@atlasauth/cli 0.24.0 → 0.25.0

package/dist/migrate/export/supertokens-config.js

@@ -1,150 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchSupertokensConfig = fetchSupertokensConfig;
-exports.translateSupertokensConfig = translateSupertokensConfig;
-const supertokens_1 = require("./supertokens");
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-async function fetchSupertokensConfig(http, origin, appId) {
-    let tenants = [];
-    try {
-        tenants = await (0, supertokens_1.listTenants)(http, appId);
-    }
-    catch (err) {
-        if (!(err instanceof vendor_http_1.VendorApiError) || ![401, 403, 404, 501].includes(err.status))
-            throw err;
-    }
-    // A core without the multitenancy listing still has the public tenant's single-tenant view.
-    if (!tenants.length) {
-        try {
-            const { body } = await http.get(`${(0, supertokens_1.corePrefix)(appId, 'public')}/recipe/multitenancy/tenant?tenantId=public`);
-            if ((0, record_set_1.isObj)(body))
-                tenants = [body];
-        }
-        catch (err) {
-            if (!(err instanceof vendor_http_1.VendorApiError) || ![401, 403, 404, 501].includes(err.status))
-                throw err;
-        }
-    }
-    return { origin, appId, tenants };
-}
-const enabled = (v) => (0, record_set_1.isObj)(v) && v.enabled === true;
-const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : undefined);
-/** Core defaults when the tenant's config does not override them. */
-const DEFAULT_REFRESH_MINUTES = 144_000;
-function translateSupertokensConfig(snap) {
-    const b = new translate_kit_1.ConfigBuilder();
-    const pub = snap.tenants.find((t) => (0, record_set_1.str)(t.tenantId) === 'public') ?? snap.tenants[0];
-    if (!pub) {
-        b.add('manual', 'core', 'tenant list', 'The core did not return its tenants (check the API key): nothing to translate. Your recipes live in supertokens.init in your backend; list them by hand.');
-    }
-    else {
-        const first = (0, record_set_1.strs)(pub.firstFactors);
-        const hasFirst = (...f) => f.some((x) => first.includes(x));
-        // firstFactors is absent on older cores: fall back to the recipes' enabled flags.
-        const legacy = first.length === 0;
-        // ── recipes and first factors ──
-        if (enabled(pub.emailPassword) && (legacy || hasFirst('emailpassword'))) {
-            b.set('strategies.password', true);
-            b.add('differs', 'recipes emailpassword', 'emailPassword.enabled', 'Password sign-in. The core API never returns password hashes: export from the core database (bcrypt and Argon2 verify as they are) or use the supertokens lazy-migration preset.', 'auth_config.strategies.password');
-        }
-        if (enabled(pub.passwordless)) {
-            if (legacy || hasFirst('otp-email')) {
-                b.set('strategies.emailCode', true);
-                b.add('mapped', 'recipes passwordless', 'firstFactors otp-email', 'Email one-time codes.', 'auth_config.strategies.emailCode');
-            }
-            if (legacy || hasFirst('link-email')) {
-                b.set('strategies.emailLink', true);
-                b.add('mapped', 'recipes passwordless', 'firstFactors link-email', 'Email magic links.', 'auth_config.strategies.emailLink');
-            }
-            if (legacy || hasFirst('otp-phone')) {
-                b.set('strategies.phoneCode', true);
-                b.add('mapped', 'recipes passwordless', 'firstFactors otp-phone', 'SMS codes (bring your own SMS provider).', 'auth_config.strategies.phoneCode');
-            }
-            if (hasFirst('link-phone'))
-                b.add('differs', 'recipes passwordless', 'firstFactors link-phone', 'SMS magic links have no Atlas counterpart: use SMS codes.', 'auth_config.strategies.phoneCode');
-        }
-        // ── third-party providers ──
-        const providers = (0, record_set_1.isObj)(pub.thirdParty) ? (0, record_set_1.objs)(pub.thirdParty.providers) : [];
-        if (enabled(pub.thirdParty) || providers.length) {
-            for (const p of providers) {
-                const id = (0, record_set_1.str)(p.thirdPartyId) ?? '';
-                const name = (0, record_set_1.str)(p.name) ?? id;
-                const clients = (0, record_set_1.objs)(p.clients);
-                const client = clients[0];
-                const key = (0, translate_kit_1.socialKey)(id);
-                if (!key) {
-                    b.add('manual', 'recipes thirdparty', `${name} (${id})`, 'No built-in Atlas provider: add it as a custom OAuth provider (or an SSO connection for SAML via Boxy).', 'custom_oauth_providers');
-                    continue;
-                }
-                b.socialProvider({ atlasKey: key, vendorName: name, area: 'recipes thirdparty', setting: `${name} (${id})`, clientId: (0, record_set_1.str)(client?.clientId), scopes: (0, record_set_1.strs)(client?.scope) });
-                if (clients.length > 1)
-                    b.add('differs', 'recipes thirdparty', `${name} clients`, `${clients.length} OAuth clients (web, mobile…): Atlas keeps one per provider; add the others as native-app credentials.`, `oauth_providers ${key}`);
-            }
-        }
-        // ── multi-factor ──
-        const second = (0, record_set_1.strs)(pub.requiredSecondaryFactors);
-        if (second.includes('totp')) {
-            b.set('mfa.factors.totp', true);
-            b.add('mapped', 'recipes multifactorauth', 'requiredSecondaryFactors totp', 'Authenticator apps; verified TOTP devices move with a database export.', 'auth_config.mfa.factors.totp');
-        }
-        for (const f of second.filter((x) => x !== 'totp')) {
-            const channel = f === 'otp-email' ? 'emailCode' : null;
-            if (channel) {
-                b.set('mfa.factors.emailCode', true);
-                b.add('mapped', 'recipes multifactorauth', `requiredSecondaryFactors ${f}`, 'Email code as a second factor.', 'auth_config.mfa.factors.emailCode');
-            }
-            else {
-                b.add('differs', 'recipes multifactorauth', `requiredSecondaryFactors ${f}`, 'Atlas recommends authenticator apps or passkeys as the second factor; enable the factors you want in auth_config.mfa.', 'auth_config.mfa');
-            }
-        }
-        if (second.length) {
-            b.set('mfaPolicy', 'required');
-            b.add('differs', 'recipes multifactorauth', 'requiredSecondaryFactors', 'A second factor on every sign-in. If your backend decides per user (the MFA recipe\'s getMFARequirementsForAuth override), set the policy to optional and use step-up for the sensitive routes.', 'auth_config.mfaPolicy');
-        }
-        else if ((0, record_set_1.strs)(pub.firstFactors).length) {
-            b.add('manual', 'recipes multifactorauth', 'getMFARequirementsForAuth override', 'MFA requirements set in code (supertokens.init) are not visible to the core: port them to the Atlas MFA policy or step-up rules.', 'auth_config.mfaPolicy');
-        }
-        // ── core configuration ──
-        const core = (0, record_set_1.isObj)(pub.coreConfig) ? pub.coreConfig : {};
-        const refresh = num(core.refresh_token_validity) ?? DEFAULT_REFRESH_MINUTES;
-        b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(refresh * 60_000));
-        b.add('mapped', 'core config', 'refresh_token_validity', `${refresh} minutes (the session lives as long as its refresh token); Atlas caps a session at 90 days.`, 'auth_config.session.absoluteMs');
-        const access = num(core.access_token_validity);
-        if (access !== undefined)
-            b.add('differs', 'core config', 'access_token_validity', `SuperTokens access tokens lived ${access}s. Atlas session tokens are short-lived and refreshed by its SDKs (auth_config.session.jwtTtlSeconds).`, 'auth_config.session.jwtTtlSeconds');
-        const codeLife = num(core.passwordless_code_lifetime);
-        if (codeLife !== undefined) {
-            const minutes = Math.max(1, Math.round(codeLife / 60_000));
-            b.set('verification.emailCode.ttlMinutes', minutes);
-            b.add('mapped', 'core config', 'passwordless_code_lifetime', `Codes live ${minutes} minute(s).`, 'auth_config.verification.emailCode.ttlMinutes');
-        }
-        const attempts = num(core.passwordless_max_code_input_attempts);
-        if (attempts !== undefined) {
-            b.set('verification.emailCode.maxAttempts', attempts);
-            b.add('mapped', 'core config', 'passwordless_max_code_input_attempts', `${attempts} attempts per code.`, 'auth_config.verification.emailCode.maxAttempts');
-        }
-        for (const k of ['password_reset_token_lifetime', 'email_verification_token_lifetime']) {
-            if (num(core[k]) !== undefined)
-                b.add('differs', 'core config', k, 'Atlas link and code lifetimes are instance settings; review auth_config.verification.', 'auth_config.verification');
-        }
-        if (core.totp_max_attempts !== undefined || core.totp_rate_limit_cooldown_sec !== undefined) {
-            b.add('differs', 'core config', 'totp_max_attempts / totp_rate_limit_cooldown_sec', 'Atlas throttles failed second-factor attempts per account and IP.', 'auth_config.rateLimit');
-        }
-        // ── other tenants ──
-        const others = snap.tenants.filter((t) => t !== pub);
-        for (const t of others) {
-            b.add('differs', `tenants ${(0, record_set_1.str)(t.tenantId) ?? '?'}`, 'tenant', 'A tenant becomes an organization with the data export; its own enabled recipes and providers are not translated: configure per-organization SSO connections for them.', 'organizations');
-        }
-    }
-    // ── what the core never sees ──
-    b.add('manual', 'backend config', 'supertokens.init override functions', 'Recipe overrides (custom sign-up rules, claims, email and SMS delivery) live in your backend: port sign-up rules to Atlas actions, claims to a JWT template, and delivery to your own email / SMS provider.', 'actions');
-    b.add('manual', 'backend config', 'EmailVerification mode (REQUIRED / OPTIONAL)', 'The mode is set in supertokens.init, not in the core: set auth_config.requireEmailVerification to match it.', 'auth_config.requireEmailVerification');
-    b.add('manual', 'backend config', 'appInfo (apiDomain, websiteDomain, cookieDomain)', 'Add your website origin to the instance allowed origins; set the cross-subdomain cookie setting if you used cookieDomain.', 'instance.allowed_origins');
-    // The bridge needs the app's API domain (apiDomain), not the core's address: the plugin asks for it.
-    return b.result(`SuperTokens core ${snap.origin} (app ${snap.appId})`, {
-        lazy: { preset: 'supertokens', config: { base_url: snap.origin } },
-    });
-}
-//# sourceMappingURL=supertokens-config.js.map

package/dist/migrate/export/supertokens-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"supertokens-config.js","sourceRoot":"","sources":["../../../src/migrate/export/supertokens-config.ts"],"names":[],"mappings":";;AAsBA,wDAiBC;AAQD,gEAgHC;AA9JD,+CAAwD;AACxD,6CAAgE;AAChE,mDAA2E;AAC3E,+CAAgE;AAkBzD,KAAK,UAAU,sBAAsB,CAAC,IAAgB,EAAE,MAAc,EAAE,KAAa;IAC1F,IAAI,OAAO,GAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAA,yBAAW,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,GAAG,CAAC;IAChG,CAAC;IACD,4FAA4F;IAC5F,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAA,wBAAU,EAAC,KAAK,EAAE,QAAQ,CAAC,6CAA6C,CAAC,CAAC;YAClH,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,CAAC;QAChG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;AACxE,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE9G,qEAAqE;AACrE,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAExC,SAAgB,0BAA0B,CAAC,IAA+B;IACxE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,0JAA0J,CAAC,CAAC;IACrM,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,kFAAkF;QAClF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QAElC,kCAAkC;QAClC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACxE,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,kLAAkL,EAAE,iCAAiC,CAAC,CAAC;QAC5R,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,IAAI,MAAM,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;gBACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,kCAAkC,CAAC,CAAC;YACjI,CAAC;YACD,IAAI,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;gBACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;YAC/H,CAAC;YACD,IAAI,MAAM,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;gBACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,0CAA0C,EAAE,kCAAkC,CAAC,CAAC;YACpJ,CAAC;YACD,IAAI,QAAQ,CAAC,YAAY,CAAC;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,2DAA2D,EAAE,kCAAkC,CAAC,CAAC;QACnM,CAAC;QAED,8BAA8B;QAC9B,MAAM,SAAS,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YAChD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,EAAE,CAAC,CAAC;gBAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,EAAE,GAAG,EAAE,yGAAyG,EAAE,wBAAwB,CAAC,CAAC;oBAC9L,SAAS;gBACX,CAAC;gBACD,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC5K,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,EAAE,GAAG,IAAI,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,wGAAwG,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;YACzO,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,wEAAwE,EAAE,8BAA8B,CAAC,CAAC;QACxL,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,IAAI,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;gBACrC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,4BAA4B,CAAC,EAAE,EAAE,gCAAgC,EAAE,mCAAmC,CAAC,CAAC;YACrJ,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,yBAAyB,EAAE,4BAA4B,CAAC,EAAE,EAAE,uHAAuH,EAAE,iBAAiB,CAAC,CAAC;YAC3N,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC/B,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,iMAAiM,EAAE,uBAAuB,CAAC,CAAC;QACtS,CAAC;aAAM,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YACzC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,oCAAoC,EAAE,kIAAkI,EAAE,uBAAuB,CAAC,CAAC;QAChP,CAAC;QAED,2BAA2B;QAC3B,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,uBAAuB,CAAC;QAC5E,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,wBAAwB,EAAE,GAAG,OAAO,6FAA6F,EAAE,gCAAgC,CAAC,CAAC;QACpM,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,uBAAuB,EAAE,mCAAmC,MAAM,wGAAwG,EAAE,mCAAmC,CAAC,CAAC;QAC3Q,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,GAAG,CAAC,mCAAmC,EAAE,OAAO,CAAC,CAAC;YACpD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,4BAA4B,EAAE,cAAc,OAAO,aAAa,EAAE,+CAA+C,CAAC,CAAC;QACpJ,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,CAAC,CAAC,GAAG,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC;YACtD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,sCAAsC,EAAE,GAAG,QAAQ,qBAAqB,EAAE,gDAAgD,CAAC,CAAC;QAC7J,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,mCAAmC,CAAC,EAAE,CAAC;YACvF,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,EAAE,uFAAuF,EAAE,0BAA0B,CAAC,CAAC;QAC1L,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,IAAI,IAAI,CAAC,4BAA4B,KAAK,SAAS,EAAE,CAAC;YAC5F,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,kDAAkD,EAAE,mEAAmE,EAAE,uBAAuB,CAAC,CAAC;QACpL,CAAC;QACD,sBAAsB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,uKAAuK,EAAE,eAAe,CAAC,CAAC;QAC5P,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,qCAAqC,EAAE,6MAA6M,EAAE,SAAS,CAAC,CAAC;IACnS,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,8CAA8C,EAAE,6GAA6G,EAAE,sCAAsC,CAAC,CAAC;IACzO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,kDAAkD,EAAE,2HAA2H,EAAE,0BAA0B,CAAC,CAAC;IAE/O,qGAAqG;IACrG,OAAO,CAAC,CAAC,MAAM,CAAC,oBAAoB,IAAI,CAAC,MAAM,SAAS,IAAI,CAAC,KAAK,GAAG,EAAE;QACrE,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;KACnE,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/supertokens.d.ts

@@ -1,125 +0,0 @@
-import type { PasswordHash, Timestamp } from '@atlasauth/migrate';
-import { type Tables } from './frameworks/tables';
-import { RecordSet, type Obj } from './record-set';
-import { VendorHttp } from './vendor-http';
-/**
- * `atlas migrate export supertokens` — a SuperTokens core (self-hosted, or the
- * managed service) onto the canonical bundle models. Two ways in:
- *
- *   - a DATABASE DUMP of the core (one file per table, made with
- *     `psql \copy … csv header`, see the guide): everything the core keeps —
- *     password hashes (bcrypt, Argon2), TOTP device secrets, email verification
- *     state, user metadata, roles, tenants, user id mappings;
- *   - the core's HTTP API with its API key (`GET /users`, `/recipe/user/…`,
- *     `/recipe/roles`, `/recipe/multitenancy/tenant/list`): users, linked
- *     login methods, verified flags, metadata, roles and tenants. The API never
- *     returns password hashes or TOTP secrets: those users move by lazy
- *     migration / enrol again.
- *
- * What maps where:
- *   - users: one Atlas user per SuperTokens PRIMARY user (account linking
- *     folds emailpassword, thirdparty and passwordless login methods into one);
- *     the id is the id the app sees (`userid_mapping` external id when set), the
- *     `sub` of every access token;
- *   - emails (verified from `emailverification_verified_emails`; passwordless
- *     addresses and phone numbers are verified by the sign-in itself);
- *   - passwords: bcrypt and Argon2 PHC strings as they are; anything else is
- *     counted and left for lazy migration;
- *   - third-party links as identities (`thirdparty_users`);
- *   - roles (app roles with their permissions; roles a user holds on the
- *     public tenant) and tenants (every non-public tenant becomes an
- *     organization, its users members, roles held there their organization role);
- *   - verified TOTP devices as authenticator-app factors;
- *   - user metadata as private metadata (names carried over when present).
- */
-export interface SupertokensExportOptions {
-    /** A dump of the core database (one table per file). */
-    tables?: Tables;
-    /** The core's address (`https://st-dev-abc.aws.supertokens.io`, `http://core:3567`). */
-    connectionUri?: string;
-    /** The core's API key (`api-key` header). */
-    apiKey?: string;
-    /** The SuperTokens app id (multi-app cores); `public` by default. */
-    appId?: string;
-    /** The `table_names_prefix` the core runs with, when it has one. */
-    tablePrefix?: string;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-/** One way of signing in as seen by the core (a recipe user). */
-export interface LoginMethod {
-    recipeUserId: string;
-    recipeId: string;
-    email?: string;
-    phone?: string;
-    thirdParty?: {
-        id: string;
-        userId: string;
-    };
-    passwordHash?: string;
-    verified: boolean;
-    timeJoined?: Timestamp;
-    tenantIds: string[];
-}
-/** A primary user and the login methods linked to it. */
-export interface StUser {
-    /** The primary user id (before any `userid_mapping`). */
-    id: string;
-    loginMethods: LoginMethod[];
-    timeJoined?: Timestamp;
-}
-export interface TotpDevice {
-    name?: string;
-    secret?: string;
-    period?: number;
-    verified: boolean;
-}
-export interface SupertokensSnapshot {
-    source: 'database' | 'api';
-    users: StUser[];
-    /** User id → metadata object. */
-    metadata: Map<string, Obj>;
-    /** Role → permissions. */
-    roles: Map<string, string[]>;
-    userRoles: Array<{
-        userId: string;
-        tenantId: string;
-        role: string;
-    }>;
-    /** Tenant ids other than `public`. */
-    tenants: string[];
-    /** User id → TOTP devices (a database dump; the API carries no secrets). */
-    totp: Map<string, TotpDevice[]>;
-    /** User id → last active time (epoch ms). */
-    lastActive: Map<string, number>;
-    /** SuperTokens user id → the external id the app uses. */
-    idMappings: Map<string, string>;
-    warnings: string[];
-}
-export declare function exportSupertokens(opts: SupertokensExportOptions): Promise<RecordSet>;
-/** `st-dev-x.aws.supertokens.io` → `https://st-dev-x.aws.supertokens.io`; an http address is kept (a core inside your network). */
-export declare function normalizeCoreUri(raw: string): string;
-export declare function snapshotFromTables(tables: Tables, appId: string, prefix?: string): SupertokensSnapshot;
-/** A core client: the API key header, the app and tenant path prefixes. */
-export declare function supertokensHttp(o: {
-    connectionUri: string;
-    apiKey?: string;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-}): VendorHttp;
-/** `/appid-<app>/<tenant>` path prefix of an app and tenant on the core (public → none). */
-export declare function corePrefix(appId: string, tenantId: string): string;
-/** The tenants of an app, from the multitenancy recipe (older cores answer on the v1 path). */
-export declare function listTenants(http: VendorHttp, appId: string): Promise<Obj[]>;
-export declare function fetchSupertokensSnapshot(o: SupertokensExportOptions & {
-    connectionUri: string;
-    appId: string;
-    onProgress: (m: string) => void;
-}): Promise<SupertokensSnapshot>;
-/** A SuperTokens `password_hash` → the bundle's password; null for a shape Atlas cannot verify. */
-export declare function mapSupertokensPassword(hash: unknown): PasswordHash | null;
-export declare function buildSupertokensRecordSet(snap: SupertokensSnapshot, o: {
-    origin: string;
-    appId: string;
-}): RecordSet;