@atlasauth/cli 0.24.0 → 0.25.0

package/dist/migrate/export/record-set.js

@@ -1,98 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.bag = exports.strs = exports.objs = exports.str = exports.isObj = exports.RecordSet = void 0;
-exports.e164 = e164;
-exports.compact = compact;
-const migrate_1 = require("@atlasauth/migrate");
-/**
- * What a vendor exporter gathered, grouped by canonical model. A vendor API
- * hands data back in ITS order (users carry their identities, organizations
- * their members); the bundle needs canonical order, so exporters collect here
- * and the writer replays {@link RecordSet.ordered}.
- */
-class RecordSet {
-    rows = new Map();
-    seen = new Map();
-    warnings = [];
-    omitted = {};
-    /** Manifest fields the exporter learned (origin, providers, settings, rpId). */
-    manifest = {};
-    /**
-     * Add a row. With `key`, a second row with the same key is dropped (a member
-     * reached through two listings, a role seen on two organizations).
-     */
-    add(model, data, key) {
-        if (key !== undefined) {
-            const keys = this.seen.get(model) ?? new Set();
-            if (keys.has(key))
-                return;
-            keys.add(key);
-            this.seen.set(model, keys);
-        }
-        const list = this.rows.get(model) ?? [];
-        list.push(data);
-        this.rows.set(model, list);
-    }
-    warn(message) {
-        if (!this.warnings.includes(message))
-            this.warnings.push(message);
-    }
-    omit(model, reason, count = 1) {
-        const o = this.omitted[model] ?? { count: 0, reason };
-        o.count += count;
-        this.omitted[model] = o;
-    }
-    count(model) {
-        return this.rows.get(model)?.length ?? 0;
-    }
-    list(model) {
-        return (this.rows.get(model) ?? []);
-    }
-    /** Every row, in the order the bundle writer requires. */
-    *ordered() {
-        for (const model of migrate_1.CANONICAL_MODEL_ORDER) {
-            for (const data of this.rows.get(model) ?? [])
-                yield { model, data };
-        }
-    }
-    counts() {
-        const out = {};
-        for (const model of migrate_1.CANONICAL_MODEL_ORDER) {
-            const n = this.rows.get(model)?.length ?? 0;
-            if (n)
-                out[model] = n;
-        }
-        return out;
-    }
-}
-exports.RecordSet = RecordSet;
-const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
-exports.isObj = isObj;
-const str = (v) => typeof v === 'string' && v.trim() ? v.trim() : typeof v === 'number' && Number.isFinite(v) ? String(v) : undefined;
-exports.str = str;
-const objs = (v) => (Array.isArray(v) ? v.filter(exports.isObj) : []);
-exports.objs = objs;
-const strs = (v) => Array.isArray(v) ? v.map((x) => (0, exports.str)(x)).filter((x) => x !== undefined) : [];
-exports.strs = strs;
-/** A metadata bag, only when it has keys. */
-const bag = (v) => ((0, exports.isObj)(v) && Object.keys(v).length > 0 ? v : undefined);
-exports.bag = bag;
-/** E.164 or nothing: vendors store numbers with spaces/dashes; anything else is dropped. */
-function e164(raw) {
-    const s = (0, exports.str)(raw);
-    if (!s)
-        return undefined;
-    const digits = s.replace(/[\s().-]/g, '');
-    const withPlus = digits.startsWith('+') ? digits : digits.startsWith('00') ? `+${digits.slice(2)}` : `+${digits}`;
-    return /^\+[1-9]\d{6,14}$/.test(withPlus) ? withPlus : undefined;
-}
-/** Drop undefined fields so a record carries only what the vendor had. */
-function compact(o) {
-    for (const k of Object.keys(o)) {
-        const v = o[k];
-        if (v === undefined || (Array.isArray(v) && v.length === 0))
-            delete o[k];
-    }
-    return o;
-}
-//# sourceMappingURL=record-set.js.map

package/dist/migrate/export/record-set.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"record-set.js","sourceRoot":"","sources":["../../../src/migrate/export/record-set.ts"],"names":[],"mappings":";;;AAoFA,oBAMC;AAED,0BAMC;AAlGD,gDAK4B;AAE5B;;;;;GAKG;AACH,MAAa,SAAS;IACH,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC5C,IAAI,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,QAAQ,GAAa,EAAE,CAAC;IACxB,OAAO,GAAsD,EAAE,CAAC;IACzE,gFAAgF;IAChF,QAAQ,GAAqG,EAAE,CAAC;IAEhH;;;OAGG;IACH,GAAG,CAA2B,KAAQ,EAAE,IAA4B,EAAE,GAAY;QAChF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,KAAa,EAAE,MAAc,EAAE,KAAK,GAAG,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACtD,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAqB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,CAA2B,KAAQ;QACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAkC,CAAC;IACvE,CAAC;IAED,0DAA0D;IAC1D,CAAC,OAAO;QACN,KAAK,MAAM,KAAK,IAAI,+BAAqB,EAAE,CAAC;YAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAED,MAAM;QACJ,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,+BAAqB,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAzDD,8BAyDC;AAKM,MAAM,KAAK,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAA3F,QAAA,KAAK,SAAsF;AACjG,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CACpD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AADxG,QAAA,GAAG,OACqG;AAC9G,MAAM,IAAI,GAAG,CAAC,CAAU,EAAS,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAAxE,QAAA,IAAI,QAAoE;AAC9E,MAAM,IAAI,GAAG,CAAC,CAAU,EAAY,EAAE,CAC3C,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,WAAG,EAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAD9E,QAAA,IAAI,QAC0E;AAC3F,6CAA6C;AACtC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAmB,EAAE,CAAC,CAAC,IAAA,aAAK,EAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAA/F,QAAA,GAAG,OAA4F;AAC5G,4FAA4F;AAC5F,SAAgB,IAAI,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;IAClH,OAAO,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AACD,0EAA0E;AAC1E,SAAgB,OAAO,CAAmB,CAAI;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAmB,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/migrate/export/source-lines.d.ts

@@ -1,17 +0,0 @@
-import type { ReportStatus } from '../framework/plugin';
-import type { ConfigBuilder } from './translate-kit';
-/**
- * Report lines that point at a config FILE the owner keeps (appwrite.json,
- * nhost.toml, pb_schema.json): the 1-based line a setting sits on, so the
- * report reads `nhost/nhost.toml:42` instead of a bare setting path.
- */
-/**
- * The line of a JSON key path (`["settings", "auth", "security", "duration"]`)
- * in a JSON text, found by walking the quoted keys in order. Undefined when a
- * key is missing (the report then names only the setting path).
- */
-export declare function jsonKeyLine(text: string, path: string[]): number | undefined;
-/** The 1-based line of a character offset. */
-export declare function lineAt(text: string, offset: number): number;
-/** Add a report line with a file location (when the line is known). */
-export declare function addAt(b: ConfigBuilder, file: string | undefined, line: number | undefined, status: ReportStatus, area: string, setting: string, note: string, atlas?: string): void;

package/dist/migrate/export/source-lines.js

@@ -1,43 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.jsonKeyLine = jsonKeyLine;
-exports.lineAt = lineAt;
-exports.addAt = addAt;
-/**
- * Report lines that point at a config FILE the owner keeps (appwrite.json,
- * nhost.toml, pb_schema.json): the 1-based line a setting sits on, so the
- * report reads `nhost/nhost.toml:42` instead of a bare setting path.
- */
-/**
- * The line of a JSON key path (`["settings", "auth", "security", "duration"]`)
- * in a JSON text, found by walking the quoted keys in order. Undefined when a
- * key is missing (the report then names only the setting path).
- */
-function jsonKeyLine(text, path) {
-    let at = 0;
-    for (const key of path) {
-        const i = text.indexOf(`"${key}"`, at);
-        if (i < 0)
-            return undefined;
-        at = i + key.length + 2;
-    }
-    return lineAt(text, at);
-}
-/** The 1-based line of a character offset. */
-function lineAt(text, offset) {
-    let line = 1;
-    for (let i = 0; i < offset && i < text.length; i++)
-        if (text.charCodeAt(i) === 10)
-            line++;
-    return line;
-}
-/** Add a report line with a file location (when the line is known). */
-function addAt(b, file, line, status, area, setting, note, atlas) {
-    b.add(status, area, setting, note, atlas);
-    if (file && line) {
-        const entry = b.report[b.report.length - 1];
-        entry.file = file;
-        entry.line = line;
-    }
-}
-//# sourceMappingURL=source-lines.js.map

package/dist/migrate/export/source-lines.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"source-lines.js","sourceRoot":"","sources":["../../../src/migrate/export/source-lines.ts"],"names":[],"mappings":";;AAcA,kCAQC;AAGD,wBAIC;AAGD,sBAOC;AApCD;;;;GAIG;AAEH;;;;GAIG;AACH,SAAgB,WAAW,CAAC,IAAY,EAAE,IAAc;IACtD,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5B,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,8CAA8C;AAC9C,SAAgB,MAAM,CAAC,IAAY,EAAE,MAAc;IACjD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,CAAC;IAC1F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,SAAgB,KAAK,CAAC,CAAgB,EAAE,IAAwB,EAAE,IAAwB,EAAE,MAAoB,EAAE,IAAY,EAAE,OAAe,EAAE,IAAY,EAAE,KAAc;IAC3K,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/migrate/export/sso-metadata.d.ts

@@ -1,47 +0,0 @@
-import type { SsoConnectionRecord } from '@atlasauth/migrate';
-import { RecordSet, type Obj } from './record-set';
-export interface SamlIdp {
-    entityId: string;
-    ssoUrl?: string;
-    ssoBinding?: string;
-    certificates: string[];
-    nameIdFormat?: string;
-    wantAuthnRequestsSigned?: boolean;
-}
-/** Every identity provider in a metadata document. Throws on a document with none. */
-export declare function parseSamlMetadata(xml: string): SamlIdp[];
-export interface SsoConnectionOptions {
-    name?: string;
-    domains?: string[];
-    organizationId?: string;
-    metadataUrl?: string;
-    id?: string;
-}
-export declare function samlConnections(xml: string, o?: SsoConnectionOptions): {
-    connections: SsoConnectionRecord[];
-    warnings: string[];
-};
-export interface OidcDiscovery {
-    issuer: string;
-    authorization_endpoint?: string;
-    token_endpoint?: string;
-    userinfo_endpoint?: string;
-    jwks_uri?: string;
-    scopes_supported: string[];
-    grant_types_supported: string[];
-    id_token_signing_alg_values_supported: string[];
-}
-/** The discovery URL for an issuer or a discovery URL. */
-export declare function discoveryUrl(input: string): string;
-export declare function parseDiscovery(doc: unknown, requested: string): OidcDiscovery;
-export declare function fetchDiscovery(fetchImpl: typeof fetch, input: string): Promise<OidcDiscovery>;
-export declare function oidcConnection(d: OidcDiscovery, o?: SsoConnectionOptions & {
-    clientId?: string;
-    clientSecret?: string;
-}): SsoConnectionRecord;
-/** The records an SSO-only route writes: the connection, and an organization when it belongs to one. */
-export declare function connectionSet(connections: SsoConnectionRecord[], origin: string, organization?: {
-    id: string;
-    name: string;
-}): RecordSet;
-export type { Obj };

package/dist/migrate/export/sso-metadata.js

@@ -1,180 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseSamlMetadata = parseSamlMetadata;
-exports.samlConnections = samlConnections;
-exports.discoveryUrl = discoveryUrl;
-exports.parseDiscovery = parseDiscovery;
-exports.fetchDiscovery = fetchDiscovery;
-exports.oidcConnection = oidcConnection;
-exports.connectionSet = connectionSet;
-const record_set_1 = require("./record-set");
-/**
- * The SSO connections any identity provider hands over as standard documents:
- * SAML 2.0 IdP metadata (an EntityDescriptor, or an EntitiesDescriptor
- * federation) and an OpenID Connect discovery document. Used by the `saml` and
- * `oidc` routes, and by every vendor whose enterprise connections are
- * described by one of the two.
- */
-// ── SAML metadata ───────────────────────────────────────────────────────────
-const attr = (tag, name) => {
-    const m = new RegExp(`\\b${name}\\s*=\\s*("([^"]*)"|'([^']*)')`).exec(tag);
-    const v = m ? (m[2] ?? m[3]) : undefined;
-    return v === undefined ? undefined : decodeXml(v);
-};
-function decodeXml(s) {
-    return s.replace(/&(lt|gt|amp|quot|apos|#x[0-9a-f]+|#\d+);/gi, (_, e) => {
-        const l = e.toLowerCase();
-        if (l === 'lt')
-            return '<';
-        if (l === 'gt')
-            return '>';
-        if (l === 'amp')
-            return '&';
-        if (l === 'quot')
-            return '"';
-        if (l === 'apos')
-            return "'";
-        return String.fromCodePoint(l.startsWith('#x') ? parseInt(l.slice(2), 16) : parseInt(l.slice(1), 10));
-    });
-}
-/** Elements by local name, ignoring any namespace prefix (`md:`, `ds:`, none). */
-function elements(xml, local) {
-    const out = [];
-    const re = new RegExp(`<(?:[A-Za-z0-9_-]+:)?${local}\\b([^>]*?)(/>|>([\\s\\S]*?)</(?:[A-Za-z0-9_-]+:)?${local}\\s*>)`, 'g');
-    for (let m = re.exec(xml); m; m = re.exec(xml))
-        out.push({ tag: m[1], body: m[3] ?? '' });
-    return out;
-}
-/** Every identity provider in a metadata document. Throws on a document with none. */
-function parseSamlMetadata(xml) {
-    if (/<!DOCTYPE|<!ENTITY/i.test(xml))
-        throw new Error('The metadata contains a DOCTYPE / ENTITY declaration, which is refused.');
-    const idps = [];
-    const scoped = elements(xml, 'EntityDescriptor');
-    // An EntityDescriptor nested in an EntitiesDescriptor is matched by the regex too; a lone one matches once.
-    for (const ed of scoped) {
-        const idp = elements(ed.body, 'IDPSSODescriptor')[0];
-        const entityId = attr(`${ed.tag}`, 'entityID');
-        if (!idp || !entityId)
-            continue;
-        const services = elements(idp.body, 'SingleSignOnService').map((s) => ({ binding: attr(s.tag, 'Binding') ?? '', location: attr(s.tag, 'Location') }));
-        const pick = services.find((s) => s.binding.endsWith('HTTP-Redirect') && s.location) ?? services.find((s) => s.binding.endsWith('HTTP-POST') && s.location) ?? services.find((s) => s.location);
-        const certs = [];
-        for (const k of elements(idp.body, 'KeyDescriptor')) {
-            if (attr(k.tag, 'use') === 'encryption')
-                continue;
-            for (const c of elements(k.body, 'X509Certificate')) {
-                const b64 = c.body.replace(/\s+/g, '');
-                if (/^[A-Za-z0-9+/=]+$/.test(b64) && !certs.includes(b64))
-                    certs.push(b64);
-            }
-        }
-        idps.push((0, record_set_1.compact)({
-            entityId,
-            ssoUrl: pick?.location,
-            ssoBinding: pick?.binding,
-            certificates: certs,
-            nameIdFormat: elements(idp.body, 'NameIDFormat')[0]?.body.trim() || undefined,
-            wantAuthnRequestsSigned: attr(idp.tag, 'WantAuthnRequestsSigned') === 'true' ? true : undefined,
-        }));
-    }
-    if (!idps.length)
-        throw new Error('No identity provider (IDPSSODescriptor) found in the SAML metadata.');
-    return idps;
-}
-const pem = (b64) => `-----BEGIN CERTIFICATE-----\n${b64.match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----\n`;
-function samlConnections(xml, o = {}) {
-    const idps = parseSamlMetadata(xml);
-    const warnings = [];
-    const connections = idps.map((idp, i) => {
-        // compact() drops an empty certificate list.
-        const certificates = idp.certificates ?? [];
-        if (!idp.ssoUrl)
-            warnings.push(`${idp.entityId}: no SingleSignOnService in the metadata.`);
-        if (!certificates.length)
-            warnings.push(`${idp.entityId}: no signing certificate in the metadata; Atlas cannot verify its assertions.`);
-        if (certificates.length > 1)
-            warnings.push(`${idp.entityId}: ${certificates.length} signing certificates; the first is imported, add the others in the dashboard when the IdP rolls its key.`);
-        return (0, record_set_1.compact)({
-            id: o.id ?? (idps.length > 1 ? `${slug(idp.entityId)}-${i + 1}` : slug(idp.entityId)),
-            name: o.name ?? hostName(idp.entityId),
-            organization_id: o.organizationId,
-            protocol: 'saml',
-            domains: o.domains,
-            enabled: true,
-            saml: (0, record_set_1.compact)({
-                idp_entity_id: idp.entityId,
-                idp_sso_url: idp.ssoUrl,
-                idp_certificate: certificates[0] ? pem(certificates[0]) : undefined,
-                idp_metadata_url: o.metadataUrl,
-                idp_metadata_xml: idps.length === 1 ? xml : undefined,
-            }),
-        });
-    });
-    return { connections, warnings };
-}
-const slug = (s) => s.replace(/^https?:\/\//, '').replace(/[^A-Za-z0-9]+/g, '-').replace(/^-+|-+$/g, '').toLowerCase().slice(0, 64) || 'saml';
-const hostName = (entityId) => {
-    try {
-        return new URL(entityId).host;
-    }
-    catch {
-        return entityId.slice(0, 64);
-    }
-};
-/** The discovery URL for an issuer or a discovery URL. */
-function discoveryUrl(input) {
-    const u = input.trim().replace(/\/+$/, '');
-    if (!/^https:\/\//i.test(u))
-        throw new Error('The OpenID Connect issuer must be an https:// URL.');
-    return u.endsWith('/.well-known/openid-configuration') ? u : `${u}/.well-known/openid-configuration`;
-}
-function parseDiscovery(doc, requested) {
-    if (!(0, record_set_1.isObj)(doc) || !(0, record_set_1.str)(doc.issuer))
-        throw new Error('The discovery document has no issuer.');
-    const issuer = (0, record_set_1.str)(doc.issuer);
-    const want = requested.replace(/\/\.well-known\/openid-configuration$/, '').replace(/\/+$/, '');
-    // RFC 8414 §3.3: the issuer in the document must equal the one it was fetched for.
-    if (issuer.replace(/\/+$/, '') !== want)
-        throw new Error(`The discovery document names issuer ${issuer}, not ${want}.`);
-    return {
-        issuer,
-        authorization_endpoint: (0, record_set_1.str)(doc.authorization_endpoint),
-        token_endpoint: (0, record_set_1.str)(doc.token_endpoint),
-        userinfo_endpoint: (0, record_set_1.str)(doc.userinfo_endpoint),
-        jwks_uri: (0, record_set_1.str)(doc.jwks_uri),
-        scopes_supported: (0, record_set_1.strs)(doc.scopes_supported),
-        grant_types_supported: (0, record_set_1.strs)(doc.grant_types_supported),
-        id_token_signing_alg_values_supported: (0, record_set_1.strs)(doc.id_token_signing_alg_values_supported),
-    };
-}
-async function fetchDiscovery(fetchImpl, input) {
-    const url = discoveryUrl(input);
-    const res = await fetchImpl(url, { headers: { accept: 'application/json' }, redirect: 'error' });
-    if (res.status !== 200)
-        throw new Error(`${url} answered ${res.status}.`);
-    return parseDiscovery(await res.json().catch(() => null), input.trim().replace(/\/\.well-known\/openid-configuration$/, ''));
-}
-function oidcConnection(d, o = {}) {
-    const scopes = ['openid', 'email', 'profile'].filter((s) => d.scopes_supported.length === 0 || d.scopes_supported.includes(s));
-    return (0, record_set_1.compact)({
-        id: o.id ?? slug(d.issuer),
-        name: o.name ?? hostName(d.issuer),
-        organization_id: o.organizationId,
-        protocol: 'oidc',
-        domains: o.domains,
-        enabled: true,
-        oidc: (0, record_set_1.compact)({ issuer: d.issuer, discovery_url: discoveryUrl(d.issuer), client_id: o.clientId, client_secret: o.clientSecret, scopes }),
-    });
-}
-/** The records an SSO-only route writes: the connection, and an organization when it belongs to one. */
-function connectionSet(connections, origin, organization) {
-    const set = new record_set_1.RecordSet();
-    set.manifest = { origin };
-    if (organization)
-        set.add('organization', { id: organization.id, name: organization.name, slug: slug(organization.name) }, organization.id);
-    for (const c of connections)
-        set.add('sso_connection', organization ? { ...c, organization_id: organization.id } : c, c.id);
-    return set;
-}
-//# sourceMappingURL=sso-metadata.js.map

package/dist/migrate/export/sso-metadata.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso-metadata.js","sourceRoot":"","sources":["../../../src/migrate/export/sso-metadata.ts"],"names":[],"mappings":";;AAiDA,8CA8BC;AAYD,0CA0BC;AAyBD,oCAIC;AAED,wCAgBC;AAED,wCAKC;AAED,wCAWC;AAGD,sCAMC;AAhMD,6CAA8E;AAE9E;;;;;;GAMG;AAEH,+EAA+E;AAE/E,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,IAAY,EAAsB,EAAE;IAC7D,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,gCAAgC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,4CAA4C,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE;QAC9E,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QAC3B,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC;QAC5B,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,GAAG,CAAC;QAC7B,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,GAAG,CAAC;QAC7B,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,GAAW,EAAE,KAAa;IAC1C,MAAM,GAAG,GAAyC,EAAE,CAAC;IACrD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,wBAAwB,KAAK,qDAAqD,KAAK,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5H,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,sFAAsF;AACtF,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAChI,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACjD,4GAA4G;IAC5G,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ;YAAE,SAAS;QAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACtJ,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChM,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,YAAY;gBAAE,SAAS;YAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBACpD,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACvC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAA,oBAAO,EAAC;YAChB,QAAQ;YACR,MAAM,EAAE,IAAI,EAAE,QAAQ;YACtB,UAAU,EAAE,IAAI,EAAE,OAAO;YACzB,YAAY,EAAE,KAAK;YACnB,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,SAAS;YAC7E,uBAAuB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SACrF,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,gCAAgC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;AAU9H,SAAgB,eAAe,CAAC,GAAW,EAAE,IAA0B,EAAE;IACvE,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAuB,EAAE;QAC3D,6CAA6C;QAC7C,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,2CAA2C,CAAC,CAAC;QAC3F,IAAI,CAAC,YAAY,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,+EAA+E,CAAC,CAAC;QACxI,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,MAAM,2GAA2G,CAAC,CAAC;QAC/L,OAAO,IAAA,oBAAO,EAAC;YACb,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrF,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,eAAe,EAAE,CAAC,CAAC,cAAc;YACjC,QAAQ,EAAE,MAAe;YACzB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,aAAa,EAAE,GAAG,CAAC,QAAQ;gBAC3B,WAAW,EAAE,GAAG,CAAC,MAAM;gBACvB,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnE,gBAAgB,EAAE,CAAC,CAAC,WAAW;gBAC/B,gBAAgB,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;aACtD,CAAC;SACoB,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;AACtJ,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC;AAeF,0DAA0D;AAC1D,SAAgB,YAAY,CAAC,KAAa;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mCAAmC,CAAC;AACvG,CAAC;AAED,SAAgB,cAAc,CAAC,GAAY,EAAE,SAAiB;IAC5D,IAAI,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,mFAAmF;IACnF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,SAAS,IAAI,GAAG,CAAC,CAAC;IACxH,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,sBAAsB,CAAC;QACvD,cAAc,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,cAAc,CAAC;QACvC,iBAAiB,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,iBAAiB,CAAC;QAC7C,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC;QAC3B,gBAAgB,EAAE,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC;QAC5C,qBAAqB,EAAE,IAAA,iBAAI,EAAC,GAAG,CAAC,qBAAqB,CAAC;QACtD,qCAAqC,EAAE,IAAA,iBAAI,EAAC,GAAG,CAAC,qCAAqC,CAAC;KACvF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,SAAuB,EAAE,KAAa;IACzE,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACjG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/H,CAAC;AAED,SAAgB,cAAc,CAAC,CAAgB,EAAE,IAAyE,EAAE;IAC1H,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/H,OAAO,IAAA,oBAAO,EAAC;QACb,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,eAAe,EAAE,CAAC,CAAC,cAAc;QACjC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;KAClH,CAAC,CAAC;AAC5B,CAAC;AAED,wGAAwG;AACxG,SAAgB,aAAa,CAAC,WAAkC,EAAE,MAAc,EAAE,YAA2C;IAC3H,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,CAAC;IAC1B,IAAI,YAAY;QAAE,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;IAC5I,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5H,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/stytch-config.d.ts

@@ -1,22 +0,0 @@
-import type { TranslationResult } from '../framework/plugin';
-import { type Obj } from './record-set';
-import { type StytchProduct } from './stytch';
-import { type VendorHttp } from './vendor-http';
-/**
- * `atlas migrate stytch config` — what Stytch's project API exposes: the RBAC
- * policy (roles, resources and their actions) and, for B2B, the organizations
- * with their SSO connections. Password strength, session duration, OAuth
- * providers, MFA and branding are dashboard-only settings: the report lists
- * each as manual, with where to find it. The bridge and lazy-migration presets
- * are carried to the next step.
- */
-export interface StytchConfigSnapshot {
-    projectId: string;
-    product: StytchProduct;
-    roles: Obj[];
-    resources: Obj[];
-    organizations: number;
-    ssoConnections: number;
-}
-export declare function fetchStytchConfig(http: VendorHttp, projectId: string, product: StytchProduct): Promise<StytchConfigSnapshot>;
-export declare function translateStytchConfig(snap: StytchConfigSnapshot): TranslationResult;

package/dist/migrate/export/stytch-config.js

@@ -1,102 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchStytchConfig = fetchStytchConfig;
-exports.translateStytchConfig = translateStytchConfig;
-const record_set_1 = require("./record-set");
-const stytch_1 = require("./stytch");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-async function optionalGet(http, path) {
-    try {
-        const body = (await http.get(path)).body;
-        return (0, record_set_1.isObj)(body) ? body : null;
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
-            return null;
-        throw err;
-    }
-}
-async function fetchStytchConfig(http, projectId, product) {
-    // The consumer policy endpoint is UNCONFIRMED; a project without it just reports no roles.
-    const res = await optionalGet(http, product === 'b2b' ? '/v1/b2b/rbac/policy' : '/v1/rbac/policy');
-    const policy = res && (0, record_set_1.isObj)(res.policy) ? res.policy : {};
-    let organizations = 0;
-    let ssoConnections = 0;
-    if (product === 'b2b') {
-        try {
-            const { body } = await http.post('/v1/b2b/organizations/search', { limit: 1000 });
-            const orgs = (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.organizations : undefined);
-            organizations = orgs.length;
-            for (const o of orgs) {
-                const id = (0, record_set_1.str)(o.organization_id);
-                const sso = id ? await optionalGet(http, `/v1/b2b/sso/${encodeURIComponent(id)}`) : null;
-                if (sso)
-                    ssoConnections += (0, record_set_1.objs)(sso.saml_connections).length + (0, record_set_1.objs)(sso.oidc_connections).length;
-            }
-        }
-        catch (err) {
-            if (!(err instanceof vendor_http_1.VendorApiError))
-                throw err;
-        }
-    }
-    return { projectId, product, roles: (0, record_set_1.objs)(policy.roles), resources: (0, record_set_1.objs)(policy.resources), organizations, ssoConnections };
-}
-function translateStytchConfig(snap) {
-    const b = new translate_kit_1.ConfigBuilder();
-    const permissions = new Set();
-    for (const r of snap.resources) {
-        const resource = (0, record_set_1.str)(r.resource_id);
-        if (resource)
-            for (const a of (0, record_set_1.strs)(r.actions))
-                permissions.add(`${resource}:${a}`);
-    }
-    let roles = 0;
-    for (const r of snap.roles) {
-        const id = (0, record_set_1.str)(r.role_id);
-        if (!id)
-            continue;
-        const key = (0, stytch_1.stytchRoleKey)(id);
-        const perms = (0, record_set_1.objs)(r.permissions).flatMap((p) => (0, record_set_1.strs)(p.actions).map((a) => `${(0, record_set_1.str)(p.resource_id) ?? '*'}:${a}`));
-        for (const p of perms)
-            if (!p.startsWith('*:'))
-                permissions.add(p);
-        // Built-in roles already exist in Atlas as admin and member.
-        if (key !== id)
-            continue;
-        roles++;
-        b.roles[id] = key;
-        b.push('roles', { key, name: key, description: (0, record_set_1.str)(r.description) ?? '', permissions: perms });
-    }
-    for (const key of permissions)
-        b.push('permissions', { key, name: key, description: '' });
-    if (permissions.size)
-        b.add('mapped', 'authorization', 'RBAC resources and actions', `${permissions.size} permission(s), keyed resource:action.`, 'permissions');
-    if (roles)
-        b.add('mapped', 'authorization', 'custom roles', `${roles} role(s); members keep the same role id as their Atlas role key. stytch_admin and stytch_member map to Atlas's admin and member.`, 'roles');
-    if (snap.roles.length === 0)
-        b.add('manual', 'authorization', 'RBAC policy', 'No RBAC policy was returned; default roles carry over as admin and member.');
-    if (snap.ssoConnections)
-        b.add('mapped', 'enterprise', `${snap.ssoConnections} SSO connection(s) in ${snap.organizations} organization(s)`, 'Move with the data export as Atlas SSO connections.', 'sso_connections');
-    if (snap.product === 'b2b')
-        b.add('manual', 'organizations', 'organization MFA policy, allowed auth methods, JIT provisioning', 'Per-organization settings are kept in the exported organization metadata; set the matching policy on each Atlas organization.');
-    for (const [setting, where] of [
-        ['password strength (zxcvbn / LUDS) and breach check', 'Dashboard → Authentication → Passwords; set Atlas password rules under auth_config.password'],
-        ['session duration and JWT lifetime', 'Dashboard → Sessions; set the Atlas session lifetime'],
-        ['OAuth providers (client ids and secrets)', 'Dashboard → OAuth; use the same OAuth apps in Atlas so imported accounts relink'],
-        ['redirect URLs and authorized domains', 'Dashboard → Redirect URLs, SDK configuration'],
-        ['multi-factor authentication (TOTP, SMS)', 'Dashboard → Authentication → MFA'],
-        ['email templates, SMS and branding', 'Dashboard → Email templates, Branding'],
-        ['custom claims and JWT templates', 'Dashboard → Sessions → JWT templates'],
-        ['webhooks', 'Dashboard → Webhooks (create Atlas webhook endpoints)'],
-    ]) {
-        b.add('manual', 'settings not in the API', setting, `Stytch does not expose this through the project API; copy it from ${where}.`);
-    }
-    const test = snap.projectId.startsWith('project-test-');
-    const vars = { project_id: snap.projectId, ...(test ? { api_host: 'test.stytch.com' } : {}), ...(snap.product === 'b2b' ? { jwks_path: 'b2b/sessions' } : {}) };
-    return b.result(`Stytch project ${snap.projectId}`, {
-        bridge: { preset: 'stytch', vars },
-        lazy: { preset: 'stytch', config: { project_id: snap.projectId, product: snap.product } },
-    });
-}
-//# sourceMappingURL=stytch-config.js.map

package/dist/migrate/export/stytch-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"stytch-config.js","sourceRoot":"","sources":["../../../src/migrate/export/stytch-config.ts"],"names":[],"mappings":";;AAkCA,8CAqBC;AAED,sDAgDC;AAvGD,6CAAgE;AAChE,qCAA6D;AAC7D,mDAAgD;AAChD,+CAAgE;AAmBhE,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY;IACvD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAgB,EAAE,SAAiB,EAAE,OAAsB;IACjG,2FAA2F;IAC3F,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACnG,MAAM,MAAM,GAAQ,GAAG,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,8BAA8B,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChE,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAClC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,eAAe,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzF,IAAI,GAAG;oBAAE,cAAc,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;YACnG,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC;gBAAE,MAAM,GAAG,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAA,iBAAI,EAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;AAC7H,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAA0B;IAC9D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAE9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,GAAG,GAAG,IAAA,sBAAa,EAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClH,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnE,6DAA6D;QAC7D,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,KAAK,EAAE,CAAC;QACR,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAU,CAAC,CAAC;IACzG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,WAAW;QAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;IAClG,IAAI,WAAW,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,4BAA4B,EAAE,GAAG,WAAW,CAAC,IAAI,wCAAwC,EAAE,aAAa,CAAC,CAAC;IACjK,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,KAAK,kIAAkI,EAAE,OAAO,CAAC,CAAC;IACjN,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,4EAA4E,CAAC,CAAC;IAE3J,IAAI,IAAI,CAAC,cAAc;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,cAAc,yBAAyB,IAAI,CAAC,aAAa,kBAAkB,EAAE,qDAAqD,EAAE,iBAAiB,CAAC,CAAC;IACtN,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,iEAAiE,EAAE,+HAA+H,CAAC,CAAC;IAEjQ,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,oDAAoD,EAAE,6FAA6F,CAAC;QACrJ,CAAC,mCAAmC,EAAE,sDAAsD,CAAC;QAC7F,CAAC,0CAA0C,EAAE,iFAAiF,CAAC;QAC/H,CAAC,sCAAsC,EAAE,8CAA8C,CAAC;QACxF,CAAC,yCAAyC,EAAE,kCAAkC,CAAC;QAC/E,CAAC,mCAAmC,EAAE,uCAAuC,CAAC;QAC9E,CAAC,iCAAiC,EAAE,sCAAsC,CAAC;QAC3E,CAAC,UAAU,EAAE,uDAAuD,CAAC;KAC7D,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,OAAO,EAAE,qEAAqE,KAAK,GAAG,CAAC,CAAC;IACrI,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxL,OAAO,CAAC,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,SAAS,EAAE,EAAE;QAClD,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;QAClC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE;KAC1F,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/stytch.d.ts

@@ -1,68 +0,0 @@
-import type { PasswordHash, UserRecord } from '@atlasauth/migrate';
-import { RecordSet, type Obj } from './record-set';
-import { VendorHttp } from './vendor-http';
-/**
- * `atlas migrate export stytch` — Stytch (consumer and B2B) onto the canonical
- * bundle models, from the Stytch API with the project id and secret (on this
- * machine only).
- *
- *   consumer   `POST /v1/users/search` (cursor paging, 1000 per page): emails
- *              and phone numbers with their verified flags, name, OAuth
- *              providers, metadata, roles, lock state.
- *   B2B        `POST /v1/b2b/organizations/search`, then per organization
- *              `POST /v1/b2b/organizations/members/search`, `GET /v1/b2b/sso/{org}`
- *              and the RBAC policy (`GET /v1/b2b/rbac/policy`).
- *
- * Stytch members belong to ONE organization each (`member_id` is per
- * organization). Atlas users are people, so members sharing an email become one
- * user: the earliest member's id is the user id (the session JWT `sub` of that
- * member maps to it) and the others' ids are kept in `private_metadata`.
- *
- * Password hashes never leave Stytch through the API: they come from the export
- * Stytch support sends on request (support@stytch.com), given as `--stytch-hashes`
- * (CSV, JSON or NDJSON). Until then the `stytch` lazy-migration preset checks
- * passwords against Stytch on first sign-in. TOTP secrets, passkeys and crypto
- * wallets are not exported.
- */
-export type StytchProduct = 'consumer' | 'b2b';
-export interface StytchExportOptions {
-    projectId: string;
-    secret: string;
-    /** Detected from the project when omitted. */
-    product?: StytchProduct;
-    /** Override `https://api.stytch.com` (live) / `https://test.stytch.com` (test), e.g. a custom domain. */
-    baseUrl?: string;
-    /** The support-provided password export (CSV, JSON array or NDJSON text). */
-    hashesText?: string;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-/** The API host for a project id: live projects are on api.stytch.com, test projects on test.stytch.com. */
-export declare function stytchBaseUrl(projectId: string): string;
-/** HTTP Basic credentials for the project. */
-export declare function stytchAuthorization(projectId: string, secret: string): string;
-export declare function stytchHttp(o: Pick<StytchExportOptions, 'projectId' | 'secret' | 'baseUrl' | 'fetchImpl' | 'sleep'>): VendorHttp;
-/** Is this a B2B project? Its organization search answers; a consumer project refuses the endpoint. */
-export declare function detectStytchProduct(http: VendorHttp): Promise<StytchProduct>;
-/** Stytch's cursor paging: `results_metadata.next_cursor` until it is null. */
-export declare function stytchSearch(http: VendorHttp, path: string, body: Obj, key: string): Promise<Obj[]>;
-export declare function exportStytch(opts: StytchExportOptions): Promise<RecordSet>;
-/** One Stytch user object → a user record; null with nothing to sign in with. */
-export declare function mapStytchUser(u: Obj): UserRecord | null;
-export declare function stytchRoleKey(roleId: string): string;
-/**
- * Parse the password export Stytch support sends: a JSON array (or an object
- * holding one under `users` / `members` / `results`), NDJSON, or CSV with a
- * header row. Keys are lower-cased; a nested `scrypt_config` etc. is flattened.
- */
-export declare function parseStytchHashes(text: string): Obj[];
-/**
- * One row of the support export → the bundle's password hash. Field names
- * follow Stytch's own password-migration API (`hash`, `hash_type`, and the
- * `scrypt_config` / `pbkdf_2_config` / salt fields), which is the format the
- * export mirrors (UNCONFIRMED: Stytch support documents it per request).
- */
-export declare function stytchPasswordHash(row: Obj): PasswordHash | {
-    reason: string;
-};