@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/logto.js

@@ -1,809 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.exportLogto = exportLogto;
-exports.normalizeEndpoint = normalizeEndpoint;
-exports.tenantOfEndpoint = tenantOfEndpoint;
-exports.managementResource = managementResource;
-exports.logtoRow = logtoRow;
-exports.tenantRows = tenantRows;
-exports.snapshotFromTables = snapshotFromTables;
-exports.logtoManagementHttp = logtoManagementHttp;
-exports.fetchLogtoSnapshot = fetchLogtoSnapshot;
-exports.parseLegacyExpression = parseLegacyExpression;
-exports.mapLogtoPassword = mapLogtoPassword;
-exports.mapLogtoUser = mapLogtoUser;
-exports.buildLogtoRecordSet = buildLogtoRecordSet;
-const tables_1 = require("./frameworks/tables");
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-/** Logto user columns the user record carries itself (the rest of `profile` lands in metadata). */
-const NAME_KEYS = new Set(['givenName', 'familyName']);
-/** The Management API's page size cap. */
-const PAGE = 100;
-/** TOTP as Logto runs it (otplib authenticator defaults). */
-const TOTP = { algorithm: 'SHA1', digits: 6, period: 30 };
-async function exportLogto(opts) {
-    const progress = opts.onProgress ?? (() => undefined);
-    const endpoint = opts.endpoint ? normalizeEndpoint(opts.endpoint) : undefined;
-    // A dump names its tenant (`default` when self-hosted); the API's is in a Cloud endpoint.
-    const tenantId = opts.tenantId ?? (!opts.tables && endpoint ? tenantOfEndpoint(endpoint) : null) ?? 'default';
-    let snap;
-    if (opts.tables) {
-        progress('database dump');
-        snap = snapshotFromTables(opts.tables, tenantId);
-        // The public signing keys, when the endpoint is known (never from the dump: logto_configs holds the PRIVATE keys).
-        if (endpoint)
-            snap.jwks = await readJwks(new vendor_http_1.VendorHttp({ vendor: 'Logto', baseUrl: endpoint, fetchImpl: opts.fetchImpl, sleep: opts.sleep, attempts: 2 })).catch(() => []);
-    }
-    else {
-        if (!endpoint)
-            throw new Error('Logto export needs a database dump (--set logto-dump=<dir>) or the Logto endpoint and a machine-to-machine app for the Management API.');
-        if (!opts.m2m)
-            throw new Error('The Logto Management API needs a machine-to-machine app id and secret (LOGTO_M2M_APP_ID / LOGTO_M2M_APP_SECRET).');
-        snap = await fetchLogtoSnapshot({ ...opts, endpoint, m2m: opts.m2m, tenantId, onProgress: progress });
-    }
-    return buildLogtoRecordSet(snap, { endpoint, tenantId, rpId: opts.rpId ?? (endpoint ? new URL(endpoint).hostname : undefined) });
-}
-/** `https://auth.example.com/` → `https://auth.example.com` (https only, no path). */
-function normalizeEndpoint(raw) {
-    const withScheme = /^https?:\/\//.test(raw.trim()) ? raw.trim() : `https://${raw.trim()}`;
-    const url = new URL(withScheme);
-    if (url.protocol !== 'https:' && url.hostname !== 'localhost')
-        throw new Error(`The Logto endpoint must be https: ${raw}`);
-    return `${url.protocol}//${url.host}`;
-}
-/** The Cloud tenant id of `https://abc123.logto.app`, or null for any other host. */
-function tenantOfEndpoint(endpoint) {
-    const m = /^https:\/\/([a-z0-9]+)\.logto\.app$/.exec(endpoint);
-    return m ? m[1] : null;
-}
-/** The Management API resource indicator of a tenant. */
-function managementResource(tenantId) {
-    return `https://${tenantId}.logto.app/api`;
-}
-// ── database dump ───────────────────────────────────────────────────────────
-/** JSONB columns (camelCase): a CSV dump carries them as JSON text. */
-const JSON_KEYS = new Set([
-    'profile',
-    'identities',
-    'customData',
-    'logtoConfig',
-    'mfaVerifications',
-    'config',
-    'domains',
-    'branding',
-    'color',
-    'metadata',
-    'detail',
-    'oidcClientMetadata',
-    'customClientMetadata',
-    'protectedAppMetadata',
-    'signIn',
-    'signUp',
-    'socialSignIn',
-    'socialSignInConnectorTargets',
-    'passwordPolicy',
-    'mfa',
-    'adaptiveMfa',
-    'trustedDevice',
-    'languageInfo',
-    'customContent',
-    'captchaPolicy',
-    'sentinelPolicy',
-    'emailBlocklistPolicy',
-    'verificationCodePolicy',
-    'forgotPasswordMethods',
-    'passkeySignIn',
-    'signUpProfileFields',
-    'passwordExpiration',
-    'usernamePolicy',
-]);
-/** A database row as the Management API would spell it: camelCase keys, JSONB parsed. */
-function logtoRow(row) {
-    const out = {};
-    for (const [k, v] of Object.entries(row)) {
-        const key = k.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
-        out[key] = JSON_KEYS.has(key) && typeof v === 'string' ? parseJson(v) : v;
-    }
-    return out;
-}
-function parseJson(v) {
-    const t = v.trim();
-    if (!t)
-        return undefined;
-    try {
-        return JSON.parse(t);
-    }
-    catch {
-        return v;
-    }
-}
-/** One table's rows of one tenant (a dump made with `where tenant_id = …` has every row already). */
-function tenantRows(tables, name, tenantId) {
-    return tables
-        .rows(name)
-        .filter((r) => {
-        const t = (0, tables_1.text)((0, tables_1.col)(r, 'tenant_id', 'tenantId'));
-        return t === undefined || t === tenantId;
-    })
-        .map(logtoRow);
-}
-function group(rows, key, value) {
-    const out = new Map();
-    for (const r of rows) {
-        const k = (0, record_set_1.str)(r[key]);
-        const v = (0, record_set_1.str)(r[value]);
-        if (!k || !v)
-            continue;
-        out.set(k, [...(out.get(k) ?? []), v]);
-    }
-    return out;
-}
-function snapshotFromTables(tables, tenantId) {
-    const t = (name) => tenantRows(tables, name, tenantId);
-    const roles = t('roles').filter((r) => (0, record_set_1.str)(r.type) !== 'MachineToMachine');
-    const roleIds = new Set(roles.map((r) => (0, record_set_1.str)(r.id)).filter((x) => !!x));
-    const scopeName = new Map(t('scopes').map((s) => [(0, record_set_1.str)(s.id) ?? '', (0, record_set_1.str)(s.name) ?? '']));
-    const orgScopeName = new Map(t('organization_scopes').map((s) => [(0, record_set_1.str)(s.id) ?? '', (0, record_set_1.str)(s.name) ?? '']));
-    const named = (ids, names) => (ids ?? []).map((id) => names.get(id)).filter((n) => !!n);
-    const rolePermissions = new Map();
-    for (const [roleId, scopeIds] of group(t('roles_scopes'), 'roleId', 'scopeId'))
-        rolePermissions.set(roleId, named(scopeIds, scopeName));
-    const userRoles = new Map();
-    for (const [userId, ids] of group(t('users_roles'), 'userId', 'roleId'))
-        userRoles.set(userId, ids.filter((id) => roleIds.has(id)));
-    const organizationRoles = t('organization_roles').filter((r) => (0, record_set_1.str)(r.type) !== 'MachineToMachine');
-    const orgScopes = group(t('organization_role_scope_relations'), 'organizationRoleId', 'organizationScopeId');
-    const orgResourceScopes = group(t('organization_role_resource_scope_relations'), 'organizationRoleId', 'scopeId');
-    const organizationRolePermissions = new Map();
-    for (const r of organizationRoles) {
-        const id = (0, record_set_1.str)(r.id);
-        if (id)
-            organizationRolePermissions.set(id, [...named(orgScopes.get(id), orgScopeName), ...named(orgResourceScopes.get(id), scopeName)]);
-    }
-    const memberRoles = new Map();
-    for (const r of t('organization_role_user_relations')) {
-        const k = `${(0, record_set_1.str)(r.organizationId)}:${(0, record_set_1.str)(r.userId)}`;
-        const role = (0, record_set_1.str)(r.organizationRoleId);
-        if (role)
-            memberRoles.set(k, [...(memberRoles.get(k) ?? []), role]);
-    }
-    const members = t('organization_user_relations')
-        .map((r) => ({ organizationId: (0, record_set_1.str)(r.organizationId) ?? '', userId: (0, record_set_1.str)(r.userId) ?? '' }))
-        .filter((m) => m.organizationId && m.userId)
-        .map((m) => ({ ...m, roleIds: memberRoles.get(`${m.organizationId}:${m.userId}`) ?? [] }));
-    const invitationRoles = group(t('organization_invitation_role_relations'), 'organizationInvitationId', 'organizationRoleId');
-    return {
-        source: 'database',
-        users: t('users'),
-        roles,
-        rolePermissions,
-        userRoles,
-        organizations: t('organizations'),
-        organizationRoles,
-        organizationRolePermissions,
-        members,
-        invitations: t('organization_invitations').map((row) => ({ row, roleIds: invitationRoles.get((0, record_set_1.str)(row.id) ?? '') ?? [] })),
-        organizationDomains: group(t('organization_jit_email_domains'), 'organizationId', 'emailDomain'),
-        ssoConnectors: t('sso_connectors'),
-        ssoIdentities: t('user_sso_identities'),
-        personalAccessTokens: t('personal_access_tokens'),
-        jwks: [],
-        hasFactors: true,
-    };
-}
-// ── Management API ──────────────────────────────────────────────────────────
-/** A Management API client: an M2M access token fetched (and refreshed) on this machine. */
-function logtoManagementHttp(o) {
-    const fetchImpl = o.fetchImpl ?? fetch;
-    const now = o.now ?? Date.now;
-    let cached = null;
-    const token = async () => {
-        if (cached && cached.until > now())
-            return cached.token;
-        const res = await fetchImpl(`${o.endpoint}/oidc/token`, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/x-www-form-urlencoded',
-                accept: 'application/json',
-                authorization: `Basic ${Buffer.from(`${o.m2m.appId}:${o.m2m.appSecret}`).toString('base64')}`,
-            },
-            body: new URLSearchParams({ grant_type: 'client_credentials', resource: managementResource(o.tenantId), scope: 'all' }).toString(),
-        });
-        const body = (await res.json().catch(() => null));
-        const access = (0, record_set_1.str)(body?.access_token);
-        if (res.status !== 200 || !access) {
-            throw new vendor_http_1.VendorApiError('Logto', res.status, '/oidc/token', (0, record_set_1.str)(body?.error_description) ?? (0, record_set_1.str)(body?.error) ?? 'no access token (check the app id, secret and the Management API role)');
-        }
-        const ttl = typeof body?.expires_in === 'number' ? body.expires_in : 3600;
-        cached = { token: access, until: now() + Math.max(ttl - 60, 30) * 1000 };
-        return access;
-    };
-    return new vendor_http_1.VendorHttp({ vendor: 'Logto', baseUrl: o.endpoint, headers: async () => ({ authorization: `Bearer ${await token()}` }), fetchImpl: o.fetchImpl, sleep: o.sleep });
-}
-/** Every page of a paginated Management API listing (`page`, `page_size`). */
-async function pages(http, path) {
-    const out = [];
-    const sep = path.includes('?') ? '&' : '?';
-    for (let page = 1; page <= 100_000; page++) {
-        const { body } = await http.get(`${path}${sep}page=${page}&page_size=${PAGE}`);
-        const rows = (0, record_set_1.objs)(body);
-        out.push(...rows);
-        if (rows.length < PAGE)
-            break;
-    }
-    return out;
-}
-/** A listing an older Logto (or a narrower token) may not have: empty, with a warning. */
-async function optional(warnings, what, fn, empty) {
-    try {
-        return await fn();
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && [401, 403, 404, 501].includes(err.status)) {
-            warnings.push(`${what} could not be read (${err.status}): skipped.`);
-            return empty;
-        }
-        throw err;
-    }
-}
-async function readJwks(http) {
-    const { body } = await http.get('/oidc/jwks');
-    return (0, record_set_1.objs)(body?.keys);
-}
-async function fetchLogtoSnapshot(o) {
-    const http = logtoManagementHttp({ endpoint: o.endpoint, m2m: o.m2m, tenantId: o.tenantId, fetchImpl: o.fetchImpl, sleep: o.sleep });
-    const warnings = o.warnings ?? [];
-    o.onProgress('users');
-    const users = await pages(http, '/api/users?includePasswordHash=true');
-    o.onProgress('roles');
-    const roles = (await pages(http, '/api/roles')).filter((r) => (0, record_set_1.str)(r.type) !== 'MachineToMachine');
-    const rolePermissions = new Map();
-    const userRoles = new Map();
-    for (const r of roles) {
-        const id = (0, record_set_1.str)(r.id);
-        if (!id)
-            continue;
-        const { body } = await http.get(`/api/roles/${encodeURIComponent(id)}/scopes`);
-        rolePermissions.set(id, (0, record_set_1.objs)(body).map((s) => (0, record_set_1.str)(s.name)).filter((s) => !!s));
-        for (const u of await pages(http, `/api/roles/${encodeURIComponent(id)}/users`)) {
-            const uid = (0, record_set_1.str)(u.id);
-            if (uid)
-                userRoles.set(uid, [...(userRoles.get(uid) ?? []), id]);
-        }
-    }
-    o.onProgress('organizations');
-    const organizations = await optional(warnings, 'Organizations', () => pages(http, '/api/organizations'), []);
-    const organizationRoles = (await optional(warnings, 'Organization roles', () => pages(http, '/api/organization-roles'), [])).filter((r) => (0, record_set_1.str)(r.type) !== 'MachineToMachine');
-    const organizationRolePermissions = new Map();
-    for (const r of organizationRoles) {
-        const id = (0, record_set_1.str)(r.id);
-        if (!id)
-            continue;
-        organizationRolePermissions.set(id, [...(0, record_set_1.objs)(r.scopes), ...(0, record_set_1.objs)(r.resourceScopes)].map((s) => (0, record_set_1.str)(s.name)).filter((s) => !!s));
-    }
-    const members = [];
-    const organizationDomains = new Map();
-    for (const org of organizations) {
-        const id = (0, record_set_1.str)(org.id);
-        if (!id)
-            continue;
-        for (const u of await pages(http, `/api/organizations/${encodeURIComponent(id)}/users`)) {
-            const uid = (0, record_set_1.str)(u.id);
-            if (uid)
-                members.push({ organizationId: id, userId: uid, roleIds: (0, record_set_1.objs)(u.organizationRoles).map((x) => (0, record_set_1.str)(x.id)).filter((x) => !!x) });
-        }
-        const domains = await optional(warnings, `JIT email domains of organization ${id}`, async () => (0, record_set_1.objs)((await http.get(`/api/organizations/${encodeURIComponent(id)}/jit/email-domains`)).body), []);
-        const list = domains.map((d) => (0, record_set_1.str)(d.emailDomain)).filter((d) => !!d);
-        if (list.length)
-            organizationDomains.set(id, list);
-    }
-    const invitations = (await optional(warnings, 'Organization invitations', async () => (0, record_set_1.objs)((await http.get('/api/organization-invitations')).body), [])).map((row) => ({
-        row,
-        roleIds: (0, record_set_1.objs)(row.organizationRoles).map((x) => (0, record_set_1.str)(x.id)).filter((x) => !!x),
-    }));
-    o.onProgress('enterprise SSO');
-    const ssoConnectors = await optional(warnings, 'SSO connectors', async () => (0, record_set_1.objs)((await http.get('/api/sso-connectors')).body), []);
-    const ssoIdentities = [];
-    if (ssoConnectors.length) {
-        // SSO identities only come with the single-user read.
-        for (const u of users) {
-            const uid = (0, record_set_1.str)(u.id);
-            if (!uid)
-                continue;
-            const { body } = await http.get(`/api/users/${encodeURIComponent(uid)}?includeSsoIdentities=true`);
-            for (const s of (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.ssoIdentities : undefined))
-                ssoIdentities.push({ ...s, userId: (0, record_set_1.str)(s.userId) ?? uid });
-        }
-    }
-    const personalAccessTokens = [];
-    if (o.personalAccessTokens) {
-        o.onProgress('personal access tokens');
-        for (const u of users) {
-            const uid = (0, record_set_1.str)(u.id);
-            if (!uid)
-                continue;
-            const rows = await optional(warnings, 'Personal access tokens', async () => (0, record_set_1.objs)((await http.get(`/api/users/${encodeURIComponent(uid)}/personal-access-tokens`)).body), []);
-            for (const p of rows)
-                personalAccessTokens.push({ ...p, userId: (0, record_set_1.str)(p.userId) ?? uid });
-        }
-    }
-    o.onProgress('signing keys');
-    const jwks = await optional(warnings, 'The signing keys (/oidc/jwks)', () => readJwks(http), []);
-    return {
-        source: 'api',
-        users,
-        roles,
-        rolePermissions,
-        userRoles,
-        organizations,
-        organizationRoles,
-        organizationRolePermissions,
-        members,
-        invitations,
-        organizationDomains,
-        ssoConnectors,
-        ssoIdentities,
-        personalAccessTokens,
-        jwks,
-        hasFactors: false,
-        warnings: [...new Set(warnings)],
-    };
-}
-// ── passwords ───────────────────────────────────────────────────────────────
-const PLAIN_DIGESTS = new Set(['md5', 'sha1', 'sha256', 'sha512']);
-const PBKDF2_DIGESTS = new Set(['sha1', 'sha256', 'sha384', 'sha512']);
-const HEX = /^[0-9a-f]+$/i;
-/** A Logto `Legacy` expression `["algorithm", [args with "@"], "hash"]`, or null. */
-function parseLegacyExpression(value) {
-    let doc;
-    try {
-        doc = JSON.parse(value);
-    }
-    catch {
-        return null;
-    }
-    if (!Array.isArray(doc) || doc.length !== 3)
-        return null;
-    const [algorithm, args, hash] = doc;
-    if (typeof algorithm !== 'string' || typeof hash !== 'string' || !Array.isArray(args))
-        return null;
-    if (!args.every((a) => typeof a === 'string') || !args.includes('@'))
-        return null;
-    return { algorithm, args, hash };
-}
-/**
- * A Logto password digest and its `password_encryption_method` → the bundle's
- * password. Null when the user has none or Logto itself could not verify it.
- */
-function mapLogtoPassword(digest, method) {
-    const d = typeof digest === 'string' ? digest.trim() : '';
-    if (!d)
-        return null;
-    switch ((0, record_set_1.str)(method)) {
-        case 'Argon2i':
-        case 'Argon2id':
-        case 'Argon2d':
-            return /^\$argon2(id|i|d)\$/.test(d) ? { algorithm: 'argon2', hash: d } : null;
-        case 'Bcrypt':
-            return { algorithm: 'bcrypt', hash: d };
-        // hash-wasm hex digests of the bare password.
-        case 'MD5':
-            return { algorithm: 'md5', hash: d, params: { encoding: 'hex' } };
-        case 'SHA1':
-            return { algorithm: 'sha1', hash: d, params: { encoding: 'hex' } };
-        case 'SHA256':
-            return { algorithm: 'sha256', hash: d, params: { encoding: 'hex' } };
-        case 'Legacy':
-            return mapLegacy(d);
-        default:
-            return null;
-    }
-}
-function mapLegacy(d) {
-    const e = parseLegacyExpression(d);
-    if (!e)
-        return null;
-    const { algorithm, args, hash } = e;
-    const at = args.indexOf('@');
-    // The plain shapes onto the registry's own verifiers.
-    if (PLAIN_DIGESTS.has(algorithm) && HEX.test(hash)) {
-        if (args.length === 1)
-            return { algorithm, hash, params: { encoding: 'hex' } };
-        const salt = args.length === 2 ? args[at === 0 ? 1 : 0] : '@';
-        if (salt !== '@')
-            return { algorithm: `${algorithm}_salted`, hash, salt, params: { salt_position: at === 0 ? 'suffix' : 'prefix', encoding: 'hex' } };
-    }
-    if ((algorithm === 'pbkdf2' || algorithm === 'pbkdf2Sync') && args.length === 5 && at === 4) {
-        const [salt, iterations, keylen, digest] = args;
-        const hexSalt = salt.startsWith('hex:') ? salt.slice(4) : undefined;
-        const ok = PBKDF2_DIGESTS.has(digest) && /^\d+$/.test(iterations) && /^\d+$/.test(keylen) && HEX.test(hash) && hash.length === Number(keylen) * 2 && (hexSalt === undefined || (HEX.test(hexSalt) && hexSalt.length % 2 === 0));
-        if (ok) {
-            return {
-                algorithm: 'pbkdf2',
-                hash,
-                salt: hexSalt ?? salt,
-                params: { digest, iterations: Number(iterations), key_length: Number(keylen), encoding: 'hex', salt_encoding: hexSalt === undefined ? 'utf8' : 'hex' },
-            };
-        }
-    }
-    if (algorithm === 'firebase-scrypt' && args.length === 6 && at === 5) {
-        const [salt, signerKey, separator, rounds, memCost] = args;
-        return { algorithm: 'scrypt_firebase', hash, salt, params: { signer_key: signerKey, salt_separator: separator, rounds: Number(rounds), mem_cost: Number(memCost) } };
-    }
-    // Everything else (several args around the password, other digests, PBKDF2
-    // variants, SHA-crypt) keeps the expression for the logto_legacy verifier.
-    return { algorithm: 'logto_legacy', hash: d };
-}
-// ── records ─────────────────────────────────────────────────────────────────
-/** A unique key per name within a scope (`Billing Admin` → `billing_admin`, then `billing_admin_x1y2`). */
-function keyer() {
-    const used = new Set();
-    return (name, id) => {
-        let key = (0, translate_kit_1.keyOf)(name);
-        if (used.has(key))
-            key = `${key}_${id.slice(-4).toLowerCase()}`;
-        used.add(key);
-        return key;
-    };
-}
-/** One Logto user → a user record (null when it has nothing to sign in with). */
-function mapLogtoUser(u, roles = []) {
-    const id = (0, record_set_1.str)(u.id);
-    if (!id)
-        return { user: null, passwordUnsupported: false };
-    const profile = (0, record_set_1.isObj)(u.profile) ? u.profile : {};
-    const primary = (0, record_set_1.str)(u.primaryEmail)?.toLowerCase();
-    const phone = (0, record_set_1.e164)(u.primaryPhone);
-    const username = (0, record_set_1.str)(u.username);
-    // Logto keeps no verified flag: an address is only set once verified (or by an admin).
-    const emails = primary ? [{ email: primary, verified: true, primary: true }] : [];
-    if (!primary && !phone && !username) {
-        // A social-only account: the provider's address, unverified, so the user can be matched.
-        const social = Object.values((0, record_set_1.isObj)(u.identities) ? u.identities : {})
-            .map((i) => ((0, record_set_1.isObj)(i) && (0, record_set_1.isObj)(i.details) ? (0, record_set_1.str)(i.details.email)?.toLowerCase() : undefined))
-            .find((e) => e?.includes('@'));
-        if (social)
-            emails.push({ email: social, verified: false, primary: true });
-    }
-    const digest = u.passwordEncrypted ?? u.passwordDigest;
-    const method = u.passwordEncryptionMethod ?? u.passwordAlgorithm;
-    const password = mapLogtoPassword(digest, method);
-    const extraProfile = Object.fromEntries(Object.entries(profile).filter(([k, v]) => !NAME_KEYS.has(k) && v !== null && v !== undefined && v !== ''));
-    const suspended = (0, tables_1.bool)(u.isSuspended);
-    const user = (0, record_set_1.compact)({
-        id,
-        emails,
-        phones: phone ? [{ phone, verified: true, primary: !primary }] : [],
-        username,
-        first_name: (0, record_set_1.str)(profile.givenName),
-        last_name: (0, record_set_1.str)(profile.familyName),
-        name: (0, record_set_1.str)(u.name),
-        image_url: (0, record_set_1.str)(u.avatar),
-        password: password ?? undefined,
-        roles,
-        banned: suspended ? true : undefined,
-        ban_reason: suspended ? 'Suspended in Logto' : undefined,
-        public_metadata: (0, record_set_1.bag)(u.customData),
-        private_metadata: (0, record_set_1.bag)({
-            ...(Object.keys(extraProfile).length ? { logto_profile: extraProfile } : {}),
-            ...((0, record_set_1.str)(u.applicationId) ? { logto_application_id: (0, record_set_1.str)(u.applicationId) } : {}),
-            ...((0, tables_1.bool)(u.isPasswordExpired) ? { logto_password_expired: true } : {}),
-        }),
-        created_at: (0, tables_1.time)(u.createdAt),
-        last_sign_in_at: (0, tables_1.time)(u.lastSignInAt),
-    });
-    const ok = !!(user.emails?.length || user.phones?.length || user.username);
-    return { user: ok ? user : null, passwordUnsupported: !password && typeof digest === 'string' && digest.trim() !== '' };
-}
-/** SAML providers vs OIDC ones (Logto's SsoProviderName). */
-const SAML_PROVIDERS = new Set(['SAML', 'AzureAD']);
-function mapSsoConnector(c, endpoint) {
-    const id = (0, record_set_1.str)(c.id);
-    const provider = (0, record_set_1.str)(c.providerName);
-    if (!id || !provider)
-        return null;
-    const config = (0, record_set_1.isObj)(c.config) ? c.config : {};
-    const domains = (0, record_set_1.strs)(c.domains);
-    const name = (0, record_set_1.str)(c.connectorName) ?? provider;
-    if (SAML_PROVIDERS.has(provider)) {
-        const mapping = (0, record_set_1.isObj)(config.attributeMapping) ? Object.fromEntries(Object.entries(config.attributeMapping).filter((e) => typeof e[1] === 'string')) : {};
-        return (0, record_set_1.compact)({
-            id,
-            name,
-            protocol: 'saml',
-            domains,
-            enabled: true,
-            saml: (0, record_set_1.compact)({
-                idp_entity_id: (0, record_set_1.str)(config.entityId),
-                idp_sso_url: (0, record_set_1.str)(config.signInEndpoint),
-                idp_certificate: (0, record_set_1.str)(config.x509Certificate),
-                idp_metadata_url: (0, record_set_1.str)(config.metadataUrl),
-                idp_metadata_xml: (0, record_set_1.str)(config.metadata),
-                // Logto's SP identifiers: the IdP must be updated when these change.
-                sp_entity_id: endpoint ? `${endpoint}/enterprise-sso/${id}` : undefined,
-                sp_acs_url: endpoint ? `${endpoint}/api/authn/single-sign-on/saml/${id}` : undefined,
-                attribute_mapping: Object.keys(mapping).length ? mapping : undefined,
-            }),
-        });
-    }
-    // OIDC, Okta, Azure AD (OIDC) and Google Workspace are OpenID Connect underneath.
-    const issuer = (0, record_set_1.str)(config.issuer) ?? (provider === 'GoogleWorkspace' ? 'https://accounts.google.com' : undefined);
-    return (0, record_set_1.compact)({
-        id,
-        name,
-        protocol: 'oidc',
-        domains,
-        enabled: true,
-        oidc: (0, record_set_1.compact)({
-            issuer,
-            client_id: (0, record_set_1.str)(config.clientId),
-            client_secret: (0, record_set_1.str)(config.clientSecret),
-            scopes: (0, record_set_1.str)(config.scope)?.split(/[ +]/).filter(Boolean),
-        }),
-    });
-}
-const INVITATION_STATUS = { Pending: 'pending', Accepted: 'accepted', Revoked: 'revoked', Expired: 'expired' };
-function buildLogtoRecordSet(snap, o) {
-    const set = new record_set_1.RecordSet();
-    for (const w of snap.warnings ?? [])
-        set.warn(w);
-    // ── roles ──
-    const appKey = keyer();
-    const appRoleKey = new Map();
-    const defaults = [];
-    for (const r of snap.roles) {
-        const id = (0, record_set_1.str)(r.id);
-        const name = (0, record_set_1.str)(r.name);
-        if (!id || !name)
-            continue;
-        const key = appKey(name, id);
-        appRoleKey.set(id, key);
-        if ((0, tables_1.bool)(r.isDefault))
-            defaults.push(name);
-        set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(r.description), scope: 'app', permissions: snap.rolePermissions.get(id) ?? [] }), `app:${key}`);
-    }
-    if (defaults.length) {
-        set.warn(`Logto gives every new user the default role(s) ${defaults.join(', ')}; Atlas does not assign roles at sign-up. Existing users keep them; give new users the role with an action or the Backend API.`);
-    }
-    const orgKey = keyer();
-    const orgRoleKey = new Map();
-    for (const r of snap.organizationRoles) {
-        const id = (0, record_set_1.str)(r.id);
-        const name = (0, record_set_1.str)(r.name);
-        if (!id || !name)
-            continue;
-        const key = orgKey(name, id);
-        orgRoleKey.set(id, key);
-        set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(r.description), scope: 'organization', permissions: snap.organizationRolePermissions.get(id) ?? [] }), `org:${key}`);
-    }
-    // ── organizations ──
-    const orgIds = new Set();
-    for (const org of snap.organizations) {
-        const id = (0, record_set_1.str)(org.id);
-        const name = (0, record_set_1.str)(org.name);
-        if (!id || !name)
-            continue;
-        orgIds.add(id);
-        const branding = (0, record_set_1.isObj)(org.branding) ? org.branding : {};
-        set.add('organization', (0, record_set_1.compact)({
-            id,
-            name,
-            image_url: (0, record_set_1.str)(branding.logoUrl),
-            domains: snap.organizationDomains.get(id) ?? [],
-            public_metadata: (0, record_set_1.bag)({ ...((0, record_set_1.isObj)(org.customData) ? org.customData : {}), ...((0, record_set_1.str)(org.description) ? { description: (0, record_set_1.str)(org.description) } : {}) }),
-            private_metadata: (0, tables_1.bool)(org.isMfaRequired) ? { logto_mfa_required: true } : undefined,
-            created_at: (0, tables_1.time)(org.createdAt),
-        }));
-    }
-    if (snap.organizations.some((org) => (0, tables_1.bool)(org.isMfaRequired))) {
-        set.warn('Some organizations require MFA of their members in Logto (private_metadata.logto_mfa_required): set an organization MFA policy in Atlas.');
-    }
-    // ── enterprise SSO ──
-    const connectorProtocol = new Map();
-    const connectorName = new Map();
-    for (const c of snap.ssoConnectors) {
-        const record = mapSsoConnector(c, o.endpoint);
-        if (!record)
-            continue;
-        connectorProtocol.set(record.id, record.protocol);
-        connectorName.set(record.id, record.name ?? record.id);
-        set.add('sso_connection', record);
-    }
-    if (snap.ssoConnectors.some((c) => SAML_PROVIDERS.has((0, record_set_1.str)(c.providerName) ?? '')) && !o.endpoint) {
-        set.warn('The Logto endpoint was not given, so the SAML connections carry no SP entity id / ACS URL: pass --set logto-endpoint=<url> to record them.');
-    }
-    // ── users ──
-    const userIds = new Set();
-    const algorithms = {};
-    let unsupported = 0;
-    let hashless = 0;
-    for (const u of snap.users) {
-        const id = (0, record_set_1.str)(u.id);
-        const roles = (snap.userRoles.get(id ?? '') ?? []).map((r) => appRoleKey.get(r)).filter((k) => !!k);
-        const { user, passwordUnsupported } = mapLogtoUser(u, roles);
-        if (!user) {
-            set.omit('user', 'no email, phone number or username');
-            continue;
-        }
-        userIds.add(user.id);
-        set.add('user', user);
-        if (user.password)
-            algorithms[user.password.algorithm] = (algorithms[user.password.algorithm] ?? 0) + 1;
-        if (passwordUnsupported)
-            unsupported++;
-        if (!user.password && !passwordUnsupported && u.hasPassword === true)
-            hashless++;
-    }
-    if (unsupported)
-        set.warn(`${unsupported} user(s) have a password hash Logto itself cannot verify (unknown method or malformed Legacy expression): they reset their password, or move by lazy migration.`);
-    if (hashless) {
-        set.warn(`${hashless} user(s) have a password the Management API did not return (the Management API does not return hashes on every Logto version, or the token is read-only): turn on the logto lazy-migration preset, or export from the database.`);
-    }
-    if (snap.source === 'api' && userIds.size) {
-        set.warn('The Management API never returns MFA secrets (TOTP keys, WebAuthn credentials, backup codes): users with MFA enrol again in Atlas, or export from the database to keep them.');
-    }
-    // ── identities ──
-    for (const u of snap.users) {
-        const id = (0, record_set_1.str)(u.id);
-        if (!id || !userIds.has(id))
-            continue;
-        for (const [target, identity] of Object.entries((0, record_set_1.isObj)(u.identities) ? u.identities : {})) {
-            if (!(0, record_set_1.isObj)(identity))
-                continue;
-            const providerUserId = (0, record_set_1.str)(identity.userId);
-            if (!providerUserId)
-                continue;
-            const details = (0, record_set_1.isObj)(identity.details) ? identity.details : {};
-            set.add('identity', (0, record_set_1.compact)({ user_id: id, provider: target, provider_user_id: providerUserId, kind: 'oauth', email: (0, record_set_1.str)(details.email)?.toLowerCase(), profile: (0, record_set_1.bag)(details) }), `${target}:${providerUserId}`);
-        }
-    }
-    for (const s of snap.ssoIdentities) {
-        const userId = (0, record_set_1.str)(s.userId);
-        const connectorId = (0, record_set_1.str)(s.ssoConnectorId);
-        const identityId = (0, record_set_1.str)(s.identityId);
-        if (!userId || !userIds.has(userId) || !connectorId || !identityId)
-            continue;
-        if (!connectorProtocol.has(connectorId)) {
-            set.omit('identity', 'SSO identity of a connector the export does not carry');
-            continue;
-        }
-        const detail = (0, record_set_1.isObj)(s.detail) ? s.detail : {};
-        set.add('identity', (0, record_set_1.compact)({
-            id: (0, record_set_1.str)(s.id),
-            user_id: userId,
-            provider: connectorName.get(connectorId) ?? connectorId,
-            provider_user_id: identityId,
-            kind: connectorProtocol.get(connectorId),
-            sso_connection_id: connectorId,
-            email: (0, record_set_1.str)(detail.email)?.toLowerCase(),
-            profile: (0, record_set_1.bag)({ ...detail, ...((0, record_set_1.str)(s.issuer) ? { issuer: (0, record_set_1.str)(s.issuer) } : {}) }),
-        }), `sso:${connectorId}:${identityId}`);
-    }
-    // ── second factors and passkeys (database dumps) ──
-    if (snap.hasFactors) {
-        for (const u of snap.users) {
-            const userId = (0, record_set_1.str)(u.id);
-            if (!userId || !userIds.has(userId))
-                continue;
-            const factors = Array.isArray(u.mfaVerifications) ? (0, record_set_1.objs)(u.mfaVerifications) : [];
-            for (const f of factors)
-                addFactor(set, userId, f, o.rpId);
-        }
-    }
-    // ── memberships and invitations ──
-    let multiRole = 0;
-    let fallback = false;
-    for (const m of snap.members) {
-        if (!orgIds.has(m.organizationId) || !userIds.has(m.userId))
-            continue;
-        const keys = m.roleIds.map((r) => orgRoleKey.get(r)).filter((k) => !!k);
-        if (keys.length > 1)
-            multiRole++;
-        if (!keys.length)
-            fallback = true;
-        set.add('membership', { organization_id: m.organizationId, user_id: m.userId, role: keys[0] ?? 'member' }, `${m.organizationId}:${m.userId}`);
-    }
-    if (fallback && !set.list('role').some((r) => r.scope === 'organization' && r.key === 'member')) {
-        set.add('role', { key: 'member', name: 'Member', scope: 'organization' }, 'org:member');
-    }
-    if (multiRole) {
-        set.warn(`${multiRole} membership(s) hold several organization roles in Logto; Atlas keeps one role per membership (the first). Merge the permissions into one role where a member needs both.`);
-    }
-    for (const { row, roleIds } of snap.invitations) {
-        const id = (0, record_set_1.str)(row.id);
-        const email = (0, record_set_1.str)(row.invitee)?.toLowerCase();
-        const organizationId = (0, record_set_1.str)(row.organizationId);
-        if (!id || !email || !email.includes('@')) {
-            set.omit('invitation', 'the invitee is not an email address');
-            continue;
-        }
-        if (organizationId && !orgIds.has(organizationId))
-            continue;
-        set.add('invitation', (0, record_set_1.compact)({
-            id,
-            organization_id: organizationId,
-            email,
-            role: roleIds.map((r) => orgRoleKey.get(r)).find((k) => !!k),
-            status: INVITATION_STATUS[(0, record_set_1.str)(row.status) ?? ''],
-            inviter_user_id: (0, record_set_1.str)(row.inviterId),
-            expires_at: (0, tables_1.time)(row.expiresAt),
-            created_at: (0, tables_1.time)(row.createdAt),
-        }));
-    }
-    // ── personal access tokens ──
-    for (const p of snap.personalAccessTokens) {
-        const userId = (0, record_set_1.str)(p.userId);
-        const name = (0, record_set_1.str)(p.name);
-        const value = (0, record_set_1.str)(p.value);
-        if (!userId || !userIds.has(userId) || !name || !value)
-            continue;
-        set.add('api_key', (0, record_set_1.compact)({ id: `${userId}:${name}`, user_id: userId, name, hash: (0, tables_1.sha256Hex)(value), hash_algorithm: 'sha256', start: value.slice(0, 8), expires_at: (0, tables_1.time)(p.expiresAt), created_at: (0, tables_1.time)(p.createdAt) }));
-    }
-    // ── signing keys ──
-    for (const k of snap.jwks) {
-        const kid = (0, record_set_1.str)(k.kid);
-        if (kid)
-            set.add('jwks', { kid, jwk: k });
-    }
-    set.manifest = {
-        origin: o.endpoint ? new URL(o.endpoint).host : `Logto database (tenant ${o.tenantId})`,
-        ...(o.rpId ? { rpId: o.rpId } : {}),
-        providers: [...new Set(set.list('identity').map((i) => i.provider))].sort(),
-        settings: { tenant_id: o.tenantId, read_from: snap.source, password_algorithms: algorithms, totp: TOTP },
-    };
-    return set;
-}
-/** One `mfa_verifications` entry → a factor or a passkey. */
-function addFactor(set, userId, f, rpId) {
-    const type = (0, record_set_1.str)(f.type);
-    const created = (0, tables_1.time)(f.createdAt);
-    if (type === 'Totp') {
-        const secret = (0, record_set_1.str)(f.key)?.replace(/[\s=]/g, '').toUpperCase();
-        if (!secret || !/^[A-Z2-7]+$/.test(secret)) {
-            set.omit('mfa_factor', 'a TOTP key that is not base32');
-            return;
-        }
-        set.add('mfa_factor', (0, record_set_1.compact)({ id: (0, record_set_1.str)(f.id), user_id: userId, type: 'totp', secret_base32: secret, ...TOTP, verified: true, created_at: created }));
-    }
-    else if (type === 'BackupCode') {
-        const codes = (0, record_set_1.objs)(f.codes)
-            .filter((c) => !(0, record_set_1.str)(c.usedAt))
-            .map((c) => (0, record_set_1.str)(c.code))
-            .filter((c) => !!c);
-        if (!codes.length) {
-            set.omit('mfa_factor', 'every backup code already used');
-            return;
-        }
-        set.add('mfa_factor', (0, record_set_1.compact)({ id: (0, record_set_1.str)(f.id), user_id: userId, type: 'backup_codes', backup_codes: codes, verified: true, created_at: created }));
-    }
-    else if (type === 'WebAuthn') {
-        const credentialId = (0, tables_1.base64url)(f.credentialId);
-        const publicKey = (0, tables_1.base64url)(f.publicKey);
-        const rp = (0, record_set_1.str)(f.rpId) ?? rpId;
-        if (!credentialId || !publicKey) {
-            set.omit('passkey', 'a WebAuthn credential without its id or public key');
-            return;
-        }
-        if (!rp) {
-            set.omit('passkey', 'the relying-party id is unknown (pass --set logto-endpoint=<url> or --set rp-id=<host>)');
-            return;
-        }
-        set.add('passkey', (0, record_set_1.compact)({
-            id: (0, record_set_1.str)(f.id),
-            user_id: userId,
-            credential_id: credentialId,
-            public_key: publicKey,
-            sign_count: typeof f.counter === 'number' ? f.counter : undefined,
-            rp_id: rp,
-            transports: (0, record_set_1.strs)(f.transports),
-            name: (0, record_set_1.str)(f.name) ?? (0, record_set_1.str)(f.agent),
-            created_at: created,
-        }));
-    }
-    else {
-        set.omit('mfa_factor', `Logto factor type ${type ?? 'unknown'}`);
-    }
-}
-//# sourceMappingURL=logto.js.map