@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/auth0.d.ts

@@ -1,62 +0,0 @@
-import type { PasswordHash } from '@atlasauth/migrate';
-import { RecordSet, type Obj } from './record-set';
-/**
- * `atlas migrate export auth0` — Auth0 (and Okta Customer Identity Cloud,
- * which is Auth0) onto the canonical bundle models.
- *
- * Read with a Management API token the owner holds (a machine-to-machine
- * application's client id + secret, or a token pasted from the dashboard);
- * the calls run on this machine and the credentials go nowhere else.
- *
- *   - users: through a user-export JOB (the only complete listing — user
- *     search stops at 1,000), or from an export file the owner already has;
- *   - password hashes and MFA secrets: Auth0 releases them ONLY through a
- *     support ticket. Pass the decrypted file with --auth0-hashes-file; rows are matched
- *     by user id (`_id.$oid` → `auth0|<oid>`) or email. Without it, enable the
- *     `auth0` lazy-migration preset so passwords move on first sign-in;
- *   - social and enterprise identities, app roles (role → users), organizations,
- *     members with their roles, pending invitations, enterprise connections
- *     (SAML / OIDC / Azure AD / ADFS / Okta / Ping / Google Workspace), and the
- *     tenant's public signing keys;
- *   - with --authentication-methods: per user, phone/email second factors and
- *     passkeys (public key only — Auth0 never returns a TOTP secret by API).
- *
- * Sessions are not exported: Auth0 issues JWTs, bridged by the `auth0`
- * bridge preset against the tenant's JWKS.
- */
-export interface Auth0ExportOptions {
-    /** The tenant's canonical domain (`acme.us.auth0.com`), not a custom domain. */
-    domain: string;
-    clientId?: string;
-    clientSecret?: string;
-    /** A Management API token, instead of client credentials. */
-    token?: string;
-    /** The text of a user export file (NDJSON or JSON array), instead of running an export job. */
-    usersText?: string;
-    /** The text of the decrypted password-hash / MFA export from Auth0 support (NDJSON or JSON). */
-    hashesText?: string;
-    /** Only this database / social connection's users (export job `connection_id`). */
-    connectionId?: string;
-    /** Read each user's authentication methods (phone/email factors, passkeys). One call per user. */
-    authenticationMethods?: boolean;
-    /** The WebAuthn relying party the passkeys were registered for (default: the domain). */
-    rpId?: string;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-/** Fields requested from the export job (json format allows whole metadata objects). */
-export declare const AUTH0_EXPORT_FIELDS: readonly ["user_id", "email", "email_verified", "username", "phone_number", "phone_verified", "given_name", "family_name", "name", "nickname", "picture", "identities", "app_metadata", "user_metadata", "created_at", "last_login", "blocked"];
-export declare function exportAuth0(opts: Auth0ExportOptions): Promise<RecordSet>;
-export declare function managementToken(domain: string, opts: Auth0ExportOptions, fetchImpl: typeof fetch): Promise<string>;
-/** NDJSON (Auth0's export format) or a JSON array / `{ users: [] }`. */
-export declare function parseLines(text: string): Obj[];
-/** Auth0 role names are free text: `Billing Admin` → `billing_admin`. */
-export declare function roleKey(name: string): string;
-/**
- * An Auth0 bulk-import `custom_password_hash` (users imported into Auth0 that
- * never signed in since keep it) → the Atlas registry's algorithm + params.
- */
-export declare function auth0CustomHash(c: Obj): PasswordHash | {
-    reason: string;
-};

package/dist/migrate/export/auth0.js

@@ -1,575 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH0_EXPORT_FIELDS = void 0;
-exports.exportAuth0 = exportAuth0;
-exports.managementToken = managementToken;
-exports.parseLines = parseLines;
-exports.roleKey = roleKey;
-exports.auth0CustomHash = auth0CustomHash;
-const node_zlib_1 = require("node:zlib");
-const record_set_1 = require("./record-set");
-const vendor_http_1 = require("./vendor-http");
-/** Fields requested from the export job (json format allows whole metadata objects). */
-exports.AUTH0_EXPORT_FIELDS = [
-    'user_id',
-    'email',
-    'email_verified',
-    'username',
-    'phone_number',
-    'phone_verified',
-    'given_name',
-    'family_name',
-    'name',
-    'nickname',
-    'picture',
-    'identities',
-    'app_metadata',
-    'user_metadata',
-    'created_at',
-    'last_login',
-    'blocked',
-];
-const ENTERPRISE_STRATEGIES = ['samlp', 'oidc', 'waad', 'adfs', 'okta', 'pingfederate', 'google-apps', 'ad'];
-async function exportAuth0(opts) {
-    const set = new record_set_1.RecordSet();
-    const domain = opts.domain.replace(/^https?:\/\//, '').replace(/\/+$/, '');
-    if (!/^[a-z0-9.-]+$/i.test(domain))
-        throw new Error(`Not an Auth0 domain: ${opts.domain}`);
-    const progress = opts.onProgress ?? (() => undefined);
-    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-    const fetchImpl = opts.fetchImpl ?? fetch;
-    let token = opts.token;
-    const http = new vendor_http_1.VendorHttp({
-        vendor: 'Auth0',
-        baseUrl: `https://${domain}/api/v2`,
-        headers: async () => ({ authorization: `Bearer ${(token ??= await managementToken(domain, opts, fetchImpl))}` }),
-        fetchImpl,
-        sleep,
-    });
-    // Offline: only the files (users + hashes), no Management API calls at all.
-    const online = Boolean(opts.token || (opts.clientId && opts.clientSecret));
-    if (!online && opts.usersText === undefined) {
-        throw new Error('Auth0 export needs a Management API token (or M2M client id + secret), or a user export file.');
-    }
-    if (!online)
-        set.warn('Exported from files only: organizations, roles and enterprise connections need Management API access.');
-    const list = async (fn) => (online ? fn() : []);
-    // Enterprise connections first: identities point at them by name.
-    progress('connections');
-    const connectionIds = new Map();
-    for (const c of await list(() => pageAll(http, `/connections?${ENTERPRISE_STRATEGIES.map((s) => `strategy=${s}`).join('&')}`, 'connections'))) {
-        const added = addConnection(set, c, domain);
-        if (added)
-            connectionIds.set((0, record_set_1.str)(c.name), added);
-    }
-    progress('organizations');
-    const orgs = await list(() => checkpointAll(http, '/organizations', 'organizations'));
-    for (const o of orgs) {
-        const id = (0, record_set_1.str)(o.id);
-        const name = (0, record_set_1.str)(o.display_name) ?? (0, record_set_1.str)(o.name);
-        if (!id || !name)
-            continue;
-        set.add('organization', (0, record_set_1.compact)({
-            id,
-            name,
-            slug: (0, record_set_1.str)(o.name),
-            image_url: (0, record_set_1.str)((0, record_set_1.isObj)(o.branding) ? o.branding.logo_url : undefined),
-            public_metadata: (0, record_set_1.bag)(o.metadata),
-        }));
-    }
-    progress('roles');
-    const roles = await list(() => pageAll(http, '/roles', 'roles'));
-    const roleKeyById = new Map();
-    const userRoles = new Map();
-    for (const r of roles) {
-        const id = (0, record_set_1.str)(r.id);
-        const name = (0, record_set_1.str)(r.name);
-        if (!id || !name)
-            continue;
-        const key = roleKey(name);
-        roleKeyById.set(id, key);
-        const permissions = (await pageAll(http, `/roles/${id}/permissions`, 'permissions'))
-            .map((p) => (0, record_set_1.str)(p.permission_name))
-            .filter((p) => !!p);
-        set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(r.description), scope: 'app', permissions }), `app:${key}`);
-        if (orgs.length)
-            set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(r.description), scope: 'organization', permissions }), `org:${key}`);
-        for (const u of await checkpointAll(http, `/roles/${id}/users`, 'users')) {
-            const uid = (0, record_set_1.str)(u.user_id);
-            if (uid)
-                userRoles.set(uid, [...(userRoles.get(uid) ?? []), key]);
-        }
-    }
-    progress('users');
-    const userLines = opts.usersText !== undefined ? parseLines(opts.usersText) : await runExportJob(http, opts, fetchImpl, sleep, progress);
-    const secrets = opts.hashesText !== undefined ? indexHashes(parseLines(opts.hashesText)) : null;
-    const userIds = new Set();
-    let withHash = 0;
-    for (const u of userLines) {
-        const id = (0, record_set_1.str)(u.user_id);
-        if (!id)
-            continue;
-        const secret = secrets ? (secrets.byId.get(id) ?? secrets.byEmail.get((0, record_set_1.str)(u.email)?.toLowerCase() ?? '')) : undefined;
-        if (addUser(set, u, { roles: userRoles.get(id), secret, connectionIds })) {
-            userIds.add(id);
-            if (secret?.password)
-                withHash++;
-        }
-    }
-    const dbUsers = set.list('user').filter((u) => u.id.startsWith('auth0|')).length;
-    if (!secrets && dbUsers > 0) {
-        set.warn(`${dbUsers} database user(s) without password hashes: Auth0 releases hashes only through a support ticket. Import them later with --auth0-hashes-file, or turn on the auth0 lazy-migration preset so each password moves on its first sign-in.`);
-    }
-    else if (secrets && withHash < dbUsers) {
-        set.omit('password', 'no row in the hash export for this database user', dbUsers - withHash);
-    }
-    if (opts.authenticationMethods && online) {
-        progress('authentication methods');
-        for (const id of userIds)
-            await addAuthenticationMethods(set, http, id, opts.rpId ?? domain);
-    }
-    else {
-        set.warn('Second factors and passkeys were not read (pass --authentication-methods). Without them, users re-enrol MFA in Atlas.');
-    }
-    progress('organization members');
-    for (const o of orgs) {
-        const orgId = (0, record_set_1.str)(o.id);
-        if (!orgId)
-            continue;
-        for (const m of await checkpointAll(http, `/organizations/${orgId}/members?fields=user_id,roles&include_fields=true`, 'members')) {
-            const uid = (0, record_set_1.str)(m.user_id);
-            if (!uid || !userIds.has(uid))
-                continue;
-            const role = (0, record_set_1.objs)(m.roles).map((r) => roleKeyById.get((0, record_set_1.str)(r.id) ?? '') ?? ((0, record_set_1.str)(r.name) ? roleKey((0, record_set_1.str)(r.name)) : undefined)).find(Boolean) ?? 'member';
-            set.add('membership', { organization_id: orgId, user_id: uid, role }, `${orgId}:${uid}`);
-            if ((0, record_set_1.objs)(m.roles).length > 1)
-                set.warn(`Some organization members hold several Auth0 roles; Atlas seats each member with one role (the first).`);
-        }
-        for (const inv of await pageAll(http, `/organizations/${orgId}/invitations`, 'invitations')) {
-            const id = (0, record_set_1.str)(inv.id);
-            const email = (0, record_set_1.str)((0, record_set_1.isObj)(inv.invitee) ? inv.invitee.email : undefined);
-            if (!id || !email)
-                continue;
-            const roleIds = Array.isArray(inv.roles) ? inv.roles : [];
-            set.add('invitation', (0, record_set_1.compact)({
-                id,
-                organization_id: orgId,
-                email,
-                role: roleIds.map((r) => roleKeyById.get(String(r))).find(Boolean),
-                status: 'pending',
-                expires_at: (0, record_set_1.str)(inv.expires_at),
-                created_at: (0, record_set_1.str)(inv.created_at),
-            }));
-        }
-    }
-    progress('signing keys');
-    if (online) {
-        try {
-            const res = await fetchImpl(`https://${domain}/.well-known/jwks.json`, { headers: { accept: 'application/json' } });
-            if (res.ok) {
-                const body = (await res.json());
-                for (const k of (0, record_set_1.objs)(body.keys))
-                    if ((0, record_set_1.str)(k.kid))
-                        set.add('jwks', { kid: (0, record_set_1.str)(k.kid), jwk: k });
-            }
-        }
-        catch {
-            set.warn('The tenant JWKS could not be read; the bridge preset fetches it live instead.');
-        }
-    }
-    set.manifest = {
-        origin: domain,
-        rpId: opts.authenticationMethods ? (opts.rpId ?? domain) : null,
-        providers: [...new Set(set.list('identity').map((i) => i.provider))].sort(),
-    };
-    return set;
-}
-// ── tokens and paging ───────────────────────────────────────────────────────
-async function managementToken(domain, opts, fetchImpl) {
-    if (!opts.clientId || !opts.clientSecret) {
-        throw new Error('Auth0 export needs a Management API token, or the client id and secret of a machine-to-machine application authorized for the Management API.');
-    }
-    const res = await fetchImpl(`https://${domain}/oauth/token`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', accept: 'application/json' },
-        body: JSON.stringify({ grant_type: 'client_credentials', client_id: opts.clientId, client_secret: opts.clientSecret, audience: `https://${domain}/api/v2/` }),
-    });
-    const body = (await res.json().catch(() => ({})));
-    if (!res.ok || !body.access_token) {
-        throw new vendor_http_1.VendorApiError('Auth0', res.status, '/oauth/token', body.error_description ?? 'could not get a Management API token');
-    }
-    return body.access_token;
-}
-/** page/per_page listing with include_totals (Auth0's classic paging). */
-async function pageAll(http, path, key) {
-    const out = [];
-    const sep = path.includes('?') ? '&' : '?';
-    for (let page = 0;; page++) {
-        const { body } = await http.get(`${path}${sep}page=${page}&per_page=100&include_totals=true`);
-        const rows = Array.isArray(body) ? body.filter(record_set_1.isObj) : (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
-        out.push(...rows);
-        const total = (0, record_set_1.isObj)(body) && typeof body.total === 'number' ? body.total : undefined;
-        if (rows.length < 100 || (total !== undefined && out.length >= total))
-            return out;
-    }
-}
-/** Checkpoint paging (`from` / `take`, `next` in the body): no 1,000-row ceiling. */
-async function checkpointAll(http, path, key) {
-    const out = [];
-    const sep = path.includes('?') ? '&' : '?';
-    let from;
-    for (;;) {
-        const { body } = await http.get(`${path}${sep}take=100${from ? `&from=${encodeURIComponent(from)}` : ''}`);
-        const rows = Array.isArray(body) ? body.filter(record_set_1.isObj) : (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
-        out.push(...rows);
-        from = (0, record_set_1.isObj)(body) ? (0, record_set_1.str)(body.next) : undefined;
-        if (!from || rows.length === 0)
-            return out;
-    }
-}
-async function runExportJob(http, opts, fetchImpl, sleep, progress) {
-    const body = { format: 'json', fields: exports.AUTH0_EXPORT_FIELDS.map((name) => ({ name })) };
-    if (opts.connectionId)
-        body.connection_id = opts.connectionId;
-    let job;
-    try {
-        job = (await http.post('/jobs/users-exports', body)).body;
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 402)) {
-            throw new Error(`Auth0 refused the user export job (${err.message}). Export jobs need a paid plan and the read:users scope; or download an export yourself and pass it with --auth0-users-file.`);
-        }
-        throw err;
-    }
-    const id = (0, record_set_1.str)(job.id);
-    if (!id)
-        throw new Error('Auth0 did not return an export job id.');
-    for (let i = 0;; i++) {
-        const { body: status } = await http.get(`/jobs/${id}`);
-        const state = (0, record_set_1.str)(status.status);
-        if (state === 'completed' && (0, record_set_1.str)(status.location)) {
-            // The location is a short-lived pre-signed URL: no Auth0 credentials go with it.
-            const res = await fetchImpl((0, record_set_1.str)(status.location));
-            if (!res.ok)
-                throw new vendor_http_1.VendorApiError('Auth0', res.status, 'export download', 'the export file could not be downloaded');
-            const raw = Buffer.from(await res.arrayBuffer());
-            const text = raw[0] === 0x1f && raw[1] === 0x8b ? (0, node_zlib_1.gunzipSync)(raw).toString('utf8') : raw.toString('utf8');
-            return parseLines(text);
-        }
-        if (state === 'failed')
-            throw new Error(`The Auth0 export job ${id} failed${(0, record_set_1.str)(status.summary) ? `: ${(0, record_set_1.str)(status.summary)}` : ''}.`);
-        if (i % 6 === 0)
-            progress(`waiting for export job ${id} (${state ?? 'pending'}${typeof status.time_left_seconds === 'number' ? `, ~${status.time_left_seconds}s left` : ''})`);
-        await sleep(5000);
-    }
-}
-/** NDJSON (Auth0's export format) or a JSON array / `{ users: [] }`. */
-function parseLines(text) {
-    const t = text.trim();
-    if (!t)
-        return [];
-    if (t.startsWith('['))
-        return (0, record_set_1.objs)(JSON.parse(t));
-    try {
-        const one = JSON.parse(t);
-        if ((0, record_set_1.isObj)(one))
-            return Array.isArray(one.users) ? (0, record_set_1.objs)(one.users) : [one];
-    }
-    catch {
-        // NDJSON: one object per line.
-    }
-    return t
-        .split(/\r?\n/)
-        .filter((l) => l.trim())
-        .map((l) => JSON.parse(l))
-        .filter(record_set_1.isObj);
-}
-function indexHashes(rows) {
-    const byId = new Map();
-    const byEmail = new Map();
-    for (const r of rows) {
-        const oid = (0, record_set_1.isObj)(r._id) ? (0, record_set_1.str)(r._id.$oid) : (0, record_set_1.str)(r._id);
-        const id = (0, record_set_1.str)(r.user_id) ?? (oid ? `auth0|${oid}` : undefined);
-        const secret = {};
-        const hash = (0, record_set_1.str)(r.passwordHash) ?? (0, record_set_1.str)(r.password_hash);
-        if (hash)
-            secret.password = { algorithm: 'auto', hash };
-        else if ((0, record_set_1.isObj)(r.custom_password_hash)) {
-            const mapped = auth0CustomHash(r.custom_password_hash);
-            if ('reason' in mapped)
-                secret.passwordReason = mapped.reason;
-            else
-                secret.password = mapped;
-        }
-        // MFA secrets, when support includes them, in the bulk-import `mfa_factors` shape.
-        for (const f of (0, record_set_1.objs)(r.mfa_factors)) {
-            const totp = (0, record_set_1.isObj)(f.totp) ? (0, record_set_1.str)(f.totp.secret) : undefined;
-            if (totp)
-                (secret.totp ??= []).push(totp);
-            const phone = (0, record_set_1.isObj)(f.phone) ? (0, record_set_1.str)(f.phone.value) : undefined;
-            if (phone)
-                (secret.phones ??= []).push(phone);
-            const email = (0, record_set_1.isObj)(f.email) ? (0, record_set_1.str)(f.email.value) : undefined;
-            if (email)
-                (secret.emails ??= []).push(email);
-        }
-        if (id)
-            byId.set(id, secret);
-        const email = (0, record_set_1.str)(r.email)?.toLowerCase();
-        if (email && !byEmail.has(email))
-            byEmail.set(email, secret);
-    }
-    return { byId, byEmail };
-}
-function addUser(set, u, ctx) {
-    const id = (0, record_set_1.str)(u.user_id);
-    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
-    const phone = (0, record_set_1.e164)(u.phone_number);
-    const user = (0, record_set_1.compact)({
-        id,
-        emails: email ? [{ email, verified: u.email_verified === true, primary: true }] : [],
-        phones: phone ? [{ phone, verified: u.phone_verified === true, primary: !email }] : [],
-        username: (0, record_set_1.str)(u.username),
-        first_name: (0, record_set_1.str)(u.given_name),
-        last_name: (0, record_set_1.str)(u.family_name),
-        name: (0, record_set_1.str)(u.given_name) || (0, record_set_1.str)(u.family_name) ? undefined : (0, record_set_1.str)(u.name) && (0, record_set_1.str)(u.name) !== email ? (0, record_set_1.str)(u.name) : undefined,
-        image_url: (0, record_set_1.str)(u.picture),
-        roles: ctx.roles,
-        banned: u.blocked === true ? true : undefined,
-        // app_metadata is server-controlled in Auth0 (often holds entitlements): it
-        // lands in the backend-only bag. user_metadata is user-editable.
-        private_metadata: (0, record_set_1.bag)(u.app_metadata),
-        unsafe_metadata: (0, record_set_1.bag)(u.user_metadata),
-        created_at: (0, record_set_1.str)(u.created_at),
-        last_sign_in_at: (0, record_set_1.str)(u.last_login),
-    });
-    if (ctx.secret?.password)
-        user.password = ctx.secret.password;
-    else if (ctx.secret?.passwordReason)
-        set.omit('password', ctx.secret.passwordReason);
-    if (!user.emails?.length && !user.phones?.length && !user.username) {
-        set.omit('user', 'no email, phone number or username');
-        return false;
-    }
-    set.add('user', user);
-    for (const i of (0, record_set_1.objs)(u.identities)) {
-        const provider = (0, record_set_1.str)(i.provider);
-        const sub = (0, record_set_1.str)(i.user_id);
-        if (!provider || !sub || provider === 'auth0' || provider === 'sms' || provider === 'email')
-            continue;
-        const connection = (0, record_set_1.str)(i.connection);
-        const enterprise = connection ? ctx.connectionIds.get(connection) : undefined;
-        set.add('identity', (0, record_set_1.compact)({
-            user_id: id,
-            provider: enterprise ? connection : provider,
-            provider_user_id: sub,
-            kind: enterprise ? (provider === 'samlp' || provider === 'adfs' ? 'saml' : 'oidc') : i.isSocial === true ? 'oauth' : 'enterprise',
-            sso_connection_id: enterprise,
-            profile: (0, record_set_1.bag)(i.profileData),
-        }));
-    }
-    for (const secret of ctx.secret?.totp ?? []) {
-        set.add('mfa_factor', { user_id: id, type: 'totp', secret_base32: secret.replace(/=+$/, '').toUpperCase(), digits: 6, period: 30, algorithm: 'SHA1', verified: true });
-    }
-    for (const p of ctx.secret?.phones ?? []) {
-        const n = (0, record_set_1.e164)(p);
-        if (n)
-            set.add('mfa_factor', { user_id: id, type: 'phone', phone: n, verified: true }, `phone:${id}:${n}`);
-    }
-    for (const _ of ctx.secret?.emails ?? [])
-        set.add('mfa_factor', { user_id: id, type: 'email', verified: true }, `email:${id}`);
-    return true;
-}
-async function addAuthenticationMethods(set, http, userId, rpId) {
-    let methods;
-    try {
-        methods = await pageAll(http, `/users/${encodeURIComponent(userId)}/authentication-methods`, 'authenticators');
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 404))
-            return;
-        throw err;
-    }
-    for (const m of methods) {
-        const type = (0, record_set_1.str)(m.type);
-        if (m.confirmed === false)
-            continue;
-        if (type === 'phone' || type === 'sms') {
-            const phone = (0, record_set_1.e164)(m.phone_number);
-            if (phone)
-                set.add('mfa_factor', { user_id: userId, type: 'phone', phone, verified: true, created_at: (0, record_set_1.str)(m.created_at) }, `phone:${userId}:${phone}`);
-        }
-        else if (type === 'email') {
-            set.add('mfa_factor', { user_id: userId, type: 'email', verified: true, created_at: (0, record_set_1.str)(m.created_at) }, `email:${userId}`);
-        }
-        else if ((type === 'passkey' || type === 'webauthn-platform' || type === 'webauthn-roaming') && (0, record_set_1.str)(m.key_id) && (0, record_set_1.str)(m.public_key)) {
-            set.add('passkey', (0, record_set_1.compact)({
-                id: (0, record_set_1.str)(m.id),
-                user_id: userId,
-                credential_id: b64url((0, record_set_1.str)(m.key_id)),
-                public_key: b64url((0, record_set_1.str)(m.public_key)),
-                rp_id: (0, record_set_1.str)(m.relying_party_identifier) ?? rpId,
-                aaguid: (0, record_set_1.str)(m.aaguid),
-                name: (0, record_set_1.str)(m.name),
-                backed_up: m.credential_backed_up === true ? true : undefined,
-                created_at: (0, record_set_1.str)(m.created_at),
-            }));
-        }
-        else if (type === 'totp' || type === 'guardian' || type === 'push' || type === 'recovery-code' || type === 'webauthn-roaming' || type === 'webauthn-platform') {
-            set.omit('mfa_factor', `Auth0 does not return ${type} secrets by API (support export, or re-enrolment)`);
-        }
-    }
-}
-const b64url = (v) => v.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-/** Auth0 role names are free text: `Billing Admin` → `billing_admin`. */
-function roleKey(name) {
-    return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '') || 'role';
-}
-/**
- * An Auth0 bulk-import `custom_password_hash` (users imported into Auth0 that
- * never signed in since keep it) → the Atlas registry's algorithm + params.
- */
-function auth0CustomHash(c) {
-    const algorithm = (0, record_set_1.str)(c.algorithm)?.toLowerCase();
-    const hash = (0, record_set_1.isObj)(c.hash) ? c.hash : {};
-    const value = (0, record_set_1.str)(hash.value);
-    if (!algorithm || !value)
-        return { reason: 'custom_password_hash without algorithm or hash value' };
-    const salt = (0, record_set_1.isObj)(c.salt) ? c.salt : undefined;
-    const pwEnc = (0, record_set_1.isObj)(c.password) ? (0, record_set_1.str)(c.password.encoding) : undefined;
-    if (pwEnc && !['utf8', 'utf-8', 'ascii'].includes(pwEnc)) {
-        return { reason: `custom_password_hash password.encoding "${pwEnc}" is not supported` };
-    }
-    const encoding = (0, record_set_1.str)(hash.encoding) ?? (algorithm === 'scrypt' ? 'hex' : 'hex');
-    const saltParams = salt
-        ? { salt_position: (0, record_set_1.str)(salt.position) ?? 'prefix', salt_encoding: (0, record_set_1.str)(salt.encoding) ?? 'utf8' }
-        : {};
-    switch (algorithm) {
-        case 'bcrypt':
-            return { algorithm: 'bcrypt', hash: value };
-        case 'argon2':
-            return { algorithm: 'argon2', hash: value };
-        case 'pbkdf2':
-            // A PHC string `$pbkdf2-<digest>$i=<iterations>,l=<keylen>$<salt>$<hash>`.
-            return { algorithm: 'auto', hash: value };
-        case 'ldap':
-            // RFC 2307: Atlas verifies the SHA family ({SHA}, {SSHA}, {SSHA256}, {SSHA512}).
-            return /^\{S?SHA(256|512)?\}/i.test(value) ? { algorithm: 'ldap_ssha', hash: value } : { reason: 'custom_password_hash ldap scheme other than {SHA}/{SSHA} is not supported' };
-        case 'md5':
-        case 'sha1':
-        case 'sha256':
-        case 'sha512': {
-            const s = salt ? (0, record_set_1.str)(salt.value) : undefined;
-            if (!s)
-                return { algorithm, hash: value, params: { encoding } };
-            return { algorithm: `${algorithm}_salted`, hash: value, salt: s, params: { encoding, ...saltParams } };
-        }
-        case 'hmac': {
-            const digest = (0, record_set_1.str)(hash.digest)?.toLowerCase();
-            const key = (0, record_set_1.isObj)(hash.key) ? (0, record_set_1.str)(hash.key.value) : undefined;
-            if (digest !== 'sha256' || !key)
-                return { reason: `custom_password_hash hmac with digest "${digest ?? '?'}" is not supported (sha256 only)` };
-            if (salt)
-                return { reason: 'custom_password_hash hmac with a salt is not supported' };
-            return { algorithm: 'hmac_sha256', hash: value, params: { key, key_encoding: ((0, record_set_1.isObj)(hash.key) ? (0, record_set_1.str)(hash.key.encoding) : undefined) ?? 'utf8', encoding } };
-        }
-        case 'scrypt': {
-            const s = salt ? (0, record_set_1.str)(salt.value) : undefined;
-            const keylen = typeof c.keylen === 'number' ? c.keylen : undefined;
-            if (!s || !keylen)
-                return { reason: 'custom_password_hash scrypt needs salt and keylen' };
-            return {
-                algorithm: 'scrypt',
-                hash: value,
-                salt: s,
-                params: {
-                    n: typeof c.cost === 'number' ? c.cost : 16384,
-                    r: typeof c.blockSize === 'number' ? c.blockSize : 8,
-                    p: typeof c.parallelization === 'number' ? c.parallelization : 1,
-                    key_length: keylen,
-                    encoding,
-                    salt_encoding: (0, record_set_1.str)(salt?.encoding) ?? 'utf8',
-                },
-            };
-        }
-        default:
-            return { reason: `custom_password_hash algorithm "${algorithm}" is not supported` };
-    }
-}
-// ── enterprise connections ──────────────────────────────────────────────────
-function addConnection(set, c, domain) {
-    const id = (0, record_set_1.str)(c.id);
-    const name = (0, record_set_1.str)(c.name);
-    const strategy = (0, record_set_1.str)(c.strategy);
-    if (!id || !name || !strategy)
-        return undefined;
-    const o = (0, record_set_1.isObj)(c.options) ? c.options : {};
-    const domains = Array.isArray(o.domain_aliases) ? o.domain_aliases.map((d) => (0, record_set_1.str)(d)).filter((d) => !!d) : [];
-    if (strategy === 'samlp' || strategy === 'adfs' || strategy === 'pingfederate') {
-        const cert = (0, record_set_1.str)(o.signingCert) ?? (0, record_set_1.str)(o.cert);
-        set.add('sso_connection', (0, record_set_1.compact)({
-            id,
-            name: (0, record_set_1.str)(c.display_name) ?? name,
-            protocol: 'saml',
-            domains,
-            saml: (0, record_set_1.compact)({
-                idp_entity_id: (0, record_set_1.str)(o.entityId) ?? (0, record_set_1.str)(o.issuer),
-                idp_sso_url: (0, record_set_1.str)(o.signInEndpoint) ?? (0, record_set_1.str)(o.pingFederateBaseUrl),
-                idp_certificate: cert ? pemFromAuth0Cert(cert) : undefined,
-                idp_metadata_url: (0, record_set_1.str)(o.metadataUrl) ?? (0, record_set_1.str)(o.adfs_server),
-                idp_metadata_xml: (0, record_set_1.str)(o.metadataXml),
-                sp_entity_id: `urn:auth0:${domain.split('.')[0]}:${name}`,
-                sp_acs_url: `https://${domain}/login/callback?connection=${encodeURIComponent(name)}`,
-                attribute_mapping: (0, record_set_1.isObj)(o.fieldsMap)
-                    ? Object.fromEntries(Object.entries(o.fieldsMap).filter(([, v]) => typeof v === 'string'))
-                    : undefined,
-            }),
-        }));
-        return id;
-    }
-    if (strategy === 'oidc' || strategy === 'okta' || strategy === 'waad' || strategy === 'google-apps') {
-        const issuer = strategy === 'waad'
-            ? (0, record_set_1.str)(o.tenant_domain)
-                ? `https://login.microsoftonline.com/${(0, record_set_1.str)(o.tenant_id) ?? (0, record_set_1.str)(o.tenant_domain)}/v2.0`
-                : undefined
-            : strategy === 'google-apps'
-                ? 'https://accounts.google.com'
-                : (0, record_set_1.str)(o.issuer) ?? ((0, record_set_1.str)(o.domain) ? `https://${(0, record_set_1.str)(o.domain)}` : undefined);
-        set.add('sso_connection', (0, record_set_1.compact)({
-            id,
-            name: (0, record_set_1.str)(c.display_name) ?? name,
-            protocol: 'oidc',
-            domains: strategy === 'google-apps' && (0, record_set_1.str)(o.domain) ? [...domains, (0, record_set_1.str)(o.domain)] : domains,
-            oidc: (0, record_set_1.compact)({
-                issuer,
-                discovery_url: (0, record_set_1.str)(o.discovery_url),
-                client_id: (0, record_set_1.str)(o.client_id),
-                client_secret: (0, record_set_1.str)(o.client_secret),
-                scopes: (0, record_set_1.str)(o.scope)?.split(/\s+/),
-            }),
-        }));
-        if (!(0, record_set_1.str)(o.client_secret))
-            set.warn(`Enterprise connection ${name}: Auth0 does not return its client secret; enter it in Atlas after the import.`);
-        return id;
-    }
-    set.warn(`Enterprise connection ${name} (${strategy}) has no Atlas counterpart and was not exported (LDAP/AD connector: use lazy migration).`);
-    return undefined;
-}
-/** Auth0 returns the IdP signing certificate as base64 DER or PEM. */
-function pemFromAuth0Cert(cert) {
-    if (cert.includes('BEGIN CERTIFICATE'))
-        return cert;
-    const body = cert.replace(/\s+/g, '');
-    let der = body;
-    // Some tenants store the PEM itself base64-encoded.
-    try {
-        const decoded = Buffer.from(body, 'base64').toString('utf8');
-        if (decoded.includes('BEGIN CERTIFICATE'))
-            return decoded;
-    }
-    catch {
-        der = body;
-    }
-    return `-----BEGIN CERTIFICATE-----\n${der.match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----`;
-}
-//# sourceMappingURL=auth0.js.map