@atlasauth/cli 0.24.0 → 0.25.0

package/dist/migrate/export/password-detect.js

@@ -1,81 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLAINTEXT_PBKDF2_ITERATIONS = void 0;
-exports.detectPasswordHash = detectPasswordHash;
-exports.isKnownAlgorithm = isKnownAlgorithm;
-const node_crypto_1 = require("node:crypto");
-const migrate_1 = require("@atlasauth/migrate");
-const SHAPES = [
-    { re: /^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/, algorithm: 'bcrypt' },
-    { re: /^\$argon2(id|i|d)\$/, algorithm: 'argon2' },
-    { re: /^\$6\$(rounds=\d{1,9}\$)?[^$]{0,16}\$[./0-9A-Za-z]{86}$/, algorithm: 'sha_crypt' },
-    { re: /^\$5\$(rounds=\d{1,9}\$)?[^$]{0,16}\$[./0-9A-Za-z]{43}$/, algorithm: 'sha_crypt' },
-    { re: /^\$(1|apr1)\$[^$]{0,8}\$[./0-9A-Za-z]{22}$/, algorithm: 'md5_crypt', weak: true },
-    { re: /^pbkdf2_(sha1|sha256|sha512)\$\d+\$[^$]+\$.+$/, algorithm: 'pbkdf2_django' },
-    { re: /^bcrypt_sha256\$\$2[aby]\$/, algorithm: 'bcrypt_sha256_django' },
-    { re: /^\$pbkdf2-(sha1|sha256|sha512)\$\d+\$[^$]*\$.+$/, algorithm: 'pbkdf2_phc' },
-    { re: /^\$scrypt\$ln=\d+,r=\d+,p=\d+\$/, algorithm: 'scrypt_phc' },
-    { re: /^pbkdf2:(sha1|sha256|sha512)(:\d+)?\$[^$]+\$[0-9a-f]+$/, algorithm: 'pbkdf2_werkzeug' },
-    { re: /^scrypt:\d+:\d+:\d+\$[^$]+\$[0-9a-f]+$/, algorithm: 'scrypt_werkzeug' },
-    { re: /^\$[PH]\$[./0-9A-Za-z]{31}$/, algorithm: 'phpass', weak: true },
-    { re: /^\{(SSHA|SHA|SSHA256|SSHA512|SHA256|SHA512)\}[A-Za-z0-9+/=]+$/i, algorithm: 'ldap_ssha', weak: true },
-    { re: /^\{(MD5|SMD5|SHA384|SSHA384)\}[A-Za-z0-9+/=]+$/i, algorithm: 'ldap_digest', weak: true },
-    { re: /^\{PBKDF2(-(SHA1|SHA256|SHA512))?\}\d+\$/i, algorithm: 'ldap_pbkdf2' },
-    { re: /^\{PBKDF2_SHA256\}[A-Za-z0-9+/=]+$/i, algorithm: 'ldap_pbkdf2' },
-];
-/** `{CRYPT}` / `{BCRYPT}` / `{ARGON2}` around one of the crypt-style shapes above. */
-const WRAPPED = /^\{(CRYPT|BCRYPT|ARGON2)\}(\$.+)$/i;
-/** Directory schemes that are not hashes Atlas can check (pass-through or Kerberos). */
-const DELEGATED = /^\{(SASL|K5KEY|KERBEROS|UNIX|NS-MTA-MD5|RADIUS|TOTP)\}/i;
-/**
- * Identify a self-describing hash. `{CLEARTEXT}` (and a plaintext value when
- * `plaintext` is allowed) is hashed here with PBKDF2 before it is written, so
- * no password is ever stored in the clear (Atlas re-hashes it to Argon2id on
- * the first sign-in).
- */
-function detectPasswordHash(raw, options = {}) {
-    const value = raw?.trim();
-    if (!value)
-        return { ok: false, reason: 'no password' };
-    for (const s of SHAPES)
-        if (s.re.test(value))
-            return { ok: true, password: { algorithm: s.algorithm, hash: value }, weak: s.weak === true };
-    const wrapped = WRAPPED.exec(value);
-    if (wrapped) {
-        const inner = wrapped[2];
-        const known = SHAPES.find((s) => s.re.test(inner) && ['bcrypt', 'argon2', 'sha_crypt', 'sha_crypt', 'md5_crypt'].includes(s.algorithm));
-        if (known)
-            return { ok: true, password: { algorithm: 'ldap_crypt', hash: value }, weak: known.weak === true };
-        return { ok: false, reason: `{${wrapped[1].toUpperCase()}} hash in a format Atlas cannot verify` };
-    }
-    if (/^\{CRYPT\}/i.test(value))
-        return { ok: false, reason: 'traditional DES {CRYPT} hash (not verifiable)' };
-    if (DELEGATED.test(value))
-        return { ok: false, reason: `${/^\{[^}]+\}/.exec(value)[0]} is checked by another service (pass-through authentication)` };
-    const clear = /^\{CLEARTEXT\}(.*)$/i.exec(value);
-    if (clear)
-        return hashPlaintext(clear[1]);
-    if (/^\{[A-Z0-9_-]+\}/i.test(value))
-        return { ok: false, reason: `unsupported scheme ${/^\{[^}]+\}/.exec(value)[0]}` };
-    if (options.plaintext)
-        return hashPlaintext(value);
-    return { ok: false, reason: 'unrecognised hash format (name its algorithm)' };
-}
-/** PBKDF2-SHA256 rounds for a plaintext password hashed on export (re-hashed to Argon2id on first sign-in). */
-exports.PLAINTEXT_PBKDF2_ITERATIONS = 10_000;
-function hashPlaintext(password) {
-    if (!password)
-        return { ok: false, reason: 'empty password' };
-    const salt = (0, node_crypto_1.randomBytes)(16);
-    const hash = (0, node_crypto_1.pbkdf2Sync)(password, salt, exports.PLAINTEXT_PBKDF2_ITERATIONS, 32, 'sha256');
-    return {
-        ok: true,
-        password: { algorithm: 'pbkdf2', hash: hash.toString('base64'), salt: salt.toString('base64'), params: { digest: 'sha256', iterations: exports.PLAINTEXT_PBKDF2_ITERATIONS, encoding: 'base64', salt_encoding: 'base64' } },
-        weak: false,
-    };
-}
-/** Whether Atlas's registry has a verifier id (or `auto`). */
-function isKnownAlgorithm(id) {
-    return migrate_1.PASSWORD_HASH_ALGORITHMS.includes(id);
-}
-//# sourceMappingURL=password-detect.js.map

package/dist/migrate/export/password-detect.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"password-detect.js","sourceRoot":"","sources":["../../../src/migrate/export/password-detect.ts"],"names":[],"mappings":";;;AA4CA,gDAkBC;AAiBD,4CAEC;AAjFD,6CAAsD;AACtD,gDAAiF;AAYjF,MAAM,MAAM,GAA6D;IACvE,EAAE,EAAE,EAAE,sCAAsC,EAAE,SAAS,EAAE,QAAQ,EAAE;IACnE,EAAE,EAAE,EAAE,qBAAqB,EAAE,SAAS,EAAE,QAAQ,EAAE;IAClD,EAAE,EAAE,EAAE,yDAAyD,EAAE,SAAS,EAAE,WAAW,EAAE;IACzF,EAAE,EAAE,EAAE,yDAAyD,EAAE,SAAS,EAAE,WAAW,EAAE;IACzF,EAAE,EAAE,EAAE,4CAA4C,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE;IACxF,EAAE,EAAE,EAAE,+CAA+C,EAAE,SAAS,EAAE,eAAe,EAAE;IACnF,EAAE,EAAE,EAAE,4BAA4B,EAAE,SAAS,EAAE,sBAAsB,EAAE;IACvE,EAAE,EAAE,EAAE,iDAAiD,EAAE,SAAS,EAAE,YAAY,EAAE;IAClF,EAAE,EAAE,EAAE,iCAAiC,EAAE,SAAS,EAAE,YAAY,EAAE;IAClE,EAAE,EAAE,EAAE,wDAAwD,EAAE,SAAS,EAAE,iBAAiB,EAAE;IAC9F,EAAE,EAAE,EAAE,wCAAwC,EAAE,SAAS,EAAE,iBAAiB,EAAE;IAC9E,EAAE,EAAE,EAAE,6BAA6B,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;IACtE,EAAE,EAAE,EAAE,gEAAgE,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5G,EAAE,EAAE,EAAE,iDAAiD,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;IAC/F,EAAE,EAAE,EAAE,2CAA2C,EAAE,SAAS,EAAE,aAAa,EAAE;IAC7E,EAAE,EAAE,EAAE,qCAAqC,EAAE,SAAS,EAAE,aAAa,EAAE;CACxE,CAAC;AAEF,sFAAsF;AACtF,MAAM,OAAO,GAAG,oCAAoC,CAAC;AAErD,wFAAwF;AACxF,MAAM,SAAS,GAAG,yDAAyD,CAAC;AAE5E;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,GAAuB,EAAE,UAAmC,EAAE;IAC/F,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;IAC5I,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACxI,IAAI,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAC7G,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,8DAA8D,EAAE,CAAC;IACvJ,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxH,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;AAChF,CAAC;AAED,+GAA+G;AAClG,QAAA,2BAA2B,GAAG,MAAM,CAAC;AAElD,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,EAAE,mCAA2B,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,mCAA2B,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE;QACnN,IAAI,EAAE,KAAK;KACZ,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAQ,kCAA8C,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/migrate/export/pingone.d.ts

@@ -1,36 +0,0 @@
-import type { SsoConnectionRecord } from '@atlasauth/migrate';
-import { RecordSet, type Obj } from './record-set';
-import { VendorHttp } from './vendor-http';
-/**
- * `atlas migrate ping-identity export` — a PingOne environment through its
- * management API with a worker application (client id + secret, on this
- * machine): users (login, email and verification, name, phones, enabled /
- * locked state, population, last sign-on), groups (as roles, with their
- * members), external-IdP identities and the environment's SAML / OIDC identity
- * providers (as SSO connections).
- *
- * PingOne never returns password hashes, TOTP secrets or FIDO2 credentials:
- * passwords move by lazy migration (the `ping_identity` preset checks them with
- * PingOne's password-check call), second factors are enrolled again.
- */
-/** auth.pingone.<tld> / api.pingone.<tld> for a region code. */
-export declare function pingRegion(region: string | undefined): string;
-export interface PingOneExportOptions {
-    environmentId: string;
-    clientId: string;
-    clientSecret: string;
-    region?: string;
-    /** Read each user's group memberships (one call per user; off for very large environments). */
-    groups?: boolean;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-/** A client-credentials access token for the worker application. */
-export declare function pingOneToken(o: Pick<PingOneExportOptions, 'environmentId' | 'clientId' | 'clientSecret' | 'region' | 'fetchImpl'>): Promise<string>;
-export declare function pingOneHttp(o: PingOneExportOptions, token: string): VendorHttp;
-/** Every item of a PingOne collection (`_embedded.<key>`, next page in `_links.next.href`). */
-export declare function pingOneList(http: VendorHttp, path: string, key: string): Promise<Obj[]>;
-/** A PingOne identity provider → an SSO connection (SAML / OIDC); other types are social logins. */
-export declare function ssoConnectionOf(idp: Obj): SsoConnectionRecord | null;
-export declare function exportPingOne(o: PingOneExportOptions): Promise<RecordSet>;

package/dist/migrate/export/pingone.js

@@ -1,218 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.pingRegion = pingRegion;
-exports.pingOneToken = pingOneToken;
-exports.pingOneHttp = pingOneHttp;
-exports.pingOneList = pingOneList;
-exports.ssoConnectionOf = ssoConnectionOf;
-exports.exportPingOne = exportPingOne;
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-/**
- * `atlas migrate ping-identity export` — a PingOne environment through its
- * management API with a worker application (client id + secret, on this
- * machine): users (login, email and verification, name, phones, enabled /
- * locked state, population, last sign-on), groups (as roles, with their
- * members), external-IdP identities and the environment's SAML / OIDC identity
- * providers (as SSO connections).
- *
- * PingOne never returns password hashes, TOTP secrets or FIDO2 credentials:
- * passwords move by lazy migration (the `ping_identity` preset checks them with
- * PingOne's password-check call), second factors are enrolled again.
- */
-/** auth.pingone.<tld> / api.pingone.<tld> for a region code. */
-function pingRegion(region) {
-    const r = (region ?? 'com').toLowerCase().replace(/^\./, '');
-    if (!/^(com|eu|asia|ca|com\.au|sg)$/.test(r))
-        throw new Error(`Unknown PingOne region "${region}" (use com, eu, asia, ca, com.au or sg).`);
-    return r;
-}
-/** A client-credentials access token for the worker application. */
-async function pingOneToken(o) {
-    const f = o.fetchImpl ?? fetch;
-    const res = await f(`https://auth.pingone.${pingRegion(o.region)}/${o.environmentId}/as/token`, {
-        method: 'POST',
-        headers: {
-            'content-type': 'application/x-www-form-urlencoded',
-            authorization: `Basic ${Buffer.from(`${encodeURIComponent(o.clientId)}:${encodeURIComponent(o.clientSecret)}`).toString('base64')}`,
-        },
-        body: 'grant_type=client_credentials',
-    });
-    const body = (await res.json().catch(() => null));
-    const token = (0, record_set_1.str)(body?.access_token);
-    if (res.status !== 200 || !token)
-        throw new Error(`PingOne refused the worker application's credentials (${res.status}${(0, record_set_1.str)(body?.error_description) ? `: ${(0, record_set_1.str)(body?.error_description)}` : ''}).`);
-    return token;
-}
-function pingOneHttp(o, token) {
-    return new vendor_http_1.VendorHttp({
-        vendor: 'PingOne',
-        baseUrl: `https://api.pingone.${pingRegion(o.region)}/v1/environments/${o.environmentId}`,
-        headers: { authorization: `Bearer ${token}` },
-        fetchImpl: o.fetchImpl,
-        sleep: o.sleep,
-    });
-}
-/** Every item of a PingOne collection (`_embedded.<key>`, next page in `_links.next.href`). */
-async function pingOneList(http, path, key) {
-    const out = [];
-    let next = path;
-    while (next) {
-        const res = await http.get(next);
-        const body = (0, record_set_1.isObj)(res.body) ? res.body : {};
-        out.push(...(0, record_set_1.objs)((0, record_set_1.isObj)(body._embedded) ? body._embedded[key] : undefined));
-        const href = (0, record_set_1.isObj)(body._links) && (0, record_set_1.isObj)(body._links.next) ? body._links.next.href : undefined;
-        next = typeof href === 'string' ? href : undefined;
-    }
-    return out;
-}
-async function listOrEmpty(http, path, key) {
-    try {
-        return await pingOneList(http, path, key);
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && [403, 404].includes(err.status))
-            return [];
-        throw err;
-    }
-}
-/** A PingOne identity provider → an SSO connection (SAML / OIDC); other types are social logins. */
-function ssoConnectionOf(idp) {
-    const type = (0, record_set_1.str)(idp.type);
-    const id = (0, record_set_1.str)(idp.id);
-    if (!id)
-        return null;
-    if (type === 'SAML') {
-        const certs = (0, record_set_1.isObj)(idp.idpVerification) ? (0, record_set_1.objs)(idp.idpVerification.certificates) : [];
-        return (0, record_set_1.compact)({
-            id,
-            name: (0, record_set_1.str)(idp.name),
-            protocol: 'saml',
-            enabled: idp.enabled !== false,
-            saml: (0, record_set_1.compact)({
-                idp_entity_id: (0, record_set_1.str)(idp.idpEntityId),
-                idp_sso_url: (0, record_set_1.str)(idp.ssoEndpoint),
-                sp_entity_id: (0, record_set_1.str)(idp.spEntityId),
-                // The signing certificate itself is not in the list answer: fetch the certificate id's key from PingOne or paste the IdP metadata.
-                idp_certificate: (0, record_set_1.str)(certs[0]?.certificate),
-            }),
-        });
-    }
-    if (type === 'OPENID_CONNECT') {
-        return (0, record_set_1.compact)({
-            id,
-            name: (0, record_set_1.str)(idp.name),
-            protocol: 'oidc',
-            enabled: idp.enabled !== false,
-            oidc: (0, record_set_1.compact)({
-                issuer: (0, record_set_1.str)(idp.issuer),
-                discovery_url: (0, record_set_1.str)(idp.discoveryEndpoint),
-                client_id: (0, record_set_1.str)(idp.clientId),
-                scopes: Array.isArray(idp.scopes) ? idp.scopes.map(String) : undefined,
-            }),
-        });
-    }
-    return null;
-}
-async function exportPingOne(o) {
-    const set = new record_set_1.RecordSet();
-    const say = o.onProgress ?? (() => undefined);
-    set.manifest = { origin: `PingOne environment ${o.environmentId}` };
-    const http = pingOneHttp(o, await pingOneToken(o));
-    say('identity providers');
-    const connections = new Set();
-    for (const idp of await listOrEmpty(http, '/identityProviders', 'identityProviders')) {
-        const sso = ssoConnectionOf(idp);
-        if (sso) {
-            set.add('sso_connection', sso, sso.id);
-            connections.add(sso.id);
-        }
-        else if ((0, record_set_1.str)(idp.type))
-            set.warn(`Social identity provider "${(0, record_set_1.str)(idp.name) ?? (0, record_set_1.str)(idp.type)}" (${(0, record_set_1.str)(idp.type)}) is configured in Atlas as an OAuth provider (atlas migrate ping-identity config), not imported as a connection.`);
-    }
-    say('groups');
-    const groups = await listOrEmpty(http, '/groups', 'groups');
-    const roleOf = new Map();
-    for (const g of groups) {
-        const id = (0, record_set_1.str)(g.id);
-        const name = (0, record_set_1.str)(g.name);
-        if (!id || !name)
-            continue;
-        const key = (0, translate_kit_1.keyOf)(name);
-        roleOf.set(id, key);
-        set.add('role', { key, name, scope: 'app', description: (0, record_set_1.str)(g.description) }, key);
-    }
-    say('users');
-    const users = await pingOneList(http, '/users?limit=100', 'users');
-    let i = 0;
-    for (const u of users) {
-        const id = (0, record_set_1.str)(u.id);
-        if (!id)
-            continue;
-        if (++i % 500 === 0)
-            say(`  ${i} of ${users.length} users`);
-        const name = (0, record_set_1.isObj)(u.name) ? u.name : {};
-        const email = (0, record_set_1.str)(u.email)?.toLowerCase();
-        const emails = email ? [{ email, verified: u.emailVerified === true || (0, record_set_1.str)(u.verifyStatus) === 'VERIFIED', primary: true }] : [];
-        const phones = [];
-        for (const raw of [u.mobilePhone, u.primaryPhone]) {
-            const p = (0, record_set_1.e164)(raw);
-            if (p && !phones.some((x) => x.phone === p))
-                phones.push({ phone: p, verified: false, primary: phones.length === 0 });
-        }
-        const account = (0, record_set_1.isObj)(u.account) ? u.account : {};
-        const lifecycle = (0, record_set_1.isObj)(u.lifecycle) ? u.lifecycle : {};
-        const record = (0, record_set_1.compact)({
-            id,
-            emails,
-            phones,
-            username: (0, record_set_1.str)(u.username),
-            first_name: (0, record_set_1.str)(name.given),
-            last_name: (0, record_set_1.str)(name.family),
-            name: (0, record_set_1.str)(name.formatted),
-            created_at: (0, record_set_1.str)(u.createdAt),
-            last_sign_in_at: (0, record_set_1.isObj)(u.lastSignOn) ? (0, record_set_1.str)(u.lastSignOn.at) : undefined,
-            private_metadata: { pingone: (0, record_set_1.compact)({ population: (0, record_set_1.isObj)(u.population) ? (0, record_set_1.str)(u.population.id) : undefined, type: (0, record_set_1.str)(u.type), mfa_enabled: u.mfaEnabled === true ? true : undefined }) },
-        });
-        if (u.enabled === false) {
-            record.banned = true;
-            record.ban_reason = 'Disabled in PingOne';
-        }
-        else if ((0, record_set_1.str)(account.status) === 'LOCKED')
-            record.locked = true;
-        if (['ACCOUNT_DISABLED', 'DISABLED'].includes((0, record_set_1.str)(lifecycle.status) ?? ''))
-            record.banned = true;
-        if (!record.emails?.length && !record.phones?.length && !record.username) {
-            set.omit('user', 'no email, phone or username', 1);
-            continue;
-        }
-        if (o.groups !== false && roleOf.size) {
-            const memberOf = await listOrEmpty(http, `/users/${encodeURIComponent(id)}/memberOfGroups`, 'groups');
-            const roles = memberOf.map((g) => roleOf.get((0, record_set_1.str)(g.id) ?? '')).filter((r) => !!r);
-            if (roles.length)
-                record.roles = roles;
-        }
-        set.add('user', record, id);
-        // A user who signs in through an external IdP keeps that link.
-        const ext = (0, record_set_1.isObj)(u.identityProvider) ? u.identityProvider : undefined;
-        const extType = (0, record_set_1.str)(ext?.type);
-        if (ext && extType && extType !== 'PING_ONE') {
-            const link = (0, record_set_1.compact)({
-                user_id: id,
-                provider: extType.toLowerCase(),
-                provider_user_id: (0, record_set_1.str)(ext.id) ?? id,
-                kind: connections.has((0, record_set_1.str)(ext.id) ?? '') ? 'enterprise' : 'oauth',
-                sso_connection_id: connections.has((0, record_set_1.str)(ext.id) ?? '') ? (0, record_set_1.str)(ext.id) : undefined,
-                email,
-                profile: (0, record_set_1.bag)({ external_id: (0, record_set_1.str)(u.externalId) }),
-            });
-            set.add('identity', link);
-        }
-    }
-    set.omit('password', 'PingOne never exports password hashes', users.length);
-    set.omit('mfa_factor', 'PingOne never exports TOTP secrets or FIDO2 credentials', 0);
-    set.warn('Passwords move by lazy migration (preset ping_identity); users enrol their second factor again.');
-    return set;
-}
-//# sourceMappingURL=pingone.js.map

package/dist/migrate/export/pingone.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pingone.js","sourceRoot":"","sources":["../../../src/migrate/export/pingone.ts"],"names":[],"mappings":";;AAmBA,gCAIC;AAeD,oCAcC;AAED,kCAQC;AAGD,kCAWC;AAYD,0CAmCC;AAED,sCA8FC;AA1ND,6CAAyF;AACzF,mDAAwC;AACxC,+CAA2D;AAE3D;;;;;;;;;;;GAWG;AAEH,gEAAgE;AAChE,SAAgB,UAAU,CAAC,MAA0B;IACnD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,0CAA0C,CAAC,CAAC;IAC3I,OAAO,CAAC,CAAC;AACX,CAAC;AAcD,oEAAoE;AAC7D,KAAK,UAAU,YAAY,CAAC,CAAqG;IACtI,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,wBAAwB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,WAAW,EAAE;QAC9F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;SACpI;QACD,IAAI,EAAE,+BAA+B;KACtC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAe,CAAC;IAChE,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,CAAC,MAAM,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,IAAA,gBAAG,EAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrM,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,WAAW,CAAC,CAAuB,EAAE,KAAa;IAChE,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,uBAAuB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,aAAa,EAAE;QACzF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AACxF,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IAC3E,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,GAAsB,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAY,IAAA,kBAAK,EAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IACpE,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAChF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAgB,eAAe,CAAC,GAAQ;IACtC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,IAAA,oBAAO,EAAsB;YAClC,EAAE;YACF,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,KAAK;YAC9B,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,aAAa,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC;gBACnC,WAAW,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC;gBACjC,YAAY,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,UAAU,CAAC;gBACjC,mIAAmI;gBACnI,eAAe,EAAE,IAAA,gBAAG,EAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;aAC5C,CAAC;SACoB,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,IAAA,oBAAO,EAAsB;YAClC,EAAE;YACF,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,KAAK;YAC9B,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,MAAM,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC;gBACvB,aAAa,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,iBAAiB,CAAC;gBACzC,SAAS,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC;gBAC5B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;aACtF,CAAC;SACoB,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,CAAuB;IACzD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,EAAE,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnD,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,MAAM,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACvC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,6BAA6B,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,mHAAmH,CAAC,CAAC;IACxO,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,IAAI,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,KAAK,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjJ,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAe,IAAA,oBAAO,EAAC;YACjC,EAAE;YACF,MAAM;YACN,MAAM;YACN,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YACzB,UAAU,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,KAAK,CAAC;YAC3B,SAAS,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,SAAS,CAAC;YACzB,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;YAC5B,eAAe,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YACvE,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAA,oBAAO,EAAC,EAAE,UAAU,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE;SAC3K,CAAC,CAAC;QACjB,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,UAAU,GAAG,qBAAqB,CAAC;QAC5C,CAAC;aAAM,IAAI,IAAA,gBAAG,EAAC,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAClE,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAA,gBAAG,EAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,UAAU,kBAAkB,CAAC,EAAE,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YACtG,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/F,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACzC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAE5B,+DAA+D;QAC/D,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,OAAO,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAmB,IAAA,oBAAO,EAAC;gBACnC,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;gBAC/B,gBAAgB,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;gBACnC,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO;gBACjE,iBAAiB,EAAE,WAAW,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/E,KAAK;gBACL,OAAO,EAAE,IAAA,gBAAG,EAAC,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;aAC/B,CAAC,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,uCAAuC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5E,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,yDAAyD,EAAE,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;IAC5G,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/plugin-kit.d.ts

@@ -1,25 +0,0 @@
-import type { MigrationBundleWriter } from '@atlasauth/migrate';
-import type { CredentialSpec, ExportCursor, PluginContext } from '../framework/plugin';
-import type { RecordSet } from './record-set';
-/**
- * Write a vendor export through the sealed-bundle writer: the manifest fields
- * and warnings the exporter learned, what it had to leave out, then every
- * record in canonical order. On `--resume` the vendor is read again and the
- * records an earlier segment already holds are skipped (vendor listings are
- * returned in a stable order).
- */
-export declare function writeRecordSet(set: RecordSet, writer: MigrationBundleWriter, resume: {
-    cursor: ExportCursor | null;
-    checkpoint(cursor: ExportCursor): void;
-}, say: (line: string) => void): Promise<void>;
-/** A credential, or a CliError naming every way to pass it. */
-export declare function need(p: PluginContext, spec: CredentialSpec): string;
-/** A boolean flag (`--factors`). */
-export declare function flag(p: PluginContext, name: string): boolean;
-/** A local file named by a credential spec (flag or env var), as text or bytes; undefined when not given. */
-export declare function localFile(p: PluginContext, spec: CredentialSpec, as: 'text'): string | undefined;
-export declare function localFile(p: PluginContext, spec: CredentialSpec, as: 'bytes'): Buffer | undefined;
-/** A vendor host (`acme.us.auth0.com`) from a host or URL. */
-export declare function hostOf(raw: string): string;
-/** Vendor errors become CLI errors with the vendor's own words (never a stack). */
-export declare function vendorStep<T>(label: string, fn: () => Promise<T>): Promise<T>;

package/dist/migrate/export/plugin-kit.js

@@ -1,82 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.writeRecordSet = writeRecordSet;
-exports.need = need;
-exports.flag = flag;
-exports.localFile = localFile;
-exports.hostOf = hostOf;
-exports.vendorStep = vendorStep;
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const errors_1 = require("../../errors");
-/**
- * What every vendor plugin shares: replaying an exporter's {@link RecordSet}
- * through the framework's bundle writer, and reading the owner's local files
- * and flags.
- */
-/** Records between two export checkpoints. */
-const CHECKPOINT_EVERY = 1000;
-/**
- * Write a vendor export through the sealed-bundle writer: the manifest fields
- * and warnings the exporter learned, what it had to leave out, then every
- * record in canonical order. On `--resume` the vendor is read again and the
- * records an earlier segment already holds are skipped (vendor listings are
- * returned in a stable order).
- */
-async function writeRecordSet(set, writer, resume, say) {
-    const start = typeof resume.cursor === 'number' ? resume.cursor : 0;
-    writer.describe(set.manifest);
-    for (const w of set.warnings)
-        writer.warn(w);
-    if (!start)
-        for (const [model, o] of Object.entries(set.omitted))
-            writer.omit(model, o.reason, o.count);
-    if (start)
-        say(`  resuming after record ${start}`);
-    let i = 0;
-    for (const r of set.ordered()) {
-        i++;
-        if (i <= start)
-            continue;
-        const issues = await writer.add(r.model, r.data);
-        if (issues.length)
-            say(`  left out ${r.model} #${i}: ${issues[0].message}`);
-        if (i % CHECKPOINT_EVERY === 0)
-            resume.checkpoint(i);
-    }
-}
-/** A credential, or a CliError naming every way to pass it. */
-function need(p, spec) {
-    return p.credential({ ...spec, required: true });
-}
-/** A boolean flag (`--factors`). */
-function flag(p, name) {
-    return p.args.values[name] === true;
-}
-function localFile(p, spec, as) {
-    const path = p.credential({ ...spec, required: false });
-    if (!path)
-        return undefined;
-    try {
-        return as === 'text' ? p.ctx.readFile((0, node_path_1.resolve)(path)) : (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(path));
-    }
-    catch (err) {
-        throw new errors_1.CliError(`Could not read ${spec.label} at ${path}: ${err.message}`);
-    }
-}
-/** A vendor host (`acme.us.auth0.com`) from a host or URL. */
-function hostOf(raw) {
-    return raw.trim().replace(/^https?:\/\//, '').replace(/[/?#].*$/, '');
-}
-/** Vendor errors become CLI errors with the vendor's own words (never a stack). */
-async function vendorStep(label, fn) {
-    try {
-        return await fn();
-    }
-    catch (err) {
-        if (err instanceof errors_1.CliError)
-            throw err;
-        throw new errors_1.CliError(`${label}: ${err.message}`);
-    }
-}
-//# sourceMappingURL=plugin-kit.js.map

package/dist/migrate/export/plugin-kit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin-kit.js","sourceRoot":"","sources":["../../../src/migrate/export/plugin-kit.ts"],"names":[],"mappings":";;AAuBA,wCAmBC;AAGD,oBAEC;AAGD,oBAEC;AAKD,8BAQC;AAGD,wBAEC;AAGD,gCAOC;AAhFD,qCAAuC;AACvC,yCAAoC;AAEpC,yCAAwC;AAIxC;;;;GAIG;AAEH,8CAA8C;AAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;;GAMG;AACI,KAAK,UAAU,cAAc,CAClC,GAAc,EACd,MAA6B,EAC7B,MAA+E,EAC/E,GAA2B;IAE3B,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACxG,IAAI,KAAK;QAAE,GAAG,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9B,CAAC,EAAE,CAAC;QACJ,IAAI,CAAC,IAAI,KAAK;YAAE,SAAS;QACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAa,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,gBAAgB,KAAK,CAAC;YAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,SAAgB,IAAI,CAAC,CAAgB,EAAE,IAAoB;IACzD,OAAO,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;AACpD,CAAC;AAED,oCAAoC;AACpC,SAAgB,IAAI,CAAC,CAAgB,EAAE,IAAY;IACjD,OAAQ,CAAC,CAAC,IAAI,CAAC,MAAkC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACnE,CAAC;AAKD,SAAgB,SAAS,CAAC,CAAgB,EAAE,IAAoB,EAAE,EAAoB;IACpF,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,kBAAkB,IAAI,CAAC,KAAK,OAAO,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAgB,MAAM,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,UAAU,CAAI,KAAa,EAAE,EAAoB;IACrE,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAQ;YAAE,MAAM,GAAG,CAAC;QACvC,MAAM,IAAI,iBAAQ,CAAC,GAAG,KAAK,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/migrate/export/pocketbase-config.d.ts

@@ -1,28 +0,0 @@
-import type { TranslationResult } from '../framework/plugin';
-import { type Obj } from './record-set';
-/**
- * `atlas migrate pocketbase config` — a PocketBase app's auth-collection
- * options → Atlas config.
- *
- * Read from `_collections` (the data.db or its dump — the same source the
- * export reads) or from a collections export file (Settings → Export
- * collections, `pb_schema.json`), with file:line for the file. v0.23+
- * options (`passwordAuth`, `oauth2`, `mfa`, `otp`, `authToken`, `authRule`,
- * flattened onto the collection in an export file, under `options` in the
- * database) and ≤0.22 options (`allowEmailAuth`, `minPasswordLength`,
- * `onlyVerified` …) are both understood. Token secrets and OAuth client
- * secrets are never copied.
- */
-export interface PocketBaseConfigSnapshot {
-    /** `_collections` rows, or the collections array of an export file. */
-    collections: Obj[];
-    /** The export file, for file:line in the report. */
-    file?: {
-        path: string;
-        text: string;
-    };
-    /** The public PocketBase URL (bridge and lazy-migration presets). */
-    url?: string;
-}
-export declare function parsePocketBaseSchema(text: string): Obj[];
-export declare function translatePocketBaseConfig(snap: PocketBaseConfigSnapshot): TranslationResult;