@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/hanko.js

@@ -1,605 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.hankoPasswordHash = hankoPasswordHash;
-exports.exportHankoTables = exportHankoTables;
-exports.exportHankoApi = exportHankoApi;
-const tables_1 = require("./frameworks/tables");
-const record_set_1 = require("./record-set");
-const vendor_http_1 = require("./vendor-http");
-/** Hanko's built-in third-party providers (`third_party.providers.<name>`); `custom_<key>` are custom OIDC providers. */
-const BUILT_IN_PROVIDERS = new Set(['apple', 'discord', 'facebook', 'github', 'google', 'linkedin', 'microsoft']);
-/** Hanko's TOTP parameters (flow_api/services/totp.go: pquerna/otp defaults, not configurable). */
-const TOTP = { digits: 6, period: 30, algorithm: 'SHA1' };
-const NO_PASSKEY_RP = 'Passkeys were left out: pass the relying-party id they were registered for (--set hanko-rp-id=<webauthn.relying_party.id>, e.g. example.com).';
-const MFA_ONLY_NOTE = (n) => `${n} WebAuthn credential(s) were Hanko security keys used only as a second factor (mfa_only). They move as passkeys bound to the same relying-party id; Atlas can also accept them as a first factor.`;
-// ── password hashes ─────────────────────────────────────────────────────────
-/**
- * Hanko's own Firebase-scrypt import format (flow_api/services/password.go,
- * after Supabase's): `$fbscrypt$v=1,n=<mem cost>,r=<rounds>,p=<parallelism>,ss=<salt
- * separator>,sk=<signer key>$<salt>$<hash>`, every value standard base64.
- */
-const FBSCRYPT = /^\$fbscrypt\$v=(\d+),n=(\d+),r=(\d+),p=(\d+)(?:,ss=([^,$]+))?(?:,sk=([^$]+))?\$([^$]+)\$(.+)$/;
-/** A Hanko `password_credentials.password` as a bundle password; null when Atlas cannot verify it. */
-function hankoPasswordHash(raw) {
-    const digest = (0, tables_1.text)(raw);
-    if (!digest)
-        return null;
-    if (/^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/.test(digest))
-        return { algorithm: 'bcrypt', hash: digest };
-    const m = FBSCRYPT.exec(digest);
-    // Atlas's scrypt_firebase verifier is Firebase's own construction: version 1, p = 1.
-    if (!m || m[1] !== '1' || m[4] !== '1' || !m[6])
-        return null;
-    return {
-        algorithm: 'scrypt_firebase',
-        hash: m[8],
-        salt: m[7],
-        params: { rounds: Number(m[3]), mem_cost: Number(m[2]), salt_separator: m[5] ?? '', signer_key: m[6] },
-    };
-}
-// ── shared mapping ──────────────────────────────────────────────────────────
-/** Base64url bytes as Hanko stores them (raw URL encoding); other encodings are normalised. */
-function b64u(v) {
-    const s = (0, tables_1.text)(v);
-    if (!s)
-        return undefined;
-    return /^[A-Za-z0-9_-]+$/.test(s) ? s : (0, tables_1.base64url)(s);
-}
-const ZERO_AAGUID = '00000000-0000-0000-0000-000000000000';
-function passkey(o) {
-    const credentialId = b64u(o.id);
-    const publicKey = b64u(o.publicKey);
-    if (!credentialId || !publicKey)
-        return null;
-    const aaguid = (0, tables_1.text)(o.aaguid);
-    const count = Number(o.signCount);
-    return (0, record_set_1.compact)({
-        id: credentialId,
-        user_id: o.userId,
-        credential_id: credentialId,
-        public_key: publicKey,
-        sign_count: Number.isFinite(count) && count > 0 ? count : undefined,
-        rp_id: o.rpId,
-        transports: o.transports,
-        aaguid: aaguid && aaguid !== ZERO_AAGUID ? aaguid : undefined,
-        backed_up: o.backedUp === undefined ? undefined : (0, tables_1.bool)(o.backedUp),
-        name: (0, tables_1.text)(o.name),
-        created_at: (0, tables_1.time)(o.createdAt),
-    });
-}
-/** A metadata column / field: a JSON object (or the string Hanko stores), only when it has keys. */
-function metadata(v) {
-    return (0, record_set_1.bag)((0, record_set_1.isObj)(v) ? v : (0, tables_1.json)(v));
-}
-/** `user_custom_claims.claims` stores `{ name: { value, source } }`; the Admin API returns them flat. */
-function customClaims(v, wrapped) {
-    const o = (0, record_set_1.isObj)(v) ? v : (0, tables_1.json)(v);
-    if (!o)
-        return undefined;
-    if (!wrapped)
-        return (0, record_set_1.bag)(o);
-    const flat = {};
-    for (const [k, c] of Object.entries(o))
-        flat[k] = (0, record_set_1.isObj)(c) && 'value' in c ? c.value : c;
-    return (0, record_set_1.bag)(flat);
-}
-function privateMetadata(priv, claims) {
-    // Custom claims Hanko put in the session JWT: kept for a JWT template to add back.
-    return (0, record_set_1.bag)({ ...(priv ?? {}), ...(claims ? { hanko_custom_claims: claims } : {}) });
-}
-/** A third-party / SAML identity. `provider` is Hanko's provider id (`google`, `custom_<key>`, or a SAML IdP's entity id). */
-function identity(o) {
-    const kind = o.saml ? 'saml' : BUILT_IN_PROVIDERS.has(o.provider) ? 'oauth' : 'oidc';
-    const verified = o.data?.email_verified;
-    return (0, record_set_1.compact)({
-        id: o.id,
-        user_id: o.userId,
-        provider: o.provider,
-        provider_user_id: o.providerUserId,
-        kind,
-        sso_connection_id: o.ssoConnectionId,
-        email: (0, record_set_1.str)(o.data?.email)?.toLowerCase() ?? o.fallbackEmail,
-        email_verified: verified === undefined ? undefined : verified === true || verified === 'true',
-        profile: (0, record_set_1.bag)(o.data),
-    });
-}
-function sortedEmails(list) {
-    // Primary first, the rest in the order Hanko had them.
-    return [...list.filter((e) => e.primary), ...list.filter((e) => !e.primary)];
-}
-/** A Hanko user with neither an email nor a username cannot be imported (nothing to sign in with). */
-const NO_IDENTIFIER = 'Hanko user without an email address or username';
-function membershipRole(slugs, set) {
-    const sorted = [...new Set(slugs)].sort();
-    if (sorted.length > 1)
-        set.warn('Some memberships carry more than one Hanko role: Atlas keeps one role per membership (the first by slug); grant the others again in Atlas.');
-    return sorted[0] ?? 'member';
-}
-// ── the database dump ───────────────────────────────────────────────────────
-/** Read a Hanko database dump (pure). */
-function exportHankoTables(tables, opts = {}) {
-    const set = new record_set_1.RecordSet();
-    const tenant = pickTenant(tables, opts.tenantId);
-    const rows = (...names) => tables.rows(...names).filter((r) => !tenant || !(0, tables_1.text)((0, tables_1.col)(r, 'tenant_id')) || (0, tables_1.text)((0, tables_1.col)(r, 'tenant_id')) === tenant);
-    const by = (list, key, value) => {
-        const out = new Map();
-        for (const r of list) {
-            const k = (0, tables_1.text)((0, tables_1.col)(r, key));
-            const v = value(r);
-            if (!k || v === undefined)
-                continue;
-            out.set(k, [...(out.get(k) ?? []), v]);
-        }
-        return out;
-    };
-    const userRows = rows('users');
-    if (!userRows.length)
-        throw new Error('No users table in the dump (expected users.json / users.ndjson / users.csv from the Hanko database).');
-    // users.id is internal; the JWT `sub` (and every Admin API id) is public_id, equal to id unless set on creation.
-    const publicId = new Map();
-    for (const u of userRows) {
-        const id = (0, tables_1.text)((0, tables_1.col)(u, 'id'));
-        if (id)
-            publicId.set(id, (0, tables_1.text)((0, tables_1.col)(u, 'public_id')) ?? id);
-    }
-    const primaries = new Set(rows('primary_emails').map((r) => (0, tables_1.text)((0, tables_1.col)(r, 'email_id'))).filter((v) => !!v));
-    const emailRows = rows('emails');
-    const emailById = new Map();
-    for (const e of emailRows) {
-        const id = (0, tables_1.text)((0, tables_1.col)(e, 'id'));
-        const address = (0, tables_1.text)((0, tables_1.col)(e, 'address'));
-        if (id && address)
-            emailById.set(id, { address: address.toLowerCase(), userId: (0, tables_1.text)((0, tables_1.col)(e, 'user_id')) });
-    }
-    const emailsOf = by(emailRows, 'user_id', (e) => {
-        const address = (0, tables_1.text)((0, tables_1.col)(e, 'address'));
-        return address ? { email: address.toLowerCase(), verified: (0, tables_1.bool)((0, tables_1.col)(e, 'verified')), primary: primaries.has((0, tables_1.text)((0, tables_1.col)(e, 'id')) ?? '') } : undefined;
-    });
-    const usernameOf = new Map();
-    for (const r of rows('usernames')) {
-        const userId = (0, tables_1.text)((0, tables_1.col)(r, 'user_id'));
-        const username = (0, tables_1.text)((0, tables_1.col)(r, 'username'));
-        if (userId && username)
-            usernameOf.set(userId, username);
-    }
-    const passwordOf = new Map();
-    for (const r of rows('password_credentials')) {
-        const userId = (0, tables_1.text)((0, tables_1.col)(r, 'user_id'));
-        if (userId)
-            passwordOf.set(userId, (0, tables_1.col)(r, 'password'));
-    }
-    const metadataOf = new Map();
-    for (const r of rows('user_metadata')) {
-        const userId = (0, tables_1.text)((0, tables_1.col)(r, 'user_id'));
-        if (userId)
-            metadataOf.set(userId, r);
-    }
-    const claimsOf = new Map();
-    for (const r of rows('user_custom_claims')) {
-        const userId = (0, tables_1.text)((0, tables_1.col)(r, 'user_id'));
-        const claims = customClaims((0, tables_1.col)(r, 'claims'), true);
-        if (userId && claims)
-            claimsOf.set(userId, claims);
-    }
-    // ── users ──
-    const exported = new Map(); // internal id → exported (public) id
-    let unsupportedHashes = 0;
-    for (const u of userRows) {
-        const id = (0, tables_1.text)((0, tables_1.col)(u, 'id'));
-        if (!id)
-            continue;
-        const pub = publicId.get(id);
-        let emails = sortedEmails(emailsOf.get(id) ?? []);
-        // Hanko before late 2022 kept one address on the user row.
-        const legacyEmail = (0, tables_1.text)((0, tables_1.col)(u, 'email'));
-        if (!emails.length && legacyEmail)
-            emails = [{ email: legacyEmail.toLowerCase(), verified: (0, tables_1.bool)((0, tables_1.col)(u, 'verified')), primary: true }];
-        if (emails.length && !emails.some((e) => e.primary))
-            emails[0] = { ...emails[0], primary: true };
-        const username = usernameOf.get(id) ?? (0, tables_1.text)((0, tables_1.col)(u, 'username'));
-        if (!emails.length && !username) {
-            set.omit('user', NO_IDENTIFIER);
-            continue;
-        }
-        let password;
-        if (passwordOf.has(id)) {
-            password = hankoPasswordHash(passwordOf.get(id)) ?? undefined;
-            if (!password)
-                unsupportedHashes++;
-        }
-        const meta = metadataOf.get(id);
-        set.add('user', (0, record_set_1.compact)({
-            id: pub,
-            emails,
-            username,
-            first_name: (0, tables_1.text)((0, tables_1.col)(u, 'given_name')),
-            last_name: (0, tables_1.text)((0, tables_1.col)(u, 'family_name')),
-            name: (0, tables_1.text)((0, tables_1.col)(u, 'name')),
-            image_url: (0, tables_1.text)((0, tables_1.col)(u, 'picture')),
-            password,
-            public_metadata: meta ? metadata((0, tables_1.col)(meta, 'public_metadata')) : undefined,
-            private_metadata: privateMetadata(meta ? metadata((0, tables_1.col)(meta, 'private_metadata')) : undefined, claimsOf.get(id)),
-            unsafe_metadata: meta ? metadata((0, tables_1.col)(meta, 'unsafe_metadata')) : undefined,
-            created_at: (0, tables_1.time)((0, tables_1.col)(u, 'created_at')),
-        }), pub);
-        exported.set(id, pub);
-    }
-    if (unsupportedHashes) {
-        set.warn(`${unsupportedHashes} password hash(es) are in a format Atlas cannot verify: those users sign in once through the hanko lazy-migration preset (or reset their password).`);
-    }
-    const owner = (internal) => (internal ? exported.get(internal) : undefined);
-    // ── SAML providers (Hanko ≥ 2.x keeps them in the database; config.yaml ones are synthesised below) ──
-    const metadataByProvider = new Map();
-    for (const m of rows('saml_idp_metadata')) {
-        const pid = (0, tables_1.text)((0, tables_1.col)(m, 'provider_id'));
-        if (pid)
-            metadataByProvider.set(pid, m);
-    }
-    const connectionByDomain = new Map();
-    for (const p of rows('saml_providers')) {
-        const id = (0, tables_1.text)((0, tables_1.col)(p, 'id'));
-        const domain = (0, tables_1.text)((0, tables_1.col)(p, 'domain'))?.toLowerCase();
-        if (!id)
-            continue;
-        if (domain)
-            connectionByDomain.set(domain, id);
-        const md = metadataByProvider.get(id);
-        const attrs = (0, tables_1.json)((0, tables_1.col)(p, 'attribute_map'));
-        const mapping = {};
-        for (const [k, v] of Object.entries(attrs ?? {}))
-            if (typeof v === 'string' && v)
-                mapping[k] = v;
-        set.add('sso_connection', (0, record_set_1.compact)({
-            id,
-            name: (0, tables_1.text)((0, tables_1.col)(p, 'name')),
-            protocol: 'saml',
-            domains: domain ? [domain] : undefined,
-            enabled: (0, tables_1.col)(p, 'enabled') === undefined ? undefined : (0, tables_1.bool)((0, tables_1.col)(p, 'enabled')),
-            saml: (0, record_set_1.compact)({
-                idp_entity_id: (0, tables_1.text)((0, tables_1.col)(p, 'entity_id')) ?? (md ? (0, tables_1.text)((0, tables_1.col)(md, 'issuer')) : undefined),
-                idp_metadata_url: (0, tables_1.text)((0, tables_1.col)(p, 'metadata_url')),
-                idp_metadata_xml: md ? (0, tables_1.text)((0, tables_1.col)(md, 'raw_metadata_xml')) : undefined,
-                idp_sso_url: md ? (0, tables_1.text)((0, tables_1.col)(md, 'sso_url')) : undefined,
-                idp_certificate: md ? (0, tables_1.text)((0, tables_1.col)(md, 'certificates_pem')) : undefined,
-                attribute_mapping: Object.keys(mapping).length ? mapping : undefined,
-            }),
-        }), id);
-    }
-    // ── identities ──
-    const samlDomainOf = new Map();
-    for (const s of rows('saml_identities')) {
-        const identityId = (0, tables_1.text)((0, tables_1.col)(s, 'identity_id'));
-        const domain = (0, tables_1.text)((0, tables_1.col)(s, 'domain'))?.toLowerCase();
-        if (identityId && domain)
-            samlDomainOf.set(identityId, domain);
-    }
-    const providers = new Set();
-    let synthesized = 0;
-    for (const r of rows('identities')) {
-        // Before 2025 the columns were provider_id (the provider's user id) and provider_name.
-        const legacy = (0, tables_1.col)(r, 'provider_name') !== undefined;
-        const provider = (0, tables_1.text)((0, tables_1.col)(r, legacy ? 'provider_name' : 'provider_id'));
-        const providerUserId = (0, tables_1.text)((0, tables_1.col)(r, legacy ? 'provider_id' : 'provider_user_id'));
-        const emailId = (0, tables_1.text)((0, tables_1.col)(r, 'email_id'));
-        const user = owner((0, tables_1.text)((0, tables_1.col)(r, 'user_id')) ?? (emailId ? emailById.get(emailId)?.userId : undefined));
-        if (!provider || !providerUserId || !user) {
-            set.omit('identity', 'Identity whose user was not exported');
-            continue;
-        }
-        const id = (0, tables_1.text)((0, tables_1.col)(r, 'id'));
-        const domain = id ? samlDomainOf.get(id) : undefined;
-        let ssoConnectionId;
-        if (domain) {
-            ssoConnectionId = connectionByDomain.get(domain);
-            if (!ssoConnectionId) {
-                // A SAML provider configured in config.yaml: the connection is created from what the identity knows.
-                ssoConnectionId = `saml:${domain}`;
-                connectionByDomain.set(domain, ssoConnectionId);
-                set.add('sso_connection', { id: ssoConnectionId, name: domain, protocol: 'saml', domains: [domain], saml: { idp_entity_id: provider } }, ssoConnectionId);
-                synthesized++;
-            }
-        }
-        else {
-            providers.add(provider);
-        }
-        set.add('identity', identity({
-            id,
-            userId: user,
-            provider,
-            providerUserId,
-            data: (0, tables_1.json)((0, tables_1.col)(r, 'data')),
-            ssoConnectionId,
-            saml: Boolean(domain),
-            fallbackEmail: emailId ? emailById.get(emailId)?.address : undefined,
-        }), `${provider}\u0000${providerUserId}`);
-    }
-    if (synthesized) {
-        set.warn(`${synthesized} SAML connection(s) come from config.yaml (saml.identity_providers) and were created from their users' identities: add each IdP's metadata URL in Atlas (atlas migrate hanko config lists them).`);
-    }
-    // ── TOTP ──
-    for (const r of rows('otp_secrets')) {
-        const user = owner((0, tables_1.text)((0, tables_1.col)(r, 'user_id')));
-        const secret = (0, tables_1.text)((0, tables_1.col)(r, 'secret'))?.replace(/=+$/, '').toUpperCase();
-        if (!user || !secret)
-            continue;
-        set.add('mfa_factor', (0, record_set_1.compact)({ id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), user_id: user, type: 'totp', secret_base32: secret, ...TOTP, verified: true, created_at: (0, tables_1.time)((0, tables_1.col)(r, 'created_at')) }));
-    }
-    // ── passkeys and security keys ──
-    const transports = by(rows('webauthn_credential_transports'), 'webauthn_credential_id', (t) => (0, tables_1.text)((0, tables_1.col)(t, 'name')));
-    const credentials = rows('webauthn_credentials').filter((c) => owner((0, tables_1.text)((0, tables_1.col)(c, 'user_id'))));
-    if (credentials.length && !opts.rpId) {
-        set.omit('passkey', 'No relying-party id given (--set hanko-rp-id)', credentials.length);
-        set.warn(NO_PASSKEY_RP);
-    }
-    else if (opts.rpId) {
-        let mfaOnly = 0;
-        for (const c of credentials) {
-            const record = passkey({
-                id: (0, tables_1.col)(c, 'id'),
-                userId: owner((0, tables_1.text)((0, tables_1.col)(c, 'user_id'))),
-                publicKey: (0, tables_1.col)(c, 'public_key'),
-                rpId: opts.rpId,
-                signCount: (0, tables_1.col)(c, 'sign_count'),
-                aaguid: (0, tables_1.col)(c, 'aaguid'),
-                backedUp: (0, tables_1.col)(c, 'backup_state'),
-                name: (0, tables_1.col)(c, 'name'),
-                transports: transports.get((0, tables_1.text)((0, tables_1.col)(c, 'id')) ?? '') ?? [],
-                createdAt: (0, tables_1.col)(c, 'created_at'),
-            });
-            if (!record) {
-                set.omit('passkey', 'WebAuthn credential without an id or public key');
-                continue;
-            }
-            if ((0, tables_1.bool)((0, tables_1.col)(c, 'mfa_only')))
-                mfaOnly++;
-            set.add('passkey', record, record.credential_id);
-        }
-        if (mfaOnly)
-            set.warn(MFA_ONLY_NOTE(mfaOnly));
-    }
-    // ── organizations, roles, memberships ──
-    for (const o of rows('organizations')) {
-        const id = (0, tables_1.text)((0, tables_1.col)(o, 'id'));
-        const name = (0, tables_1.text)((0, tables_1.col)(o, 'name'));
-        if (id && name)
-            set.add('organization', (0, record_set_1.compact)({ id, name, created_at: (0, tables_1.time)((0, tables_1.col)(o, 'created_at')) }), id);
-    }
-    const roleSlug = new Map();
-    for (const r of rows('roles')) {
-        const id = (0, tables_1.text)((0, tables_1.col)(r, 'id'));
-        const slug = (0, tables_1.text)((0, tables_1.col)(r, 'slug'));
-        if (!id || !slug)
-            continue;
-        roleSlug.set(id, slug);
-        set.add('role', (0, record_set_1.compact)({ key: slug, name: (0, tables_1.text)((0, tables_1.col)(r, 'name')), scope: 'organization' }), slug);
-    }
-    const bindings = new Map();
-    for (const b of rows('role_bindings')) {
-        const slug = roleSlug.get((0, tables_1.text)((0, tables_1.col)(b, 'role_id')) ?? '');
-        const key = `${(0, tables_1.text)((0, tables_1.col)(b, 'user_id'))}\u0000${(0, tables_1.text)((0, tables_1.col)(b, 'organization_id'))}`;
-        if (slug)
-            bindings.set(key, [...(bindings.get(key) ?? []), slug]);
-    }
-    for (const m of rows('organization_memberships')) {
-        const internal = (0, tables_1.text)((0, tables_1.col)(m, 'user_id'));
-        const user = owner(internal);
-        const org = (0, tables_1.text)((0, tables_1.col)(m, 'organization_id'));
-        if (!user || !org) {
-            set.omit('membership', 'Membership whose user was not exported');
-            continue;
-        }
-        set.add('membership', (0, record_set_1.compact)({ id: (0, tables_1.text)((0, tables_1.col)(m, 'id')), organization_id: org, user_id: user, role: membershipRole(bindings.get(`${internal}\u0000${org}`) ?? [], set), created_at: (0, tables_1.time)((0, tables_1.col)(m, 'created_at')) }), `${org}\u0000${user}`);
-    }
-    // ── what does not move ──
-    const now = Date.now();
-    const live = rows('sessions').filter((s) => {
-        const exp = (0, tables_1.timeMs)((0, tables_1.col)(s, 'expires_at'));
-        return exp === undefined || exp > now;
-    }).length;
-    if (live)
-        set.omit('session', 'Hanko sessions are JWTs the bridge accepts as they are (hanko preset)', live);
-    const webhooks = rows('webhooks').length;
-    if (webhooks)
-        set.warn(`${webhooks} Hanko webhook(s) in the database: recreate them as Atlas webhooks (the event names differ).`);
-    set.manifest = (0, record_set_1.compact)({
-        origin: tenant ? `Hanko database dump (tenant ${tenant})` : 'Hanko database dump',
-        rpId: opts.rpId,
-        providers: [...providers].sort(),
-        settings: (0, record_set_1.compact)({ hanko_tenant_id: tenant, totp: { ...TOTP } }),
-    });
-    return set;
-}
-/** The tenant to export: the one given, the only one in the dump, or an error naming them. */
-function pickTenant(tables, given) {
-    if (given)
-        return given;
-    const tenants = new Set(tables.rows('users').map((u) => (0, tables_1.text)((0, tables_1.col)(u, 'tenant_id'))).filter((t) => !!t));
-    if (tenants.size > 1) {
-        throw new Error(`The dump holds users of ${tenants.size} Hanko tenants (${[...tenants].sort().join(', ')}): export one at a time with --set hanko-tenant-id=<tenant id>.`);
-    }
-    return undefined;
-}
-// ── the Admin API ───────────────────────────────────────────────────────────
-/** Every page of a Hanko admin listing (`?page=&per_page=`; Link / X-Total-Count headers). Null when the endpoint does not exist. */
-async function pages(http, path, size, optional) {
-    const out = [];
-    for (let page = 1;; page++) {
-        let res;
-        try {
-            res = await http.get(`${path}?page=${page}&per_page=${size}`);
-        }
-        catch (err) {
-            // Older Hanko versions have no organizations / roles.
-            if (optional && err instanceof vendor_http_1.VendorApiError && err.status === 404)
-                return null;
-            throw err;
-        }
-        const list = (0, record_set_1.objs)(res.body);
-        out.push(...list);
-        const total = Number(res.headers.get('x-total-count'));
-        if (list.length < size || (Number.isFinite(total) && total > 0 && out.length >= total))
-            return out;
-    }
-}
-/** Read a Hanko project through the Admin API. */
-async function exportHankoApi(o) {
-    const set = new record_set_1.RecordSet();
-    const progress = o.onProgress ?? (() => undefined);
-    const size = Math.min(Math.max(o.pageSize ?? 100, 1), 1000);
-    const http = new vendor_http_1.VendorHttp({
-        vendor: 'Hanko',
-        baseUrl: o.adminUrl,
-        headers: o.apiKey ? { authorization: `Bearer ${o.apiKey}` } : {},
-        fetchImpl: o.fetchImpl,
-        sleep: o.sleep,
-    });
-    progress('organizations');
-    for (const org of (await pages(http, '/organizations', size, true)) ?? []) {
-        const id = (0, record_set_1.str)(org.id);
-        const name = (0, record_set_1.str)(org.name);
-        if (id && name)
-            set.add('organization', (0, record_set_1.compact)({ id, name, created_at: (0, record_set_1.str)(org.created_at) }), id);
-    }
-    progress('roles');
-    for (const role of (await pages(http, '/roles', size, true)) ?? []) {
-        const slug = (0, record_set_1.str)(role.slug);
-        if (slug)
-            set.add('role', (0, record_set_1.compact)({ key: slug, name: (0, record_set_1.str)(role.name), scope: 'organization' }), slug);
-    }
-    progress('users');
-    const listed = (await pages(http, '/users', size, false)) ?? [];
-    const providers = new Set();
-    let withPassword = 0;
-    let withTotp = 0;
-    let mfaOnly = 0;
-    let credentialsWithoutRp = 0;
-    for (const [i, item] of listed.entries()) {
-        const id = (0, record_set_1.str)(item.id);
-        if (!id)
-            continue;
-        if (i > 0 && i % 100 === 0)
-            progress(`users (${i}/${listed.length})`);
-        // The listing has emails, passkeys and username; identities, metadata and names need the user itself.
-        let u = item;
-        try {
-            const { body } = await http.get(`/users/${encodeURIComponent(id)}`);
-            if ((0, record_set_1.isObj)(body))
-                u = { ...item, ...body };
-        }
-        catch (err) {
-            if (!(err instanceof vendor_http_1.VendorApiError && err.status === 404))
-                throw err;
-        }
-        const emailById = new Map();
-        const emails = sortedEmails((0, record_set_1.objs)(u.emails).flatMap((e) => {
-            const address = (0, record_set_1.str)(e.address)?.toLowerCase();
-            if (!address)
-                return [];
-            if ((0, record_set_1.str)(e.id))
-                emailById.set((0, record_set_1.str)(e.id), address);
-            return [{ email: address, verified: e.is_verified === true, primary: e.is_primary === true }];
-        }));
-        const named = u.username;
-        const username = (0, record_set_1.isObj)(named) ? (0, record_set_1.str)(named.username) : (0, record_set_1.str)(named);
-        if (!emails.length && !username) {
-            set.omit('user', NO_IDENTIFIER);
-            continue;
-        }
-        if ((0, record_set_1.isObj)(u.password))
-            withPassword++;
-        if ((0, record_set_1.isObj)(u.otp))
-            withTotp++;
-        const meta = (0, record_set_1.isObj)(u.metadata) ? u.metadata : {};
-        set.add('user', (0, record_set_1.compact)({
-            id,
-            emails,
-            username,
-            first_name: (0, record_set_1.str)(u.given_name),
-            last_name: (0, record_set_1.str)(u.family_name),
-            name: (0, record_set_1.str)(u.name),
-            image_url: (0, record_set_1.str)(u.picture),
-            public_metadata: metadata(meta.public_metadata),
-            private_metadata: privateMetadata(metadata(meta.private_metadata), customClaims(u.custom_claims, false)),
-            unsafe_metadata: metadata(meta.unsafe_metadata),
-            created_at: (0, record_set_1.str)(u.created_at),
-        }), id);
-        // The admin DTO names them the other way round: provider_id is the provider's user id, provider_name the provider.
-        for (const ident of (0, record_set_1.objs)(u.identities)) {
-            const provider = (0, record_set_1.str)(ident.provider_name);
-            const providerUserId = (0, record_set_1.str)(ident.provider_id);
-            if (!provider || !providerUserId)
-                continue;
-            const saml = /^(https?:\/\/|urn:)/i.test(provider);
-            if (!saml)
-                providers.add(provider);
-            set.add('identity', identity({ id: (0, record_set_1.str)(ident.id), userId: id, provider, providerUserId, saml, fallbackEmail: emailById.get((0, record_set_1.str)(ident.email_id) ?? '') }), `${provider}\u0000${providerUserId}`);
-        }
-        for (const c of (0, record_set_1.objs)(u.webauthn_credentials)) {
-            if (!o.rpId) {
-                credentialsWithoutRp++;
-                continue;
-            }
-            const record = passkey({
-                id: c.id,
-                userId: id,
-                publicKey: c.public_key,
-                rpId: o.rpId,
-                aaguid: c.aaguid,
-                backedUp: c.backup_state,
-                name: c.name,
-                transports: (0, record_set_1.strs)(c.transports),
-                createdAt: c.created_at,
-            });
-            if (!record) {
-                set.omit('passkey', 'WebAuthn credential without an id or public key');
-                continue;
-            }
-            if (c.mfa_only === true)
-                mfaOnly++;
-            set.add('passkey', record, record.credential_id);
-        }
-        for (const org of (0, record_set_1.objs)(u.organizations)) {
-            const orgId = (0, record_set_1.str)(org.id);
-            if (!orgId)
-                continue;
-            if ((0, record_set_1.str)(org.name))
-                set.add('organization', { id: orgId, name: (0, record_set_1.str)(org.name) }, orgId);
-            const roles = (0, record_set_1.objs)(org.roles);
-            for (const r of roles)
-                if ((0, record_set_1.str)(r.slug))
-                    set.add('role', (0, record_set_1.compact)({ key: (0, record_set_1.str)(r.slug), name: (0, record_set_1.str)(r.name), scope: 'organization' }), (0, record_set_1.str)(r.slug));
-            set.add('membership', { organization_id: orgId, user_id: id, role: membershipRole(roles.map((r) => (0, record_set_1.str)(r.slug)).filter((s) => !!s), set) }, `${orgId}\u0000${id}`);
-        }
-    }
-    if (withPassword) {
-        set.warn(`${withPassword} user(s) have a Hanko password: the Admin API never returns password hashes, so these move by lazy migration (preset hanko) on each user's first Atlas sign-in — or export from the database instead.`);
-    }
-    if (withTotp)
-        set.warn(`${withTotp} user(s) use TOTP: the Admin API never returns TOTP secrets, so they enrol an authenticator again in Atlas (a database dump carries the secrets).`);
-    if (credentialsWithoutRp) {
-        set.omit('passkey', 'No relying-party id given (--set hanko-rp-id)', credentialsWithoutRp);
-        set.warn(NO_PASSKEY_RP);
-    }
-    if (mfaOnly)
-        set.warn(MFA_ONLY_NOTE(mfaOnly));
-    if (o.apiUrl) {
-        progress('signing keys');
-        const pub = new vendor_http_1.VendorHttp({ vendor: 'Hanko', baseUrl: o.apiUrl, fetchImpl: o.fetchImpl, sleep: o.sleep });
-        try {
-            const { body } = await pub.get('/.well-known/jwks.json');
-            for (const jwk of (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.keys : undefined)) {
-                const kid = (0, record_set_1.str)(jwk.kid);
-                if (kid && jwk.d === undefined)
-                    set.add('jwks', { kid, jwk }, kid);
-            }
-        }
-        catch (err) {
-            if (!(err instanceof vendor_http_1.VendorApiError))
-                throw err;
-            set.warn(`Could not read Hanko's signing keys (${err.message}); the bridge fetches them itself.`);
-        }
-    }
-    set.manifest = (0, record_set_1.compact)({ origin: `Hanko Admin API ${o.adminUrl.replace(/^https?:\/\//, '').replace(/\/+$/, '')}`, rpId: o.rpId, providers: [...providers].sort(), settings: { totp: { ...TOTP } } });
-    return set;
-}
-//# sourceMappingURL=hanko.js.map