@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/userfront.js

@@ -1,189 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkTenantId = checkTenantId;
-exports.userfrontHttp = userfrontHttp;
-exports.exportUserfront = exportUserfront;
-exports.mapUserfrontUser = mapUserfrontUser;
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-const API = 'https://api.userfront.com/v0';
-const MAX_PAGES = 100_000;
-/** First-factor strategies that are not a social login. */
-const NON_SOCIAL = new Set(['password', 'link', 'verificationCode', 'totp', 'sso', 'saml', 'passkey', 'webauthn', 'email', 'phone']);
-function checkTenantId(tenantId) {
-    const t = tenantId.trim();
-    if (!/^[A-Za-z0-9]{4,16}$/.test(t))
-        throw new Error(`Not a Userfront tenant id: ${tenantId}`);
-    return t;
-}
-function userfrontHttp(o) {
-    return new vendor_http_1.VendorHttp({
-        vendor: 'Userfront',
-        baseUrl: (o.apiBase ?? API).replace(/\/+$/, ''),
-        headers: { authorization: `Bearer ${o.apiKey}` },
-        fetchImpl: o.fetchImpl,
-        sleep: o.sleep,
-    });
-}
-async function exportUserfront(opts) {
-    const set = new record_set_1.RecordSet();
-    const tid = checkTenantId(opts.tenantId);
-    if (!/^uf_(test|live)_admin_/.test(opts.apiKey))
-        throw new Error('Userfront export needs an admin API key (uf_live_admin_… or uf_test_admin_…).');
-    const progress = opts.onProgress ?? (() => undefined);
-    const http = userfrontHttp(opts);
-    progress('organizations');
-    const orgIds = new Set();
-    await walk(async (page) => (await http.get(`/tenants/${tid}/tenants?page=${page}`)).body, (body) => (0, record_set_1.objs)(body?.results).concat((0, record_set_1.objs)(body?.tenants)), (body) => {
-        const n = body?.totalPages;
-        return typeof n === 'number' ? n : undefined;
-    }, (t) => {
-        const id = (0, record_set_1.str)(t.tenantId);
-        if (!id || id === tid || orgIds.has(id))
-            return false;
-        orgIds.add(id);
-        set.add('organization', (0, record_set_1.compact)({ id, name: (0, record_set_1.str)(t.name) ?? id, image_url: (0, record_set_1.str)(t.image), public_metadata: (0, record_set_1.bag)(t.data), created_at: (0, record_set_1.str)(t.createdAt) }), id);
-        return true;
-    });
-    progress('roles');
-    const roleNames = new Set();
-    const rolesBody = await optional(async () => (await http.get(`/tenants/${tid}/roles`)).body);
-    for (const r of (0, record_set_1.objs)(rolesBody?.roles)) {
-        const name = (0, record_set_1.str)(r.name);
-        if (name)
-            roleNames.add(name);
-    }
-    progress('users');
-    const seen = new Set();
-    let unknownOrgs = 0;
-    let mfa = 0;
-    let passkeys = 0;
-    let social = 0;
-    await walk((page) => findUsers(http, tid, page), (body) => (0, record_set_1.objs)(body?.results), (body) => {
-        const meta = body?.meta;
-        return (0, record_set_1.isObj)(meta) && typeof meta.totalPages === 'number' ? meta.totalPages : undefined;
-    }, (u) => {
-        const rawId = (0, record_set_1.str)(u.userId);
-        if (rawId && seen.has(rawId))
-            return false;
-        if (rawId)
-            seen.add(rawId);
-        const user = mapUserfrontUser(u, tid);
-        if (!user) {
-            set.omit('user', 'no email, phone number or username');
-            return true;
-        }
-        const authz = (0, record_set_1.isObj)(u.authorization) ? u.authorization : {};
-        const mine = authz[tid];
-        const own = (0, record_set_1.isObj)(mine) ? (0, record_set_1.strs)(mine.roles) : [];
-        if (own.length)
-            user.roles = own.map(translate_kit_1.keyOf);
-        for (const n of own)
-            roleNames.add(n);
-        set.add('user', user, user.id);
-        for (const [orgId, raw] of Object.entries(authz)) {
-            if (orgId === tid || !(0, record_set_1.isObj)(raw))
-                continue;
-            if (!orgIds.has(orgId)) {
-                unknownOrgs++;
-                continue;
-            }
-            const roles = (0, record_set_1.strs)(raw.roles).map(translate_kit_1.keyOf);
-            set.add('membership', { organization_id: orgId, user_id: user.id, role: roles[0] ?? 'member' }, `${orgId}:${user.id}`);
-            for (const r of (0, record_set_1.strs)(raw.roles))
-                roleNames.add(r);
-            if (roles.length > 1)
-                set.warn('Some organization members hold several Userfront roles; Atlas seats each member with one role (the first).');
-        }
-        const auth = (0, record_set_1.isObj)(u.authentication) ? u.authentication : {};
-        if (u.isMfaRequired === true || (0, record_set_1.objs)(auth.secondFactors).length > 0)
-            mfa++;
-        for (const f of (0, record_set_1.objs)(auth.firstFactors)) {
-            const strategy = (0, record_set_1.str)(f.strategy);
-            if (strategy && /passkey|webauthn/i.test(strategy))
-                passkeys++;
-            else if (strategy && !NON_SOCIAL.has(strategy))
-                social++;
-        }
-        return true;
-    });
-    if (unknownOrgs > 0) {
-        set.warn(`${unknownOrgs} organization grant(s) name a tenant that is not in the organization listing; those memberships were left out.`);
-    }
-    if (mfa > 0)
-        set.omit('mfa_factor', 'Userfront does not export second-factor secrets; members enrol again in Atlas', mfa);
-    if (passkeys > 0)
-        set.omit('passkey', 'Userfront does not export passkey public keys; register again in Atlas', passkeys);
-    if (social > 0)
-        set.omit('identity', "Userfront does not export social accounts' provider user ids: they relink by verified email on first social sign-in", social);
-    if (set.count('user') > 0) {
-        set.warn('Userfront never returns password hashes: turn on the userfront lazy-migration preset so each password moves on its first Atlas sign-in.');
-    }
-    for (const name of roleNames) {
-        const key = (0, translate_kit_1.keyOf)(name);
-        set.add('role', { key, name, scope: 'app' }, `app:${key}`);
-        if (orgIds.size > 0)
-            set.add('role', { key, name, scope: 'organization' }, `org:${key}`);
-    }
-    set.manifest = { origin: tid, settings: { tenant_id: tid } };
-    return set;
-}
-/**
- * Walk a paged listing whose page numbering Userfront does not document: page
- * 0 is probed, then pages go up from 1 until one is empty, past the reported
- * total, or adds nobody new (a row seen twice is taken once).
- */
-async function walk(get, rowsOf, totalPages, take) {
-    for (let page = 0; page < MAX_PAGES; page++) {
-        const body = await optional(() => get(page));
-        const rows = rowsOf(body);
-        let fresh = 0;
-        for (const r of rows)
-            if (take(r))
-                fresh++;
-        const pages = totalPages(body);
-        if (page > 0 && (rows.length === 0 || (pages !== undefined && page > pages)))
-            break;
-        if (page >= 2 && fresh === 0)
-            break;
-    }
-}
-async function findUsers(http, tenantId, page) {
-    return (await http.post(`/tenants/${tenantId}/users/find`, { filters: {}, page, order: [['createdAt', 'ASC']] })).body;
-}
-/** One Userfront user (users/find result) → a user record. */
-function mapUserfrontUser(u, tenantId) {
-    const id = (0, record_set_1.str)(u.userId);
-    if (!id)
-        return null;
-    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
-    const phone = (0, record_set_1.e164)(u.phoneNumber);
-    const username = (0, record_set_1.str)(u.username);
-    const uuid = (0, record_set_1.str)(u.userUuid);
-    const user = (0, record_set_1.compact)({
-        id,
-        emails: email ? [{ email, verified: u.isEmailConfirmed === true || (u.isEmailConfirmed === undefined && u.isConfirmed === true), primary: true }] : [],
-        phones: phone ? [{ phone, verified: u.isPhoneNumberConfirmed === true, primary: !email }] : [],
-        username,
-        name: (0, record_set_1.str)(u.name),
-        image_url: (0, record_set_1.str)(u.image),
-        locked: u.locked === true ? true : undefined,
-        public_metadata: (0, record_set_1.bag)(u.data),
-        private_metadata: (0, record_set_1.bag)({ ...(uuid ? { userfront_user_uuid: uuid } : {}), userfront_tenant_id: tenantId }),
-        created_at: (0, record_set_1.str)(u.createdAt),
-        last_sign_in_at: (0, record_set_1.str)(u.lastActiveAt),
-    });
-    return user.emails?.length || user.phones?.length || user.username ? user : null;
-}
-async function optional(fn) {
-    try {
-        return await fn();
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404, 405].includes(err.status))
-            return null;
-        throw err;
-    }
-}
-//# sourceMappingURL=userfront.js.map

package/dist/migrate/export/userfront.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"userfront.js","sourceRoot":"","sources":["../../../src/migrate/export/userfront.ts"],"names":[],"mappings":";;AAqCA,sCAIC;AAED,sCAQC;AAED,0CAoGC;AA6BD,4CAqBC;AA1MD,6CAA+F;AAC/F,mDAAwC;AACxC,+CAA2D;AA6B3D,MAAM,GAAG,GAAG,8BAA8B,CAAC;AAC3C,MAAM,SAAS,GAAG,OAAO,CAAC;AAC1B,2DAA2D;AAC3D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAErI,SAAgB,aAAa,CAAC,QAAgB;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,aAAa,CAAC,CAAwG;IACpI,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE;QAChD,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,IAA4B;IAChE,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IAClJ,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEjC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,IAAI,CACR,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,YAAY,GAAG,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAClF,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAA,iBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EACzD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC;QAC3B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3J,OAAO,IAAI,CAAC;IACd,CAAC,CACF,CAAC;IAEF,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EACpC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,EAC7B,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;QACxB,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM;YAAE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAK,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvB,WAAW,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,qBAAK,CAAC,CAAC;YACzC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACvH,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;QAC/I,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,EAAE,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,QAAQ,EAAE,CAAC;iBAC1D,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CACF,CAAC;IACF,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,gHAAgH,CAAC,CAAC;IAC3I,CAAC;IACD,IAAI,GAAG,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,+EAA+E,EAAE,GAAG,CAAC,CAAC;IAC1H,IAAI,QAAQ,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,wEAAwE,EAAE,QAAQ,CAAC,CAAC;IAC1H,IAAI,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,qHAAqH,EAAE,MAAM,CAAC,CAAC;IACpK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,yIAAyI,CAAC,CAAC;IACtJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAc,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,cAAuB,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,IAAI,CACjB,GAA0C,EAC1C,MAAmC,EACnC,UAAoD,EACpD,IAA2B;IAE3B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,IAAI,CAAC,CAAC,CAAC;gBAAE,KAAK,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM;QACpF,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC;YAAE,MAAM;IACtC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,QAAgB,EAAE,IAAY;IACvE,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAM,YAAY,QAAQ,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9H,CAAC;AAED,8DAA8D;AAC9D,SAAgB,gBAAgB,CAAC,CAAM,EAAE,QAAgB;IACvD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACtJ,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,sBAAsB,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAC9F,QAAQ;QACR,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;QACjB,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC5C,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,gBAAgB,EAAE,IAAA,gBAAG,EAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC;QACxG,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,EAAoB;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/migrate/export/vendor-http.d.ts

@@ -1,46 +0,0 @@
-/**
- * The HTTP side of `atlas migrate export <vendor>`: calls the OLD vendor's
- * management API from the owner's machine, with the owner's vendor
- * credentials. Nothing here talks to Atlas, and no vendor credential is ever
- * written into a bundle or sent anywhere but the vendor.
- *
- * Shared by every vendor exporter: JSON requests, a bounded retry on 429 and
- * 5xx that honours `Retry-After` (and the `X-RateLimit-Reset` epoch some
- * vendors send instead), and errors that name the call without echoing a
- * credential.
- */
-export declare class VendorApiError extends Error {
-    readonly vendor: string;
-    readonly status: number;
-    readonly path: string;
-    constructor(vendor: string, status: number, path: string, detail: string);
-}
-export interface VendorHttpOptions {
-    vendor: string;
-    baseUrl: string;
-    /** Headers on every call (the authorization header lives here, never in a URL). */
-    headers?: Record<string, string> | (() => Promise<Record<string, string>> | Record<string, string>);
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    /** Attempts per call on 429/5xx, the first included. */
-    attempts?: number;
-    now?: () => number;
-}
-export interface VendorResponse<T> {
-    status: number;
-    body: T;
-    headers: Headers;
-}
-export declare class VendorHttp {
-    private readonly o;
-    constructor(o: VendorHttpOptions);
-    get vendor(): string;
-    url(path: string): string;
-    get<T>(path: string): Promise<VendorResponse<T>>;
-    post<T>(path: string, body: unknown): Promise<VendorResponse<T>>;
-    request<T>(method: string, path: string, body?: unknown): Promise<VendorResponse<T>>;
-    private waitFor;
-    private now;
-}
-/** The `rel="next"` URL of an RFC 8288 `Link` header (Okta's pagination). */
-export declare function nextLink(header: string | null): string | null;

package/dist/migrate/export/vendor-http.js

@@ -1,138 +0,0 @@
-"use strict";
-/**
- * The HTTP side of `atlas migrate export <vendor>`: calls the OLD vendor's
- * management API from the owner's machine, with the owner's vendor
- * credentials. Nothing here talks to Atlas, and no vendor credential is ever
- * written into a bundle or sent anywhere but the vendor.
- *
- * Shared by every vendor exporter: JSON requests, a bounded retry on 429 and
- * 5xx that honours `Retry-After` (and the `X-RateLimit-Reset` epoch some
- * vendors send instead), and errors that name the call without echoing a
- * credential.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.VendorHttp = exports.VendorApiError = void 0;
-exports.nextLink = nextLink;
-class VendorApiError extends Error {
-    vendor;
-    status;
-    path;
-    constructor(vendor, status, path, detail) {
-        super(`${vendor} API ${status} on ${path}${detail ? `: ${detail}` : ''}`);
-        this.vendor = vendor;
-        this.status = status;
-        this.path = path;
-    }
-}
-exports.VendorApiError = VendorApiError;
-const MAX_WAIT_MS = 60_000;
-class VendorHttp {
-    o;
-    constructor(o) {
-        this.o = o;
-    }
-    get vendor() {
-        return this.o.vendor;
-    }
-    url(path) {
-        return /^https:\/\//.test(path) ? path : `${this.o.baseUrl.replace(/\/+$/, '')}${path.startsWith('/') ? '' : '/'}${path}`;
-    }
-    async get(path) {
-        return this.request('GET', path);
-    }
-    async post(path, body) {
-        return this.request('POST', path, body);
-    }
-    async request(method, path, body) {
-        const fetchImpl = this.o.fetchImpl ?? fetch;
-        const sleep = this.o.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-        const attempts = Math.max(1, this.o.attempts ?? 5);
-        const display = path.split('?')[0].replace(/^https:\/\/[^/]+/, '');
-        for (let attempt = 1;; attempt++) {
-            const extra = typeof this.o.headers === 'function' ? await this.o.headers() : this.o.headers;
-            const headers = { accept: 'application/json', ...extra };
-            if (body !== undefined)
-                headers['content-type'] = 'application/json';
-            let res;
-            try {
-                res = await fetchImpl(this.url(path), {
-                    method,
-                    headers,
-                    body: body === undefined ? undefined : JSON.stringify(body),
-                });
-            }
-            catch (err) {
-                if (attempt < attempts) {
-                    await sleep(backoff(attempt));
-                    continue;
-                }
-                throw new VendorApiError(this.o.vendor, 0, display, err instanceof Error ? err.message : String(err));
-            }
-            if ((res.status === 429 || res.status >= 500) && attempt < attempts) {
-                await sleep(this.waitFor(res, attempt));
-                continue;
-            }
-            const text = await res.text();
-            let parsed = null;
-            if (text) {
-                try {
-                    parsed = JSON.parse(text);
-                }
-                catch {
-                    parsed = text;
-                }
-            }
-            if (res.status < 200 || res.status >= 300) {
-                throw new VendorApiError(this.o.vendor, res.status, display, errorDetail(parsed));
-            }
-            return { status: res.status, body: parsed, headers: res.headers };
-        }
-    }
-    waitFor(res, attempt) {
-        const retryAfter = res.headers.get('retry-after');
-        if (retryAfter) {
-            const secs = Number(retryAfter);
-            if (Number.isFinite(secs))
-                return Math.min(Math.max(secs * 1000, 0), MAX_WAIT_MS);
-            const at = Date.parse(retryAfter);
-            if (Number.isFinite(at))
-                return Math.min(Math.max(at - this.now(), 0), MAX_WAIT_MS);
-        }
-        const reset = Number(res.headers.get('x-ratelimit-reset'));
-        if (Number.isFinite(reset) && reset > 1e9) {
-            return Math.min(Math.max(reset * 1000 - this.now(), 250), MAX_WAIT_MS);
-        }
-        return backoff(attempt);
-    }
-    now() {
-        return (this.o.now ?? Date.now)();
-    }
-}
-exports.VendorHttp = VendorHttp;
-function backoff(attempt) {
-    return Math.min(500 * 2 ** (attempt - 1), MAX_WAIT_MS);
-}
-/** A short, credential-free description of a vendor error body. */
-function errorDetail(body) {
-    if (typeof body === 'string')
-        return body.slice(0, 200);
-    if (!body || typeof body !== 'object')
-        return '';
-    const b = body;
-    const first = Array.isArray(b.errors) ? b.errors[0] : undefined;
-    const pick = [b.message, b.error_description, b.errorSummary, b.errorDescription, first?.long_message, first?.message, b.error, b.errorCode];
-    const found = pick.find((v) => typeof v === 'string' && v);
-    return typeof found === 'string' ? found.slice(0, 200) : '';
-}
-/** The `rel="next"` URL of an RFC 8288 `Link` header (Okta's pagination). */
-function nextLink(header) {
-    if (!header)
-        return null;
-    for (const part of header.split(',')) {
-        const m = /<([^>]+)>\s*;\s*rel="?next"?/.exec(part.trim());
-        if (m)
-            return m[1];
-    }
-    return null;
-}
-//# sourceMappingURL=vendor-http.js.map

package/dist/migrate/export/vendor-http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"vendor-http.js","sourceRoot":"","sources":["../../../src/migrate/export/vendor-http.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAmIH,4BAOC;AAxID,MAAa,cAAe,SAAQ,KAAK;IAE5B;IACA;IACA;IAHX,YACW,MAAc,EACd,MAAc,EACd,IAAY,EACrB,MAAc;QAEd,KAAK,CAAC,GAAG,MAAM,QAAQ,MAAM,OAAO,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QALjE,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;IAIvB,CAAC;CACF;AATD,wCASC;AAoBD,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,MAAa,UAAU;IACQ;IAA7B,YAA6B,CAAoB;QAApB,MAAC,GAAD,CAAC,CAAmB;IAAG,CAAC;IAErD,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;IAC5H,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QACvC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACpE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7F,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;YACjF,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YACrE,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;oBACpC,MAAM;oBACN,OAAO;oBACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC5D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;oBACvB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACxG,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;gBACpE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;gBACxC,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,MAAM,GAAY,IAAI,CAAC;YAC3B,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,IAAI,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC1C,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,GAAa,EAAE,OAAe;QAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAClF,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;CACF;AAhFD,gCAgFC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,mEAAmE;AACnE,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7I,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;IAC3D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAC7E,SAAgB,QAAQ,CAAC,MAAqB;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/migrate/export/workos-config.d.ts

@@ -1,23 +0,0 @@
-import type { TranslationResult } from '../framework/plugin';
-import { type Obj } from './record-set';
-import { type VendorHttp } from './vendor-http';
-/**
- * `atlas migrate workos config` — what WorkOS's API exposes of an environment:
- * roles and permissions (RBAC), the redirect URIs and CORS origins registered
- * for AuthKit, and the SSO connections / Directory Sync directories (which
- * move with the data export). Authentication methods, MFA policy, session and
- * token lifetimes, branding, email templates, JWT templates and signup rules
- * live only in the WorkOS dashboard: the report lists each as manual, with
- * where to find it.
- */
-export interface WorkosConfigSnapshot {
-    clientId?: string;
-    roles: Obj[];
-    permissions: Obj[];
-    redirectUris: Obj[];
-    corsOrigins: Obj[];
-    connections: Obj[];
-    directories: number;
-}
-export declare function fetchWorkosConfig(http: VendorHttp, clientId?: string): Promise<WorkosConfigSnapshot>;
-export declare function translateWorkosConfig(snap: WorkosConfigSnapshot): TranslationResult;

package/dist/migrate/export/workos-config.js

@@ -1,125 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchWorkosConfig = fetchWorkosConfig;
-exports.translateWorkosConfig = translateWorkosConfig;
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-async function listOf(http, path) {
-    const out = [];
-    let after;
-    try {
-        for (;;) {
-            const q = new URLSearchParams({ limit: '100', order: 'asc' });
-            if (after)
-                q.set('after', after);
-            const body = (await http.get(`${path}?${q.toString()}`)).body;
-            out.push(...(0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.data : undefined));
-            const next = (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.list_metadata) ? (0, record_set_1.str)(body.list_metadata.after) : undefined;
-            if (!next || next === after)
-                break;
-            after = next;
-        }
-    }
-    catch (err) {
-        // Absent on this environment (RBAC off, endpoint not offered, no permission).
-        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404, 405].includes(err.status))
-            return out;
-        throw err;
-    }
-    return out;
-}
-async function plainList(http, path) {
-    try {
-        const body = (await http.get(path)).body;
-        return (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.data : undefined);
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404, 405].includes(err.status))
-            return [];
-        throw err;
-    }
-}
-async function fetchWorkosConfig(http, clientId) {
-    return {
-        ...(clientId ? { clientId } : {}),
-        // The roles listing is not paginated.
-        roles: await plainList(http, '/authorization/roles'),
-        permissions: await listOf(http, '/authorization/permissions'),
-        redirectUris: await listOf(http, '/user_management/redirect_uris'),
-        corsOrigins: await listOf(http, '/user_management/cors_origins'),
-        connections: await listOf(http, '/connections'),
-        directories: (await listOf(http, '/directories')).length,
-    };
-}
-function translateWorkosConfig(snap) {
-    const b = new translate_kit_1.ConfigBuilder();
-    for (const p of snap.permissions) {
-        const key = (0, record_set_1.str)(p.slug);
-        if (key)
-            b.push('permissions', { key, name: (0, record_set_1.str)(p.name) ?? key, description: (0, record_set_1.str)(p.description) ?? '' });
-    }
-    if (snap.permissions.length)
-        b.add('mapped', 'authorization', 'permissions', `${snap.permissions.length} permission(s).`, 'permissions');
-    let roles = 0;
-    for (const r of snap.roles) {
-        const slug = (0, record_set_1.str)(r.slug);
-        // Organization-specific roles are exported per organization with the data.
-        if (!slug || (0, record_set_1.str)(r.type) === 'OrganizationRole')
-            continue;
-        roles++;
-        b.roles[slug] = slug;
-        b.push('roles', { key: slug, name: (0, record_set_1.str)(r.name) ?? slug, description: (0, record_set_1.str)(r.description) ?? '', permissions: (0, record_set_1.strs)(r.permissions) });
-    }
-    if (roles)
-        b.add('mapped', 'authorization', 'environment roles', `${roles} role(s); members keep the same role slug as their Atlas role key.`, 'roles');
-    if (snap.roles.length === 0)
-        b.add('manual', 'authorization', 'roles', 'No roles were returned (RBAC may be off for this environment); the default "admin" and "member" roles carry over as Atlas organization roles.');
-    const redirects = new Set();
-    for (const u of snap.redirectUris) {
-        const uri = (0, record_set_1.str)(u.uri);
-        if (uri)
-            redirects.add(uri);
-    }
-    for (const url of redirects) {
-        if (url.includes('*'))
-            b.add('differs', 'redirect URIs', url, 'Atlas redirect URLs are exact (no wildcards).', 'redirect_urls');
-        else
-            b.push('redirect_urls', { url });
-    }
-    const exact = [...redirects].filter((u) => !u.includes('*')).length;
-    if (exact)
-        b.add('mapped', 'redirect URIs', 'redirect_uris', `${exact} redirect URI(s).`, 'redirect_urls');
-    if (redirects.size === 0)
-        b.add('manual', 'redirect URIs', 'redirect_uris', 'WorkOS did not list its redirect URIs by API: add your app\'s post-sign-in URLs to Atlas (redirect_urls).', 'redirect_urls');
-    for (const o of snap.corsOrigins) {
-        const origin = (0, record_set_1.str)(o.origin);
-        if (origin)
-            b.add('manual', 'CORS origins', origin, 'Add this origin to the allowed origins of your Atlas instance (Atlas dashboard → Settings → Allowed origins).');
-    }
-    const sso = snap.connections.length;
-    if (sso)
-        b.add('mapped', 'enterprise', `${sso} SSO connection(s)`, 'Move with the data export as Atlas SSO connections. WorkOS does not return the identity provider details: each customer\'s IdP is set up again against the new Atlas service-provider settings.', 'sso_connections');
-    if (snap.directories)
-        b.add('manual', 'enterprise', `${snap.directories} Directory Sync directory(ies)`, 'Reconnect through Atlas SCIM provisioning; the identity provider re-provisions users and groups.');
-    for (const [setting, where] of [
-        ['authentication methods (password, Magic Auth, social, passkeys)', 'Authentication → Methods'],
-        ['social connections (client ids and secrets)', 'Authentication → Social login (use the same OAuth apps in Atlas so imported accounts relink)'],
-        ['multi-factor authentication policy', 'Authentication → Multi-Factor Auth'],
-        ['session lifetime and access token lifetime', 'Authentication → Sessions'],
-        ['sign-up rules, email verification and domain restrictions', 'Authentication → Sign-up'],
-        ['branding, hosted-page text and email templates', 'Branding and Email'],
-        ['JWT templates and custom claims', 'Authentication → Sessions → JWT template'],
-        ['custom authentication domain', 'Domains'],
-        ['Radar (bot and fraud rules)', 'Radar'],
-        ['webhooks and events', 'Webhooks (create Atlas webhook endpoints)'],
-    ]) {
-        b.add('manual', 'settings not in the API', setting, `WorkOS does not expose this by API; copy it from the WorkOS dashboard (${where}).`);
-    }
-    return b.result(`WorkOS environment${snap.clientId ? ` ${snap.clientId}` : ''}`, {
-        ...(snap.clientId
-            ? { bridge: { preset: 'workos', vars: { client_id: snap.clientId } }, lazy: { preset: 'workos', config: { client_id: snap.clientId } } }
-            : {}),
-    });
-}
-//# sourceMappingURL=workos-config.js.map

package/dist/migrate/export/workos-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workos-config.js","sourceRoot":"","sources":["../../../src/migrate/export/workos-config.ts"],"names":[],"mappings":";;AAwDA,8CAWC;AAED,sDA+DC;AAlID,6CAAgE;AAChE,mDAAgD;AAChD,+CAAgE;AAqBhE,KAAK,UAAU,MAAM,CAAC,IAAgB,EAAE,IAAY;IAClD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,IAAI,KAAK;gBAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,KAAK;gBAAE,MAAM;YACnC,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8EAA8E;QAC9E,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3F,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,IAAY;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,OAAO,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAgB,EAAE,QAAiB;IACzE,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,sCAAsC;QACtC,KAAK,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,sBAAsB,CAAC;QACpD,WAAW,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,4BAA4B,CAAC;QAC7D,YAAY,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,gCAAgC,CAAC;QAClE,WAAW,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,+BAA+B,CAAC;QAChE,WAAW,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC;QAC/C,WAAW,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM;KACzD,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAA0B;IAC9D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,GAAG;YAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAU,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAEzI,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,2EAA2E;QAC3E,IAAI,CAAC,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,kBAAkB;YAAE,SAAS;QAC1D,KAAK,EAAE,CAAC;QACR,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAU,CAAC,CAAC;IAC7I,CAAC;IACD,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,KAAK,oEAAoE,EAAE,OAAO,CAAC,CAAC;IACxJ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,+IAA+I,CAAC,CAAC;IAExN,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,+CAA+C,EAAE,eAAe,CAAC,CAAC;;YAC3H,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,KAAK,mBAAmB,EAAE,eAAe,CAAC,CAAC;IAC3G,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,2GAA2G,EAAE,eAAe,CAAC,CAAC;IAE1M,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,+GAA+G,CAAC,CAAC;IACvK,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;IACpC,IAAI,GAAG;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,GAAG,oBAAoB,EAAE,iMAAiM,EAAE,iBAAiB,CAAC,CAAC;IACzR,IAAI,IAAI,CAAC,WAAW;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,WAAW,gCAAgC,EAAE,kGAAkG,CAAC,CAAC;IAE7M,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,iEAAiE,EAAE,0BAA0B,CAAC;QAC/F,CAAC,6CAA6C,EAAE,8FAA8F,CAAC;QAC/I,CAAC,oCAAoC,EAAE,oCAAoC,CAAC;QAC5E,CAAC,4CAA4C,EAAE,2BAA2B,CAAC;QAC3E,CAAC,2DAA2D,EAAE,0BAA0B,CAAC;QACzF,CAAC,gDAAgD,EAAE,oBAAoB,CAAC;QACxE,CAAC,iCAAiC,EAAE,0CAA0C,CAAC;QAC/E,CAAC,8BAA8B,EAAE,SAAS,CAAC;QAC3C,CAAC,6BAA6B,EAAE,OAAO,CAAC;QACxC,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;KAC5D,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,OAAO,EAAE,0EAA0E,KAAK,IAAI,CAAC,CAAC;IAC3I,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,qBAAqB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;QAC/E,GAAG,CAAC,IAAI,CAAC,QAAQ;YACf,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;YACxI,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/workos.d.ts

@@ -1,46 +0,0 @@
-import type { UserRecord } from '@atlasauth/migrate';
-import { RecordSet, type Obj } from './record-set';
-/**
- * `atlas migrate export workos` — a WorkOS environment (AuthKit + SSO +
- * Directory Sync) onto the canonical bundle models, read with an API key on
- * this machine.
- *
- *   - organizations (verified domains, metadata), environment roles and each
- *     organization's custom roles, memberships with their role slug, pending
- *     and past invitations;
- *   - users (verified email, names, avatar, metadata, last sign-in) with the
- *     OAuth identities WorkOS holds for them (provider user ids, so social
- *     sign-in relinks exactly);
- *   - SSO connections (SAML / OIDC) with the IdP signing certificates WorkOS
- *     returns; the IdP entity id, SSO URL and OIDC client secret are NOT
- *     available through the API, so the customer's IdP is reconfigured against
- *     the new Atlas connection;
- *   - password hashes: WorkOS publishes no export of them (only an import
- *     path). If WorkOS support gives you a hash file, pass it
- *     (--workos-hashes-file); otherwise turn on the `workos` lazy-migration
- *     preset, which checks each password against WorkOS on first sign-in.
- *
- * Not exportable: TOTP secrets and passkeys (users enrol again), API key
- * secrets (reissue as Atlas API keys), sessions (the `workos` bridge preset
- * exchanges the access token). Directory Sync directories are reconnected in
- * Atlas SCIM.
- */
-export interface WorkosExportOptions {
-    apiKey: string;
-    /** For the manifest only (the client id appears in token issuers). */
-    clientId?: string;
-    /** API base (default https://api.workos.com). */
-    baseUrl?: string;
-    /** A password-hash export from WorkOS support (CSV or NDJSON), when the owner has one. */
-    hashesText?: string;
-    /** Also count TOTP / SMS / WebAuthn factors per user (one more request each) so the report says how many re-enrol. */
-    countFactors?: boolean;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-export declare function exportWorkos(opts: WorkosExportOptions): Promise<RecordSet>;
-/** One WorkOS user → a user record (a user always has an email). */
-export declare function mapWorkosUser(u: Obj): UserRecord | null;
-/** `GoogleOAuth` → `google`, `GitHubOAuth` → `github`: the provider name an Atlas provider key is looked up by. */
-export declare function providerKey(provider: string): string;