@atlasauth/cli 0.11.0 → 0.12.0

package/dist/migrate/export/frameworks/authjs.js

@@ -0,0 +1,146 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTHJS_TABLES = void 0;
+exports.exportAuthJs = exportAuthJs;
+const tables_1 = require("./tables");
+exports.AUTHJS_TABLES = {
+    user: ['User', 'users', 'user', 'next_auth.users'],
+    account: ['Account', 'accounts', 'account', 'next_auth.accounts'],
+    session: ['Session', 'sessions', 'session', 'next_auth.sessions'],
+    authenticator: ['Authenticator', 'authenticators', 'authenticator'],
+};
+const PASSWORD_COLUMNS = ['password', 'passwordHash', 'password_hash', 'hashedPassword', 'hashed_password', 'encryptedPassword'];
+function exportAuthJs(tables, options = {}) {
+    const out = new tables_1.FrameworkExport();
+    const now = (options.now ?? new Date()).getTime();
+    const users = tables.find(...exports.AUTHJS_TABLES.user);
+    if (!users) {
+        out.warn(`No users table found (looked for ${exports.AUTHJS_TABLES.user.join(', ')}).`);
+        return out;
+    }
+    const userIds = new Set();
+    let passwordsCarried = 0;
+    let passwordsUnknown = 0;
+    for (const row of users.rows) {
+        const id = (0, tables_1.text)((0, tables_1.col)(row, 'id', '_id'));
+        const email = (0, tables_1.text)((0, tables_1.col)(row, 'email'));
+        if (!id) {
+            out.omit('user', 'row without an id');
+            continue;
+        }
+        const verifiedAt = (0, tables_1.col)(row, 'emailVerified', 'email_verified');
+        const name = (0, tables_1.text)((0, tables_1.col)(row, 'name'));
+        const digest = (0, tables_1.text)(options.passwordColumn ? (0, tables_1.col)(row, options.passwordColumn) : (0, tables_1.col)(row, ...PASSWORD_COLUMNS));
+        let password;
+        if (digest) {
+            const known = (0, tables_1.selfDescribingHash)(digest);
+            if (known) {
+                password = known;
+                passwordsCarried++;
+            }
+            else
+                passwordsUnknown++;
+        }
+        if (!email) {
+            out.omit('user', 'no email address (Auth.js users without one cannot sign in to Atlas by email)');
+            continue;
+        }
+        userIds.add(id);
+        out.add('user', {
+            id,
+            emails: [{ email: email.toLowerCase(), verified: Boolean(verifiedAt) && verifiedAt !== false && verifiedAt !== 'false', primary: true }],
+            name,
+            ...(0, tables_1.splitName)(name),
+            image_url: (0, tables_1.text)((0, tables_1.col)(row, 'image')),
+            password,
+            created_at: (0, tables_1.time)((0, tables_1.col)(row, 'createdAt', 'created_at')),
+        });
+    }
+    if (passwordsCarried)
+        out.warn(`${passwordsCarried} Credentials-provider password hash(es) carried over; they verify on first sign-in and are upgraded to Argon2id.`);
+    if (passwordsUnknown) {
+        out.warn(`${passwordsUnknown} password value(s) are not a hash format Atlas verifies (bcrypt, Argon2, scrypt salt:key, PBKDF2): those users reset their password, or use lazy migration against your old /api/auth/callback/credentials.`);
+    }
+    const providers = new Set();
+    for (const row of tables.rows(...exports.AUTHJS_TABLES.account)) {
+        const userId = (0, tables_1.text)((0, tables_1.col)(row, 'userId', 'user_id'));
+        const provider = (0, tables_1.text)((0, tables_1.col)(row, 'provider'));
+        const subject = (0, tables_1.text)((0, tables_1.col)(row, 'providerAccountId', 'provider_account_id'));
+        const type = (0, tables_1.text)((0, tables_1.col)(row, 'type')) ?? 'oauth';
+        if (!userId || !provider || !subject || !userIds.has(userId)) {
+            out.omit('identity', 'account row without a known user, provider or providerAccountId');
+            continue;
+        }
+        if (type === 'email' || type === 'credentials' || type === 'webauthn')
+            continue;
+        providers.add(provider);
+        const expiresAt = (0, tables_1.col)(row, 'expires_at', 'expiresAt');
+        out.add('identity', {
+            user_id: userId,
+            provider,
+            provider_user_id: subject,
+            kind: type === 'oidc' ? 'oidc' : 'oauth',
+            ...(options.oauthTokens
+                ? {
+                    access_token: (0, tables_1.text)((0, tables_1.col)(row, 'access_token', 'accessToken')),
+                    refresh_token: (0, tables_1.text)((0, tables_1.col)(row, 'refresh_token', 'refreshToken')),
+                    // Auth.js stores expires_at in epoch SECONDS.
+                    expires_at: expiresAt !== undefined ? (0, tables_1.time)(Number(expiresAt) * (Number(expiresAt) < 1e11 ? 1000 : 1)) : undefined,
+                }
+                : {}),
+            scopes: (0, tables_1.text)((0, tables_1.col)(row, 'scope'))?.split(/[\s,]+/).filter(Boolean),
+        });
+    }
+    out.manifest.providers = [...providers].sort();
+    const authenticators = tables.rows(...exports.AUTHJS_TABLES.authenticator);
+    if (authenticators.length && !options.rpId) {
+        out.omit('passkey', 'no RP id given (--rp-id): a passkey only works on the domain it was registered for', authenticators.length);
+    }
+    else {
+        for (const row of authenticators) {
+            const userId = (0, tables_1.text)((0, tables_1.col)(row, 'userId', 'user_id'));
+            const credentialId = (0, tables_1.base64url)((0, tables_1.col)(row, 'credentialID', 'credential_id', 'credentialId'));
+            const publicKey = (0, tables_1.base64url)((0, tables_1.col)(row, 'credentialPublicKey', 'credential_public_key'));
+            if (!userId || !userIds.has(userId) || !credentialId || !publicKey) {
+                out.omit('passkey', 'authenticator row without a known user, credential id or public key');
+                continue;
+            }
+            const transports = (0, tables_1.text)((0, tables_1.col)(row, 'transports'));
+            out.add('passkey', {
+                user_id: userId,
+                credential_id: credentialId,
+                public_key: publicKey,
+                sign_count: Number((0, tables_1.col)(row, 'counter') ?? 0) || 0,
+                rp_id: options.rpId,
+                transports: transports ? transports.split(/[\s,]+/).filter(Boolean) : undefined,
+                backed_up: (0, tables_1.bool)((0, tables_1.col)(row, 'credentialBackedUp', 'credential_backed_up')),
+            });
+        }
+        if (options.rpId)
+            out.manifest.rpId = options.rpId;
+    }
+    if (options.sessions !== false) {
+        for (const row of tables.rows(...exports.AUTHJS_TABLES.session)) {
+            const token = (0, tables_1.text)((0, tables_1.col)(row, 'sessionToken', 'session_token'));
+            const userId = (0, tables_1.text)((0, tables_1.col)(row, 'userId', 'user_id'));
+            const expires = (0, tables_1.timeMs)((0, tables_1.col)(row, 'expires', 'expires_at', 'expiresAt'));
+            if (!token || !userId || !userIds.has(userId) || expires === undefined) {
+                out.omit('session', 'session row without a token, a known user or an expiry');
+                continue;
+            }
+            if (expires <= now) {
+                out.omit('session', 'expired');
+                continue;
+            }
+            out.add('session', {
+                id: (0, tables_1.text)((0, tables_1.col)(row, 'id', '_id')) ?? (0, tables_1.sha256Hex)(token).slice(0, 32),
+                user_id: userId,
+                token_hash: (0, tables_1.sha256Hex)(token),
+                expires_at: new Date(expires).toISOString(),
+            });
+        }
+    }
+    out.manifest.settings = { session_cookie: ['authjs.session-token', 'next-auth.session-token'] };
+    return out;
+}
+//# sourceMappingURL=authjs.js.map

package/dist/migrate/export/frameworks/authjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authjs.js","sourceRoot":"","sources":["../../../../src/migrate/export/frameworks/authjs.ts"],"names":[],"mappings":";;;AAyDA,oCAoIC;AA7LD,qCAYkB;AAoCL,QAAA,aAAa,GAAG;IAC3B,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC;IAClD,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,CAAC;IACjE,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,CAAC;IACjE,aAAa,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,eAAe,CAAC;CAC3D,CAAC;AAEX,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AAEjI,SAAgB,YAAY,CAAC,MAAc,EAAE,UAA+B,EAAE;IAC5E,MAAM,GAAG,GAAG,IAAI,wBAAe,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAa,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,oCAAoC,qBAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,IAAA,YAAG,EAAC,GAAG,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAA,aAAI,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,YAAG,EAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAA,YAAG,EAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC;QAC/G,IAAI,QAAyD,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,IAAA,2BAAkB,EAAC,MAAM,CAAC,CAAC;YACzC,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,GAAG,KAAK,CAAC;gBACjB,gBAAgB,EAAE,CAAC;YACrB,CAAC;;gBAAM,gBAAgB,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,+EAA+E,CAAC,CAAC;YAClG,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE;YACd,EAAE;YACF,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACxI,IAAI;YACJ,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC;YAClB,SAAS,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAClC,QAAQ;YACR,UAAU,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,gBAAgB;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,gBAAgB,kHAAkH,CAAC,CAAC;IACtK,IAAI,gBAAgB,EAAE,CAAC;QACrB,GAAG,CAAC,IAAI,CACN,GAAG,gBAAgB,6MAA6M,CACjO,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,iEAAiE,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,UAAU;YAAE,SAAS;QAChF,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,IAAA,YAAG,EAAC,GAAG,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QACtD,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE;YAClB,OAAO,EAAE,MAAM;YACf,QAAQ;YACR,gBAAgB,EAAE,OAAO;YACzB,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACxC,GAAG,CAAC,OAAO,CAAC,WAAW;gBACrB,CAAC,CAAC;oBACE,YAAY,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;oBAC3D,aAAa,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;oBAC9D,8CAA8C;oBAC9C,UAAU,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAA,aAAI,EAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;iBAClH;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAE/C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAa,CAAC,aAAa,CAAC,CAAC;IACnE,IAAI,cAAc,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,oFAAoF,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACnI,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,IAAA,kBAAS,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;YAC1F,MAAM,SAAS,GAAG,IAAA,kBAAS,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,qBAAqB,EAAE,uBAAuB,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,qEAAqE,CAAC,CAAC;gBAC3F,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE;gBACjB,OAAO,EAAE,MAAM;gBACf,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,MAAM,CAAC,IAAA,YAAG,EAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;gBACjD,KAAK,EAAE,OAAO,CAAC,IAAK;gBACpB,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/E,SAAS,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,IAAI;YAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,IAAA,eAAM,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACvE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,wDAAwD,CAAC,CAAC;gBAC9E,SAAS;YACX,CAAC;YACD,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE;gBACjB,EAAE,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,IAAA,kBAAS,EAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAChE,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,IAAA,kBAAS,EAAC,KAAK,CAAC;gBAC5B,UAAU,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,EAAE,cAAc,EAAE,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,EAAE,CAAC;IAChG,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/frameworks/devise.d.ts

@@ -0,0 +1,39 @@
+import { FrameworkExport, type Tables } from './tables';
+/**
+ * Devise (Rails) → canonical records, from the rows the Rails runner script
+ * ({@link DEVISE_EXPORT_SCRIPT}) streams out of the app with its own models —
+ * so attributes Rails encrypts (devise-two-factor's `otp_secret` under Active
+ * Record encryption or attr_encrypted) arrive decrypted, and the Devise config
+ * (pepper, stretches, the modules each model enables) comes along.
+ *
+ *   users            → user: email + confirmable (`confirmed_at`), the bcrypt
+ *                      `encrypted_password` (with `config.pepper` when set),
+ *                      lockable (`locked_at`), trackable timestamps
+ *   omniauth         → identity: `provider`/`uid` on users, or an
+ *                      `identities` / `authentications` table
+ *   devise-two-factor → mfa_factor totp (`otp_secret`) + backup codes (their
+ *                      Devise-bcrypt digests, verified like passwords)
+ *   rolify / `admin`  → app roles
+ *   activerecord-session_store → session (the cookie store has no rows: the
+ *                      bridge decrypts the `_<app>_session` cookie instead)
+ *
+ * devise-encryptable digests (sha1 / sha512 / authlogic / restful_authentication)
+ * are not carried: those users reset their password or migrate lazily.
+ */
+export interface DeviseExportOptions {
+    /** The Warden scope / model table (default `users`). */
+    usersTable?: string;
+    /** Treat emails as verified when the model does not use :confirmable. Default false. */
+    trustUnconfirmable?: boolean;
+    sessions?: boolean;
+    now?: Date;
+}
+export declare function exportDevise(tables: Tables, options?: DeviseExportOptions): FrameworkExport;
+/**
+ * The Rails runner script that streams a Devise app's rows as NDJSON
+ * (`{"table": …, "row": {…}}`), straight into `atlas migrate export devise
+ * --file -`, so decrypted secrets only ever travel through the pipe:
+ *
+ *   bin/rails runner atlas_export.rb | npx atlas migrate devise export --file -
+ */
+export declare const DEVISE_EXPORT_SCRIPT = "# Atlas export for a Devise app. Run: bin/rails runner atlas_export.rb [ModelName]\nrequire \"json\"\n\nmodel = (ARGV[0] || \"User\").constantize\nemit = ->(table, row) { $stdout.puts({ table: table, row: row }.to_json) }\n\nsession_key = Rails.application.config.session_options[:key] rescue nil\nemit.call(\"devise_config\", {\n  devise_version: Devise::VERSION,\n  pepper: Devise.pepper,\n  stretches: Devise.stretches,\n  modules: model.devise_modules.join(\",\"),\n  session_store: Rails.application.config.session_store.to_s.demodulize.underscore,\n  session_key: session_key,\n  session_ttl_seconds: (Rails.application.config.session_options[:expire_after] || 1209600).to_i,\n})\n\nattrs = model.column_names - %w[encrypted_otp_secret encrypted_otp_secret_iv encrypted_otp_secret_salt]\nmodel.find_each(batch_size: 1000) do |u|\n  row = attrs.index_with { |c| u.read_attribute(c) }\n  # devise-two-factor: read the secret through the model so Rails decrypts it.\n  row[\"otp_secret\"] = u.otp_secret if u.respond_to?(:otp_secret)\n  emit.call(model.table_name, row)\nend\n\n%w[Identity Authentication].each do |name|\n  next unless Object.const_defined?(name)\n  klass = name.constantize\n  next unless klass < ActiveRecord::Base\n  klass.find_each { |i| emit.call(klass.table_name, i.attributes.slice(\"user_id\", \"provider\", \"uid\", \"email\")) }\nend\n\nif Object.const_defined?(:Role) && ActiveRecord::Base.connection.table_exists?(\"users_roles\")\n  Role.find_each { |r| emit.call(\"roles\", r.attributes.slice(\"id\", \"name\", \"resource_type\", \"resource_id\")) }\n  ActiveRecord::Base.connection.select_all(\"SELECT user_id, role_id FROM users_roles\").each { |r| emit.call(\"users_roles\", r) }\nend\n\nif defined?(ActiveRecord::SessionStore::Session)\n  scope = \"warden.user.#{Devise::Mapping.find_scope!(model)}.key\"\n  ActiveRecord::SessionStore::Session.find_each do |s|\n    entry = s.data[scope] rescue nil\n    next unless entry\n    emit.call(\"sessions\", { session_id: s.session_id, user_id: Array(entry[0]).first, updated_at: s.updated_at })\n  end\nend\n";

package/dist/migrate/export/frameworks/devise.js

@@ -0,0 +1,218 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVISE_EXPORT_SCRIPT = void 0;
+exports.exportDevise = exportDevise;
+const tables_1 = require("./tables");
+function exportDevise(tables, options = {}) {
+    const out = new tables_1.FrameworkExport();
+    const now = (options.now ?? new Date()).getTime();
+    const config = tables.rows('devise_config')[0] ?? {};
+    const pepper = (0, tables_1.text)(config.pepper);
+    const modules = new Set(String(config.modules ?? '').split(/[\s,]+/).filter(Boolean));
+    const confirmable = modules.size ? modules.has('confirmable') : undefined;
+    out.manifest.sourceVersion = (0, tables_1.text)(config.devise_version) ? `devise ${(0, tables_1.text)(config.devise_version)}` : 'devise';
+    if (pepper)
+        out.manifest.settings = { pepper_set: true };
+    const users = tables.find(...(options.usersTable ? [options.usersTable] : ['users', 'user', 'accounts', 'admins']));
+    if (!users) {
+        out.warn('No users rows found (run the Rails export script with your Devise model).');
+        return out;
+    }
+    const ids = new Set();
+    const providers = new Set();
+    let encryptable = 0;
+    let mfa = 0;
+    for (const row of users.rows) {
+        const id = (0, tables_1.text)((0, tables_1.col)(row, 'id'));
+        const email = (0, tables_1.text)((0, tables_1.col)(row, 'email'))?.toLowerCase();
+        if (!id || !email) {
+            out.omit('user', 'row without an id or email');
+            continue;
+        }
+        const encrypted = (0, tables_1.text)((0, tables_1.col)(row, 'encrypted_password'));
+        let password;
+        if (encrypted && /^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/.test(encrypted)) {
+            password = pepper ? { algorithm: 'bcrypt_pepper', hash: encrypted, params: { pepper } } : { algorithm: 'bcrypt', hash: encrypted };
+        }
+        else if (encrypted)
+            encryptable++;
+        const confirmedAt = (0, tables_1.col)(row, 'confirmed_at');
+        const verified = confirmable === false || (confirmable === undefined && !('confirmed_at' in row))
+            ? options.trustUnconfirmable === true
+            : Boolean(confirmedAt);
+        const name = (0, tables_1.text)((0, tables_1.col)(row, 'name', 'full_name'));
+        const roles = new Set();
+        if ((0, tables_1.bool)((0, tables_1.col)(row, 'admin', 'is_admin')))
+            roles.add('admin');
+        const role = (0, tables_1.text)((0, tables_1.col)(row, 'role'));
+        if (role)
+            roles.add(role);
+        ids.add(id);
+        out.add('user', {
+            id,
+            emails: [{ email, verified, primary: true }],
+            username: (0, tables_1.text)((0, tables_1.col)(row, 'username')),
+            name,
+            first_name: (0, tables_1.text)((0, tables_1.col)(row, 'first_name')) ?? (0, tables_1.splitName)(name).first_name,
+            last_name: (0, tables_1.text)((0, tables_1.col)(row, 'last_name')) ?? (0, tables_1.splitName)(name).last_name,
+            password,
+            locked: Boolean((0, tables_1.col)(row, 'locked_at')) || undefined,
+            roles: roles.size ? [...roles] : undefined,
+            created_at: (0, tables_1.time)((0, tables_1.col)(row, 'created_at')),
+            last_sign_in_at: (0, tables_1.time)((0, tables_1.col)(row, 'current_sign_in_at', 'last_sign_in_at')),
+            private_metadata: (0, tables_1.text)((0, tables_1.col)(row, 'unconfirmed_email')) ? { unconfirmed_email: (0, tables_1.text)((0, tables_1.col)(row, 'unconfirmed_email')) } : undefined,
+        });
+        // omniauth's single-provider convention: provider + uid columns on the user.
+        const provider = (0, tables_1.text)((0, tables_1.col)(row, 'provider'));
+        const uid = (0, tables_1.text)((0, tables_1.col)(row, 'uid'));
+        if (provider && uid && provider !== 'email') {
+            providers.add(provider);
+            out.add('identity', { user_id: id, provider, provider_user_id: uid, kind: 'oauth' });
+        }
+        // devise-two-factor.
+        const secret = (0, tables_1.text)((0, tables_1.col)(row, 'otp_secret'));
+        if (secret && ((0, tables_1.bool)((0, tables_1.col)(row, 'otp_required_for_login')) || !('otp_required_for_login' in row))) {
+            mfa++;
+            out.add('mfa_factor', { user_id: id, type: 'totp', secret_base32: secret.toUpperCase(), digits: 6, period: 30, algorithm: 'SHA1', verified: true });
+            const codes = backupCodes((0, tables_1.col)(row, 'otp_backup_codes'));
+            if (codes.length) {
+                out.add('mfa_factor', {
+                    user_id: id,
+                    type: 'backup_codes',
+                    backup_code_hashes: codes.map((hash) => pepper ? { algorithm: 'bcrypt_pepper', hash, params: { pepper } } : { algorithm: 'bcrypt', hash }),
+                });
+            }
+        }
+    }
+    if (encryptable)
+        out.warn(`${encryptable} encrypted_password value(s) are not bcrypt (devise-encryptable): those users reset their password or migrate lazily.`);
+    if (mfa)
+        out.warn(`${mfa} devise-two-factor TOTP secret(s) carried over; authenticator apps keep working.`);
+    for (const row of tables.rows('identities', 'authentications', 'user_identities', 'omniauth_identities')) {
+        const userId = (0, tables_1.text)((0, tables_1.col)(row, 'user_id'));
+        const provider = (0, tables_1.text)((0, tables_1.col)(row, 'provider'));
+        const uid = (0, tables_1.text)((0, tables_1.col)(row, 'uid', 'provider_uid'));
+        if (!userId || !provider || !uid || !ids.has(userId)) {
+            out.omit('identity', 'identity row without a known user, provider or uid');
+            continue;
+        }
+        providers.add(provider);
+        out.add('identity', { user_id: userId, provider, provider_user_id: uid, kind: 'oauth', email: (0, tables_1.text)((0, tables_1.col)(row, 'email')) });
+    }
+    out.manifest.providers = [...providers].sort();
+    // rolify: roles(id, name, resource_type, resource_id) + users_roles(user_id, role_id). Global roles only.
+    const roleNames = new Map();
+    for (const r of tables.rows('roles')) {
+        const rid = (0, tables_1.text)((0, tables_1.col)(r, 'id'));
+        const name = (0, tables_1.text)((0, tables_1.col)(r, 'name'));
+        if (rid && name && !(0, tables_1.text)((0, tables_1.col)(r, 'resource_type')))
+            roleNames.set(rid, name);
+    }
+    if (roleNames.size) {
+        for (const name of new Set(roleNames.values()))
+            out.add('role', { key: name, name, scope: 'app' });
+        const extra = new Map();
+        for (const ur of tables.rows('users_roles')) {
+            const uid = (0, tables_1.text)((0, tables_1.col)(ur, 'user_id'));
+            const name = roleNames.get((0, tables_1.text)((0, tables_1.col)(ur, 'role_id')) ?? '');
+            if (!uid || !name || !ids.has(uid))
+                continue;
+            const set = extra.get(uid) ?? new Set();
+            set.add(name);
+            extra.set(uid, set);
+        }
+        for (const user of out.list('user')) {
+            const more = extra.get(user.id);
+            if (more)
+                user.roles = [...new Set([...(user.roles ?? []), ...more])];
+        }
+        const scoped = tables.rows('roles').length - roleNames.size;
+        if (scoped > 0)
+            out.warn(`${scoped} rolify role(s) scoped to a resource were not carried: model them as Atlas organization roles or permissions.`);
+    }
+    // activerecord-session_store rows, as the export script decoded them.
+    if (options.sessions !== false) {
+        for (const row of tables.rows('sessions')) {
+            const raw = (0, tables_1.text)((0, tables_1.col)(row, 'session_id'));
+            const userId = (0, tables_1.text)((0, tables_1.col)(row, 'user_id'));
+            const updated = (0, tables_1.timeMs)((0, tables_1.col)(row, 'expires_at')) ?? ((0, tables_1.timeMs)((0, tables_1.col)(row, 'updated_at')) !== undefined ? (0, tables_1.timeMs)((0, tables_1.col)(row, 'updated_at')) + Number(config.session_ttl_seconds ?? 1209600) * 1000 : undefined);
+            if (!raw || !userId || !ids.has(userId) || updated === undefined) {
+                out.omit('session', 'session row without an id, a known user or an expiry');
+                continue;
+            }
+            if (updated <= now) {
+                out.omit('session', 'expired');
+                continue;
+            }
+            // Rack stores the PRIVATE id `2::<sha256 hex of the cookie's public id>`.
+            const tokenHash = /^2::[0-9a-f]{64}$/.test(raw) ? raw.slice(3) : (0, tables_1.sha256Hex)(raw);
+            out.add('session', { id: tokenHash.slice(0, 32), user_id: userId, token_hash: tokenHash, expires_at: new Date(updated).toISOString() });
+        }
+    }
+    out.manifest.settings = {
+        ...(out.manifest.settings ?? {}),
+        session_store: (0, tables_1.text)(config.session_store) ?? 'cookie_store',
+        session_cookie: (0, tables_1.text)(config.session_key) ?? null,
+    };
+    return out;
+}
+function backupCodes(v) {
+    const list = Array.isArray(v) ? v : typeof v === 'string' ? (v.trim().startsWith('[') ? JSON.parse(v) : v.replace(/^\{|\}$/g, '').split(',')) : [];
+    return list
+        .map((c) => String(c).replace(/^"|"$/g, '').trim())
+        .filter((c) => /^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/.test(c));
+}
+/**
+ * The Rails runner script that streams a Devise app's rows as NDJSON
+ * (`{"table": …, "row": {…}}`), straight into `atlas migrate export devise
+ * --file -`, so decrypted secrets only ever travel through the pipe:
+ *
+ *   bin/rails runner atlas_export.rb | npx atlas migrate devise export --file -
+ */
+exports.DEVISE_EXPORT_SCRIPT = `# Atlas export for a Devise app. Run: bin/rails runner atlas_export.rb [ModelName]
+require "json"
+
+model = (ARGV[0] || "User").constantize
+emit = ->(table, row) { $stdout.puts({ table: table, row: row }.to_json) }
+
+session_key = Rails.application.config.session_options[:key] rescue nil
+emit.call("devise_config", {
+  devise_version: Devise::VERSION,
+  pepper: Devise.pepper,
+  stretches: Devise.stretches,
+  modules: model.devise_modules.join(","),
+  session_store: Rails.application.config.session_store.to_s.demodulize.underscore,
+  session_key: session_key,
+  session_ttl_seconds: (Rails.application.config.session_options[:expire_after] || 1209600).to_i,
+})
+
+attrs = model.column_names - %w[encrypted_otp_secret encrypted_otp_secret_iv encrypted_otp_secret_salt]
+model.find_each(batch_size: 1000) do |u|
+  row = attrs.index_with { |c| u.read_attribute(c) }
+  # devise-two-factor: read the secret through the model so Rails decrypts it.
+  row["otp_secret"] = u.otp_secret if u.respond_to?(:otp_secret)
+  emit.call(model.table_name, row)
+end
+
+%w[Identity Authentication].each do |name|
+  next unless Object.const_defined?(name)
+  klass = name.constantize
+  next unless klass < ActiveRecord::Base
+  klass.find_each { |i| emit.call(klass.table_name, i.attributes.slice("user_id", "provider", "uid", "email")) }
+end
+
+if Object.const_defined?(:Role) && ActiveRecord::Base.connection.table_exists?("users_roles")
+  Role.find_each { |r| emit.call("roles", r.attributes.slice("id", "name", "resource_type", "resource_id")) }
+  ActiveRecord::Base.connection.select_all("SELECT user_id, role_id FROM users_roles").each { |r| emit.call("users_roles", r) }
+end
+
+if defined?(ActiveRecord::SessionStore::Session)
+  scope = "warden.user.#{Devise::Mapping.find_scope!(model)}.key"
+  ActiveRecord::SessionStore::Session.find_each do |s|
+    entry = s.data[scope] rescue nil
+    next unless entry
+    emit.call("sessions", { session_id: s.session_id, user_id: Array(entry[0]).first, updated_at: s.updated_at })
+  end
+end
+`;
+//# sourceMappingURL=devise.js.map

package/dist/migrate/export/frameworks/devise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devise.js","sourceRoot":"","sources":["../../../../src/migrate/export/frameworks/devise.ts"],"names":[],"mappings":";;;AA0CA,oCAkJC;AA5LD,qCAUkB;AAgClB,SAAgB,YAAY,CAAC,MAAc,EAAE,UAA+B,EAAE;IAC5E,MAAM,GAAG,GAAG,IAAI,wBAAe,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,IAAA,aAAI,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,GAAG,CAAC,QAAQ,CAAC,aAAa,GAAG,IAAA,aAAI,EAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,IAAA,aAAI,EAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9G,IAAI,MAAM;QAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACtF,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACvD,IAAI,QAA0F,CAAC;QAC/F,IAAI,SAAS,IAAI,sCAAsC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxE,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACrI,CAAC;aAAM,IAAI,SAAS;YAAE,WAAW,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,IAAA,YAAG,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,WAAW,KAAK,KAAK,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;YAC/F,CAAC,CAAC,OAAO,CAAC,kBAAkB,KAAK,IAAI;YACrC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,IAAI,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QACpC,IAAI,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE;YACd,EAAE;YACF,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC5C,QAAQ,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACpC,IAAI;YACJ,UAAU,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,CAAC,UAAU;YACtE,SAAS,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,WAAW,CAAC,CAAC,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,CAAC,SAAS;YACnE,QAAQ;YACR,MAAM,EAAE,OAAO,CAAC,IAAA,YAAG,EAAC,GAAG,EAAE,WAAW,CAAC,CAAC,IAAI,SAAS;YACnD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1C,UAAU,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACxC,eAAe,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YACxE,gBAAgB,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;SAC/H,CAAC,CAAC;QACH,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAClC,IAAI,QAAQ,IAAI,GAAG,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC5C,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,qBAAqB;QACrB,MAAM,MAAM,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,CAAC,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC,IAAI,CAAC,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/F,GAAG,EAAE,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACpJ,MAAM,KAAK,GAAG,WAAW,CAAC,IAAA,YAAG,EAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE;oBACpB,OAAO,EAAE,EAAE;oBACX,IAAI,EAAE,cAAc;oBACpB,kBAAkB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAClG;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,uHAAuH,CAAC,CAAC;IACjK,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,kFAAkF,CAAC,CAAC;IAE5G,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACzG,MAAM,MAAM,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,oDAAoD,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAE/C,0GAA0G;IAC1G,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC7C,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACd,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,IAAI;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC;QAC5D,IAAI,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,+GAA+G,CAAC,CAAC;IACrJ,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,IAAA,eAAM,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,IAAA,eAAM,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAA,eAAM,EAAC,IAAA,YAAG,EAAC,GAAG,EAAE,YAAY,CAAC,CAAE,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,sDAAsD,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;YACD,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,0EAA0E;YAC1E,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,kBAAS,EAAC,GAAG,CAAC,CAAC;YAChF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC1I,CAAC;IACH,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG;QACtB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;QAChC,aAAa,EAAE,IAAA,aAAI,EAAC,MAAM,CAAC,aAAa,CAAC,IAAI,cAAc;QAC3D,cAAc,EAAE,IAAA,aAAI,EAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI;KACjD,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAe,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClK,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAClD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACU,QAAA,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CnC,CAAC"}

package/dist/migrate/export/frameworks/django.d.ts

@@ -0,0 +1,45 @@
+import { FrameworkExport, type Row, type Tables } from './tables';
+/**
+ * Django (django.contrib.auth, django-allauth) → canonical records, from
+ * `manage.py dumpdata` JSON (`[{ "model", "pk", "fields" }]`) — or the export
+ * script ({@link DJANGO_EXPORT_SCRIPT}), which runs the same dump inside the
+ * app and adds what only the app's own code can produce: allauth TOTP secrets
+ * through the MFA adapter's `decrypt`, and the unused recovery codes.
+ *
+ *   auth.user (or your AUTH_USER_MODEL) → user: the `password` column verbatim
+ *       (pbkdf2_sha256 / argon2 / bcrypt_sha256 / scrypt / legacy md5+sha1 —
+ *       every Django hasher Atlas verifies); `!`-prefixed unusable passwords are
+ *       dropped; is_active=false → banned; is_staff / is_superuser and groups →
+ *       app roles
+ *   account.emailaddress → every address with its verified / primary flags
+ *   socialaccount.socialaccount (+ socialtoken) → identity
+ *   mfa.authenticator → totp, recovery codes (script), WebAuthn passkeys
+ *   sessions.session (database backend) → session (sha256 of the session key)
+ */
+export interface DjangoExportOptions {
+    /** `app_label.model` of AUTH_USER_MODEL (detected: a model with a `password` field and `username` or `email`). */
+    userModel?: string;
+    /** The WebAuthn RP id allauth registered passkeys against. */
+    rpId?: string;
+    oauthTokens?: boolean;
+    sessions?: boolean;
+    /** Treat users.email as verified when allauth is absent. Default false. */
+    trustEmails?: boolean;
+    now?: Date;
+}
+export declare function exportDjango(tables: Tables, options?: DjangoExportOptions): FrameworkExport;
+/**
+ * Decode `django_session.session_data` without the SECRET_KEY (the rows come
+ * from the app's own database): Django ≥ 3.1 `signing.dumps` (`payload:ts:sig`,
+ * payload zlib-compressed when it starts with `.`), and the pre-3.1 form,
+ * base64(`<hash>:<json>`).
+ */
+export declare function decodeSessionData(raw: string): Row | null;
+/**
+ * The export script, run inside the Django app so allauth's own code decrypts
+ * TOTP secrets and lists the unused recovery codes; it streams NDJSON straight
+ * into the CLI:
+ *
+ *   python manage.py shell < atlas_export.py | npx atlas migrate django export --file -
+ */
+export declare const DJANGO_EXPORT_SCRIPT = "# Atlas export for a Django app (django.contrib.auth + django-allauth).\nimport io, json, sys\nfrom django.apps import apps\nfrom django.conf import settings\nfrom django.core.management import call_command\n\ndef emit(table, row):\n    sys.stdout.write(json.dumps({\"table\": table, \"row\": row}, default=str) + \"\\n\")\n\nlabels = [settings.AUTH_USER_MODEL, \"auth.group\", \"auth.permission\"]\nfor label in [\"account.emailaddress\", \"socialaccount.socialaccount\", \"socialaccount.socialtoken\", \"mfa.authenticator\", \"sessions.session\"]:\n    try:\n        apps.get_model(label)\n        labels.append(label)\n    except (LookupError, ValueError):\n        pass\n\nbuf = io.StringIO()\ncall_command(\"dumpdata\", *labels, format=\"json\", stdout=buf)\nfor obj in json.loads(buf.getvalue()):\n    emit(\"dumpdata\", obj)\n\ntry:\n    from allauth.mfa.models import Authenticator\n    from allauth.mfa.adapter import get_adapter\nexcept ImportError:\n    Authenticator = None\n\nif Authenticator is not None:\n    try:\n        from allauth.mfa.recovery_codes.internal.auth import RecoveryCodes\n    except ImportError:\n        try:\n            from allauth.mfa.recovery_codes import RecoveryCodes\n        except ImportError:\n            RecoveryCodes = None\n    adapter = get_adapter()\n    for a in Authenticator.objects.all():\n        if a.type == \"totp\":\n            emit(\"mfa_secrets\", {\"authenticator_id\": a.pk, \"secret\": adapter.decrypt(a.data[\"secret\"])})\n        elif a.type == \"recovery_codes\" and RecoveryCodes is not None:\n            emit(\"mfa_secrets\", {\"authenticator_id\": a.pk, \"codes\": RecoveryCodes(a).get_unused_codes()})\n";