@atlasauth/cli 0.12.0 → 0.14.0

package/dist/migrate/export/workos-config.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchWorkosConfig = fetchWorkosConfig;
+exports.translateWorkosConfig = translateWorkosConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function listOf(http, path) {
+    const out = [];
+    let after;
+    try {
+        for (;;) {
+            const q = new URLSearchParams({ limit: '100', order: 'asc' });
+            if (after)
+                q.set('after', after);
+            const body = (await http.get(`${path}?${q.toString()}`)).body;
+            out.push(...(0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.data : undefined));
+            const next = (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.list_metadata) ? (0, record_set_1.str)(body.list_metadata.after) : undefined;
+            if (!next || next === after)
+                break;
+            after = next;
+        }
+    }
+    catch (err) {
+        // Absent on this environment (RBAC off, endpoint not offered, no permission).
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404, 405].includes(err.status))
+            return out;
+        throw err;
+    }
+    return out;
+}
+async function plainList(http, path) {
+    try {
+        const body = (await http.get(path)).body;
+        return (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.data : undefined);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404, 405].includes(err.status))
+            return [];
+        throw err;
+    }
+}
+async function fetchWorkosConfig(http, clientId) {
+    return {
+        ...(clientId ? { clientId } : {}),
+        // The roles listing is not paginated.
+        roles: await plainList(http, '/authorization/roles'),
+        permissions: await listOf(http, '/authorization/permissions'),
+        redirectUris: await listOf(http, '/user_management/redirect_uris'),
+        corsOrigins: await listOf(http, '/user_management/cors_origins'),
+        connections: await listOf(http, '/connections'),
+        directories: (await listOf(http, '/directories')).length,
+    };
+}
+function translateWorkosConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    for (const p of snap.permissions) {
+        const key = (0, record_set_1.str)(p.slug);
+        if (key)
+            b.push('permissions', { key, name: (0, record_set_1.str)(p.name) ?? key, description: (0, record_set_1.str)(p.description) ?? '' });
+    }
+    if (snap.permissions.length)
+        b.add('mapped', 'authorization', 'permissions', `${snap.permissions.length} permission(s).`, 'permissions');
+    let roles = 0;
+    for (const r of snap.roles) {
+        const slug = (0, record_set_1.str)(r.slug);
+        // Organization-specific roles are exported per organization with the data.
+        if (!slug || (0, record_set_1.str)(r.type) === 'OrganizationRole')
+            continue;
+        roles++;
+        b.roles[slug] = slug;
+        b.push('roles', { key: slug, name: (0, record_set_1.str)(r.name) ?? slug, description: (0, record_set_1.str)(r.description) ?? '', permissions: (0, record_set_1.strs)(r.permissions) });
+    }
+    if (roles)
+        b.add('mapped', 'authorization', 'environment roles', `${roles} role(s); members keep the same role slug as their Atlas role key.`, 'roles');
+    if (snap.roles.length === 0)
+        b.add('manual', 'authorization', 'roles', 'No roles were returned (RBAC may be off for this environment); the default "admin" and "member" roles carry over as Atlas organization roles.');
+    const redirects = new Set();
+    for (const u of snap.redirectUris) {
+        const uri = (0, record_set_1.str)(u.uri);
+        if (uri)
+            redirects.add(uri);
+    }
+    for (const url of redirects) {
+        if (url.includes('*'))
+            b.add('differs', 'redirect URIs', url, 'Atlas redirect URLs are exact (no wildcards).', 'redirect_urls');
+        else
+            b.push('redirect_urls', { url });
+    }
+    const exact = [...redirects].filter((u) => !u.includes('*')).length;
+    if (exact)
+        b.add('mapped', 'redirect URIs', 'redirect_uris', `${exact} redirect URI(s).`, 'redirect_urls');
+    if (redirects.size === 0)
+        b.add('manual', 'redirect URIs', 'redirect_uris', 'WorkOS did not list its redirect URIs by API: add your app\'s post-sign-in URLs to Atlas (redirect_urls).', 'redirect_urls');
+    for (const o of snap.corsOrigins) {
+        const origin = (0, record_set_1.str)(o.origin);
+        if (origin)
+            b.add('manual', 'CORS origins', origin, 'Add this origin to the allowed origins of your Atlas instance (Atlas dashboard → Settings → Allowed origins).');
+    }
+    const sso = snap.connections.length;
+    if (sso)
+        b.add('mapped', 'enterprise', `${sso} SSO connection(s)`, 'Move with the data export as Atlas SSO connections. WorkOS does not return the identity provider details: each customer\'s IdP is set up again against the new Atlas service-provider settings.', 'sso_connections');
+    if (snap.directories)
+        b.add('manual', 'enterprise', `${snap.directories} Directory Sync directory(ies)`, 'Reconnect through Atlas SCIM provisioning; the identity provider re-provisions users and groups.');
+    for (const [setting, where] of [
+        ['authentication methods (password, Magic Auth, social, passkeys)', 'Authentication → Methods'],
+        ['social connections (client ids and secrets)', 'Authentication → Social login (use the same OAuth apps in Atlas so imported accounts relink)'],
+        ['multi-factor authentication policy', 'Authentication → Multi-Factor Auth'],
+        ['session lifetime and access token lifetime', 'Authentication → Sessions'],
+        ['sign-up rules, email verification and domain restrictions', 'Authentication → Sign-up'],
+        ['branding, hosted-page text and email templates', 'Branding and Email'],
+        ['JWT templates and custom claims', 'Authentication → Sessions → JWT template'],
+        ['custom authentication domain', 'Domains'],
+        ['Radar (bot and fraud rules)', 'Radar'],
+        ['webhooks and events', 'Webhooks (create Atlas webhook endpoints)'],
+    ]) {
+        b.add('manual', 'settings not in the API', setting, `WorkOS does not expose this by API; copy it from the WorkOS dashboard (${where}).`);
+    }
+    return b.result(`WorkOS environment${snap.clientId ? ` ${snap.clientId}` : ''}`, {
+        ...(snap.clientId
+            ? { bridge: { preset: 'workos', vars: { client_id: snap.clientId } }, lazy: { preset: 'workos', config: { client_id: snap.clientId } } }
+            : {}),
+    });
+}
+//# sourceMappingURL=workos-config.js.map

package/dist/migrate/export/workos-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-config.js","sourceRoot":"","sources":["../../../src/migrate/export/workos-config.ts"],"names":[],"mappings":";;AAwDA,8CAWC;AAED,sDA+DC;AAlID,6CAAgE;AAChE,mDAAgD;AAChD,+CAAgE;AAqBhE,KAAK,UAAU,MAAM,CAAC,IAAgB,EAAE,IAAY;IAClD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,IAAI,KAAK;gBAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,KAAK;gBAAE,MAAM;YACnC,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8EAA8E;QAC9E,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3F,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,IAAY;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,OAAO,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAgB,EAAE,QAAiB;IACzE,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,sCAAsC;QACtC,KAAK,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,sBAAsB,CAAC;QACpD,WAAW,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,4BAA4B,CAAC;QAC7D,YAAY,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,gCAAgC,CAAC;QAClE,WAAW,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,+BAA+B,CAAC;QAChE,WAAW,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC;QAC/C,WAAW,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM;KACzD,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAA0B;IAC9D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,GAAG;YAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAU,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAEzI,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,2EAA2E;QAC3E,IAAI,CAAC,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,kBAAkB;YAAE,SAAS;QAC1D,KAAK,EAAE,CAAC;QACR,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAU,CAAC,CAAC;IAC7I,CAAC;IACD,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,KAAK,oEAAoE,EAAE,OAAO,CAAC,CAAC;IACxJ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,+IAA+I,CAAC,CAAC;IAExN,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,+CAA+C,EAAE,eAAe,CAAC,CAAC;;YAC3H,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,KAAK,mBAAmB,EAAE,eAAe,CAAC,CAAC;IAC3G,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,2GAA2G,EAAE,eAAe,CAAC,CAAC;IAE1M,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,+GAA+G,CAAC,CAAC;IACvK,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;IACpC,IAAI,GAAG;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,GAAG,oBAAoB,EAAE,iMAAiM,EAAE,iBAAiB,CAAC,CAAC;IACzR,IAAI,IAAI,CAAC,WAAW;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,WAAW,gCAAgC,EAAE,kGAAkG,CAAC,CAAC;IAE7M,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,iEAAiE,EAAE,0BAA0B,CAAC;QAC/F,CAAC,6CAA6C,EAAE,8FAA8F,CAAC;QAC/I,CAAC,oCAAoC,EAAE,oCAAoC,CAAC;QAC5E,CAAC,4CAA4C,EAAE,2BAA2B,CAAC;QAC3E,CAAC,2DAA2D,EAAE,0BAA0B,CAAC;QACzF,CAAC,gDAAgD,EAAE,oBAAoB,CAAC;QACxE,CAAC,iCAAiC,EAAE,0CAA0C,CAAC;QAC/E,CAAC,8BAA8B,EAAE,SAAS,CAAC;QAC3C,CAAC,6BAA6B,EAAE,OAAO,CAAC;QACxC,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;KAC5D,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,OAAO,EAAE,0EAA0E,KAAK,IAAI,CAAC,CAAC;IAC3I,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,qBAAqB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;QAC/E,GAAG,CAAC,IAAI,CAAC,QAAQ;YACf,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;YACxI,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/workos.d.ts

@@ -0,0 +1,46 @@
+import type { UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export workos` — a WorkOS environment (AuthKit + SSO +
+ * Directory Sync) onto the canonical bundle models, read with an API key on
+ * this machine.
+ *
+ *   - organizations (verified domains, metadata), environment roles and each
+ *     organization's custom roles, memberships with their role slug, pending
+ *     and past invitations;
+ *   - users (verified email, names, avatar, metadata, last sign-in) with the
+ *     OAuth identities WorkOS holds for them (provider user ids, so social
+ *     sign-in relinks exactly);
+ *   - SSO connections (SAML / OIDC) with the IdP signing certificates WorkOS
+ *     returns; the IdP entity id, SSO URL and OIDC client secret are NOT
+ *     available through the API, so the customer's IdP is reconfigured against
+ *     the new Atlas connection;
+ *   - password hashes: WorkOS publishes no export of them (only an import
+ *     path). If WorkOS support gives you a hash file, pass it
+ *     (--workos-hashes-file); otherwise turn on the `workos` lazy-migration
+ *     preset, which checks each password against WorkOS on first sign-in.
+ *
+ * Not exportable: TOTP secrets and passkeys (users enrol again), API key
+ * secrets (reissue as Atlas API keys), sessions (the `workos` bridge preset
+ * exchanges the access token). Directory Sync directories are reconnected in
+ * Atlas SCIM.
+ */
+export interface WorkosExportOptions {
+    apiKey: string;
+    /** For the manifest only (the client id appears in token issuers). */
+    clientId?: string;
+    /** API base (default https://api.workos.com). */
+    baseUrl?: string;
+    /** A password-hash export from WorkOS support (CSV or NDJSON), when the owner has one. */
+    hashesText?: string;
+    /** Also count TOTP / SMS / WebAuthn factors per user (one more request each) so the report says how many re-enrol. */
+    countFactors?: boolean;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+export declare function exportWorkos(opts: WorkosExportOptions): Promise<RecordSet>;
+/** One WorkOS user → a user record (a user always has an email). */
+export declare function mapWorkosUser(u: Obj): UserRecord | null;
+/** `GoogleOAuth` → `google`, `GitHubOAuth` → `github`: the provider name an Atlas provider key is looked up by. */
+export declare function providerKey(provider: string): string;

package/dist/migrate/export/workos.js

@@ -0,0 +1,272 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportWorkos = exportWorkos;
+exports.mapWorkosUser = mapWorkosUser;
+exports.providerKey = providerKey;
+const csv_1 = require("../../import/csv");
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+const PAGE = 100;
+async function exportWorkos(opts) {
+    const set = new record_set_1.RecordSet();
+    if (!/^sk_[A-Za-z0-9_]+$/.test(opts.apiKey)) {
+        throw new Error('Not a WorkOS API key: it starts with sk_ (WORKOS_API_KEY).');
+    }
+    const progress = opts.onProgress ?? (() => undefined);
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'WorkOS',
+        baseUrl: (opts.baseUrl ?? 'https://api.workos.com').replace(/\/+$/, ''),
+        headers: { authorization: `Bearer ${opts.apiKey}` },
+        fetchImpl: opts.fetchImpl,
+        sleep: opts.sleep,
+    });
+    progress('organizations');
+    const orgIds = [];
+    for (const o of await listAll(http, '/organizations')) {
+        const id = (0, record_set_1.str)(o.id);
+        const name = (0, record_set_1.str)(o.name);
+        if (!id || !name)
+            continue;
+        orgIds.push(id);
+        set.add('organization', (0, record_set_1.compact)({
+            id,
+            name,
+            // Only domains WorkOS has verified let members join by domain.
+            domains: (0, record_set_1.objs)(o.domains)
+                .filter((d) => ['verified', 'legacy_verified'].includes((0, record_set_1.str)(d.state) ?? ''))
+                .map((d) => (0, record_set_1.str)(d.domain)?.toLowerCase())
+                .filter((d) => !!d),
+            public_metadata: (0, record_set_1.bag)(o.metadata),
+            private_metadata: (0, record_set_1.str)(o.external_id) ? { workos_external_id: (0, record_set_1.str)(o.external_id) } : undefined,
+            created_at: (0, record_set_1.str)(o.created_at),
+        }));
+    }
+    progress('roles');
+    const envRoles = await optional(http, '/authorization/roles');
+    for (const r of (0, record_set_1.objs)(envRoles?.data))
+        addRole(set, r, undefined);
+    for (const id of orgIds) {
+        for (const r of (0, record_set_1.objs)((await optional(http, `/authorization/organizations/${encodeURIComponent(id)}/roles`))?.data)) {
+            // The listing repeats the environment roles; only the organization's own are new.
+            if ((0, record_set_1.str)(r.type) === 'OrganizationRole')
+                addRole(set, r, id);
+        }
+    }
+    progress('users');
+    const hashes = opts.hashesText ? indexHashes(opts.hashesText) : null;
+    let withHash = 0;
+    let factorUsers = 0;
+    let passkeyUsers = 0;
+    for (const u of await listAll(http, '/user_management/users')) {
+        const user = mapWorkosUser(u);
+        if (!user) {
+            set.omit('user', 'no email address');
+            continue;
+        }
+        const h = hashes && (hashes.get(user.id) ?? hashes.get(user.emails[0].email) ?? ((0, record_set_1.str)(u.external_id) ? hashes.get((0, record_set_1.str)(u.external_id)) : undefined));
+        if (h) {
+            user.password = { algorithm: 'auto', hash: h };
+            withHash++;
+        }
+        set.add('user', user);
+        const email = user.emails[0];
+        const identities = await optional(http, `/user_management/users/${encodeURIComponent(user.id)}/identities`);
+        // The identities endpoint answers with a bare array.
+        for (const i of (0, record_set_1.objs)(Array.isArray(identities) ? identities : identities?.data)) {
+            const sub = (0, record_set_1.str)(i.idp_id);
+            const provider = (0, record_set_1.str)(i.provider);
+            if (!sub || !provider)
+                continue;
+            set.add('identity', (0, record_set_1.compact)({ user_id: user.id, provider: providerKey(provider), provider_user_id: sub, kind: 'oauth', email: email.email, email_verified: email.verified }), `${user.id}:${provider}:${sub}`);
+        }
+        if (opts.countFactors) {
+            const factors = (0, record_set_1.objs)((await optional(http, `/user_management/users/${encodeURIComponent(user.id)}/auth_factors`))?.data);
+            if (factors.some((f) => ['totp', 'sms', 'generic_otp'].includes((0, record_set_1.str)(f.type) ?? '')))
+                factorUsers++;
+            if (factors.some((f) => (0, record_set_1.str)(f.type) === 'webauthn'))
+                passkeyUsers++;
+        }
+    }
+    if (factorUsers)
+        set.omit('mfa_factor', 'WorkOS never returns TOTP secrets (they are shown only when a factor is enrolled); users enrol again in Atlas', factorUsers);
+    if (passkeyUsers)
+        set.omit('passkey', 'WorkOS does not export WebAuthn public keys; users register a passkey again in Atlas', passkeyUsers);
+    if (!opts.countFactors && set.count('user') > 0) {
+        set.warn('Second factors were not counted: WorkOS never exports TOTP secrets or passkeys, so users with a second factor enrol again (pass --set workos-factors=1 to count them).');
+    }
+    if (!hashes && set.count('user') > 0) {
+        set.warn('No password hashes: WorkOS has no password export. If WorkOS support provided one, pass it with --workos-hashes-file; otherwise turn on the workos lazy-migration preset so each password moves on its first sign-in.');
+    }
+    else if (hashes && withHash === 0) {
+        set.warn('The hash file matched no user (by user id, email or external id): check its columns.');
+    }
+    progress('memberships');
+    let multiRole = false;
+    for (const id of orgIds) {
+        for (const m of await listAll(http, '/user_management/organization_memberships', { organization_id: id, statuses: 'active' })) {
+            const userId = (0, record_set_1.str)(m.user_id);
+            if (!userId)
+                continue;
+            const roles = [(0, record_set_1.str)((0, record_set_1.isObj)(m.role) ? m.role.slug : undefined), ...(0, record_set_1.objs)(m.roles).map((r) => (0, record_set_1.str)(r.slug))].filter((s) => !!s);
+            const unique = [...new Set(roles)];
+            if (unique.length > 1)
+                multiRole = true;
+            set.add('membership', (0, record_set_1.compact)({ id: (0, record_set_1.str)(m.id), organization_id: id, user_id: userId, role: unique[0] ?? 'member', created_at: (0, record_set_1.str)(m.created_at) }), `${id}:${userId}`);
+        }
+    }
+    if (multiRole)
+        set.warn('Some members hold several WorkOS roles; Atlas seats each member with one role (the first).');
+    progress('invitations');
+    for (const inv of await optionalAll(http, '/user_management/invitations')) {
+        const id = (0, record_set_1.str)(inv.id);
+        const email = (0, record_set_1.str)(inv.email)?.toLowerCase();
+        if (!id || !email)
+            continue;
+        const state = (0, record_set_1.str)(inv.state);
+        set.add('invitation', (0, record_set_1.compact)({
+            id,
+            organization_id: (0, record_set_1.str)(inv.organization_id),
+            email,
+            role: (0, record_set_1.str)(inv.role_slug),
+            status: state && ['pending', 'accepted', 'revoked', 'expired'].includes(state) ? state : undefined,
+            inviter_user_id: (0, record_set_1.str)(inv.inviter_user_id),
+            expires_at: (0, record_set_1.str)(inv.expires_at),
+            created_at: (0, record_set_1.str)(inv.created_at),
+        }));
+    }
+    progress('sso');
+    let idpManual = 0;
+    for (const c of await optionalAll(http, '/connections')) {
+        const id = (0, record_set_1.str)(c.id);
+        if (!id)
+            continue;
+        const type = (0, record_set_1.str)(c.connection_type) ?? '';
+        const protocol = /oidc/i.test(type) ? 'oidc' : 'saml';
+        let cert;
+        if (protocol === 'saml') {
+            const certs = await optional(http, `/connections/${encodeURIComponent(id)}/saml_idp_signing_certs`);
+            cert = (0, record_set_1.str)((0, record_set_1.objs)(certs?.data)[0]?.value);
+        }
+        idpManual++;
+        set.add('sso_connection', (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(c.name) ?? `${type || protocol} ${id}`,
+            organization_id: (0, record_set_1.str)(c.organization_id),
+            protocol,
+            domains: (0, record_set_1.objs)(c.domains).map((d) => (0, record_set_1.str)(d.domain)?.toLowerCase()).filter((d) => !!d),
+            saml: protocol === 'saml' && cert ? { idp_certificate: cert } : undefined,
+            enabled: (0, record_set_1.str)(c.state) ? (0, record_set_1.str)(c.state) === 'active' : undefined,
+        }));
+    }
+    if (idpManual) {
+        set.warn(`${idpManual} SSO connection(s): WorkOS does not return the identity provider's entity id, SSO URL or OIDC client secret. Each customer's IdP admin sets the connection up again against the new Atlas service-provider details (or send them Atlas's metadata URL).`);
+    }
+    progress('directories');
+    const directories = await optionalAll(http, '/directories');
+    if (directories.length) {
+        set.warn(`${directories.length} Directory Sync directory(ies): reconnect each through Atlas SCIM provisioning (the directory's users and groups are re-provisioned by the identity provider).`);
+    }
+    progress('api keys');
+    let keys = 0;
+    for (const id of orgIds)
+        keys += (await optionalAll(http, `/organizations/${encodeURIComponent(id)}/api_keys`)).length;
+    if (keys)
+        set.omit('api_key', 'WorkOS shows an API key secret only once: reissue them as Atlas API keys', keys);
+    set.manifest = { origin: opts.clientId ?? 'api.workos.com', ...(opts.clientId ? { settings: { client_id: opts.clientId } } : {}) };
+    return set;
+}
+function addRole(set, r, organizationId) {
+    const key = (0, record_set_1.str)(r.slug);
+    if (!key)
+        return;
+    set.add('role', (0, record_set_1.compact)({ key, name: (0, record_set_1.str)(r.name), description: (0, record_set_1.str)(r.description), scope: 'organization', organization_id: organizationId, permissions: (0, record_set_1.strs)(r.permissions) }), `${organizationId ?? ''}:${key}`);
+}
+/** One WorkOS user → a user record (a user always has an email). */
+function mapWorkosUser(u) {
+    const id = (0, record_set_1.str)(u.id);
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    if (!id || !email)
+        return null;
+    const metadata = (0, record_set_1.bag)(u.metadata);
+    return (0, record_set_1.compact)({
+        id,
+        emails: [{ email, verified: u.email_verified === true, primary: true }],
+        first_name: (0, record_set_1.str)(u.first_name),
+        last_name: (0, record_set_1.str)(u.last_name),
+        image_url: (0, record_set_1.str)(u.profile_picture_url),
+        public_metadata: metadata,
+        private_metadata: (0, record_set_1.str)(u.external_id) ? { workos_external_id: (0, record_set_1.str)(u.external_id) } : undefined,
+        created_at: (0, record_set_1.str)(u.created_at),
+        last_sign_in_at: (0, record_set_1.str)(u.last_sign_in_at),
+    });
+}
+/** `GoogleOAuth` → `google`, `GitHubOAuth` → `github`: the provider name an Atlas provider key is looked up by. */
+function providerKey(provider) {
+    return provider.replace(/OAuth$/i, '').toLowerCase();
+}
+/**
+ * The support hash file, by user id, email and external id. Its layout is not
+ * published: CSV with a hash column and an id / email column, or NDJSON.
+ */
+function indexHashes(text) {
+    const t = text.trim();
+    const rows = t.startsWith('{') ? t.split(/\r?\n/).filter((l) => l.trim()).map((l) => JSON.parse(l)) : (0, csv_1.parseCsv)(t);
+    const out = new Map();
+    for (const r of rows) {
+        const keys = Object.keys(r);
+        const hashKey = keys.find((k) => /hash/i.test(k) && !/type|algo/i.test(k));
+        const hash = hashKey ? (0, record_set_1.str)(r[hashKey]) : undefined;
+        if (!hash)
+            continue;
+        for (const k of keys) {
+            const v = (0, record_set_1.str)(r[k]);
+            if (!v)
+                continue;
+            if (/^(user_?id|id|external_?id)$/i.test(k))
+                out.set(v, hash);
+            else if (/^email$/i.test(k))
+                out.set(v.toLowerCase(), hash);
+        }
+    }
+    return out;
+}
+/** Every page of a WorkOS list endpoint (`{ data, list_metadata: { after } }`), in a stable order. */
+async function listAll(http, path, params = {}) {
+    const out = [];
+    let after;
+    for (;;) {
+        const q = new URLSearchParams({ limit: String(PAGE), order: 'asc', ...params });
+        if (after)
+            q.set('after', after);
+        const body = (await http.get(`${path}?${q.toString()}`)).body;
+        out.push(...(0, record_set_1.objs)(body?.data));
+        const next = (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.list_metadata) ? (0, record_set_1.str)(body.list_metadata.after) : undefined;
+        if (!next || next === after)
+            break;
+        after = next;
+    }
+    return out;
+}
+/** A call whose absence (feature off, no permission, unknown path) is not an export failure. */
+async function optional(http, path) {
+    try {
+        return (await http.get(path)).body;
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+/** {@link listAll} for an endpoint the environment may not have (feature off, no permission). */
+async function optionalAll(http, path, params = {}) {
+    try {
+        return await listAll(http, path, params);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
+            return [];
+        throw err;
+    }
+}
+//# sourceMappingURL=workos.js.map

package/dist/migrate/export/workos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../../src/migrate/export/workos.ts"],"names":[],"mappings":";;AAgDA,oCAqLC;AAaD,sCAgBC;AAGD,kCAEC;AAtQD,0CAA4C;AAC5C,6CAAyF;AACzF,+CAA2D;AA2C3D,MAAM,IAAI,GAAG,GAAG,CAAC;AAEV,KAAK,UAAU,YAAY,CAAC,IAAyB;IAC1D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;QACnD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACtD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAS;QAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,GAAG,CAAC,GAAG,CACL,cAAc,EACd,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,IAAI;YACJ,+DAA+D;YAC/D,OAAO,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC;iBACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;iBAC3E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;iBACxC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YAChC,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7F,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;SAC9B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACjE,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,gCAAgC,kBAAkB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YACnH,kFAAkF;YAClF,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,kBAAkB;gBAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,CAAC,QAAQ,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,QAAQ,EAAE,CAAC;QACb,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAO,CAAC,CAAC,CAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,0BAA0B,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;QAC5G,qDAAqD;QACrD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;YAChF,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAChC,GAAG,CAAC,GAAG,CACL,UAAU,EACV,IAAA,oBAAO,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,OAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,EACjK,GAAG,IAAI,CAAC,EAAE,IAAI,QAAQ,IAAI,GAAG,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,0BAA0B,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACzH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAE,WAAW,EAAE,CAAC;YACnG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC;gBAAE,YAAY,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,+GAA+G,EAAE,WAAW,CAAC,CAAC;IACtK,IAAI,YAAY;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,sFAAsF,EAAE,YAAY,CAAC,CAAC;IAC5I,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,wKAAwK,CAAC,CAAC;IACrL,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CACN,uNAAuN,CACxN,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACnG,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,2CAA2C,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC9H,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,KAAK,GAAG,CAAC,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvI,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;YACxC,GAAG,CAAC,GAAG,CACL,YAAY,EACZ,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,EAC5H,GAAG,EAAE,IAAI,MAAM,EAAE,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;IAEtH,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,MAAM,WAAW,CAAC,IAAI,EAAE,8BAA8B,CAAC,EAAE,CAAC;QAC1E,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK;YAAE,SAAS;QAC5B,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,CACL,YAAY,EACZ,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,eAAe,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,eAAe,CAAC;YACzC,KAAK;YACL,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,KAAK,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAwD,CAAC,CAAC,CAAC,SAAS;YACtJ,eAAe,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,eAAe,CAAC;YACzC,UAAU,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,UAAU,CAAC;YAC/B,UAAU,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,UAAU,CAAC;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,MAAM,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;QACxD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,MAAgB,CAAC;QAC5E,IAAI,IAAwB,CAAC;QAC7B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC;YACpG,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,iBAAI,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,SAAS,EAAE,CAAC;QACZ,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAI,EAAE,EAAE;YAChD,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC;YACvC,QAAQ;YACR,OAAO,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACjG,IAAI,EAAE,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YACzE,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS;SAC9D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CACN,GAAG,SAAS,yPAAyP,CACtQ,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC5D,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,gKAAgK,CAAC,CAAC;IAClM,CAAC;IAED,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,MAAM;QAAE,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;IACvH,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,0EAA0E,EAAE,IAAI,CAAC,CAAC;IAEhH,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,IAAI,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnI,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,GAAc,EAAE,CAAM,EAAE,cAAkC;IACzE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,cAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EACvK,GAAG,cAAc,IAAI,EAAE,IAAI,GAAG,EAAE,CACjC,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,aAAa,CAAC,CAAM;IAClC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,IAAA,oBAAO,EAAC;QACb,EAAE;QACF,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC3B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,mBAAmB,CAAC;QACrC,eAAe,EAAE,QAAQ;QACzB,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7F,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC;KACxC,CAAe,CAAC;AACnB,CAAC;AAED,mHAAmH;AACnH,SAAgB,WAAW,CAAC,QAAgB;IAC1C,OAAO,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,IAAI,GAAU,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,cAAQ,EAAC,CAAC,CAAC,CAAC;IAChI,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;iBACzD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAY,EAAE,SAAiC,EAAE;IACxF,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,KAAyB,CAAC;IAC9B,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAChF,IAAI,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,KAAK;YAAE,MAAM;QACnC,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,QAAQ,CAAC,IAAgB,EAAE,IAAY;IACpD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAA2B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY,EAAE,SAAiC,EAAE;IAC5F,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACrF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/migrate/export/zitadel-config.d.ts

@@ -0,0 +1,37 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type ZitadelApiOptions } from './zitadel';
+import { type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate zitadel config` — ZITADEL settings → Atlas config.
+ *
+ * One reader, two sources: ZITADEL's own export document (`zitadel export`, or
+ * `POST /admin/v1/export` with passwords and secrets OFF), which carries each
+ * organization's policies, projects with their roles, OIDC / API applications,
+ * identity providers and actions; plus, through the API, the INSTANCE default
+ * policies (login, password complexity, lockout, second factors), which an
+ * organization without an override inherits.
+ */
+export interface ZitadelPolicies {
+    login?: Obj;
+    passwordComplexity?: Obj;
+    lockout?: Obj;
+    secondFactors?: string[];
+    multiFactors?: string[];
+}
+export interface ZitadelConfigSnapshot {
+    origin: string;
+    orgs: Obj[];
+    idpTemplates: Obj[];
+    /** Instance default policies (live API read only). */
+    defaults: ZitadelPolicies;
+    /** The instance URL: the bridge issuer and the lazy-migration base URL. */
+    instance?: string;
+}
+/** An export document (`{ orgs }`) as a config snapshot; no instance defaults. */
+export declare function configSnapshotFromExport(doc: unknown, origin: string, instance?: string): ZitadelConfigSnapshot;
+/** The instance's default policies, best effort (a narrow role or an old version answers 4xx for some). */
+export declare function fetchZitadelPolicies(http: VendorHttp): Promise<ZitadelPolicies>;
+/** Read the instance through the Admin API (an IAM_OWNER token): the export WITHOUT secrets, plus the default policies. */
+export declare function fetchZitadelConfig(o: Pick<ZitadelApiOptions, 'instance' | 'token' | 'fetchImpl' | 'sleep'>): Promise<ZitadelConfigSnapshot>;
+export declare function translateZitadelConfig(snap: ZitadelConfigSnapshot): TranslationResult;