@atlasauth/cli 0.11.0 → 0.13.0

package/dist/migrate/export/userfront.js

@@ -0,0 +1,189 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkTenantId = checkTenantId;
+exports.userfrontHttp = userfrontHttp;
+exports.exportUserfront = exportUserfront;
+exports.mapUserfrontUser = mapUserfrontUser;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+const API = 'https://api.userfront.com/v0';
+const MAX_PAGES = 100_000;
+/** First-factor strategies that are not a social login. */
+const NON_SOCIAL = new Set(['password', 'link', 'verificationCode', 'totp', 'sso', 'saml', 'passkey', 'webauthn', 'email', 'phone']);
+function checkTenantId(tenantId) {
+    const t = tenantId.trim();
+    if (!/^[A-Za-z0-9]{4,16}$/.test(t))
+        throw new Error(`Not a Userfront tenant id: ${tenantId}`);
+    return t;
+}
+function userfrontHttp(o) {
+    return new vendor_http_1.VendorHttp({
+        vendor: 'Userfront',
+        baseUrl: (o.apiBase ?? API).replace(/\/+$/, ''),
+        headers: { authorization: `Bearer ${o.apiKey}` },
+        fetchImpl: o.fetchImpl,
+        sleep: o.sleep,
+    });
+}
+async function exportUserfront(opts) {
+    const set = new record_set_1.RecordSet();
+    const tid = checkTenantId(opts.tenantId);
+    if (!/^uf_(test|live)_admin_/.test(opts.apiKey))
+        throw new Error('Userfront export needs an admin API key (uf_live_admin_… or uf_test_admin_…).');
+    const progress = opts.onProgress ?? (() => undefined);
+    const http = userfrontHttp(opts);
+    progress('organizations');
+    const orgIds = new Set();
+    await walk(async (page) => (await http.get(`/tenants/${tid}/tenants?page=${page}`)).body, (body) => (0, record_set_1.objs)(body?.results).concat((0, record_set_1.objs)(body?.tenants)), (body) => {
+        const n = body?.totalPages;
+        return typeof n === 'number' ? n : undefined;
+    }, (t) => {
+        const id = (0, record_set_1.str)(t.tenantId);
+        if (!id || id === tid || orgIds.has(id))
+            return false;
+        orgIds.add(id);
+        set.add('organization', (0, record_set_1.compact)({ id, name: (0, record_set_1.str)(t.name) ?? id, image_url: (0, record_set_1.str)(t.image), public_metadata: (0, record_set_1.bag)(t.data), created_at: (0, record_set_1.str)(t.createdAt) }), id);
+        return true;
+    });
+    progress('roles');
+    const roleNames = new Set();
+    const rolesBody = await optional(async () => (await http.get(`/tenants/${tid}/roles`)).body);
+    for (const r of (0, record_set_1.objs)(rolesBody?.roles)) {
+        const name = (0, record_set_1.str)(r.name);
+        if (name)
+            roleNames.add(name);
+    }
+    progress('users');
+    const seen = new Set();
+    let unknownOrgs = 0;
+    let mfa = 0;
+    let passkeys = 0;
+    let social = 0;
+    await walk((page) => findUsers(http, tid, page), (body) => (0, record_set_1.objs)(body?.results), (body) => {
+        const meta = body?.meta;
+        return (0, record_set_1.isObj)(meta) && typeof meta.totalPages === 'number' ? meta.totalPages : undefined;
+    }, (u) => {
+        const rawId = (0, record_set_1.str)(u.userId);
+        if (rawId && seen.has(rawId))
+            return false;
+        if (rawId)
+            seen.add(rawId);
+        const user = mapUserfrontUser(u, tid);
+        if (!user) {
+            set.omit('user', 'no email, phone number or username');
+            return true;
+        }
+        const authz = (0, record_set_1.isObj)(u.authorization) ? u.authorization : {};
+        const mine = authz[tid];
+        const own = (0, record_set_1.isObj)(mine) ? (0, record_set_1.strs)(mine.roles) : [];
+        if (own.length)
+            user.roles = own.map(translate_kit_1.keyOf);
+        for (const n of own)
+            roleNames.add(n);
+        set.add('user', user, user.id);
+        for (const [orgId, raw] of Object.entries(authz)) {
+            if (orgId === tid || !(0, record_set_1.isObj)(raw))
+                continue;
+            if (!orgIds.has(orgId)) {
+                unknownOrgs++;
+                continue;
+            }
+            const roles = (0, record_set_1.strs)(raw.roles).map(translate_kit_1.keyOf);
+            set.add('membership', { organization_id: orgId, user_id: user.id, role: roles[0] ?? 'member' }, `${orgId}:${user.id}`);
+            for (const r of (0, record_set_1.strs)(raw.roles))
+                roleNames.add(r);
+            if (roles.length > 1)
+                set.warn('Some organization members hold several Userfront roles; Atlas seats each member with one role (the first).');
+        }
+        const auth = (0, record_set_1.isObj)(u.authentication) ? u.authentication : {};
+        if (u.isMfaRequired === true || (0, record_set_1.objs)(auth.secondFactors).length > 0)
+            mfa++;
+        for (const f of (0, record_set_1.objs)(auth.firstFactors)) {
+            const strategy = (0, record_set_1.str)(f.strategy);
+            if (strategy && /passkey|webauthn/i.test(strategy))
+                passkeys++;
+            else if (strategy && !NON_SOCIAL.has(strategy))
+                social++;
+        }
+        return true;
+    });
+    if (unknownOrgs > 0) {
+        set.warn(`${unknownOrgs} organization grant(s) name a tenant that is not in the organization listing; those memberships were left out.`);
+    }
+    if (mfa > 0)
+        set.omit('mfa_factor', 'Userfront does not export second-factor secrets; members enrol again in Atlas', mfa);
+    if (passkeys > 0)
+        set.omit('passkey', 'Userfront does not export passkey public keys; register again in Atlas', passkeys);
+    if (social > 0)
+        set.omit('identity', "Userfront does not export social accounts' provider user ids: they relink by verified email on first social sign-in", social);
+    if (set.count('user') > 0) {
+        set.warn('Userfront never returns password hashes: turn on the userfront lazy-migration preset so each password moves on its first Atlas sign-in.');
+    }
+    for (const name of roleNames) {
+        const key = (0, translate_kit_1.keyOf)(name);
+        set.add('role', { key, name, scope: 'app' }, `app:${key}`);
+        if (orgIds.size > 0)
+            set.add('role', { key, name, scope: 'organization' }, `org:${key}`);
+    }
+    set.manifest = { origin: tid, settings: { tenant_id: tid } };
+    return set;
+}
+/**
+ * Walk a paged listing whose page numbering Userfront does not document: page
+ * 0 is probed, then pages go up from 1 until one is empty, past the reported
+ * total, or adds nobody new (a row seen twice is taken once).
+ */
+async function walk(get, rowsOf, totalPages, take) {
+    for (let page = 0; page < MAX_PAGES; page++) {
+        const body = await optional(() => get(page));
+        const rows = rowsOf(body);
+        let fresh = 0;
+        for (const r of rows)
+            if (take(r))
+                fresh++;
+        const pages = totalPages(body);
+        if (page > 0 && (rows.length === 0 || (pages !== undefined && page > pages)))
+            break;
+        if (page >= 2 && fresh === 0)
+            break;
+    }
+}
+async function findUsers(http, tenantId, page) {
+    return (await http.post(`/tenants/${tenantId}/users/find`, { filters: {}, page, order: [['createdAt', 'ASC']] })).body;
+}
+/** One Userfront user (users/find result) → a user record. */
+function mapUserfrontUser(u, tenantId) {
+    const id = (0, record_set_1.str)(u.userId);
+    if (!id)
+        return null;
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(u.phoneNumber);
+    const username = (0, record_set_1.str)(u.username);
+    const uuid = (0, record_set_1.str)(u.userUuid);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails: email ? [{ email, verified: u.isEmailConfirmed === true || (u.isEmailConfirmed === undefined && u.isConfirmed === true), primary: true }] : [],
+        phones: phone ? [{ phone, verified: u.isPhoneNumberConfirmed === true, primary: !email }] : [],
+        username,
+        name: (0, record_set_1.str)(u.name),
+        image_url: (0, record_set_1.str)(u.image),
+        locked: u.locked === true ? true : undefined,
+        public_metadata: (0, record_set_1.bag)(u.data),
+        private_metadata: (0, record_set_1.bag)({ ...(uuid ? { userfront_user_uuid: uuid } : {}), userfront_tenant_id: tenantId }),
+        created_at: (0, record_set_1.str)(u.createdAt),
+        last_sign_in_at: (0, record_set_1.str)(u.lastActiveAt),
+    });
+    return user.emails?.length || user.phones?.length || user.username ? user : null;
+}
+async function optional(fn) {
+    try {
+        return await fn();
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404, 405].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+//# sourceMappingURL=userfront.js.map

package/dist/migrate/export/userfront.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userfront.js","sourceRoot":"","sources":["../../../src/migrate/export/userfront.ts"],"names":[],"mappings":";;AAqCA,sCAIC;AAED,sCAQC;AAED,0CAoGC;AA6BD,4CAqBC;AA1MD,6CAA+F;AAC/F,mDAAwC;AACxC,+CAA2D;AA6B3D,MAAM,GAAG,GAAG,8BAA8B,CAAC;AAC3C,MAAM,SAAS,GAAG,OAAO,CAAC;AAC1B,2DAA2D;AAC3D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAErI,SAAgB,aAAa,CAAC,QAAgB;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,aAAa,CAAC,CAAwG;IACpI,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE;QAChD,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,IAA4B;IAChE,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IAClJ,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEjC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,IAAI,CACR,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,YAAY,GAAG,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAClF,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAA,iBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EACzD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC;QAC3B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3J,OAAO,IAAI,CAAC;IACd,CAAC,CACF,CAAC;IAEF,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EACpC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,EAC7B,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;QACxB,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM;YAAE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAK,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvB,WAAW,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,qBAAK,CAAC,CAAC;YACzC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACvH,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;QAC/I,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,EAAE,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,QAAQ,EAAE,CAAC;iBAC1D,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CACF,CAAC;IACF,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,gHAAgH,CAAC,CAAC;IAC3I,CAAC;IACD,IAAI,GAAG,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,+EAA+E,EAAE,GAAG,CAAC,CAAC;IAC1H,IAAI,QAAQ,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,wEAAwE,EAAE,QAAQ,CAAC,CAAC;IAC1H,IAAI,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,qHAAqH,EAAE,MAAM,CAAC,CAAC;IACpK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,yIAAyI,CAAC,CAAC;IACtJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAc,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,cAAuB,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,IAAI,CACjB,GAA0C,EAC1C,MAAmC,EACnC,UAAoD,EACpD,IAA2B;IAE3B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,IAAI,CAAC,CAAC,CAAC;gBAAE,KAAK,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM;QACpF,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC;YAAE,MAAM;IACtC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,QAAgB,EAAE,IAAY;IACvE,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAM,YAAY,QAAQ,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9H,CAAC;AAED,8DAA8D;AAC9D,SAAgB,gBAAgB,CAAC,CAAM,EAAE,QAAgB;IACvD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACtJ,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,sBAAsB,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAC9F,QAAQ;QACR,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;QACjB,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC5C,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,gBAAgB,EAAE,IAAA,gBAAG,EAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC;QACxG,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,EAAoB;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/migrate/export/vendor-http.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The HTTP side of `atlas migrate export <vendor>`: calls the OLD vendor's
+ * management API from the owner's machine, with the owner's vendor
+ * credentials. Nothing here talks to Atlas, and no vendor credential is ever
+ * written into a bundle or sent anywhere but the vendor.
+ *
+ * Shared by every vendor exporter: JSON requests, a bounded retry on 429 and
+ * 5xx that honours `Retry-After` (and the `X-RateLimit-Reset` epoch some
+ * vendors send instead), and errors that name the call without echoing a
+ * credential.
+ */
+export declare class VendorApiError extends Error {
+    readonly vendor: string;
+    readonly status: number;
+    readonly path: string;
+    constructor(vendor: string, status: number, path: string, detail: string);
+}
+export interface VendorHttpOptions {
+    vendor: string;
+    baseUrl: string;
+    /** Headers on every call (the authorization header lives here, never in a URL). */
+    headers?: Record<string, string> | (() => Promise<Record<string, string>> | Record<string, string>);
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    /** Attempts per call on 429/5xx, the first included. */
+    attempts?: number;
+    now?: () => number;
+}
+export interface VendorResponse<T> {
+    status: number;
+    body: T;
+    headers: Headers;
+}
+export declare class VendorHttp {
+    private readonly o;
+    constructor(o: VendorHttpOptions);
+    get vendor(): string;
+    url(path: string): string;
+    get<T>(path: string): Promise<VendorResponse<T>>;
+    post<T>(path: string, body: unknown): Promise<VendorResponse<T>>;
+    request<T>(method: string, path: string, body?: unknown): Promise<VendorResponse<T>>;
+    private waitFor;
+    private now;
+}
+/** The `rel="next"` URL of an RFC 8288 `Link` header (Okta's pagination). */
+export declare function nextLink(header: string | null): string | null;

package/dist/migrate/export/vendor-http.js

@@ -0,0 +1,138 @@
+"use strict";
+/**
+ * The HTTP side of `atlas migrate export <vendor>`: calls the OLD vendor's
+ * management API from the owner's machine, with the owner's vendor
+ * credentials. Nothing here talks to Atlas, and no vendor credential is ever
+ * written into a bundle or sent anywhere but the vendor.
+ *
+ * Shared by every vendor exporter: JSON requests, a bounded retry on 429 and
+ * 5xx that honours `Retry-After` (and the `X-RateLimit-Reset` epoch some
+ * vendors send instead), and errors that name the call without echoing a
+ * credential.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VendorHttp = exports.VendorApiError = void 0;
+exports.nextLink = nextLink;
+class VendorApiError extends Error {
+    vendor;
+    status;
+    path;
+    constructor(vendor, status, path, detail) {
+        super(`${vendor} API ${status} on ${path}${detail ? `: ${detail}` : ''}`);
+        this.vendor = vendor;
+        this.status = status;
+        this.path = path;
+    }
+}
+exports.VendorApiError = VendorApiError;
+const MAX_WAIT_MS = 60_000;
+class VendorHttp {
+    o;
+    constructor(o) {
+        this.o = o;
+    }
+    get vendor() {
+        return this.o.vendor;
+    }
+    url(path) {
+        return /^https:\/\//.test(path) ? path : `${this.o.baseUrl.replace(/\/+$/, '')}${path.startsWith('/') ? '' : '/'}${path}`;
+    }
+    async get(path) {
+        return this.request('GET', path);
+    }
+    async post(path, body) {
+        return this.request('POST', path, body);
+    }
+    async request(method, path, body) {
+        const fetchImpl = this.o.fetchImpl ?? fetch;
+        const sleep = this.o.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        const attempts = Math.max(1, this.o.attempts ?? 5);
+        const display = path.split('?')[0].replace(/^https:\/\/[^/]+/, '');
+        for (let attempt = 1;; attempt++) {
+            const extra = typeof this.o.headers === 'function' ? await this.o.headers() : this.o.headers;
+            const headers = { accept: 'application/json', ...extra };
+            if (body !== undefined)
+                headers['content-type'] = 'application/json';
+            let res;
+            try {
+                res = await fetchImpl(this.url(path), {
+                    method,
+                    headers,
+                    body: body === undefined ? undefined : JSON.stringify(body),
+                });
+            }
+            catch (err) {
+                if (attempt < attempts) {
+                    await sleep(backoff(attempt));
+                    continue;
+                }
+                throw new VendorApiError(this.o.vendor, 0, display, err instanceof Error ? err.message : String(err));
+            }
+            if ((res.status === 429 || res.status >= 500) && attempt < attempts) {
+                await sleep(this.waitFor(res, attempt));
+                continue;
+            }
+            const text = await res.text();
+            let parsed = null;
+            if (text) {
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch {
+                    parsed = text;
+                }
+            }
+            if (res.status < 200 || res.status >= 300) {
+                throw new VendorApiError(this.o.vendor, res.status, display, errorDetail(parsed));
+            }
+            return { status: res.status, body: parsed, headers: res.headers };
+        }
+    }
+    waitFor(res, attempt) {
+        const retryAfter = res.headers.get('retry-after');
+        if (retryAfter) {
+            const secs = Number(retryAfter);
+            if (Number.isFinite(secs))
+                return Math.min(Math.max(secs * 1000, 0), MAX_WAIT_MS);
+            const at = Date.parse(retryAfter);
+            if (Number.isFinite(at))
+                return Math.min(Math.max(at - this.now(), 0), MAX_WAIT_MS);
+        }
+        const reset = Number(res.headers.get('x-ratelimit-reset'));
+        if (Number.isFinite(reset) && reset > 1e9) {
+            return Math.min(Math.max(reset * 1000 - this.now(), 250), MAX_WAIT_MS);
+        }
+        return backoff(attempt);
+    }
+    now() {
+        return (this.o.now ?? Date.now)();
+    }
+}
+exports.VendorHttp = VendorHttp;
+function backoff(attempt) {
+    return Math.min(500 * 2 ** (attempt - 1), MAX_WAIT_MS);
+}
+/** A short, credential-free description of a vendor error body. */
+function errorDetail(body) {
+    if (typeof body === 'string')
+        return body.slice(0, 200);
+    if (!body || typeof body !== 'object')
+        return '';
+    const b = body;
+    const first = Array.isArray(b.errors) ? b.errors[0] : undefined;
+    const pick = [b.message, b.error_description, b.errorSummary, b.errorDescription, first?.long_message, first?.message, b.error, b.errorCode];
+    const found = pick.find((v) => typeof v === 'string' && v);
+    return typeof found === 'string' ? found.slice(0, 200) : '';
+}
+/** The `rel="next"` URL of an RFC 8288 `Link` header (Okta's pagination). */
+function nextLink(header) {
+    if (!header)
+        return null;
+    for (const part of header.split(',')) {
+        const m = /<([^>]+)>\s*;\s*rel="?next"?/.exec(part.trim());
+        if (m)
+            return m[1];
+    }
+    return null;
+}
+//# sourceMappingURL=vendor-http.js.map

package/dist/migrate/export/vendor-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor-http.js","sourceRoot":"","sources":["../../../src/migrate/export/vendor-http.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAmIH,4BAOC;AAxID,MAAa,cAAe,SAAQ,KAAK;IAE5B;IACA;IACA;IAHX,YACW,MAAc,EACd,MAAc,EACd,IAAY,EACrB,MAAc;QAEd,KAAK,CAAC,GAAG,MAAM,QAAQ,MAAM,OAAO,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QALjE,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;IAIvB,CAAC;CACF;AATD,wCASC;AAoBD,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,MAAa,UAAU;IACQ;IAA7B,YAA6B,CAAoB;QAApB,MAAC,GAAD,CAAC,CAAmB;IAAG,CAAC;IAErD,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;IAC5H,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QACvC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACpE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7F,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;YACjF,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YACrE,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;oBACpC,MAAM;oBACN,OAAO;oBACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC5D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;oBACvB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACxG,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;gBACpE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;gBACxC,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,MAAM,GAAY,IAAI,CAAC;YAC3B,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,IAAI,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC1C,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,GAAa,EAAE,OAAe;QAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAClF,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;CACF;AAhFD,gCAgFC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,mEAAmE;AACnE,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7I,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;IAC3D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAC7E,SAAgB,QAAQ,CAAC,MAAqB;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/migrate/export/workos-config.d.ts

@@ -0,0 +1,23 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { type VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate workos config` — what WorkOS's API exposes of an environment:
+ * roles and permissions (RBAC), the redirect URIs and CORS origins registered
+ * for AuthKit, and the SSO connections / Directory Sync directories (which
+ * move with the data export). Authentication methods, MFA policy, session and
+ * token lifetimes, branding, email templates, JWT templates and signup rules
+ * live only in the WorkOS dashboard: the report lists each as manual, with
+ * where to find it.
+ */
+export interface WorkosConfigSnapshot {
+    clientId?: string;
+    roles: Obj[];
+    permissions: Obj[];
+    redirectUris: Obj[];
+    corsOrigins: Obj[];
+    connections: Obj[];
+    directories: number;
+}
+export declare function fetchWorkosConfig(http: VendorHttp, clientId?: string): Promise<WorkosConfigSnapshot>;
+export declare function translateWorkosConfig(snap: WorkosConfigSnapshot): TranslationResult;

package/dist/migrate/export/workos-config.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchWorkosConfig = fetchWorkosConfig;
+exports.translateWorkosConfig = translateWorkosConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function listOf(http, path) {
+    const out = [];
+    let after;
+    try {
+        for (;;) {
+            const q = new URLSearchParams({ limit: '100', order: 'asc' });
+            if (after)
+                q.set('after', after);
+            const body = (await http.get(`${path}?${q.toString()}`)).body;
+            out.push(...(0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.data : undefined));
+            const next = (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.list_metadata) ? (0, record_set_1.str)(body.list_metadata.after) : undefined;
+            if (!next || next === after)
+                break;
+            after = next;
+        }
+    }
+    catch (err) {
+        // Absent on this environment (RBAC off, endpoint not offered, no permission).
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404, 405].includes(err.status))
+            return out;
+        throw err;
+    }
+    return out;
+}
+async function plainList(http, path) {
+    try {
+        const body = (await http.get(path)).body;
+        return (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.data : undefined);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404, 405].includes(err.status))
+            return [];
+        throw err;
+    }
+}
+async function fetchWorkosConfig(http, clientId) {
+    return {
+        ...(clientId ? { clientId } : {}),
+        // The roles listing is not paginated.
+        roles: await plainList(http, '/authorization/roles'),
+        permissions: await listOf(http, '/authorization/permissions'),
+        redirectUris: await listOf(http, '/user_management/redirect_uris'),
+        corsOrigins: await listOf(http, '/user_management/cors_origins'),
+        connections: await listOf(http, '/connections'),
+        directories: (await listOf(http, '/directories')).length,
+    };
+}
+function translateWorkosConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    for (const p of snap.permissions) {
+        const key = (0, record_set_1.str)(p.slug);
+        if (key)
+            b.push('permissions', { key, name: (0, record_set_1.str)(p.name) ?? key, description: (0, record_set_1.str)(p.description) ?? '' });
+    }
+    if (snap.permissions.length)
+        b.add('mapped', 'authorization', 'permissions', `${snap.permissions.length} permission(s).`, 'permissions');
+    let roles = 0;
+    for (const r of snap.roles) {
+        const slug = (0, record_set_1.str)(r.slug);
+        // Organization-specific roles are exported per organization with the data.
+        if (!slug || (0, record_set_1.str)(r.type) === 'OrganizationRole')
+            continue;
+        roles++;
+        b.roles[slug] = slug;
+        b.push('roles', { key: slug, name: (0, record_set_1.str)(r.name) ?? slug, description: (0, record_set_1.str)(r.description) ?? '', permissions: (0, record_set_1.strs)(r.permissions) });
+    }
+    if (roles)
+        b.add('mapped', 'authorization', 'environment roles', `${roles} role(s); members keep the same role slug as their Atlas role key.`, 'roles');
+    if (snap.roles.length === 0)
+        b.add('manual', 'authorization', 'roles', 'No roles were returned (RBAC may be off for this environment); the default "admin" and "member" roles carry over as Atlas organization roles.');
+    const redirects = new Set();
+    for (const u of snap.redirectUris) {
+        const uri = (0, record_set_1.str)(u.uri);
+        if (uri)
+            redirects.add(uri);
+    }
+    for (const url of redirects) {
+        if (url.includes('*'))
+            b.add('differs', 'redirect URIs', url, 'Atlas redirect URLs are exact (no wildcards).', 'redirect_urls');
+        else
+            b.push('redirect_urls', { url });
+    }
+    const exact = [...redirects].filter((u) => !u.includes('*')).length;
+    if (exact)
+        b.add('mapped', 'redirect URIs', 'redirect_uris', `${exact} redirect URI(s).`, 'redirect_urls');
+    if (redirects.size === 0)
+        b.add('manual', 'redirect URIs', 'redirect_uris', 'WorkOS did not list its redirect URIs by API: add your app\'s post-sign-in URLs to Atlas (redirect_urls).', 'redirect_urls');
+    for (const o of snap.corsOrigins) {
+        const origin = (0, record_set_1.str)(o.origin);
+        if (origin)
+            b.add('manual', 'CORS origins', origin, 'Add this origin to the allowed origins of your Atlas instance (Atlas dashboard → Settings → Allowed origins).');
+    }
+    const sso = snap.connections.length;
+    if (sso)
+        b.add('mapped', 'enterprise', `${sso} SSO connection(s)`, 'Move with the data export as Atlas SSO connections. WorkOS does not return the identity provider details: each customer\'s IdP is set up again against the new Atlas service-provider settings.', 'sso_connections');
+    if (snap.directories)
+        b.add('manual', 'enterprise', `${snap.directories} Directory Sync directory(ies)`, 'Reconnect through Atlas SCIM provisioning; the identity provider re-provisions users and groups.');
+    for (const [setting, where] of [
+        ['authentication methods (password, Magic Auth, social, passkeys)', 'Authentication → Methods'],
+        ['social connections (client ids and secrets)', 'Authentication → Social login (use the same OAuth apps in Atlas so imported accounts relink)'],
+        ['multi-factor authentication policy', 'Authentication → Multi-Factor Auth'],
+        ['session lifetime and access token lifetime', 'Authentication → Sessions'],
+        ['sign-up rules, email verification and domain restrictions', 'Authentication → Sign-up'],
+        ['branding, hosted-page text and email templates', 'Branding and Email'],
+        ['JWT templates and custom claims', 'Authentication → Sessions → JWT template'],
+        ['custom authentication domain', 'Domains'],
+        ['Radar (bot and fraud rules)', 'Radar'],
+        ['webhooks and events', 'Webhooks (create Atlas webhook endpoints)'],
+    ]) {
+        b.add('manual', 'settings not in the API', setting, `WorkOS does not expose this by API; copy it from the WorkOS dashboard (${where}).`);
+    }
+    return b.result(`WorkOS environment${snap.clientId ? ` ${snap.clientId}` : ''}`, {
+        ...(snap.clientId
+            ? { bridge: { preset: 'workos', vars: { client_id: snap.clientId } }, lazy: { preset: 'workos', config: { client_id: snap.clientId } } }
+            : {}),
+    });
+}
+//# sourceMappingURL=workos-config.js.map

package/dist/migrate/export/workos-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-config.js","sourceRoot":"","sources":["../../../src/migrate/export/workos-config.ts"],"names":[],"mappings":";;AAwDA,8CAWC;AAED,sDA+DC;AAlID,6CAAgE;AAChE,mDAAgD;AAChD,+CAAgE;AAqBhE,KAAK,UAAU,MAAM,CAAC,IAAgB,EAAE,IAAY;IAClD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,IAAI,KAAK;gBAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,KAAK;gBAAE,MAAM;YACnC,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8EAA8E;QAC9E,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3F,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,IAAY;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,OAAO,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAgB,EAAE,QAAiB;IACzE,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,sCAAsC;QACtC,KAAK,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,sBAAsB,CAAC;QACpD,WAAW,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,4BAA4B,CAAC;QAC7D,YAAY,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,gCAAgC,CAAC;QAClE,WAAW,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,+BAA+B,CAAC;QAChE,WAAW,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC;QAC/C,WAAW,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM;KACzD,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAA0B;IAC9D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,GAAG;YAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAU,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAEzI,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,2EAA2E;QAC3E,IAAI,CAAC,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,kBAAkB;YAAE,SAAS;QAC1D,KAAK,EAAE,CAAC;QACR,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAU,CAAC,CAAC;IAC7I,CAAC;IACD,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,KAAK,oEAAoE,EAAE,OAAO,CAAC,CAAC;IACxJ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,+IAA+I,CAAC,CAAC;IAExN,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,+CAA+C,EAAE,eAAe,CAAC,CAAC;;YAC3H,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,KAAK,mBAAmB,EAAE,eAAe,CAAC,CAAC;IAC3G,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,2GAA2G,EAAE,eAAe,CAAC,CAAC;IAE1M,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,+GAA+G,CAAC,CAAC;IACvK,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;IACpC,IAAI,GAAG;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,GAAG,oBAAoB,EAAE,iMAAiM,EAAE,iBAAiB,CAAC,CAAC;IACzR,IAAI,IAAI,CAAC,WAAW;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,WAAW,gCAAgC,EAAE,kGAAkG,CAAC,CAAC;IAE7M,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,iEAAiE,EAAE,0BAA0B,CAAC;QAC/F,CAAC,6CAA6C,EAAE,8FAA8F,CAAC;QAC/I,CAAC,oCAAoC,EAAE,oCAAoC,CAAC;QAC5E,CAAC,4CAA4C,EAAE,2BAA2B,CAAC;QAC3E,CAAC,2DAA2D,EAAE,0BAA0B,CAAC;QACzF,CAAC,gDAAgD,EAAE,oBAAoB,CAAC;QACxE,CAAC,iCAAiC,EAAE,0CAA0C,CAAC;QAC/E,CAAC,8BAA8B,EAAE,SAAS,CAAC;QAC3C,CAAC,6BAA6B,EAAE,OAAO,CAAC;QACxC,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;KAC5D,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,OAAO,EAAE,0EAA0E,KAAK,IAAI,CAAC,CAAC;IAC3I,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,qBAAqB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;QAC/E,GAAG,CAAC,IAAI,CAAC,QAAQ;YACf,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;YACxI,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/workos.d.ts

@@ -0,0 +1,46 @@
+import type { UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export workos` — a WorkOS environment (AuthKit + SSO +
+ * Directory Sync) onto the canonical bundle models, read with an API key on
+ * this machine.
+ *
+ *   - organizations (verified domains, metadata), environment roles and each
+ *     organization's custom roles, memberships with their role slug, pending
+ *     and past invitations;
+ *   - users (verified email, names, avatar, metadata, last sign-in) with the
+ *     OAuth identities WorkOS holds for them (provider user ids, so social
+ *     sign-in relinks exactly);
+ *   - SSO connections (SAML / OIDC) with the IdP signing certificates WorkOS
+ *     returns; the IdP entity id, SSO URL and OIDC client secret are NOT
+ *     available through the API, so the customer's IdP is reconfigured against
+ *     the new Atlas connection;
+ *   - password hashes: WorkOS publishes no export of them (only an import
+ *     path). If WorkOS support gives you a hash file, pass it
+ *     (--workos-hashes-file); otherwise turn on the `workos` lazy-migration
+ *     preset, which checks each password against WorkOS on first sign-in.
+ *
+ * Not exportable: TOTP secrets and passkeys (users enrol again), API key
+ * secrets (reissue as Atlas API keys), sessions (the `workos` bridge preset
+ * exchanges the access token). Directory Sync directories are reconnected in
+ * Atlas SCIM.
+ */
+export interface WorkosExportOptions {
+    apiKey: string;
+    /** For the manifest only (the client id appears in token issuers). */
+    clientId?: string;
+    /** API base (default https://api.workos.com). */
+    baseUrl?: string;
+    /** A password-hash export from WorkOS support (CSV or NDJSON), when the owner has one. */
+    hashesText?: string;
+    /** Also count TOTP / SMS / WebAuthn factors per user (one more request each) so the report says how many re-enrol. */
+    countFactors?: boolean;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+export declare function exportWorkos(opts: WorkosExportOptions): Promise<RecordSet>;
+/** One WorkOS user → a user record (a user always has an email). */
+export declare function mapWorkosUser(u: Obj): UserRecord | null;
+/** `GoogleOAuth` → `google`, `GitHubOAuth` → `github`: the provider name an Atlas provider key is looked up by. */
+export declare function providerKey(provider: string): string;