@atlasauth/cli 0.10.0 → 0.12.0

package/dist/migrate/export/translate-kit.d.ts

@@ -0,0 +1,46 @@
+import type { ReportStatus, TranslationReportEntry, TranslationResult } from '../framework/plugin';
+import type { Json } from '../../serialize';
+/**
+ * Shared machinery for the vendor CONFIG translators (`atlas migrate <vendor>
+ * config`): build the Atlas config-as-code documents (`instance` with its
+ * `auth_config`, `oauth_providers`, `roles`, `permissions`, …) and the report
+ * line by line, every line naming the vendor setting it came from.
+ *
+ * Secrets are never copied: a vendor client secret becomes a `${NAME}`
+ * placeholder the operator sets before `atlas config import`.
+ */
+export declare class ConfigBuilder {
+    readonly auth: Record<string, Json>;
+    readonly instance: Record<string, Json>;
+    readonly collections: Record<string, Json[]>;
+    readonly report: TranslationReportEntry[];
+    private readonly env;
+    readonly providers: Record<string, string>;
+    readonly roles: Record<string, string>;
+    /** Set `auth_config.<path>` (dotted). */
+    set(path: string, value: Json): void;
+    add(status: ReportStatus, area: string, setting: string, note: string, atlas?: string): void;
+    /** A `${NAME}` placeholder the import interpolates from the environment. */
+    placeholder(name: string, purpose: string): string;
+    push(collection: keyof ConfigBuilder['collections'] | string, value: Json): void;
+    /** An `oauth_providers` entry for a built-in Atlas provider, credentials as placeholders. */
+    socialProvider(o: {
+        atlasKey: string;
+        vendorName: string;
+        area: string;
+        setting: string;
+        clientId?: string;
+        scopes?: string[];
+        enabled?: boolean;
+        allowSignUp?: boolean;
+    }): void;
+    result(origin: string, extra?: Pick<TranslationResult, 'bridge' | 'lazy'>): TranslationResult;
+}
+/** Social provider names vendors use → Atlas built-in provider keys. */
+export declare const SOCIAL_KEYS: Record<string, string>;
+/** The Atlas key for a vendor's provider name (`oauth_google`, `oauth2:google`, `GOOGLE`, `google-oauth2`), or null. */
+export declare function socialKey(raw: string): string | null;
+/** `Billing Admin` → `billing_admin`. */
+export declare function keyOf(name: string): string;
+/** Atlas's session window: 5 minutes to 90 days. */
+export declare function clampSessionMs(ms: number): number;

package/dist/migrate/export/translate-kit.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SOCIAL_KEYS = exports.ConfigBuilder = void 0;
+exports.socialKey = socialKey;
+exports.keyOf = keyOf;
+exports.clampSessionMs = clampSessionMs;
+/**
+ * Shared machinery for the vendor CONFIG translators (`atlas migrate <vendor>
+ * config`): build the Atlas config-as-code documents (`instance` with its
+ * `auth_config`, `oauth_providers`, `roles`, `permissions`, …) and the report
+ * line by line, every line naming the vendor setting it came from.
+ *
+ * Secrets are never copied: a vendor client secret becomes a `${NAME}`
+ * placeholder the operator sets before `atlas config import`.
+ */
+class ConfigBuilder {
+    auth = {};
+    instance = {};
+    collections = {
+        oauth_providers: [],
+        custom_oauth_providers: [],
+        permissions: [],
+        roles: [],
+        oauth_clients: [],
+        resource_servers: [],
+        redirect_urls: [],
+        jwt_templates: [],
+    };
+    report = [];
+    env = new Map();
+    providers = {};
+    roles = {};
+    /** Set `auth_config.<path>` (dotted). */
+    set(path, value) {
+        const keys = path.split('.');
+        let node = this.auth;
+        for (const k of keys.slice(0, -1)) {
+            const next = node[k];
+            if (!next || typeof next !== 'object' || Array.isArray(next))
+                node[k] = {};
+            node = node[k];
+        }
+        node[keys[keys.length - 1]] = value;
+    }
+    add(status, area, setting, note, atlas) {
+        this.report.push({ status, area, setting, note, ...(atlas ? { atlas } : {}) });
+    }
+    /** A `${NAME}` placeholder the import interpolates from the environment. */
+    placeholder(name, purpose) {
+        this.env.set(name, purpose);
+        return `\${${name}}`;
+    }
+    push(collection, value) {
+        (this.collections[collection] ??= []).push(value);
+    }
+    /** An `oauth_providers` entry for a built-in Atlas provider, credentials as placeholders. */
+    socialProvider(o) {
+        const upper = o.atlasKey.toUpperCase().replace(/[^A-Z0-9]+/g, '_');
+        if (this.collections.oauth_providers.some((p) => p.provider === o.atlasKey))
+            return;
+        const entry = {
+            provider: o.atlasKey,
+            enabled: o.enabled !== false,
+            allow_sign_in: true,
+            allow_sign_up: o.allowSignUp !== false,
+            client_id: o.clientId ?? this.placeholder(`${upper}_CLIENT_ID`, `${o.vendorName} client id`),
+            client_secret: this.placeholder(`${upper}_CLIENT_SECRET`, `${o.vendorName} client secret`),
+        };
+        if (o.scopes?.length)
+            entry.scopes = o.scopes;
+        this.push('oauth_providers', entry);
+        this.providers[o.vendorName] = o.atlasKey;
+        this.add(o.clientId ? 'differs' : 'manual', o.area, o.setting, `${o.vendorName} sign-in becomes Atlas's built-in "${o.atlasKey}" provider. Keep the same OAuth app so imported accounts relink by provider user id; add Atlas's callback URL to it${o.clientId ? '' : ', and set the client id'} and set ${upper}_CLIENT_SECRET (secrets are never copied).`, `oauth_providers ${o.atlasKey}`);
+    }
+    result(origin, extra = {}) {
+        const documents = {};
+        const instance = { ...this.instance };
+        if (Object.keys(this.auth).length)
+            instance.auth_config = this.auth;
+        if (Object.keys(instance).length)
+            documents.instance = instance;
+        for (const [type, list] of Object.entries(this.collections))
+            if (list.length)
+                documents[type] = list;
+        return {
+            origin,
+            documents,
+            report: this.report,
+            env: [...this.env.entries()].map(([name, purpose]) => ({ name, for: purpose })),
+            mappings: { providers: this.providers, roles: this.roles },
+            ...extra,
+        };
+    }
+}
+exports.ConfigBuilder = ConfigBuilder;
+/** Social provider names vendors use → Atlas built-in provider keys. */
+exports.SOCIAL_KEYS = {
+    google: 'google',
+    'google-oauth2': 'google',
+    github: 'github',
+    gitlab: 'gitlab',
+    facebook: 'facebook',
+    apple: 'apple',
+    microsoft: 'microsoft',
+    windowslive: 'microsoft',
+    'microsoft-account': 'microsoft',
+    azure_ad: 'microsoft',
+    linkedin: 'linkedin',
+    linkedin_oidc: 'linkedin',
+    twitter: 'x',
+    x: 'x',
+    discord: 'discord',
+    slack: 'slack',
+    spotify: 'spotify',
+    twitch: 'twitch',
+    bitbucket: 'bitbucket',
+    dropbox: 'dropbox',
+    notion: 'notion',
+    salesforce: 'salesforce',
+    paypal: 'paypal',
+    amazon: 'amazon',
+    tiktok: 'tiktok',
+    line: 'line',
+    zoom: 'zoom',
+    figma: 'figma',
+    hubspot: 'hubspot',
+    atlassian: 'atlassian',
+    coinbase: 'coinbase',
+    box: 'box',
+    yahoo: 'yahoo',
+    roblox: 'roblox',
+    reddit: 'reddit',
+};
+/** The Atlas key for a vendor's provider name (`oauth_google`, `oauth2:google`, `GOOGLE`, `google-oauth2`), or null. */
+function socialKey(raw) {
+    const k = raw.toLowerCase().replace(/^oauth2?[_:]/, '').replace(/^oauth_/, '');
+    return exports.SOCIAL_KEYS[k] ?? null;
+}
+/** `Billing Admin` → `billing_admin`. */
+function keyOf(name) {
+    return name.trim().toLowerCase().replace(/[^a-z0-9:]+/g, '_').replace(/^_+|_+$/g, '') || 'role';
+}
+const MIN = 60_000;
+/** Atlas's session window: 5 minutes to 90 days. */
+function clampSessionMs(ms) {
+    return Math.min(Math.max(ms, 5 * MIN), 90 * 24 * 60 * MIN);
+}
+//# sourceMappingURL=translate-kit.js.map

package/dist/migrate/export/translate-kit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"translate-kit.js","sourceRoot":"","sources":["../../../src/migrate/export/translate-kit.ts"],"names":[],"mappings":";;;AAkJA,8BAGC;AAGD,sBAEC;AAID,wCAEC;AA7JD;;;;;;;;GAQG;AACH,MAAa,aAAa;IACf,IAAI,GAAyB,EAAE,CAAC;IAChC,QAAQ,GAAyB,EAAE,CAAC;IACpC,WAAW,GAA2B;QAC7C,eAAe,EAAE,EAAE;QACnB,sBAAsB,EAAE,EAAE;QAC1B,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,EAAE;QACT,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,EAAE;QACpB,aAAa,EAAE,EAAE;QACjB,aAAa,EAAE,EAAE;KAClB,CAAC;IACO,MAAM,GAA6B,EAAE,CAAC;IAC9B,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,SAAS,GAA2B,EAAE,CAAC;IACvC,KAAK,GAA2B,EAAE,CAAC;IAE5C,yCAAyC;IACzC,GAAG,CAAC,IAAY,EAAE,KAAW;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3E,IAAI,GAAG,IAAI,CAAC,CAAC,CAAyB,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,GAAG,KAAK,CAAC;IACvC,CAAC;IAED,GAAG,CAAC,MAAoB,EAAE,IAAY,EAAE,OAAe,EAAE,IAAY,EAAE,KAAc;QACnF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,4EAA4E;IAC5E,WAAW,CAAC,IAAY,EAAE,OAAe;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5B,OAAO,MAAM,IAAI,GAAG,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,UAAuD,EAAE,KAAW;QACvE,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,6FAA6F;IAC7F,cAAc,CAAC,CASd;QACC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,WAAW,CAAC,eAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAA2B,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC;YAAE,OAAO;QAChH,MAAM,KAAK,GAAyB;YAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK;YAC5B,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,CAAC,CAAC,WAAW,KAAK,KAAK;YACtC,SAAS,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,YAAY,EAAE,GAAG,CAAC,CAAC,UAAU,YAAY,CAAC;YAC5F,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,gBAAgB,EAAE,GAAG,CAAC,CAAC,UAAU,gBAAgB,CAAC;SAC3F,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM;YAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC1C,IAAI,CAAC,GAAG,CACN,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EACjC,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,OAAO,EACT,GAAG,CAAC,CAAC,UAAU,sCAAsC,CAAC,CAAC,QAAQ,sHAAsH,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,yBAAyB,YAAY,KAAK,4CAA4C,EAC7R,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAChC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAoD,EAAE;QAC3E,MAAM,SAAS,GAAoB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAyB,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;QACpE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;YAAE,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,IAAI,IAAI,CAAC,MAAM;gBAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACrG,OAAO;YACL,MAAM;YACN,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/E,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAC1D,GAAG,KAAK;SACT,CAAC;IACJ,CAAC;CACF;AA5FD,sCA4FC;AAED,wEAAwE;AAC3D,QAAA,WAAW,GAA2B;IACjD,MAAM,EAAE,QAAQ;IAChB,eAAe,EAAE,QAAQ;IACzB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,WAAW;IACxB,mBAAmB,EAAE,WAAW;IAChC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,UAAU;IACzB,OAAO,EAAE,GAAG;IACZ,CAAC,EAAE,GAAG;IACN,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,wHAAwH;AACxH,SAAgB,SAAS,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC/E,OAAO,mBAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,yCAAyC;AACzC,SAAgB,KAAK,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;AAClG,CAAC;AAED,MAAM,GAAG,GAAG,MAAM,CAAC;AACnB,oDAAoD;AACpD,SAAgB,cAAc,CAAC,EAAU;IACvC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;AAC7D,CAAC"}

package/dist/migrate/export/vendor-http.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The HTTP side of `atlas migrate export <vendor>`: calls the OLD vendor's
+ * management API from the owner's machine, with the owner's vendor
+ * credentials. Nothing here talks to Atlas, and no vendor credential is ever
+ * written into a bundle or sent anywhere but the vendor.
+ *
+ * Shared by every vendor exporter: JSON requests, a bounded retry on 429 and
+ * 5xx that honours `Retry-After` (and the `X-RateLimit-Reset` epoch some
+ * vendors send instead), and errors that name the call without echoing a
+ * credential.
+ */
+export declare class VendorApiError extends Error {
+    readonly vendor: string;
+    readonly status: number;
+    readonly path: string;
+    constructor(vendor: string, status: number, path: string, detail: string);
+}
+export interface VendorHttpOptions {
+    vendor: string;
+    baseUrl: string;
+    /** Headers on every call (the authorization header lives here, never in a URL). */
+    headers?: Record<string, string> | (() => Promise<Record<string, string>> | Record<string, string>);
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    /** Attempts per call on 429/5xx, the first included. */
+    attempts?: number;
+    now?: () => number;
+}
+export interface VendorResponse<T> {
+    status: number;
+    body: T;
+    headers: Headers;
+}
+export declare class VendorHttp {
+    private readonly o;
+    constructor(o: VendorHttpOptions);
+    get vendor(): string;
+    url(path: string): string;
+    get<T>(path: string): Promise<VendorResponse<T>>;
+    post<T>(path: string, body: unknown): Promise<VendorResponse<T>>;
+    request<T>(method: string, path: string, body?: unknown): Promise<VendorResponse<T>>;
+    private waitFor;
+    private now;
+}
+/** The `rel="next"` URL of an RFC 8288 `Link` header (Okta's pagination). */
+export declare function nextLink(header: string | null): string | null;

package/dist/migrate/export/vendor-http.js

@@ -0,0 +1,138 @@
+"use strict";
+/**
+ * The HTTP side of `atlas migrate export <vendor>`: calls the OLD vendor's
+ * management API from the owner's machine, with the owner's vendor
+ * credentials. Nothing here talks to Atlas, and no vendor credential is ever
+ * written into a bundle or sent anywhere but the vendor.
+ *
+ * Shared by every vendor exporter: JSON requests, a bounded retry on 429 and
+ * 5xx that honours `Retry-After` (and the `X-RateLimit-Reset` epoch some
+ * vendors send instead), and errors that name the call without echoing a
+ * credential.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VendorHttp = exports.VendorApiError = void 0;
+exports.nextLink = nextLink;
+class VendorApiError extends Error {
+    vendor;
+    status;
+    path;
+    constructor(vendor, status, path, detail) {
+        super(`${vendor} API ${status} on ${path}${detail ? `: ${detail}` : ''}`);
+        this.vendor = vendor;
+        this.status = status;
+        this.path = path;
+    }
+}
+exports.VendorApiError = VendorApiError;
+const MAX_WAIT_MS = 60_000;
+class VendorHttp {
+    o;
+    constructor(o) {
+        this.o = o;
+    }
+    get vendor() {
+        return this.o.vendor;
+    }
+    url(path) {
+        return /^https:\/\//.test(path) ? path : `${this.o.baseUrl.replace(/\/+$/, '')}${path.startsWith('/') ? '' : '/'}${path}`;
+    }
+    async get(path) {
+        return this.request('GET', path);
+    }
+    async post(path, body) {
+        return this.request('POST', path, body);
+    }
+    async request(method, path, body) {
+        const fetchImpl = this.o.fetchImpl ?? fetch;
+        const sleep = this.o.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        const attempts = Math.max(1, this.o.attempts ?? 5);
+        const display = path.split('?')[0].replace(/^https:\/\/[^/]+/, '');
+        for (let attempt = 1;; attempt++) {
+            const extra = typeof this.o.headers === 'function' ? await this.o.headers() : this.o.headers;
+            const headers = { accept: 'application/json', ...extra };
+            if (body !== undefined)
+                headers['content-type'] = 'application/json';
+            let res;
+            try {
+                res = await fetchImpl(this.url(path), {
+                    method,
+                    headers,
+                    body: body === undefined ? undefined : JSON.stringify(body),
+                });
+            }
+            catch (err) {
+                if (attempt < attempts) {
+                    await sleep(backoff(attempt));
+                    continue;
+                }
+                throw new VendorApiError(this.o.vendor, 0, display, err instanceof Error ? err.message : String(err));
+            }
+            if ((res.status === 429 || res.status >= 500) && attempt < attempts) {
+                await sleep(this.waitFor(res, attempt));
+                continue;
+            }
+            const text = await res.text();
+            let parsed = null;
+            if (text) {
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch {
+                    parsed = text;
+                }
+            }
+            if (res.status < 200 || res.status >= 300) {
+                throw new VendorApiError(this.o.vendor, res.status, display, errorDetail(parsed));
+            }
+            return { status: res.status, body: parsed, headers: res.headers };
+        }
+    }
+    waitFor(res, attempt) {
+        const retryAfter = res.headers.get('retry-after');
+        if (retryAfter) {
+            const secs = Number(retryAfter);
+            if (Number.isFinite(secs))
+                return Math.min(Math.max(secs * 1000, 0), MAX_WAIT_MS);
+            const at = Date.parse(retryAfter);
+            if (Number.isFinite(at))
+                return Math.min(Math.max(at - this.now(), 0), MAX_WAIT_MS);
+        }
+        const reset = Number(res.headers.get('x-ratelimit-reset'));
+        if (Number.isFinite(reset) && reset > 1e9) {
+            return Math.min(Math.max(reset * 1000 - this.now(), 250), MAX_WAIT_MS);
+        }
+        return backoff(attempt);
+    }
+    now() {
+        return (this.o.now ?? Date.now)();
+    }
+}
+exports.VendorHttp = VendorHttp;
+function backoff(attempt) {
+    return Math.min(500 * 2 ** (attempt - 1), MAX_WAIT_MS);
+}
+/** A short, credential-free description of a vendor error body. */
+function errorDetail(body) {
+    if (typeof body === 'string')
+        return body.slice(0, 200);
+    if (!body || typeof body !== 'object')
+        return '';
+    const b = body;
+    const first = Array.isArray(b.errors) ? b.errors[0] : undefined;
+    const pick = [b.message, b.error_description, b.errorSummary, b.errorDescription, first?.long_message, first?.message, b.error, b.errorCode];
+    const found = pick.find((v) => typeof v === 'string' && v);
+    return typeof found === 'string' ? found.slice(0, 200) : '';
+}
+/** The `rel="next"` URL of an RFC 8288 `Link` header (Okta's pagination). */
+function nextLink(header) {
+    if (!header)
+        return null;
+    for (const part of header.split(',')) {
+        const m = /<([^>]+)>\s*;\s*rel="?next"?/.exec(part.trim());
+        if (m)
+            return m[1];
+    }
+    return null;
+}
+//# sourceMappingURL=vendor-http.js.map

package/dist/migrate/export/vendor-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor-http.js","sourceRoot":"","sources":["../../../src/migrate/export/vendor-http.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAmIH,4BAOC;AAxID,MAAa,cAAe,SAAQ,KAAK;IAE5B;IACA;IACA;IAHX,YACW,MAAc,EACd,MAAc,EACd,IAAY,EACrB,MAAc;QAEd,KAAK,CAAC,GAAG,MAAM,QAAQ,MAAM,OAAO,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QALjE,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;IAIvB,CAAC;CACF;AATD,wCASC;AAoBD,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,MAAa,UAAU;IACQ;IAA7B,YAA6B,CAAoB;QAApB,MAAC,GAAD,CAAC,CAAmB;IAAG,CAAC;IAErD,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;IAC5H,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QACvC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACpE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7F,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;YACjF,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YACrE,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;oBACpC,MAAM;oBACN,OAAO;oBACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC5D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;oBACvB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACxG,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;gBACpE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;gBACxC,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,MAAM,GAAY,IAAI,CAAC;YAC3B,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,IAAI,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC1C,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,GAAa,EAAE,OAAe;QAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAClF,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;CACF;AAhFD,gCAgFC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,mEAAmE;AACnE,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7I,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;IAC3D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAC7E,SAAgB,QAAQ,CAAC,MAAqB;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/migrate/export/zip.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Read the files of a ZIP archive held in memory (stored or deflated entries,
+ * via the central directory). Enough for a vendor's data-export archive; no
+ * dependency. Refuses ZIP64, encryption and sizes past `maxBytes` per entry.
+ */
+export declare function readZip(buf: Buffer, maxBytes?: number): Map<string, Buffer>;
+/** A file in the archive by its base name (exports often nest files in a folder). */
+export declare function zipFile(files: Map<string, Buffer>, baseName: string): Buffer | undefined;

package/dist/migrate/export/zip.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readZip = readZip;
+exports.zipFile = zipFile;
+const node_zlib_1 = require("node:zlib");
+/**
+ * Read the files of a ZIP archive held in memory (stored or deflated entries,
+ * via the central directory). Enough for a vendor's data-export archive; no
+ * dependency. Refuses ZIP64, encryption and sizes past `maxBytes` per entry.
+ */
+function readZip(buf, maxBytes = 2 * 1024 ** 3) {
+    const out = new Map();
+    // End of central directory: signature 0x06054b50, within the last 64 KiB + 22.
+    let eocd = -1;
+    for (let i = buf.length - 22; i >= Math.max(0, buf.length - 65_557); i--) {
+        if (buf.readUInt32LE(i) === 0x06054b50) {
+            eocd = i;
+            break;
+        }
+    }
+    if (eocd < 0)
+        throw new Error('Not a ZIP archive (no end-of-central-directory record).');
+    const entries = buf.readUInt16LE(eocd + 10);
+    let p = buf.readUInt32LE(eocd + 16);
+    if (p === 0xffffffff)
+        throw new Error('ZIP64 archives are not supported; extract the files and pass them directly.');
+    for (let n = 0; n < entries; n++) {
+        if (buf.readUInt32LE(p) !== 0x02014b50)
+            throw new Error('Corrupt ZIP central directory.');
+        const flags = buf.readUInt16LE(p + 8);
+        const method = buf.readUInt16LE(p + 10);
+        const compressed = buf.readUInt32LE(p + 20);
+        const size = buf.readUInt32LE(p + 24);
+        const nameLen = buf.readUInt16LE(p + 28);
+        const extraLen = buf.readUInt16LE(p + 30);
+        const commentLen = buf.readUInt16LE(p + 32);
+        const local = buf.readUInt32LE(p + 42);
+        const name = buf.subarray(p + 46, p + 46 + nameLen).toString('utf8');
+        p += 46 + nameLen + extraLen + commentLen;
+        if (name.endsWith('/'))
+            continue;
+        if (flags & 0x1)
+            throw new Error(`ZIP entry ${name} is encrypted.`);
+        if (size > maxBytes)
+            throw new Error(`ZIP entry ${name} is too large.`);
+        if (buf.readUInt32LE(local) !== 0x04034b50)
+            throw new Error('Corrupt ZIP local header.');
+        const start = local + 30 + buf.readUInt16LE(local + 26) + buf.readUInt16LE(local + 28);
+        const data = buf.subarray(start, start + compressed);
+        if (method === 0)
+            out.set(name, Buffer.from(data));
+        else if (method === 8)
+            out.set(name, (0, node_zlib_1.inflateRawSync)(data, { maxOutputLength: Math.max(size, 1) }));
+        else
+            throw new Error(`ZIP entry ${name} uses compression method ${method}, which is not supported.`);
+    }
+    return out;
+}
+/** A file in the archive by its base name (exports often nest files in a folder). */
+function zipFile(files, baseName) {
+    for (const [name, data] of files)
+        if (name === baseName || name.endsWith(`/${baseName}`))
+            return data;
+    return undefined;
+}
+//# sourceMappingURL=zip.js.map

package/dist/migrate/export/zip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip.js","sourceRoot":"","sources":["../../../src/migrate/export/zip.ts"],"names":[],"mappings":";;AAOA,0BAqCC;AAGD,0BAGC;AAlDD,yCAA2C;AAE3C;;;;GAIG;AACH,SAAgB,OAAO,CAAC,GAAW,EAAE,QAAQ,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,+EAA+E;IAC/E,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzE,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,CAAC;YACT,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACrH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC,IAAI,EAAE,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,IAAI,KAAK,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC;QACpE,IAAI,IAAI,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC;QACxE,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,KAAK,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aAC9C,IAAI,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAA,0BAAc,EAAC,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;;YAC9F,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,4BAA4B,MAAM,2BAA2B,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qFAAqF;AACrF,SAAgB,OAAO,CAAC,KAA0B,EAAE,QAAgB;IAClE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK;QAAE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACtG,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/migrate/framework/builtins.d.ts

@@ -0,0 +1,2 @@
+/** Register the built-in plugins (idempotent: an already registered vendor is left as it is). */
+export declare function registerBuiltInPlugins(): void;

package/dist/migrate/framework/builtins.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerBuiltInPlugins = registerBuiltInPlugins;
+const plugin_1 = require("../auth0/plugin");
+const plugin_2 = require("../clerk/plugin");
+const plugin_3 = require("../descope/plugin");
+const plugin_4 = require("../kinde/plugin");
+const plugin_5 = require("../okta/plugin");
+const plugins_1 = require("../frameworks/plugins");
+const custom_1 = require("./custom");
+const registry_1 = require("./registry");
+/**
+ * The plugins `atlas migrate <vendor>` ships with. A vendor track adds one
+ * line here (its plugin module lives under src/migrate/<vendor>/).
+ */
+const BUILT_IN_PLUGINS = [custom_1.customPlugin, plugin_2.clerkPlugin, plugin_1.auth0Plugin, plugin_5.oktaPlugin, plugin_4.kindePlugin, plugin_3.descopePlugin, ...plugins_1.FRAMEWORK_PLUGINS];
+/** Register the built-in plugins (idempotent: an already registered vendor is left as it is). */
+function registerBuiltInPlugins() {
+    for (const plugin of BUILT_IN_PLUGINS)
+        if (!(0, registry_1.hasMigrationPlugin)(plugin.vendor))
+            (0, registry_1.registerMigrationPlugin)(plugin);
+}
+//# sourceMappingURL=builtins.js.map

package/dist/migrate/framework/builtins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtins.js","sourceRoot":"","sources":["../../../src/migrate/framework/builtins.ts"],"names":[],"mappings":";;AAgBA,wDAEC;AAlBD,4CAA8C;AAC9C,4CAA8C;AAC9C,8CAAkD;AAClD,4CAA8C;AAC9C,2CAA4C;AAC5C,mDAA0D;AAC1D,qCAAwC;AACxC,yCAAyE;AAEzE;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,qBAAY,EAAE,oBAAW,EAAE,oBAAW,EAAE,mBAAU,EAAE,oBAAW,EAAE,sBAAa,EAAE,GAAG,2BAAiB,CAAC,CAAC;AAEhI,iGAAiG;AACjG,SAAgB,sBAAsB;IACpC,KAAK,MAAM,MAAM,IAAI,gBAAgB;QAAE,IAAI,CAAC,IAAA,6BAAkB,EAAC,MAAM,CAAC,MAAM,CAAC;YAAE,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;AACjH,CAAC"}

package/dist/migrate/framework/commands.d.ts

@@ -0,0 +1,20 @@
+import type { ParsedArgs } from '../../args';
+import type { RunContext } from '../../context';
+/**
+ * `atlas migrate <vendor> [step] [path]` and `atlas migrate export <vendor> [path]`
+ * for every vendor with a plugin. With no step the whole program runs (see
+ * orchestrator.ts); a step runs on its own, reading and updating the same
+ * state file, so `export` today and `import` tomorrow work.
+ */
+/** Steps a user can run on their own. */
+export declare const SINGLE_STEPS: readonly ["config", "export", "import", "bridge", "lazy", "verify"];
+export declare function knownVendors(): string[];
+/** True when `vendor` names a registered plugin. */
+export declare function hasPlugin(vendor: string | undefined): boolean;
+/**
+ * Dispatch `atlas migrate <vendor> …`. `positionals` are the words after
+ * `migrate` (`[vendor, step?, path?]`); a word that is not a step is the path.
+ */
+export declare function migrateWithPlugin(ctx: RunContext, args: ParsedArgs, vendor: string, rest: string[]): Promise<number>;
+/** `atlas migrate export <vendor> [path]` — an alias of `atlas migrate <vendor> export [path]`. */
+export declare function migrateExportAlias(ctx: RunContext, args: ParsedArgs, rest: string[]): Promise<number>;

package/dist/migrate/framework/commands.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SINGLE_STEPS = void 0;
+exports.knownVendors = knownVendors;
+exports.hasPlugin = hasPlugin;
+exports.migrateWithPlugin = migrateWithPlugin;
+exports.migrateExportAlias = migrateExportAlias;
+const errors_1 = require("../../errors");
+const builtins_1 = require("./builtins");
+const orchestrator_1 = require("./orchestrator");
+const registry_1 = require("./registry");
+/**
+ * `atlas migrate <vendor> [step] [path]` and `atlas migrate export <vendor> [path]`
+ * for every vendor with a plugin. With no step the whole program runs (see
+ * orchestrator.ts); a step runs on its own, reading and updating the same
+ * state file, so `export` today and `import` tomorrow work.
+ */
+/** Steps a user can run on their own. */
+exports.SINGLE_STEPS = ['config', 'export', 'import', 'bridge', 'lazy', 'verify'];
+function knownVendors() {
+    (0, builtins_1.registerBuiltInPlugins)();
+    return (0, registry_1.migrationPlugins)().map((p) => p.vendor);
+}
+/** True when `vendor` names a registered plugin. */
+function hasPlugin(vendor) {
+    (0, builtins_1.registerBuiltInPlugins)();
+    return !!vendor && !!(0, registry_1.migrationPlugin)(vendor);
+}
+/**
+ * Dispatch `atlas migrate <vendor> …`. `positionals` are the words after
+ * `migrate` (`[vendor, step?, path?]`); a word that is not a step is the path.
+ */
+async function migrateWithPlugin(ctx, args, vendor, rest) {
+    (0, builtins_1.registerBuiltInPlugins)();
+    const plugin = (0, registry_1.migrationPlugin)(vendor);
+    if (!plugin)
+        throw new errors_1.CliError(`No migration plugin for '${vendor}'. Vendors: ${knownVendors().join(', ')}, better-auth.`);
+    const [first, second] = rest;
+    const step = first && exports.SINGLE_STEPS.includes(first) ? first : undefined;
+    const path = step ? second : first;
+    if (step === 'config' && !plugin.config)
+        throw new errors_1.CliError(`${plugin.label} has no configuration translator yet.`);
+    if ((step === 'export' || step === 'import') && !plugin.export)
+        throw new errors_1.CliError(`${plugin.label} has no exporter yet.`);
+    if (step === 'bridge' && !plugin.bridge)
+        throw new errors_1.CliError(`${plugin.label} has no session bridge preset.`);
+    if (step === 'lazy' && !plugin.lazy)
+        throw new errors_1.CliError(`${plugin.label} has no lazy-migration preset.`);
+    return (0, orchestrator_1.migrateVendor)(ctx, args, plugin, path, step);
+}
+/** `atlas migrate export <vendor> [path]` — an alias of `atlas migrate <vendor> export [path]`. */
+async function migrateExportAlias(ctx, args, rest) {
+    const [vendor, path] = rest;
+    if (!vendor)
+        throw new errors_1.CliError(`migrate export needs a vendor: ${knownVendors().join(', ')}.`);
+    return migrateWithPlugin(ctx, args, vendor, path ? ['export', path] : ['export']);
+}
+//# sourceMappingURL=commands.js.map

package/dist/migrate/framework/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../src/migrate/framework/commands.ts"],"names":[],"mappings":";;;AAiBA,oCAGC;AAGD,8BAGC;AAMD,8CAYC;AAGD,gDAIC;AAjDD,yCAAwC;AACxC,yCAAoD;AACpD,iDAAkE;AAClE,yCAA+D;AAE/D;;;;;GAKG;AAEH,yCAAyC;AAC5B,QAAA,YAAY,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAEhG,SAAgB,YAAY;IAC1B,IAAA,iCAAsB,GAAE,CAAC;IACzB,OAAO,IAAA,2BAAgB,GAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,oDAAoD;AACpD,SAAgB,SAAS,CAAC,MAA0B;IAClD,IAAA,iCAAsB,GAAE,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAe,EAAE,IAAgB,EAAE,MAAc,EAAE,IAAc;IACvG,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,MAAM,GAAG,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,4BAA4B,MAAM,eAAe,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC5H,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,IAAK,oBAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACnC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,uCAAuC,CAAC,CAAC;IACpH,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,uBAAuB,CAAC,CAAC;IAC3H,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,gCAAgC,CAAC,CAAC;IAC7G,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,gCAAgC,CAAC,CAAC;IACzG,OAAO,IAAA,4BAAa,EAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,mGAAmG;AAC5F,KAAK,UAAU,kBAAkB,CAAC,GAAe,EAAE,IAAgB,EAAE,IAAc;IACxF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,kCAAkC,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,OAAO,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/migrate/framework/custom.d.ts

@@ -0,0 +1,12 @@
+import { type CanonicalModel } from '@atlasauth/migrate';
+import type { MigrationPlugin } from './plugin';
+export interface CanonicalFileRecord {
+    model: CanonicalModel;
+    data: Record<string, unknown>;
+}
+/** Parse NDJSON or a JSON array of `{ model, data }`. Unknown models are returned in `unknown`. */
+export declare function parseCanonicalRecords(text: string): {
+    records: CanonicalFileRecord[];
+    unknown: Record<string, number>;
+};
+export declare const customPlugin: MigrationPlugin;