@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/fusionauth.js

@@ -1,642 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fusionAuthPassword = fusionAuthPassword;
-exports.fusionAuthBase = fusionAuthBase;
-exports.fusionAuthHttp = fusionAuthHttp;
-exports.fetchFusionAuth = fetchFusionAuth;
-exports.fusionAuthSnapshotFromTables = fusionAuthSnapshotFromTables;
-exports.mapFusionAuth = mapFusionAuth;
-exports.exportFusionAuth = exportFusionAuth;
-const node_crypto_1 = require("node:crypto");
-const tables_1 = require("./frameworks/tables");
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-// ── password schemes ────────────────────────────────────────────────────────
-/**
- * A FusionAuth password (`password`, `salt`, `factor`, `encryption_scheme`) →
- * an Atlas hash. Schemes and their registry ids are documented in core's
- * fusionauth-hashes.ts; salts are base64 except bcrypt's 22-character salt.
- */
-function fusionAuthPassword(u) {
-    const value = (0, record_set_1.str)(u.password);
-    if (!value)
-        return null;
-    const scheme = (0, record_set_1.str)(u.encryptionScheme)?.toLowerCase();
-    const salt = (0, record_set_1.str)(u.salt);
-    const factor = Number(u.factor);
-    if (!scheme)
-        return { problem: 'no encryption scheme' };
-    const needs = (what) => ({ problem: `${scheme} without ${what}` });
-    if (scheme === 'bcrypt') {
-        if (!salt || !Number.isInteger(factor) || factor < 4 || factor > 31)
-            return needs('a salt or cost factor');
-        return { hash: { algorithm: 'bcrypt', hash: `$2a$${String(factor).padStart(2, '0')}$${salt}${value}` } };
-    }
-    const pbkdf2 = /^salted-pbkdf2-hmac-(sha256|sha512)(?:-512)?$/.exec(scheme);
-    if (pbkdf2) {
-        if (!salt || !Number.isInteger(factor) || factor < 1)
-            return needs('a salt or iteration count');
-        return { hash: { algorithm: 'pbkdf2', hash: value, salt, params: { digest: pbkdf2[1], iterations: factor, encoding: 'base64', salt_encoding: 'base64' } } };
-    }
-    if (scheme === 'salted-hmac-sha256') {
-        if (!salt)
-            return needs('a salt');
-        return { hash: { algorithm: 'hmac_sha256', hash: value, salt, params: { key_encoding: 'base64', encoding: 'base64' } } };
-    }
-    if (scheme === 'salted-md5' || scheme === 'salted-sha256') {
-        if (!salt || !Number.isInteger(factor) || factor < 1)
-            return needs('a salt or factor');
-        return { hash: { algorithm: 'fusionauth_salted', hash: value, salt, params: { digest: scheme === 'salted-md5' ? 'md5' : 'sha256', iterations: factor } } };
-    }
-    if (scheme === 'phpass-md5' || scheme === 'phppass-sha512' || scheme === 'phpass-sha512') {
-        if (!salt || !Number.isInteger(factor) || factor < 1)
-            return needs('a salt or factor');
-        return { hash: { algorithm: 'fusionauth_phpass', hash: value, salt, params: { digest: scheme === 'phpass-md5' ? 'md5' : 'sha512', iterations: factor } } };
-    }
-    return { problem: `the "${scheme}" scheme (a custom password plugin)` };
-}
-function fusionAuthBase(raw) {
-    const s = raw.trim().replace(/\/+$/, '');
-    return /^https?:\/\//.test(s) ? s : `https://${s}`;
-}
-function fusionAuthHttp(o) {
-    return new vendor_http_1.VendorHttp({
-        vendor: 'FusionAuth',
-        baseUrl: fusionAuthBase(o.baseUrl),
-        headers: { authorization: o.apiKey, ...(o.tenantId ? { 'X-FusionAuth-TenantId': o.tenantId } : {}) },
-        fetchImpl: o.fetchImpl,
-        sleep: o.sleep,
-    });
-}
-/** Read a tenant through the API into a snapshot. */
-async function fetchFusionAuth(http, o) {
-    const progress = o.onProgress ?? (() => undefined);
-    const warn = o.warn ?? (() => undefined);
-    const size = Math.min(Math.max(o.pageSize ?? 100, 1), 1000);
-    /** A resource the key may not read (401/403) or this version lacks (404). */
-    const optional = async (path, what, pick, empty) => {
-        try {
-            const { body } = await http.get(path);
-            return (0, record_set_1.isObj)(body) ? pick(body) : empty;
-        }
-        catch (err) {
-            if (!(err instanceof vendor_http_1.VendorApiError) || ![401, 403, 404].includes(err.status))
-                throw err;
-            if (err.status !== 404)
-                warn(`${what} could not be read with this API key (${err.status}) and were skipped.`);
-            return empty;
-        }
-    };
-    progress('tenants and applications');
-    const tenants = await optional('/api/tenant', 'Tenants', (b) => (0, record_set_1.objs)(b.tenants), []);
-    const applications = await optional('/api/application', 'Applications', (b) => (0, record_set_1.objs)(b.applications), []);
-    progress('groups');
-    const groups = await optional('/api/group', 'Groups', (b) => (0, record_set_1.objs)(b.groups), []);
-    progress('identity providers');
-    const identityProviders = await optional('/api/identity-provider', 'Identity providers', (b) => (0, record_set_1.objs)(b.identityProviders), []);
-    const keys = {};
-    for (const idp of identityProviders) {
-        const keyId = (0, record_set_1.str)(idp.keyId);
-        if (!keyId || keys[keyId])
-            continue;
-        const pem = await optional(`/api/key/${encodeURIComponent(keyId)}`, `Key ${keyId}`, (b) => ((0, record_set_1.isObj)(b.key) ? (0, record_set_1.str)(b.key.publicKey) : undefined), undefined);
-        if (pem)
-            keys[keyId] = pem;
-    }
-    progress('API keys');
-    const apiKeys = await optional('/api/api-key', 'API keys', (b) => (0, record_set_1.objs)(b.apiKeys), []);
-    progress('users');
-    const users = [];
-    for (let startRow = 0;; startRow += size) {
-        const { body } = await http.post('/api/user/search', { search: { queryString: '*', numberOfResults: size, startRow } });
-        const page = (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body.users) : [];
-        users.push(...page);
-        const total = (0, record_set_1.isObj)(body) && typeof body.total === 'number' ? body.total : undefined;
-        if (page.length < size || (total !== undefined && startRow + size >= total))
-            break;
-    }
-    for (const [i, u] of users.entries()) {
-        const id = (0, record_set_1.str)(u.id);
-        if (!id)
-            continue;
-        if (i > 0 && i % 100 === 0)
-            progress(`users (${i}/${users.length})`);
-        u.links = await optional(`/api/identity-provider/link?userId=${encodeURIComponent(id)}`, 'Identity provider links', (b) => (0, record_set_1.objs)(b.identityProviderLinks), []);
-        const methods = (0, record_set_1.isObj)(u.twoFactor) ? (0, record_set_1.objs)(u.twoFactor.methods) : [];
-        if (methods.length)
-            u.recoveryCodes = await optional(`/api/user/two-factor/recovery-code/${encodeURIComponent(id)}`, 'Recovery codes', (b) => (0, record_set_1.strs)(b.recoveryCodes), []);
-    }
-    return { baseUrl: fusionAuthBase(o.baseUrl), tenants, applications, groups, identityProviders, keys, apiKeys, users, source: 'api' };
-}
-const roleLookup = (rows, idCol) => new Map(rows.map((r) => [(0, tables_1.text)((0, tables_1.col)(r, ...idCol)) ?? '', r]));
-/**
- * A snapshot from a dump of a self-hosted FusionAuth database: one file per
- * table (`psql \copy users TO 'users.csv' CSV HEADER`, or `mysql … --batch`
- * converted, or a JSON array), named as in FusionAuth's schema: `users`,
- * `identities` (1.59+), `tenants`, `applications`, `application_roles`,
- * `user_registrations`, `user_registrations_application_roles`, `groups`,
- * `group_members`, `group_application_roles`, `identity_providers`,
- * `identity_provider_links`, `twofactor_methods`, `twofactor_recovery_codes`,
- * `api_keys`, `keys`.
- */
-function fusionAuthSnapshotFromTables(t) {
-    const tenantRows = t.rows('tenants');
-    const tenants = tenantRows.map((r) => {
-        const data = (0, tables_1.json)((0, tables_1.col)(r, 'data')) ?? {};
-        return (0, record_set_1.compact)({ id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), name: (0, tables_1.text)((0, tables_1.col)(r, 'name')), issuer: (0, tables_1.text)(data.issuer) ?? (0, tables_1.text)((0, tables_1.col)(r, 'issuer')) });
-    });
-    const appRoles = t.rows('application_roles');
-    const roleById = roleLookup(appRoles, ['id']);
-    const rolesByApp = new Map();
-    for (const r of appRoles) {
-        const appId = (0, tables_1.text)((0, tables_1.col)(r, 'applications_id', 'application_id'));
-        if (!appId)
-            continue;
-        const list = rolesByApp.get(appId) ?? [];
-        list.push({ id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), name: (0, tables_1.text)((0, tables_1.col)(r, 'name')), isDefault: (0, tables_1.bool)((0, tables_1.col)(r, 'is_default')), isSuperRole: (0, tables_1.bool)((0, tables_1.col)(r, 'is_super_role')) });
-        rolesByApp.set(appId, list);
-    }
-    const applications = t.rows('applications').map((r) => ({
-        id: (0, tables_1.text)((0, tables_1.col)(r, 'id')),
-        name: (0, tables_1.text)((0, tables_1.col)(r, 'name')),
-        tenantId: (0, tables_1.text)((0, tables_1.col)(r, 'tenants_id', 'tenant_id')),
-        roles: rolesByApp.get((0, tables_1.text)((0, tables_1.col)(r, 'id')) ?? '') ?? [],
-    }));
-    const groupRoles = new Map();
-    for (const r of t.rows('group_application_roles')) {
-        const role = roleById.get((0, tables_1.text)((0, tables_1.col)(r, 'application_roles_id', 'application_role_id')) ?? '');
-        const gid = (0, tables_1.text)((0, tables_1.col)(r, 'groups_id', 'group_id'));
-        const name = role && (0, tables_1.text)((0, tables_1.col)(role, 'name'));
-        const appId = role && (0, tables_1.text)((0, tables_1.col)(role, 'applications_id', 'application_id'));
-        if (!gid || !name || !appId)
-            continue;
-        const m = groupRoles.get(gid) ?? {};
-        (m[appId] ??= []).push(name);
-        groupRoles.set(gid, m);
-    }
-    const groups = t.rows('groups').map((r) => ({ id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), name: (0, tables_1.text)((0, tables_1.col)(r, 'name')), tenantId: (0, tables_1.text)((0, tables_1.col)(r, 'tenants_id', 'tenant_id')), roles: groupRoles.get((0, tables_1.text)((0, tables_1.col)(r, 'id')) ?? '') ?? {} }));
-    const memberships = new Map();
-    for (const r of t.rows('group_members')) {
-        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
-        if (!uid)
-            continue;
-        (memberships.get(uid) ?? memberships.set(uid, []).get(uid)).push({ groupId: (0, tables_1.text)((0, tables_1.col)(r, 'groups_id', 'group_id')) });
-    }
-    const regRoles = new Map();
-    for (const r of t.rows('user_registrations_application_roles')) {
-        const role = roleById.get((0, tables_1.text)((0, tables_1.col)(r, 'application_roles_id', 'application_role_id')) ?? '');
-        const rid = (0, tables_1.text)((0, tables_1.col)(r, 'user_registrations_id', 'user_registration_id'));
-        const name = role && (0, tables_1.text)((0, tables_1.col)(role, 'name'));
-        if (rid && name)
-            (regRoles.get(rid) ?? regRoles.set(rid, []).get(rid)).push(name);
-    }
-    const registrations = new Map();
-    for (const r of t.rows('user_registrations')) {
-        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
-        if (!uid)
-            continue;
-        (registrations.get(uid) ?? registrations.set(uid, []).get(uid)).push({
-            applicationId: (0, tables_1.text)((0, tables_1.col)(r, 'applications_id', 'application_id')),
-            username: (0, tables_1.text)((0, tables_1.col)(r, 'username')),
-            verified: (0, tables_1.bool)((0, tables_1.col)(r, 'verified')),
-            roles: regRoles.get((0, tables_1.text)((0, tables_1.col)(r, 'id')) ?? '') ?? [],
-        });
-    }
-    const links = new Map();
-    for (const r of t.rows('identity_provider_links', 'identity_providers_links')) {
-        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
-        if (!uid)
-            continue;
-        (links.get(uid) ?? links.set(uid, []).get(uid)).push({
-            identityProviderId: (0, tables_1.text)((0, tables_1.col)(r, 'identity_providers_id', 'identity_provider_id')),
-            identityProviderUserId: (0, tables_1.text)((0, tables_1.col)(r, 'identity_provider_user_id')),
-            displayName: (0, tables_1.text)((0, tables_1.col)(r, 'display_name')),
-        });
-    }
-    const methods = new Map();
-    for (const r of t.rows('twofactor_methods', 'two_factor_methods')) {
-        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
-        if (!uid)
-            continue;
-        const settings = (0, tables_1.json)((0, tables_1.col)(r, 'settings', 'data')) ?? {};
-        const authenticator = (0, record_set_1.isObj)(settings.authenticator) ? settings.authenticator : {};
-        (methods.get(uid) ?? methods.set(uid, []).get(uid)).push((0, record_set_1.compact)({ id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), method: (0, tables_1.text)((0, tables_1.col)(r, 'method')), mobilePhone: (0, tables_1.text)((0, tables_1.col)(r, 'mobile_phone')), email: (0, tables_1.text)((0, tables_1.col)(r, 'email')), authenticator: (0, record_set_1.compact)({ ...authenticator, secret: (0, tables_1.text)((0, tables_1.col)(r, 'secret')) }) }));
-    }
-    const recovery = new Map();
-    for (const r of t.rows('twofactor_recovery_codes', 'two_factor_recovery_codes')) {
-        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
-        const raw = (0, tables_1.col)(r, 'recovery_codes', 'codes');
-        let codes = [];
-        if (Array.isArray(raw))
-            codes = (0, record_set_1.strs)(raw);
-        else if (typeof raw === 'string') {
-            try {
-                const parsed = JSON.parse(raw);
-                codes = Array.isArray(parsed) ? (0, record_set_1.strs)(parsed) : [];
-            }
-            catch {
-                codes = raw.split(/[\s,;]+/).filter(Boolean);
-            }
-        }
-        if (uid && codes.length)
-            recovery.set(uid, codes);
-    }
-    // 1.59+ keeps email / username in `identities`; older versions have them on `users`.
-    const identities = new Map();
-    for (const r of t.rows('identities')) {
-        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
-        if (uid)
-            (identities.get(uid) ?? identities.set(uid, []).get(uid)).push(r);
-    }
-    const users = t.rows('users').map((r) => {
-        const id = (0, tables_1.text)((0, tables_1.col)(r, 'id'));
-        const idents = identities.get(id) ?? [];
-        const emailRow = idents.find((i) => (0, tables_1.text)((0, tables_1.col)(i, 'email')));
-        const nameRow = idents.find((i) => (0, tables_1.text)((0, tables_1.col)(i, 'username')));
-        const data = (0, tables_1.json)((0, tables_1.col)(r, 'data')) ?? {};
-        const mfa = methods.get(id) ?? [];
-        // Before 1.26 a single secret lived on the user row.
-        const legacySecret = (0, tables_1.text)((0, tables_1.col)(r, 'two_factor_secret'));
-        if (!mfa.length && legacySecret)
-            mfa.push({ method: 'authenticator', authenticator: { secret: legacySecret } });
-        return (0, record_set_1.compact)({
-            id,
-            tenantId: (0, tables_1.text)((0, tables_1.col)(r, 'tenants_id', 'tenant_id')),
-            email: (0, tables_1.text)((0, tables_1.col)(emailRow ?? r, 'email')),
-            verified: (0, tables_1.bool)((0, tables_1.col)(emailRow ?? r, 'verified')),
-            username: (0, tables_1.text)((0, tables_1.col)(nameRow ?? r, 'username')),
-            firstName: (0, tables_1.text)((0, tables_1.col)(r, 'first_name')),
-            lastName: (0, tables_1.text)((0, tables_1.col)(r, 'last_name')),
-            fullName: (0, tables_1.text)((0, tables_1.col)(r, 'full_name')),
-            mobilePhone: (0, tables_1.text)((0, tables_1.col)(r, 'mobile_phone')),
-            imageUrl: (0, tables_1.text)((0, tables_1.col)(r, 'image_url')),
-            active: (0, tables_1.col)(r, 'active') === undefined ? true : (0, tables_1.bool)((0, tables_1.col)(r, 'active')),
-            insertInstant: (0, tables_1.time)((0, tables_1.col)(r, 'insert_instant')),
-            lastLoginInstant: (0, tables_1.time)((0, tables_1.col)(r, 'last_login_instant')),
-            passwordChangeRequired: (0, tables_1.bool)((0, tables_1.col)(r, 'password_change_required')),
-            data,
-            password: (0, tables_1.text)((0, tables_1.col)(r, 'password')),
-            salt: (0, tables_1.text)((0, tables_1.col)(r, 'salt')),
-            factor: (0, tables_1.col)(r, 'factor'),
-            encryptionScheme: (0, tables_1.text)((0, tables_1.col)(r, 'encryption_scheme')),
-            registrations: registrations.get(id) ?? [],
-            memberships: memberships.get(id) ?? [],
-            twoFactor: mfa.length ? { methods: mfa } : undefined,
-            links: links.get(id) ?? [],
-            recoveryCodes: recovery.get(id),
-        });
-    });
-    const idps = t.rows('identity_providers').map((r) => {
-        const data = (0, tables_1.json)((0, tables_1.col)(r, 'data', 'settings')) ?? {};
-        return { ...data, id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), type: (0, tables_1.text)((0, tables_1.col)(r, 'type')), name: (0, tables_1.text)((0, tables_1.col)(r, 'name')), enabled: (0, tables_1.col)(r, 'enabled') === undefined ? true : (0, tables_1.bool)((0, tables_1.col)(r, 'enabled')), keyId: (0, tables_1.text)((0, tables_1.col)(r, 'keys_id', 'key_id')) ?? (0, tables_1.text)(data.keyId) };
-    });
-    const keys = {};
-    for (const r of t.rows('keys')) {
-        const id = (0, tables_1.text)((0, tables_1.col)(r, 'id'));
-        const pem = (0, tables_1.text)((0, tables_1.col)(r, 'public_key', 'certificate'));
-        if (id && pem)
-            keys[id] = pem;
-    }
-    const apiKeys = t.rows('api_keys').map((r) => (0, record_set_1.compact)({
-        id: (0, tables_1.text)((0, tables_1.col)(r, 'id')),
-        key: (0, tables_1.text)((0, tables_1.col)(r, 'key_value', 'key')),
-        keyManager: (0, tables_1.bool)((0, tables_1.col)(r, 'key_manager')),
-        metaData: (0, tables_1.json)((0, tables_1.col)(r, 'meta_data', 'metadata')),
-        tenantId: (0, tables_1.text)((0, tables_1.col)(r, 'tenants_id', 'tenant_id')),
-        expirationInstant: (0, tables_1.time)((0, tables_1.col)(r, 'expiration_instant', 'expiration')),
-        insertInstant: (0, tables_1.time)((0, tables_1.col)(r, 'insert_instant')),
-    }));
-    return { tenants, applications, groups, identityProviders: idps, keys, apiKeys, users, source: 'database' };
-}
-// ── mapping ─────────────────────────────────────────────────────────────────
-/** Enterprise identity providers: SSO connections, not social sign-in. */
-const ENTERPRISE = new Set(['SAMLv2', 'OpenIDConnect', 'SAMLv2IdPInitiated']);
-const epoch = (v) => (typeof v === 'number' && v > 0 ? v : typeof v === 'string' ? (Date.parse(v) || undefined) : undefined);
-function authenticatorSecret(raw) {
-    // FusionAuth keeps the authenticator secret base64 encoded; Atlas wants base32.
-    const bytes = Buffer.from(raw, 'base64');
-    if (!bytes.length)
-        return undefined;
-    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
-    let bits = 0;
-    let acc = 0;
-    let out = '';
-    for (const b of bytes) {
-        acc = (acc << 8) | b;
-        bits += 8;
-        while (bits >= 5) {
-            out += alphabet[(acc >>> (bits - 5)) & 31];
-            bits -= 5;
-        }
-    }
-    if (bits > 0)
-        out += alphabet[(acc << (5 - bits)) & 31];
-    return out;
-}
-/** Map a snapshot (API or database) onto canonical records. */
-function mapFusionAuth(snap, opts = {}) {
-    const set = new record_set_1.RecordSet();
-    const groupsAs = opts.groupsAs ?? 'organizations';
-    const tenantsAs = opts.tenantsAs ?? (snap.tenants.length > 1 ? 'organizations' : 'skip');
-    const tenantName = new Map(snap.tenants.map((t) => [(0, record_set_1.str)(t.id) ?? '', (0, record_set_1.str)(t.name) ?? (0, record_set_1.str)(t.id) ?? '']));
-    const appName = new Map(snap.applications.map((a) => [(0, record_set_1.str)(a.id) ?? '', (0, record_set_1.str)(a.name) ?? '']));
-    // ── organizations: tenants and groups ──
-    const orgIds = new Set();
-    if (tenantsAs === 'organizations') {
-        for (const t of snap.tenants) {
-            const id = (0, record_set_1.str)(t.id);
-            if (!id)
-                continue;
-            orgIds.add(`tenant:${id}`);
-            set.add('organization', (0, record_set_1.compact)({ id: `tenant:${id}`, name: tenantName.get(id), slug: (0, translate_kit_1.keyOf)(tenantName.get(id)).replace(/_/g, '-'), private_metadata: { fusionauth_tenant_id: id, fusionauth_issuer: (0, record_set_1.str)(t.issuer) } }));
-        }
-    }
-    const groups = new Map();
-    for (const g of snap.groups)
-        if ((0, record_set_1.str)(g.id) && (0, record_set_1.str)(g.name))
-            groups.set((0, record_set_1.str)(g.id), g);
-    if (groupsAs === 'organizations') {
-        for (const g of groups.values()) {
-            const id = (0, record_set_1.str)(g.id);
-            orgIds.add(`group:${id}`);
-            set.add('organization', { id: `group:${id}`, name: (0, record_set_1.str)(g.name), slug: (0, translate_kit_1.keyOf)((0, record_set_1.str)(g.name)).replace(/_/g, '-'), private_metadata: { fusionauth_group_id: id } });
-        }
-    }
-    if (orgIds.size)
-        set.add('role', { key: 'member', name: 'Member', scope: 'organization' }, 'org:member');
-    // ── roles: application roles (FusionAuth puts the plain names in the JWT roles claim) ──
-    for (const app of snap.applications) {
-        for (const r of (0, record_set_1.objs)(app.roles)) {
-            const name = (0, record_set_1.str)(r.name);
-            if (!name)
-                continue;
-            set.add('role', (0, record_set_1.compact)({ key: (0, translate_kit_1.keyOf)(name), name, description: r.isSuperRole === true ? `Super role of ${appName.get((0, record_set_1.str)(app.id) ?? '') || 'an application'}` : undefined, scope: 'app' }), (0, translate_kit_1.keyOf)(name));
-        }
-    }
-    if (groupsAs === 'roles') {
-        for (const g of groups.values())
-            set.add('role', { key: `group:${(0, translate_kit_1.keyOf)((0, record_set_1.str)(g.name))}`, name: (0, record_set_1.str)(g.name), description: 'FusionAuth group', scope: 'app' }, `group:${(0, translate_kit_1.keyOf)((0, record_set_1.str)(g.name))}`);
-    }
-    // ── identity providers ──
-    const idps = new Map();
-    for (const idp of snap.identityProviders)
-        if ((0, record_set_1.str)(idp.id))
-            idps.set((0, record_set_1.str)(idp.id), idp);
-    const connections = new Set();
-    for (const [id, idp] of idps) {
-        const type = (0, record_set_1.str)(idp.type) ?? '';
-        if (!ENTERPRISE.has(type))
-            continue;
-        if (type === 'SAMLv2IdPInitiated') {
-            set.omit('sso_connection', `IdP-initiated SAML provider ${(0, record_set_1.str)(idp.name) ?? id}: Atlas SAML connections are SP-initiated`);
-            continue;
-        }
-        set.add('sso_connection', ssoConnection(idp, id, snap, (m) => set.warn(m)));
-        connections.add(id);
-    }
-    // ── users ──
-    const counts = { password: 0, totp: 0, forced: 0, inactive: 0 };
-    const badHashes = new Map();
-    const seenUsernames = new Set();
-    const userIds = new Set();
-    for (const u of snap.users) {
-        const id = (0, record_set_1.str)(u.id);
-        if (!id)
-            continue;
-        const email = (0, record_set_1.str)(u.email)?.toLowerCase();
-        const username = (0, record_set_1.str)(u.username)?.toLowerCase();
-        const phone = (0, record_set_1.e164)(u.mobilePhone);
-        if (!email && !username && !phone) {
-            set.omit('user', 'no email, username or phone');
-            continue;
-        }
-        const name = (0, record_set_1.str)(u.fullName);
-        const user = (0, record_set_1.compact)({
-            id,
-            emails: email ? [{ email, verified: u.verified === true, primary: true }] : [],
-            phones: phone ? [{ phone, verified: false, primary: !email }] : [],
-            username: username && !seenUsernames.has(username) ? username : undefined,
-            first_name: (0, record_set_1.str)(u.firstName),
-            last_name: (0, record_set_1.str)(u.lastName),
-            name: !(0, record_set_1.str)(u.firstName) && !(0, record_set_1.str)(u.lastName) ? name : undefined,
-            image_url: typeof u.imageUrl === 'string' && /^https:\/\//.test(u.imageUrl) ? u.imageUrl : undefined,
-            banned: u.active === false ? true : undefined,
-            ban_reason: u.active === false ? 'Deactivated in FusionAuth' : undefined,
-            private_metadata: (0, record_set_1.bag)((0, record_set_1.compact)({ ...((0, record_set_1.isObj)(u.data) ? u.data : {}), fusionauth_tenant_id: (0, record_set_1.str)(u.tenantId), fusionauth_password_change_required: u.passwordChangeRequired === true ? true : undefined })),
-            created_at: epoch(u.insertInstant),
-            last_sign_in_at: epoch(u.lastLoginInstant),
-        });
-        if (username)
-            seenUsernames.add(username);
-        if (u.active === false)
-            counts.inactive++;
-        if (u.passwordChangeRequired === true)
-            counts.forced++;
-        const pw = fusionAuthPassword(u);
-        if (pw && 'hash' in pw)
-            user.password = pw.hash;
-        else if (pw)
-            badHashes.set(pw.problem, (badHashes.get(pw.problem) ?? 0) + 1);
-        else if (snap.source === 'api')
-            counts.password++;
-        // Application roles from every registration, plus the roles of the user's groups.
-        const roles = new Set();
-        for (const reg of (0, record_set_1.objs)(u.registrations))
-            for (const r of (0, record_set_1.strs)(reg.roles))
-                roles.add((0, translate_kit_1.keyOf)(r));
-        const memberOf = (0, record_set_1.objs)(u.memberships).map((m) => groups.get((0, record_set_1.str)(m.groupId) ?? '')).filter((g) => !!g);
-        for (const g of memberOf) {
-            for (const names of Object.values((0, record_set_1.isObj)(g.roles) ? g.roles : {}))
-                for (const r of (0, record_set_1.strs)(names))
-                    roles.add((0, translate_kit_1.keyOf)(r));
-            if (groupsAs === 'roles')
-                roles.add(`group:${(0, translate_kit_1.keyOf)((0, record_set_1.str)(g.name))}`);
-        }
-        if (roles.size)
-            user.roles = [...roles];
-        set.add('user', (0, record_set_1.compact)(user));
-        userIds.add(id);
-        // Linked identities.
-        for (const link of (0, record_set_1.objs)(u.links)) {
-            const idp = idps.get((0, record_set_1.str)(link.identityProviderId) ?? '');
-            const providerUserId = (0, record_set_1.str)(link.identityProviderUserId);
-            if (!idp || !providerUserId)
-                continue;
-            const identity = linkIdentity(idp, link, id, providerUserId, connections);
-            set.add('identity', identity, `${identity.provider}:${providerUserId}`);
-        }
-        // Second factors.
-        const methods = (0, record_set_1.isObj)(u.twoFactor) ? (0, record_set_1.objs)(u.twoFactor.methods) : [];
-        for (const m of methods) {
-            const method = (0, record_set_1.str)(m.method);
-            if (method === 'authenticator') {
-                const a = (0, record_set_1.isObj)(m.authenticator) ? m.authenticator : {};
-                const secret = (0, record_set_1.str)(a.secret) ? authenticatorSecret((0, record_set_1.str)(a.secret)) : undefined;
-                if (!secret) {
-                    counts.totp++;
-                    continue;
-                }
-                const algo = (0, record_set_1.str)(a.algorithm)?.toUpperCase().replace('HMAC', '').replace('-', '');
-                set.add('mfa_factor', (0, record_set_1.compact)({
-                    user_id: id,
-                    type: 'totp',
-                    secret_base32: secret,
-                    digits: typeof a.codeLength === 'number' ? a.codeLength : 6,
-                    period: typeof a.timeStep === 'number' ? a.timeStep : 30,
-                    algorithm: algo === 'SHA256' || algo === 'SHA512' ? algo : 'SHA1',
-                    verified: true,
-                }), `totp:${id}:${(0, record_set_1.str)(m.id) ?? ''}`);
-            }
-            else if (method === 'sms') {
-                const p = (0, record_set_1.e164)(m.mobilePhone);
-                if (p)
-                    set.add('mfa_factor', { user_id: id, type: 'phone', phone: p, verified: true }, `phone:${id}:${p}`);
-            }
-            else if (method === 'email') {
-                set.add('mfa_factor', { user_id: id, type: 'email', verified: true }, `email:${id}`);
-            }
-            else if (method)
-                set.omit('mfa_factor', `FusionAuth two-factor method "${method}" has no Atlas counterpart`);
-        }
-        const codes = (0, record_set_1.strs)(u.recoveryCodes);
-        if (codes.length)
-            set.add('mfa_factor', { user_id: id, type: 'backup_codes', backup_codes: codes }, `recovery:${id}`);
-        // Memberships.
-        if (tenantsAs === 'organizations' && (0, record_set_1.str)(u.tenantId) && orgIds.has(`tenant:${(0, record_set_1.str)(u.tenantId)}`)) {
-            set.add('membership', { organization_id: `tenant:${(0, record_set_1.str)(u.tenantId)}`, user_id: id, role: 'member' }, `tenant:${(0, record_set_1.str)(u.tenantId)}:${id}`);
-        }
-        if (groupsAs === 'organizations') {
-            for (const g of memberOf)
-                set.add('membership', { organization_id: `group:${(0, record_set_1.str)(g.id)}`, user_id: id, role: 'member' }, `group:${(0, record_set_1.str)(g.id)}:${id}`);
-        }
-    }
-    // ── API keys ──
-    let managers = 0;
-    for (const k of snap.apiKeys) {
-        const key = (0, record_set_1.str)(k.key);
-        const id = (0, record_set_1.str)(k.id);
-        if (!id || !key)
-            continue;
-        if (k.keyManager === true) {
-            managers++;
-            continue;
-        }
-        const meta = (0, record_set_1.isObj)(k.metaData) ? k.metaData : {};
-        const attrs = (0, record_set_1.isObj)(meta.attributes) ? meta.attributes : {};
-        const endpoints = (0, record_set_1.isObj)(k.permissions) && (0, record_set_1.isObj)(k.permissions.endpoints) ? Object.keys(k.permissions.endpoints) : [];
-        const record = (0, record_set_1.compact)({
-            id,
-            name: (0, record_set_1.str)(attrs.description) ?? `FusionAuth API key ${id.slice(0, 8)}`,
-            hash: (0, node_crypto_1.createHash)('sha256').update(key, 'utf8').digest('hex'),
-            hash_algorithm: 'sha256',
-            start: key.slice(0, 6),
-            scopes: endpoints.length ? endpoints : undefined,
-            expires_at: epoch(k.expirationInstant),
-            created_at: epoch(k.insertInstant),
-        });
-        set.add('api_key', record);
-    }
-    if (managers)
-        set.omit('api_key', 'FusionAuth key-manager API keys (they manage other keys)', managers);
-    if (snap.apiKeys.length)
-        set.warn('FusionAuth API keys are imported as Atlas API keys carrying the endpoint permissions as scopes: review each before cutover (a FusionAuth key authorises FusionAuth endpoints, not Atlas ones).');
-    // ── what could not move ──
-    if (counts.password) {
-        set.warn(`${counts.password} user(s) have a FusionAuth password, but the API never returns password hashes. Export from the database of a self-hosted install (--set fusionauth-dump=<dir>), ask FusionAuth support for the hashes (Cloud), or turn on the fusionauth lazy-migration preset: each password is then checked against FusionAuth on its first Atlas sign-in.`);
-    }
-    if (counts.totp)
-        set.warn(`${counts.totp} user(s) use an authenticator app; FusionAuth returns no authenticator secrets over the API (a database export carries them). Those users enrol again in Atlas.`);
-    if (counts.forced)
-        set.warn(`${counts.forced} user(s) must change their password at next sign-in in FusionAuth; their current password was set by an administrator.`);
-    for (const [problem, n] of badHashes)
-        set.warn(`${n} user(s) were imported without a password (${problem}); they reset it, or use lazy migration.`);
-    set.warn('FusionAuth sessions are not exportable: the fusionauth bridge preset exchanges FusionAuth access tokens for Atlas sessions instead.');
-    const tenant = snap.tenants[0];
-    set.manifest = {
-        origin: snap.baseUrl ?? ((0, record_set_1.str)(tenant?.name) ? `tenant ${(0, record_set_1.str)(tenant?.name)}` : 'fusionauth'),
-        sourceVersion: null,
-        providers: [...new Set(set.list('identity').map((i) => i.provider))].sort(),
-        settings: (0, record_set_1.compact)({
-            source: snap.source === 'api' ? 'api' : 'database',
-            groups_as: groupsAs,
-            tenants_as: tenantsAs,
-            issuer: snap.tenants.length === 1 ? (0, record_set_1.str)(snap.tenants[0].issuer) : undefined,
-        }),
-    };
-    return set;
-}
-function linkIdentity(idp, link, userId, providerUserId, connections) {
-    const id = (0, record_set_1.str)(idp.id);
-    const type = (0, record_set_1.str)(idp.type) ?? '';
-    const enterprise = connections.has(id);
-    return (0, record_set_1.compact)({
-        user_id: userId,
-        provider: enterprise ? id : type.toLowerCase(),
-        provider_user_id: providerUserId,
-        kind: enterprise ? (type === 'SAMLv2' ? 'saml' : 'oidc') : 'oauth',
-        sso_connection_id: enterprise ? id : undefined,
-        profile: (0, record_set_1.bag)((0, record_set_1.compact)({ display_name: (0, record_set_1.str)(link.displayName) })),
-    });
-}
-function ssoConnection(idp, id, snap, warn) {
-    const name = (0, record_set_1.str)(idp.name) ?? id;
-    const domains = (0, record_set_1.strs)(idp.domains).map((d) => d.toLowerCase());
-    if ((0, record_set_1.str)(idp.type) === 'SAMLv2') {
-        const keyId = (0, record_set_1.str)(idp.keyId);
-        const cert = keyId ? snap.keys[keyId] : undefined;
-        if (!cert)
-            warn(`SAML identity provider ${name}: its verification certificate could not be read; add it in Atlas.`);
-        return (0, record_set_1.compact)({
-            id,
-            name,
-            protocol: 'saml',
-            domains,
-            enabled: idp.enabled !== false,
-            saml: (0, record_set_1.compact)({
-                idp_entity_id: (0, record_set_1.str)(idp.issuer),
-                idp_sso_url: (0, record_set_1.str)(idp.idpEndpoint),
-                idp_certificate: cert,
-                attribute_mapping: (0, record_set_1.str)(idp.emailClaim) ? { email: (0, record_set_1.str)(idp.emailClaim) } : undefined,
-            }),
-        });
-    }
-    const o = (0, record_set_1.isObj)(idp.oauth2) ? idp.oauth2 : {};
-    const secret = (0, record_set_1.str)(o.client_secret);
-    // FusionAuth returns the secret to a key that may read identity providers; a masked or absent one cannot be used.
-    const real = secret && !/^\*+$/.test(secret) ? secret : undefined;
-    if (!real)
-        warn(`OIDC identity provider ${name}: its client secret was not available; enter it on the SSO connection after the import.`);
-    const issuer = (0, record_set_1.str)(o.issuer);
-    return (0, record_set_1.compact)({
-        id,
-        name,
-        protocol: 'oidc',
-        domains,
-        enabled: idp.enabled !== false,
-        oidc: (0, record_set_1.compact)({
-            issuer,
-            discovery_url: issuer ? `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration` : undefined,
-            client_id: (0, record_set_1.str)(o.client_id),
-            client_secret: real,
-            scopes: (0, record_set_1.str)(o.scope)?.split(/\s+/).filter(Boolean),
-        }),
-    });
-}
-async function exportFusionAuth(o) {
-    if (o.tables) {
-        const snap = fusionAuthSnapshotFromTables(o.tables);
-        if (o.api?.baseUrl)
-            snap.baseUrl = fusionAuthBase(o.api.baseUrl);
-        return mapFusionAuth(snap, o);
-    }
-    if (!o.api)
-        throw new Error('FusionAuth: pass a database dump, or the URL and an API key.');
-    const warnings = [];
-    const snap = await fetchFusionAuth(fusionAuthHttp(o.api), { baseUrl: o.api.baseUrl, pageSize: o.api.pageSize, onProgress: o.api.onProgress, warn: (m) => warnings.push(m) });
-    const set = mapFusionAuth(snap, o);
-    for (const w of warnings)
-        set.warn(w);
-    return set;
-}
-//# sourceMappingURL=fusionauth.js.map