        catch (err) {
+            if (!(err instanceof vendor_http_1.VendorApiError))
+                throw err;
+        }
+        const o = (0, record_set_1.isObj)(detail.options) ? detail.options : {};
+        const domains = (0, record_set_1.strs)(o.home_realm_domains);
+        const name = (0, record_set_1.str)(c.display_name) ?? (0, record_set_1.str)(c.name);
+        if (strategy.startsWith('saml')) {
+            set.add('sso_connection', (0, record_set_1.compact)({
+                id,
+                name,
+                protocol: 'saml',
+                domains,
+                saml: (0, record_set_1.compact)({
+                    idp_entity_id: (0, record_set_1.str)(o.saml_entity_id),
+                    idp_metadata_url: (0, record_set_1.str)(o.saml_idp_metadata_url),
+                    idp_sso_url: (0, record_set_1.str)(o.saml_sign_in_url) ?? (0, record_set_1.str)(o.saml_sso_url),
+                    idp_certificate: (0, record_set_1.str)(o.saml_signing_certificate) ?? (0, record_set_1.str)(o.saml_certificate),
+                    sp_acs_url: (0, record_set_1.str)(o.saml_acs_url),
+                }),
+            }));
+        }
+        else {
+            set.add('sso_connection', (0, record_set_1.compact)({ id, name, protocol: 'oidc', domains, oidc: (0, record_set_1.compact)({ issuer: (0, record_set_1.str)(o.issuer) ?? (0, record_set_1.str)(o.entra_id_domain), client_id: (0, record_set_1.str)(o.client_id) }) }));
+            set.warn(`Enterprise connection ${name ?? id}: Kinde does not return its client secret; enter it in Atlas after the import.`);
+        }
+    }
+}
+async function m2mToken(base, opts) {
+    const res = await (opts.fetchImpl ?? fetch)(`${base}/oauth2/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+        body: new URLSearchParams({ grant_type: 'client_credentials', client_id: opts.clientId, client_secret: opts.clientSecret, audience: `${base}/api` }).toString(),
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok || !body.access_token)
+        throw new vendor_http_1.VendorApiError('Kinde', res.status, '/oauth2/token', body.error_description ?? 'could not get a Management API token');
+    return body.access_token;
+}
+/** Kinde's `next_token` paging. */
+async function tokenAll(http, path, key) {
+    const out = [];
+    let next;
+    do {
+        const { body } = await http.get(`${path}${next ? `&next_token=${encodeURIComponent(next)}` : ''}`);
+        const rows = (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
+        out.push(...rows);
+        next = (0, record_set_1.isObj)(body) ? (0, record_set_1.str)(body.next_token) : undefined;
+        if (rows.length === 0)
+            break;
+    } while (next);
+    return out;
+}
+function ndjson(text) {
+    return text
+        .split(/\r?\n/)
+        .filter((l) => l.trim())
+        .map((l) => JSON.parse(l))
+        .filter(record_set_1.isObj);
+}
+//# sourceMappingURL=kinde.js.map