@atlasauth/cli 0.12.0 → 0.14.0

package/dist/migrate/export/table.js

@@ -0,0 +1,248 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseDelimited = parseDelimited;
+exports.parseTable = parseTable;
+exports.parseKeyValues = parseKeyValues;
+exports.typedParams = typedParams;
+exports.mapTable = mapTable;
+const password_detect_1 = require("./password-detect");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+// ── parsing ─────────────────────────────────────────────────────────────────
+/** RFC 4180 CSV with a sniffed delimiter (`,` `;` tab `|`), quoted fields, doubled quotes, embedded newlines. */
+function parseDelimited(text) {
+    const src = text.replace(/^\ufeff/, '');
+    const first = src.split(/\r?\n/, 1)[0] ?? '';
+    const delimiter = [',', ';', '\t', '|'].map((d) => [d, first.split(d).length]).sort((a, b) => b[1] - a[1])[0][0];
+    const rows = [];
+    let row = [];
+    let field = '';
+    let quoted = false;
+    for (let i = 0; i < src.length; i++) {
+        const c = src[i];
+        if (quoted) {
+            if (c === '"') {
+                if (src[i + 1] === '"') {
+                    field += '"';
+                    i++;
+                }
+                else
+                    quoted = false;
+            }
+            else
+                field += c;
+        }
+        else if (c === '"' && field === '')
+            quoted = true;
+        else if (c === delimiter) {
+            row.push(field);
+            field = '';
+        }
+        else if (c === '\n' || c === '\r') {
+            if (c === '\r' && src[i + 1] === '\n')
+                i++;
+            row.push(field);
+            field = '';
+            if (row.some((f) => f !== ''))
+                rows.push(row);
+            row = [];
+        }
+        else
+            field += c;
+    }
+    row.push(field);
+    if (row.some((f) => f !== ''))
+        rows.push(row);
+    const header = (rows.shift() ?? []).map((h) => h.trim());
+    return rows.map((r) => Object.fromEntries(header.map((h, i) => [h, r[i] ?? ''])));
+}
+/** Rows from CSV/TSV, a JSON array (of objects, or `{ users: [...] }`) or NDJSON. */
+function parseTable(text) {
+    const t = text.trim();
+    if (t.startsWith('[') || t.startsWith('{')) {
+        try {
+            const v = JSON.parse(t);
+            if (Array.isArray(v))
+                return v.filter(record_set_1.isObj);
+            if ((0, record_set_1.isObj)(v)) {
+                const list = Object.values(v).find(Array.isArray);
+                if (list)
+                    return list.filter(record_set_1.isObj);
+                return [v];
+            }
+        }
+        catch {
+            // NDJSON: one object per line
+            return t.split(/\r?\n/).filter((l) => l.trim()).map((l, i) => {
+                try {
+                    const o = JSON.parse(l);
+                    if (!(0, record_set_1.isObj)(o))
+                        throw new Error('not an object');
+                    return o;
+                }
+                catch {
+                    throw new Error(`Line ${i + 1} is not a JSON object.`);
+                }
+            });
+        }
+    }
+    return parseDelimited(t);
+}
+// ── column recognition ──────────────────────────────────────────────────────
+const NAMES = {
+    id: ['id', 'user_id', 'userid', 'uid', 'uuid', 'sub', 'external_id'],
+    email: ['email', 'email_address', 'emailaddress', 'mail', 'e_mail'],
+    email_verified: ['email_verified', 'emailverified', 'verified', 'is_verified', 'email_confirmed', 'email_confirmed_at', 'confirmed_at', 'email_verified_at'],
+    username: ['username', 'user_name', 'login', 'handle', 'screen_name'],
+    first_name: ['first_name', 'firstname', 'given_name', 'givenname', 'fname'],
+    last_name: ['last_name', 'lastname', 'family_name', 'surname', 'lname'],
+    name: ['name', 'full_name', 'fullname', 'display_name', 'displayname'],
+    phone: ['phone', 'phone_number', 'phonenumber', 'mobile', 'mobile_phone', 'tel'],
+    password: ['password_hash', 'passwordhash', 'encrypted_password', 'hashed_password', 'password_digest', 'pwd_hash', 'password', 'passwd', 'hash', 'pass'],
+    salt: ['password_salt', 'salt', 'pwd_salt', 'passwordsalt'],
+    created_at: ['created_at', 'createdat', 'created', 'date_joined', 'registered_at', 'signup_date'],
+    last_sign_in_at: ['last_sign_in_at', 'last_login', 'last_login_at', 'last_seen', 'lastlogin'],
+    roles: ['roles', 'role', 'groups'],
+    disabled: ['disabled', 'banned', 'is_banned', 'blocked', 'is_blocked', 'suspended', 'locked'],
+    active: ['active', 'is_active', 'enabled'],
+    image_url: ['image_url', 'avatar', 'avatar_url', 'picture', 'photo'],
+};
+const truthy = (v) => {
+    if (typeof v === 'boolean')
+        return v;
+    if (typeof v === 'number')
+        return v !== 0;
+    const s = String(v ?? '').trim().toLowerCase();
+    return ['1', 'true', 't', 'yes', 'y'].includes(s) || (s !== '' && !['0', 'false', 'f', 'no', 'n', 'null', 'nil', 'none'].includes(s) && /^\d{4}-|^\d{9,}$/.test(s));
+};
+function columnFinder(row, map = {}) {
+    const lower = new Map(Object.keys(row).map((k) => [k.toLowerCase().replace(/[\s-]+/g, '_'), k]));
+    return (field) => {
+        const wanted = map[field];
+        if (wanted)
+            return Object.keys(row).find((k) => k === wanted) ?? lower.get(wanted.toLowerCase());
+        for (const n of NAMES[field] ?? [])
+            if (lower.has(n))
+                return lower.get(n);
+        return undefined;
+    };
+}
+const isoTime = (v) => {
+    const s = (0, record_set_1.str)(v);
+    if (!s)
+        return undefined;
+    const n = /^\d{9,13}$/.test(s) ? Number(s) * (s.length >= 12 ? 1 : 1000) : Date.parse(s);
+    return Number.isFinite(n) && n > 0 ? new Date(n).toISOString() : undefined;
+};
+function passwordFor(hash, salt, o) {
+    const algorithm = o.hashAlgorithm?.toLowerCase();
+    if (algorithm === 'plaintext') {
+        const d = (0, password_detect_1.detectPasswordHash)(hash, { plaintext: true });
+        return d.ok ? { password: d.password } : { reason: d.reason };
+    }
+    if (!algorithm || algorithm === 'auto') {
+        const d = (0, password_detect_1.detectPasswordHash)(hash);
+        if (d.ok)
+            return { password: d.password, weak: d.weak };
+        return { reason: `${d.reason}; name its algorithm with --set hash-algorithm=<id>` };
+    }
+    if (!(0, password_detect_1.isKnownAlgorithm)(algorithm))
+        return { reason: `unknown hash algorithm "${algorithm}"` };
+    const params = { ...(o.hashParams ?? {}) };
+    if (o.saltPosition)
+        params.salt_position = o.saltPosition;
+    if (o.hashEncoding)
+        params.encoding = o.hashEncoding;
+    return { password: (0, record_set_1.compact)({ algorithm, hash, salt, params: Object.keys(params).length ? params : undefined }) };
+}
+/** Parse `a=1,b=two,c=true` into typed params. */
+function parseKeyValues(raw) {
+    const out = {};
+    for (const part of (raw ?? '').split(',')) {
+        const i = part.indexOf('=');
+        if (i > 0)
+            out[part.slice(0, i).trim()] = part.slice(i + 1).trim();
+    }
+    return out;
+}
+function typedParams(raw) {
+    return Object.fromEntries(Object.entries(parseKeyValues(raw)).map(([k, v]) => [k, v === 'true' ? true : v === 'false' ? false : /^\d+$/.test(v) ? Number(v) : v]));
+}
+// ── mapping ─────────────────────────────────────────────────────────────────
+function mapTable(rows, options = {}) {
+    const set = new record_set_1.RecordSet();
+    set.manifest = { origin: options.origin ?? 'user table' };
+    const ids = new Set();
+    let n = 0;
+    const unusable = new Map();
+    let weak = 0;
+    for (const row of rows) {
+        n++;
+        const col = columnFinder(row, options.map);
+        const get = (f) => {
+            const c = col(f);
+            return c === undefined ? undefined : row[c];
+        };
+        const emailRaw = (0, record_set_1.str)(get('email'))?.toLowerCase();
+        const email = emailRaw?.includes('@') ? emailRaw : undefined;
+        const phone = (0, record_set_1.e164)(get('phone'));
+        const username = (0, record_set_1.str)(get('username'));
+        if (!email && !phone && !username) {
+            set.omit('user', 'no email, phone or username', 1);
+            continue;
+        }
+        const id = (0, record_set_1.str)(get('id')) ?? email ?? username ?? String(n);
+        if (ids.has(id)) {
+            set.omit('user', 'duplicate id', 1);
+            continue;
+        }
+        ids.add(id);
+        const verifiedCol = col('email_verified');
+        const emails = email ? [{ email, verified: options.trustEmails === true || (verifiedCol !== undefined && truthy(row[verifiedCol])), primary: true }] : [];
+        const phones = phone ? [{ phone, verified: false, primary: true }] : [];
+        const record = (0, record_set_1.compact)({
+            id,
+            emails,
+            phones,
+            username,
+            first_name: (0, record_set_1.str)(get('first_name')),
+            last_name: (0, record_set_1.str)(get('last_name')),
+            name: (0, record_set_1.str)(get('name')),
+            image_url: (0, record_set_1.str)(get('image_url')),
+            created_at: isoTime(get('created_at')),
+            last_sign_in_at: isoTime(get('last_sign_in_at')),
+        });
+        const roleValue = get('roles');
+        const roles = (Array.isArray(roleValue) ? (0, record_set_1.strs)(roleValue) : ((0, record_set_1.str)(roleValue) ?? '').split(/[;,|]/)).map((r) => r.trim()).filter(Boolean).map(translate_kit_1.keyOf);
+        for (const r of roles)
+            set.add('role', { key: r, name: r, scope: 'app' }, r);
+        if (roles.length)
+            record.roles = [...new Set(roles)];
+        if (truthy(get('disabled')) && col('disabled') !== undefined) {
+            record.banned = true;
+            record.ban_reason = 'Disabled in the source table';
+        }
+        else if (col('active') !== undefined && get('active') !== '' && get('active') !== undefined && !truthy(get('active'))) {
+            record.banned = true;
+            record.ban_reason = 'Inactive in the source table';
+        }
+        const hash = (0, record_set_1.str)(get('password'));
+        if (hash) {
+            const r = passwordFor(hash, (0, record_set_1.str)(get('salt')), options);
+            if (r.password) {
+                record.password = r.password;
+                if (r.weak)
+                    weak++;
+            }
+            else
+                unusable.set(r.reason, (unusable.get(r.reason) ?? 0) + 1);
+        }
+        set.add('user', record, id);
+    }
+    for (const [reason, count] of unusable)
+        set.warn(`${count} password(s) left out: ${reason}.`);
+    if (weak)
+        set.warn(`${weak} password(s) use a weak legacy hash; Atlas re-hashes each to Argon2id on that user's first sign-in.`);
+    return set;
+}
+//# sourceMappingURL=table.js.map

package/dist/migrate/export/table.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.js","sourceRoot":"","sources":["../../../src/migrate/export/table.ts"],"names":[],"mappings":";;AAoCA,wCAiCC;AAGD,gCAyBC;AAkED,wCAOC;AAED,kCAEC;AAID,4BAsEC;AAvPD,uDAAyE;AACzE,6CAAoF;AACpF,mDAAwC;AA8BxC,+EAA+E;AAE/E,iHAAiH;AACjH,SAAgB,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;IAC3H,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,IAAI,GAAG,GAAa,EAAE,CAAC;IACvB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACvB,KAAK,IAAI,GAAG,CAAC;oBACb,CAAC,EAAE,CAAC;gBACN,CAAC;;oBAAM,MAAM,GAAG,KAAK,CAAC;YACxB,CAAC;;gBAAM,KAAK,IAAI,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,GAAG,IAAI,CAAC;aAC/C,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,KAAK,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9C,GAAG,GAAG,EAAE,CAAC;QACX,CAAC;;YAAM,KAAK,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,qFAAqF;AACrF,SAAgB,UAAU,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;YACnC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,MAAM,CAAC,kBAAK,CAAC,CAAC;YAC7C,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,IAAI;oBAAE,OAAQ,IAAkB,CAAC,MAAM,CAAC,kBAAK,CAAC,CAAC;gBACnD,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;YAC9B,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC3D,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;oBACnC,IAAI,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;oBAChD,OAAO,CAAC,CAAC;gBACX,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAE/E,MAAM,KAAK,GAA6B;IACtC,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC;IACpE,KAAK,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC;IACnE,cAAc,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,cAAc,EAAE,mBAAmB,CAAC;IAC5J,QAAQ,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC;IACrE,UAAU,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC;IAC3E,SAAS,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC;IACvE,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,CAAC;IACtE,KAAK,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC;IAChF,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;IACzJ,IAAI,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;IAC3D,UAAU,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,CAAC;IACjG,eAAe,EAAE,CAAC,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,CAAC;IAC7F,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;IAClC,QAAQ,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAC;IAC7F,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC;IAC1C,SAAS,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC;CACrE,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAW,EAAE;IACrC,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtK,CAAC,CAAC;AAEF,SAAS,YAAY,CAAC,GAAQ,EAAE,MAA8B,EAAE;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,CAAC,KAAa,EAAsB,EAAE;QAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACjG,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAAsB,EAAE;IACjD,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC,CAAC;AAEF,SAAS,WAAW,CAAC,IAAY,EAAE,IAAwB,EAAE,CAAqB;IAChF,MAAM,SAAS,GAAG,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC;IACjD,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAA,oCAAkB,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAA,oCAAkB,EAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,qDAAqD,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,IAAA,kCAAgB,EAAC,SAAS,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,SAAS,GAAG,EAAE,CAAC;IAC7F,MAAM,MAAM,GAA8C,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;IACtF,IAAI,CAAC,CAAC,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1D,IAAI,CAAC,CAAC,YAAY;QAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,OAAO,EAAE,QAAQ,EAAE,IAAA,oBAAO,EAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAkB,CAAC,EAAE,CAAC;AACnI,CAAC;AAED,kDAAkD;AAClD,SAAgB,cAAc,CAAC,GAAuB;IACpD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,WAAW,CAAC,GAAuB;IACjD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrK,CAAC;AAED,+EAA+E;AAE/E,SAAgB,QAAQ,CAAC,IAAW,EAAE,UAA8B,EAAE;IACpE,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,CAAC,EAAE,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,CAAC,CAAS,EAAW,EAAE;YACjC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1K,MAAM,MAAM,GAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,MAAM,GAAe,IAAA,oBAAO,EAAC;YACjC,EAAE;YACF,MAAM;YACN,MAAM;YACN,QAAQ;YACR,UAAU,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAClC,SAAS,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAChC,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,SAAS,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAChC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACtC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;SACnC,CAAC,CAAC;QAEjB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,qBAAK,CAAC,CAAC;QACnJ,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAErD,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,UAAU,GAAG,8BAA8B,CAAC;QACrD,CAAC;aAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACxH,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,UAAU,GAAG,8BAA8B,CAAC;QACrD,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAC7B,IAAI,CAAC,CAAC,IAAI;oBAAE,IAAI,EAAE,CAAC;YACrB,CAAC;;gBAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,0BAA0B,MAAM,GAAG,CAAC,CAAC;IAC9F,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,qGAAqG,CAAC,CAAC;IACjI,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/userfront-config.d.ts

@@ -0,0 +1,15 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate userfront config` — what Userfront's admin API exposes about
+ * a tenant's configuration: its roles. Sign-in methods, forms, password and
+ * MFA rules, session lifetimes, domains and branding live only in the
+ * Userfront dashboard: the report lists each as manual with where to look.
+ * Passwords move by the `userfront` lazy-migration preset.
+ */
+export interface UserfrontConfigSnapshot {
+    tenantId: string;
+    roles: string[];
+}
+export declare function fetchUserfrontConfig(http: VendorHttp, tenantId: string): Promise<UserfrontConfigSnapshot>;
+export declare function translateUserfrontConfig(snap: UserfrontConfigSnapshot): TranslationResult;

package/dist/migrate/export/userfront-config.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchUserfrontConfig = fetchUserfrontConfig;
+exports.translateUserfrontConfig = translateUserfrontConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const userfront_1 = require("./userfront");
+const vendor_http_1 = require("./vendor-http");
+async function fetchUserfrontConfig(http, tenantId) {
+    const tid = (0, userfront_1.checkTenantId)(tenantId);
+    let body = null;
+    try {
+        body = (await http.get(`/tenants/${tid}/roles`)).body;
+    }
+    catch (err) {
+        if (!(err instanceof vendor_http_1.VendorApiError) || ![400, 403, 404].includes(err.status))
+            throw err;
+    }
+    return { tenantId: tid, roles: (0, record_set_1.objs)(body?.roles).map((r) => (0, record_set_1.str)(r.name)).filter((n) => !!n) };
+}
+function translateUserfrontConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const seen = new Set();
+    for (const name of snap.roles) {
+        const key = (0, translate_kit_1.keyOf)(name);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        b.roles[name] = key;
+        b.push('roles', { key, name, description: '', permissions: [] });
+    }
+    if (seen.size)
+        b.add('mapped', 'authorization', 'roles', `${seen.size} role(s) (tenant roles become app roles; members keep theirs with the data export).`, 'roles');
+    b.add('mapped', 'authentication', 'password sign-in', 'Userfront never returns password hashes: the userfront lazy-migration preset checks each password against Userfront on the first Atlas sign-in.', 'auth_config.strategies.password');
+    for (const [setting, where] of [
+        ['sign-in methods (password, email link, code, social, SSO)', 'Dashboard → Authentication'],
+        ['multi-factor authentication', 'Dashboard → Authentication → Multi-factor'],
+        ['session and token lifetimes', 'Dashboard → Settings → Sessions'],
+        ['social provider credentials', 'Dashboard → Authentication → Social (re-enter each client id and secret as an Atlas oauth provider)'],
+        ['domains and redirect URLs', 'Dashboard → Settings → Domains'],
+        ['forms and branding', 'Dashboard → Toolkit / Branding (use the Atlas components and theme)'],
+        ['custom emails', 'Dashboard → Emails (use the Atlas email templates)'],
+    ]) {
+        b.add('manual', 'settings not in the API', setting, `Userfront does not expose this by API; copy it from the dashboard (${where}).`);
+    }
+    b.add('differs', 'sessions', 'access and ID tokens', 'Userfront tokens carry no issuer claim, so the zero-logout bridge cannot verify them: users sign in once more after the switch.', 'migration bridge');
+    return b.result(`Userfront tenant ${snap.tenantId}`, { lazy: { preset: 'userfront', config: { tenant_id: snap.tenantId } } });
+}
+//# sourceMappingURL=userfront-config.js.map

package/dist/migrate/export/userfront-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userfront-config.js","sourceRoot":"","sources":["../../../src/migrate/export/userfront-config.ts"],"names":[],"mappings":";;AAmBA,oDASC;AAED,4DAyBC;AArDD,6CAAmD;AACnD,mDAAuD;AACvD,2CAA4C;AAC5C,+CAAgE;AAczD,KAAK,UAAU,oBAAoB,CAAC,IAAgB,EAAE,QAAgB;IAC3E,MAAM,GAAG,GAAG,IAAA,yBAAa,EAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,GAAe,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,GAAG,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAA,iBAAI,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,SAAgB,wBAAwB,CAAC,IAA6B;IACpE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,qFAAqF,EAAE,OAAO,CAAC,CAAC;IACrK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iJAAiJ,EAAE,iCAAiC,CAAC,CAAC;IAC5O,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,2DAA2D,EAAE,4BAA4B,CAAC;QAC3F,CAAC,6BAA6B,EAAE,2CAA2C,CAAC;QAC5E,CAAC,6BAA6B,EAAE,iCAAiC,CAAC;QAClE,CAAC,6BAA6B,EAAE,qGAAqG,CAAC;QACtI,CAAC,2BAA2B,EAAE,gCAAgC,CAAC;QAC/D,CAAC,oBAAoB,EAAE,qEAAqE,CAAC;QAC7F,CAAC,eAAe,EAAE,oDAAoD,CAAC;KAC/D,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,OAAO,EAAE,sEAAsE,KAAK,IAAI,CAAC,CAAC;IACvI,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE,iIAAiI,EAAE,kBAAkB,CAAC,CAAC;IAC5M,OAAO,CAAC,CAAC,MAAM,CAAC,oBAAoB,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AAChI,CAAC"}

package/dist/migrate/export/userfront.d.ts

@@ -0,0 +1,38 @@
+import type { UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export userfront` — a Userfront tenant onto the canonical
+ * bundle models, read with an admin API key (`uf_live_admin_…`) on this
+ * machine.
+ *
+ *   - users (email, username, phone, names, image, custom `data`, confirmed
+ *     flags, locked) with their roles on the tenant;
+ *   - sub-tenants → organizations, with each member's role in them;
+ *   - roles (the tenant's role list plus any a user holds).
+ *
+ * Userfront never returns password hashes, so passwords move by lazy
+ * migration: the `userfront` preset checks each password against Userfront's
+ * own sign-in on a member's first Atlas sign-in. Not exportable: second
+ * factors (re-enrol), passkeys (register again), social account ids (relink
+ * by verified email), pending invitations (create only, no listing).
+ */
+export interface UserfrontExportOptions {
+    tenantId: string;
+    /** An admin key: `uf_live_admin_…` for the live tenant, `uf_test_admin_…` for test mode. */
+    apiKey: string;
+    apiBase?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+export declare function checkTenantId(tenantId: string): string;
+export declare function userfrontHttp(o: {
+    apiKey: string;
+    apiBase?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+}): VendorHttp;
+export declare function exportUserfront(opts: UserfrontExportOptions): Promise<RecordSet>;
+/** One Userfront user (users/find result) → a user record. */
+export declare function mapUserfrontUser(u: Obj, tenantId: string): UserRecord | null;

package/dist/migrate/export/userfront.js

@@ -0,0 +1,189 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkTenantId = checkTenantId;
+exports.userfrontHttp = userfrontHttp;
+exports.exportUserfront = exportUserfront;
+exports.mapUserfrontUser = mapUserfrontUser;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+const API = 'https://api.userfront.com/v0';
+const MAX_PAGES = 100_000;
+/** First-factor strategies that are not a social login. */
+const NON_SOCIAL = new Set(['password', 'link', 'verificationCode', 'totp', 'sso', 'saml', 'passkey', 'webauthn', 'email', 'phone']);
+function checkTenantId(tenantId) {
+    const t = tenantId.trim();
+    if (!/^[A-Za-z0-9]{4,16}$/.test(t))
+        throw new Error(`Not a Userfront tenant id: ${tenantId}`);
+    return t;
+}
+function userfrontHttp(o) {
+    return new vendor_http_1.VendorHttp({
+        vendor: 'Userfront',
+        baseUrl: (o.apiBase ?? API).replace(/\/+$/, ''),
+        headers: { authorization: `Bearer ${o.apiKey}` },
+        fetchImpl: o.fetchImpl,
+        sleep: o.sleep,
+    });
+}
+async function exportUserfront(opts) {
+    const set = new record_set_1.RecordSet();
+    const tid = checkTenantId(opts.tenantId);
+    if (!/^uf_(test|live)_admin_/.test(opts.apiKey))
+        throw new Error('Userfront export needs an admin API key (uf_live_admin_… or uf_test_admin_…).');
+    const progress = opts.onProgress ?? (() => undefined);
+    const http = userfrontHttp(opts);
+    progress('organizations');
+    const orgIds = new Set();
+    await walk(async (page) => (await http.get(`/tenants/${tid}/tenants?page=${page}`)).body, (body) => (0, record_set_1.objs)(body?.results).concat((0, record_set_1.objs)(body?.tenants)), (body) => {
+        const n = body?.totalPages;
+        return typeof n === 'number' ? n : undefined;
+    }, (t) => {
+        const id = (0, record_set_1.str)(t.tenantId);
+        if (!id || id === tid || orgIds.has(id))
+            return false;
+        orgIds.add(id);
+        set.add('organization', (0, record_set_1.compact)({ id, name: (0, record_set_1.str)(t.name) ?? id, image_url: (0, record_set_1.str)(t.image), public_metadata: (0, record_set_1.bag)(t.data), created_at: (0, record_set_1.str)(t.createdAt) }), id);
+        return true;
+    });
+    progress('roles');
+    const roleNames = new Set();
+    const rolesBody = await optional(async () => (await http.get(`/tenants/${tid}/roles`)).body);
+    for (const r of (0, record_set_1.objs)(rolesBody?.roles)) {
+        const name = (0, record_set_1.str)(r.name);
+        if (name)
+            roleNames.add(name);
+    }
+    progress('users');
+    const seen = new Set();
+    let unknownOrgs = 0;
+    let mfa = 0;
+    let passkeys = 0;
+    let social = 0;
+    await walk((page) => findUsers(http, tid, page), (body) => (0, record_set_1.objs)(body?.results), (body) => {
+        const meta = body?.meta;
+        return (0, record_set_1.isObj)(meta) && typeof meta.totalPages === 'number' ? meta.totalPages : undefined;
+    }, (u) => {
+        const rawId = (0, record_set_1.str)(u.userId);
+        if (rawId && seen.has(rawId))
+            return false;
+        if (rawId)
+            seen.add(rawId);
+        const user = mapUserfrontUser(u, tid);
+        if (!user) {
+            set.omit('user', 'no email, phone number or username');
+            return true;
+        }
+        const authz = (0, record_set_1.isObj)(u.authorization) ? u.authorization : {};
+        const mine = authz[tid];
+        const own = (0, record_set_1.isObj)(mine) ? (0, record_set_1.strs)(mine.roles) : [];
+        if (own.length)
+            user.roles = own.map(translate_kit_1.keyOf);
+        for (const n of own)
+            roleNames.add(n);
+        set.add('user', user, user.id);
+        for (const [orgId, raw] of Object.entries(authz)) {
+            if (orgId === tid || !(0, record_set_1.isObj)(raw))
+                continue;
+            if (!orgIds.has(orgId)) {
+                unknownOrgs++;
+                continue;
+            }
+            const roles = (0, record_set_1.strs)(raw.roles).map(translate_kit_1.keyOf);
+            set.add('membership', { organization_id: orgId, user_id: user.id, role: roles[0] ?? 'member' }, `${orgId}:${user.id}`);
+            for (const r of (0, record_set_1.strs)(raw.roles))
+                roleNames.add(r);
+            if (roles.length > 1)
+                set.warn('Some organization members hold several Userfront roles; Atlas seats each member with one role (the first).');
+        }
+        const auth = (0, record_set_1.isObj)(u.authentication) ? u.authentication : {};
+        if (u.isMfaRequired === true || (0, record_set_1.objs)(auth.secondFactors).length > 0)
+            mfa++;
+        for (const f of (0, record_set_1.objs)(auth.firstFactors)) {
+            const strategy = (0, record_set_1.str)(f.strategy);
+            if (strategy && /passkey|webauthn/i.test(strategy))
+                passkeys++;
+            else if (strategy && !NON_SOCIAL.has(strategy))
+                social++;
+        }
+        return true;
+    });
+    if (unknownOrgs > 0) {
+        set.warn(`${unknownOrgs} organization grant(s) name a tenant that is not in the organization listing; those memberships were left out.`);
+    }
+    if (mfa > 0)
+        set.omit('mfa_factor', 'Userfront does not export second-factor secrets; members enrol again in Atlas', mfa);
+    if (passkeys > 0)
+        set.omit('passkey', 'Userfront does not export passkey public keys; register again in Atlas', passkeys);
+    if (social > 0)
+        set.omit('identity', "Userfront does not export social accounts' provider user ids: they relink by verified email on first social sign-in", social);
+    if (set.count('user') > 0) {
+        set.warn('Userfront never returns password hashes: turn on the userfront lazy-migration preset so each password moves on its first Atlas sign-in.');
+    }
+    for (const name of roleNames) {
+        const key = (0, translate_kit_1.keyOf)(name);
+        set.add('role', { key, name, scope: 'app' }, `app:${key}`);
+        if (orgIds.size > 0)
+            set.add('role', { key, name, scope: 'organization' }, `org:${key}`);
+    }
+    set.manifest = { origin: tid, settings: { tenant_id: tid } };
+    return set;
+}
+/**
+ * Walk a paged listing whose page numbering Userfront does not document: page
+ * 0 is probed, then pages go up from 1 until one is empty, past the reported
+ * total, or adds nobody new (a row seen twice is taken once).
+ */
+async function walk(get, rowsOf, totalPages, take) {
+    for (let page = 0; page < MAX_PAGES; page++) {
+        const body = await optional(() => get(page));
+        const rows = rowsOf(body);
+        let fresh = 0;
+        for (const r of rows)
+            if (take(r))
+                fresh++;
+        const pages = totalPages(body);
+        if (page > 0 && (rows.length === 0 || (pages !== undefined && page > pages)))
+            break;
+        if (page >= 2 && fresh === 0)
+            break;
+    }
+}
+async function findUsers(http, tenantId, page) {
+    return (await http.post(`/tenants/${tenantId}/users/find`, { filters: {}, page, order: [['createdAt', 'ASC']] })).body;
+}
+/** One Userfront user (users/find result) → a user record. */
+function mapUserfrontUser(u, tenantId) {
+    const id = (0, record_set_1.str)(u.userId);
+    if (!id)
+        return null;
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(u.phoneNumber);
+    const username = (0, record_set_1.str)(u.username);
+    const uuid = (0, record_set_1.str)(u.userUuid);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails: email ? [{ email, verified: u.isEmailConfirmed === true || (u.isEmailConfirmed === undefined && u.isConfirmed === true), primary: true }] : [],
+        phones: phone ? [{ phone, verified: u.isPhoneNumberConfirmed === true, primary: !email }] : [],
+        username,
+        name: (0, record_set_1.str)(u.name),
+        image_url: (0, record_set_1.str)(u.image),
+        locked: u.locked === true ? true : undefined,
+        public_metadata: (0, record_set_1.bag)(u.data),
+        private_metadata: (0, record_set_1.bag)({ ...(uuid ? { userfront_user_uuid: uuid } : {}), userfront_tenant_id: tenantId }),
+        created_at: (0, record_set_1.str)(u.createdAt),
+        last_sign_in_at: (0, record_set_1.str)(u.lastActiveAt),
+    });
+    return user.emails?.length || user.phones?.length || user.username ? user : null;
+}
+async function optional(fn) {
+    try {
+        return await fn();
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404, 405].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+//# sourceMappingURL=userfront.js.map

package/dist/migrate/export/userfront.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userfront.js","sourceRoot":"","sources":["../../../src/migrate/export/userfront.ts"],"names":[],"mappings":";;AAqCA,sCAIC;AAED,sCAQC;AAED,0CAoGC;AA6BD,4CAqBC;AA1MD,6CAA+F;AAC/F,mDAAwC;AACxC,+CAA2D;AA6B3D,MAAM,GAAG,GAAG,8BAA8B,CAAC;AAC3C,MAAM,SAAS,GAAG,OAAO,CAAC;AAC1B,2DAA2D;AAC3D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAErI,SAAgB,aAAa,CAAC,QAAgB;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,aAAa,CAAC,CAAwG;IACpI,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE;QAChD,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,IAA4B;IAChE,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IAClJ,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEjC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,IAAI,CACR,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,YAAY,GAAG,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAClF,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAA,iBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EACzD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC;QAC3B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3J,OAAO,IAAI,CAAC;IACd,CAAC,CACF,CAAC;IAEF,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EACpC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,EAC7B,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;QACxB,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM;YAAE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAK,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvB,WAAW,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,qBAAK,CAAC,CAAC;YACzC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACvH,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;QAC/I,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,EAAE,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,QAAQ,EAAE,CAAC;iBAC1D,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CACF,CAAC;IACF,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,gHAAgH,CAAC,CAAC;IAC3I,CAAC;IACD,IAAI,GAAG,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,+EAA+E,EAAE,GAAG,CAAC,CAAC;IAC1H,IAAI,QAAQ,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,wEAAwE,EAAE,QAAQ,CAAC,CAAC;IAC1H,IAAI,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,qHAAqH,EAAE,MAAM,CAAC,CAAC;IACpK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,yIAAyI,CAAC,CAAC;IACtJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAc,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,cAAuB,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,IAAI,CACjB,GAA0C,EAC1C,MAAmC,EACnC,UAAoD,EACpD,IAA2B;IAE3B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,IAAI,CAAC,CAAC,CAAC;gBAAE,KAAK,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM;QACpF,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC;YAAE,MAAM;IACtC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,QAAgB,EAAE,IAAY;IACvE,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAM,YAAY,QAAQ,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9H,CAAC;AAED,8DAA8D;AAC9D,SAAgB,gBAAgB,CAAC,CAAM,EAAE,QAAgB;IACvD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACtJ,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,sBAAsB,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAC9F,QAAQ;QACR,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;QACjB,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC5C,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,gBAAgB,EAAE,IAAA,gBAAG,EAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC;QACxG,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,EAAoB;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/migrate/export/workos-config.d.ts

@@ -0,0 +1,23 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { type VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate workos config` — what WorkOS's API exposes of an environment:
+ * roles and permissions (RBAC), the redirect URIs and CORS origins registered
+ * for AuthKit, and the SSO connections / Directory Sync directories (which
+ * move with the data export). Authentication methods, MFA policy, session and
+ * token lifetimes, branding, email templates, JWT templates and signup rules
+ * live only in the WorkOS dashboard: the report lists each as manual, with
+ * where to find it.
+ */
+export interface WorkosConfigSnapshot {
+    clientId?: string;
+    roles: Obj[];
+    permissions: Obj[];
+    redirectUris: Obj[];
+    corsOrigins: Obj[];
+    connections: Obj[];
+    directories: number;
+}
+export declare function fetchWorkosConfig(http: VendorHttp, clientId?: string): Promise<WorkosConfigSnapshot>;
+export declare function translateWorkosConfig(snap: WorkosConfigSnapshot): TranslationResult;