@atlasauth/cli 0.25.0 → 0.25.1

package/dist/migrate/export/frontegg-config.js

@@ -0,0 +1,238 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchFronteggConfig = fetchFronteggConfig;
+exports.translateFronteggConfig = translateFronteggConfig;
+const frontegg_1 = require("./frontegg");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+async function fetchFronteggConfig(c) {
+    const { http } = (0, frontegg_1.fronteggApi)(c);
+    const get = (path) => (0, frontegg_1.optional)(http, path);
+    const obj = async (path) => {
+        const b = await get(path);
+        return (0, record_set_1.isObj)(b) ? b : null;
+    };
+    const roles = [];
+    for (let page = 0; page < 50; page++) {
+        const b = await get(`/identity/resources/roles/v2?_limit=200&_offset=${page}`);
+        const items = (0, frontegg_1.listOf)(b, 'roles');
+        roles.push(...items);
+        if (items.length < 200)
+            break;
+    }
+    return {
+        clientId: c.clientId,
+        region: (c.region ?? 'eu').toLowerCase(),
+        configuration: await obj('/identity/resources/configurations/v1'),
+        password: await obj('/identity/resources/configurations/v1/password'),
+        mfaPolicy: await obj('/identity/resources/configurations/v1/mfa-policy'),
+        lockout: await obj('/identity/resources/configurations/v1/lockout-policy'),
+        sessions: await obj('/identity/resources/configurations/sessions/v1/vendor'),
+        roles,
+        permissions: (0, frontegg_1.listOf)(await get('/identity/resources/permissions/v1')),
+        customProviders: (0, frontegg_1.listOf)(await get('/identity/resources/sso/custom/v1')),
+        applications: (0, frontegg_1.listOf)(await get('/applications/resources/applications/v1'), 'applications'),
+        jwtTemplates: (0, frontegg_1.listOf)(await get('/identity/resources/jwt-templates/v1')),
+        domainRestrictions: await obj('/identity/resources/configurations/restrictions/v1/email-domain/config'),
+    };
+}
+function translateFronteggConfig(snap, domain) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const cfg = snap.configuration;
+    if (cfg) {
+        const strategy = (0, record_set_1.str)(cfg.authStrategy) ?? '';
+        const name = 'authStrategy';
+        const username = strategy.startsWith('Username');
+        if (username) {
+            b.set('strategies.username', true);
+            b.add('mapped', 'authentication', name, `${strategy}: usernames are imported as Atlas usernames.`, 'auth_config.strategies.username');
+        }
+        if (/Password$/.test(strategy)) {
+            b.set('strategies.password', true);
+            b.add('differs', 'authentication', name, `${strategy}: password sign-in. Frontegg never returns password hashes: the frontegg lazy-migration preset checks each password against Frontegg on first sign-in.`, 'auth_config.strategies.password');
+        }
+        else if (/MagicLink$/.test(strategy)) {
+            b.set('strategies.emailLink', true);
+            b.add('mapped', 'authentication', name, `${strategy}: passwordless email link.`, 'auth_config.strategies.emailLink');
+        }
+        else if (/Code$/.test(strategy)) {
+            b.set('strategies.emailCode', true);
+            b.add('mapped', 'authentication', name, `${strategy}: passwordless email code.`, 'auth_config.strategies.emailCode');
+        }
+        else if (/Sms(Code)?$/.test(strategy)) {
+            b.set('strategies.phoneCode', true);
+            b.add('differs', 'authentication', name, `${strategy}: SMS codes. Atlas keeps SMS sign-in off until you turn it on (every message costs money).`, 'auth_config.strategies.phoneCode');
+        }
+        else if (strategy === 'NoLocalAuthentication') {
+            b.add('manual', 'authentication', name, 'NoLocalAuthentication: Frontegg only federates sign-in (SSO / social). Enable the matching connections in Atlas; no local strategy is turned on.', 'auth_config.strategies');
+        }
+        else if (strategy) {
+            b.add('manual', 'authentication', name, `${strategy}: review the sign-in methods by hand.`, 'auth_config.strategies');
+        }
+        if (cfg.allowSignups === false)
+            b.add('manual', 'authentication', 'allowSignups', 'Self sign-up is off in Frontegg: close public sign-up in Atlas (invitations or waitlist).', 'auth_config.signUpMode');
+        if (cfg.allowNotVerifiedUsersLogin === true)
+            b.add('manual', 'authentication', 'allowNotVerifiedUsersLogin', 'Frontegg lets unverified users sign in; Atlas verifies an email before it counts as a login identifier.');
+        const tokenSecs = Number(cfg.defaultTokenExpiration ?? 0);
+        if (tokenSecs > 0)
+            b.add('differs', 'tokens', 'defaultTokenExpiration', `${tokenSecs}s access token. Atlas session tokens are short-lived and refreshed by the SDK; the session length below sets how long a user stays signed in.`, 'auth_config.session');
+        const refreshSecs = Number(cfg.defaultRefreshTokenExpiration ?? 0);
+        if (refreshSecs > 0) {
+            b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(refreshSecs * 1000));
+            b.add('mapped', 'tokens', 'defaultRefreshTokenExpiration', `${refreshSecs}s refresh token lifetime.`, 'auth_config.session.absoluteMs');
+        }
+        if (cfg.jwtAlgorithm === 'HS256')
+            b.add('manual', 'tokens', 'jwtAlgorithm', 'Frontegg signs this environment with HS256 (a shared secret). Atlas signs with asymmetric keys: verify Atlas tokens against its JWKS instead of the secret.');
+        if (cfg.addRolesToJwt === false || cfg.addPermissionsToJwt === false)
+            b.add('manual', 'tokens', 'addRolesToJwt / addPermissionsToJwt', 'Roles and permissions were not in the Frontegg JWT; Atlas puts organization roles and permissions in its session claims when the session has an active organization.');
+        if (cfg.rotateRefreshTokens === true)
+            b.add('mapped', 'tokens', 'rotateRefreshTokens', 'Atlas rotates refresh tokens on every use.');
+        if (cfg.apiTokensEnabled === true)
+            b.add('manual', 'api tokens', 'apiTokensEnabled', 'Frontegg API tokens (client id + secret) cannot be exported: reissue them as Atlas API keys or M2M clients.', 'oauth_clients');
+        if (cfg.forceSameDeviceOnAuth === true)
+            b.add('manual', 'authentication', 'forceSameDeviceOnAuth', 'Atlas email links work from any device; there is no same-device switch.');
+    }
+    else {
+        b.add('manual', 'authentication', 'configurations/v1', 'The identity configuration could not be read (permission or plan): turn on the same sign-in methods in Atlas by hand.', 'auth_config.strategies');
+    }
+    const pw = snap.password;
+    if (pw) {
+        const min = Number(pw.minLength ?? 0);
+        if (min > 0) {
+            b.set('passwordPolicy.minLength', Math.max(8, min));
+            b.add(min < 8 ? 'differs' : 'mapped', 'password', 'minLength', `${min}${min < 8 ? ' (Atlas requires at least 8; existing passwords still sign in)' : ''}.`, 'auth_config.passwordPolicy.minLength');
+        }
+        if (pw.blockPwnedPasswords === true) {
+            b.set('passwordPolicy.checkBreaches', true);
+            b.add('mapped', 'password', 'blockPwnedPasswords', 'Breached passwords are refused.', 'auth_config.passwordPolicy.checkBreaches');
+        }
+        if ((0, record_set_1.isObj)(pw.requiredTests) && Object.values(pw.requiredTests).some(Boolean)) {
+            b.add('differs', 'password', 'requiredTests / optionalTests', 'Atlas follows NIST 800-63B: length and breached-password checks, no character-class rules.', 'auth_config.passwordPolicy');
+        }
+        if (pw.allowPassphrases === true)
+            b.add('mapped', 'password', 'allowPassphrases', 'Atlas accepts any password that meets the length rule, passphrases included.');
+    }
+    const lock = snap.lockout;
+    if (lock && lock.enabled === true) {
+        b.add('mapped', 'security', 'lockout-policy', `Frontegg locks after ${lock.maxAttempts ?? '?'} failed attempts; Atlas throttles failed sign-ins per account and IP.`, 'auth_config.rateLimit');
+    }
+    const mfa = snap.mfaPolicy;
+    if (mfa) {
+        const enforce = (0, record_set_1.str)(mfa.enforceMFAType) ?? '';
+        if (/force/i.test(enforce)) {
+            b.set('mfaPolicy', 'required');
+            b.add('mapped', 'mfa', 'enforceMFAType', `${enforce}: a second factor for everyone (users enrol again: Frontegg does not export authenticator seeds).`, 'auth_config.mfaPolicy');
+        }
+        else if (enforce) {
+            b.add('differs', 'mfa', 'enforceMFAType', `${enforce}: MFA is optional for users; turn on the factors (authenticator app, passkeys) in Atlas.`, 'auth_config.mfa');
+        }
+        if (mfa.allowRememberMyDevice === true)
+            b.add('manual', 'mfa', 'allowRememberMyDevice', 'Remembered devices: set the equivalent trusted-device window in Atlas MFA settings.', 'auth_config.mfa');
+    }
+    const sess = snap.sessions;
+    if (sess) {
+        const idle = (0, record_set_1.isObj)(sess.sessionIdleTimeoutConfiguration) ? sess.sessionIdleTimeoutConfiguration : undefined;
+        if (idle && idle.isActive === true && Number(idle.timeout) > 0) {
+            b.set('session.idleMs', (0, translate_kit_1.clampSessionMs)(Number(idle.timeout) * 1000));
+            b.add('mapped', 'sessions', 'sessionIdleTimeoutConfiguration', `${idle.timeout}s idle timeout.`, 'auth_config.session.idleMs');
+        }
+        const abs = (0, record_set_1.isObj)(sess.sessionTimeoutConfiguration) ? sess.sessionTimeoutConfiguration : undefined;
+        if (abs && abs.isActive === true && Number(abs.timeout) > 0) {
+            b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(Number(abs.timeout) * 1000));
+            b.add('mapped', 'sessions', 'sessionTimeoutConfiguration', `${abs.timeout}s absolute session lifetime.`, 'auth_config.session.absoluteMs');
+        }
+        const conc = (0, record_set_1.isObj)(sess.sessionConcurrentConfiguration) ? sess.sessionConcurrentConfiguration : undefined;
+        if (conc && conc.isActive === true)
+            b.add('manual', 'sessions', 'sessionConcurrentConfiguration', `Frontegg caps concurrent sessions at ${conc.maxSessions ?? '?'}; Atlas has no per-user session cap (users revoke devices from their profile).`);
+    }
+    // Permissions and roles (permission ids in a role's list resolve through the permission list).
+    const permissionKeys = new Map();
+    for (const p of snap.permissions) {
+        const key = (0, record_set_1.str)(p.key);
+        if (!key)
+            continue;
+        const id = (0, record_set_1.str)(p.id);
+        if (id)
+            permissionKeys.set(id, key);
+        b.push('permissions', { key, name: (0, record_set_1.str)(p.name) ?? key, description: (0, record_set_1.str)(p.description) ?? '' });
+    }
+    if (snap.permissions.length)
+        b.add('mapped', 'authorization', 'permissions', `${snap.permissions.length} permission(s).`, 'permissions');
+    const seen = new Set();
+    let tenantRoles = 0;
+    for (const r of snap.roles) {
+        const raw = (0, record_set_1.str)(r.key) ?? (0, record_set_1.str)(r.name);
+        if (!raw)
+            continue;
+        if ((0, record_set_1.str)(r.tenantId)) {
+            tenantRoles++;
+            continue;
+        }
+        const key = (0, translate_kit_1.keyOf)(raw);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        b.roles[raw] = key;
+        const perms = (Array.isArray(r.permissions) ? r.permissions : [])
+            .map((p) => ((0, record_set_1.isObj)(p) ? ((0, record_set_1.str)(p.key) ?? permissionKeys.get((0, record_set_1.str)(p.id) ?? '')) : permissionKeys.get(String(p))))
+            .filter((p) => !!p);
+        b.push('roles', { key, name: (0, record_set_1.str)(r.name) ?? raw, description: (0, record_set_1.str)(r.description) ?? '', permissions: perms });
+    }
+    if (seen.size)
+        b.add('mapped', 'authorization', 'roles', `${seen.size} environment role(s) become organization roles with their permissions.`, 'roles');
+    if (tenantRoles)
+        b.add('differs', 'authorization', 'account-specific roles', `${tenantRoles} role(s) defined inside one account: they move with the data export as that organization's custom roles.`, 'roles');
+    // Custom social providers.
+    for (const p of snap.customProviders) {
+        const name = (0, record_set_1.str)(p.displayName) ?? (0, record_set_1.str)(p.name) ?? (0, record_set_1.str)(p.id) ?? 'custom';
+        const clientId = (0, record_set_1.str)(p.clientId);
+        const authUrl = (0, record_set_1.str)(p.authorizationUrl);
+        const tokenUrl = (0, record_set_1.str)(p.tokenUrl);
+        const userInfo = (0, record_set_1.str)(p.userInfoUrl);
+        const key = (0, translate_kit_1.keyOf)(name);
+        b.push('custom_oauth_providers', {
+            key,
+            name,
+            enabled: p.active !== false,
+            client_id: clientId ?? b.placeholder(`${key.toUpperCase()}_CLIENT_ID`, `${name} client id`),
+            client_secret: b.placeholder(`${key.toUpperCase()}_CLIENT_SECRET`, `${name} client secret`),
+            ...(authUrl ? { authorization_url: authUrl } : {}),
+            ...(tokenUrl ? { token_url: tokenUrl } : {}),
+            ...(userInfo ? { userinfo_url: userInfo } : {}),
+            ...((0, record_set_1.strs)(p.scopes).length ? { scopes: (0, record_set_1.strs)(p.scopes) } : {}),
+        });
+        b.add('differs', 'custom social login', name, 'Becomes an Atlas custom OAuth provider. Keep the same OAuth app and add Atlas\'s callback URL; set the client secret (secrets are never copied).', 'custom_oauth_providers');
+    }
+    b.add('manual', 'social login', 'built-in providers (Google, GitHub, Microsoft, …)', 'Frontegg does not list the social providers you enabled in its public API: turn the same providers on in Atlas (oauth_providers) and keep the same OAuth apps so accounts relink.', 'oauth_providers');
+    // Applications: login and app URLs.
+    const urls = new Set();
+    for (const a of snap.applications) {
+        for (const u of [(0, record_set_1.str)(a.appURL), (0, record_set_1.str)(a.loginURL)])
+            if (u && /^https?:\/\//.test(u))
+                urls.add(u);
+    }
+    for (const url of urls)
+        b.push('redirect_urls', { url });
+    if (urls.size)
+        b.add('mapped', 'applications', 'appURL / loginURL', `${urls.size} application URL(s) as allowed redirect URLs (add any other post-login URL yourself).`, 'redirect_urls');
+    if (snap.applications.length > 1)
+        b.add('manual', 'applications', 'multiple applications', `${snap.applications.length} Frontegg applications share one user pool; Atlas has one instance per app: create one Atlas instance (or use organizations) per product.`);
+    if (snap.jwtTemplates.length)
+        b.add('manual', 'tokens', 'JWT templates', `${snap.jwtTemplates.length} custom JWT template(s): recreate their claims as an Atlas JWT template.`, 'jwt_templates');
+    const dr = snap.domainRestrictions;
+    if (dr && (dr.active === true || dr.enabled === true))
+        b.add('manual', 'security', 'email domain restrictions', 'Frontegg allow / block list for sign-up domains: set the equivalent sign-up restrictions in Atlas.', 'auth_config.signUpMode');
+    for (const [setting, where] of [
+        ['hosted login branding, localisation and flows', 'Frontegg portal → Builder / Login Box'],
+        ['email and SMS templates and providers', 'Frontegg portal → Notifications (Atlas sends with your own provider keys)'],
+        ['webhooks and audit streams', 'Frontegg portal → Webhooks'],
+        ['entitlements (plans, features)', 'Frontegg portal → Entitlements (use Atlas organization roles and permissions, or your billing system)'],
+    ]) {
+        b.add('manual', 'settings not in the API', setting, `Not exposed for export; recreate it in Atlas (see ${where}).`);
+    }
+    return b.result(`Frontegg environment (${snap.region})`, {
+        ...(domain ? { bridge: { preset: 'frontegg', vars: { base_url: domain } } } : {}),
+        lazy: { preset: 'frontegg', config: { client_id: snap.clientId, region: snap.region } },
+    });
+}
+//# sourceMappingURL=frontegg-config.js.map

package/dist/migrate/export/frontegg-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontegg-config.js","sourceRoot":"","sources":["../../../src/migrate/export/frontegg-config.ts"],"names":[],"mappings":";;AA+BA,kDA6BC;AAED,0DAiLC;AA7OD,yCAAoF;AACpF,6CAA0D;AAC1D,mDAAuE;AA2BhE,KAAK,UAAU,mBAAmB,CAAC,CAAqB;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAA,sBAAW,EAAC,CAAC,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAU,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7B,CAAC,CAAC;IACF,MAAM,KAAK,GAAU,EAAE,CAAC;IACxB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,IAAA,iBAAM,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACrB,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM;IAChC,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE;QACxC,aAAa,EAAE,MAAM,GAAG,CAAC,uCAAuC,CAAC;QACjE,QAAQ,EAAE,MAAM,GAAG,CAAC,gDAAgD,CAAC;QACrE,SAAS,EAAE,MAAM,GAAG,CAAC,kDAAkD,CAAC;QACxE,OAAO,EAAE,MAAM,GAAG,CAAC,sDAAsD,CAAC;QAC1E,QAAQ,EAAE,MAAM,GAAG,CAAC,uDAAuD,CAAC;QAC5E,KAAK;QACL,WAAW,EAAE,IAAA,iBAAM,EAAC,MAAM,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACpE,eAAe,EAAE,IAAA,iBAAM,EAAC,MAAM,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACvE,YAAY,EAAE,IAAA,iBAAM,EAAC,MAAM,GAAG,CAAC,yCAAyC,CAAC,EAAE,cAAc,CAAC;QAC1F,YAAY,EAAE,IAAA,iBAAM,EAAC,MAAM,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACvE,kBAAkB,EAAE,MAAM,GAAG,CAAC,wEAAwE,CAAC;KACxG,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,IAA4B,EAAE,MAAe;IACnF,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;IAC/B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,cAAc,CAAC;QAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,QAAQ,8CAA8C,EAAE,iCAAiC,CAAC,CAAC;QACxI,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,QAAQ,wJAAwJ,EAAE,iCAAiC,CAAC,CAAC;QACnP,CAAC;aAAM,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,QAAQ,4BAA4B,EAAE,kCAAkC,CAAC,CAAC;QACvH,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,QAAQ,4BAA4B,EAAE,kCAAkC,CAAC,CAAC;QACvH,CAAC;aAAM,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,QAAQ,4FAA4F,EAAE,kCAAkC,CAAC,CAAC;QACxL,CAAC;aAAM,IAAI,QAAQ,KAAK,uBAAuB,EAAE,CAAC;YAChD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,kJAAkJ,EAAE,wBAAwB,CAAC,CAAC;QACxN,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,QAAQ,uCAAuC,EAAE,wBAAwB,CAAC,CAAC;QACxH,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,2FAA2F,EAAE,wBAAwB,CAAC,CAAC;QACzM,IAAI,GAAG,CAAC,0BAA0B,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,yGAAyG,CAAC,CAAC;QACxN,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,CAAC,CAAC;QAC1D,IAAI,SAAS,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,wBAAwB,EAAE,GAAG,SAAS,+IAA+I,EAAE,qBAAqB,CAAC,CAAC;QAC5P,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,6BAA6B,IAAI,CAAC,CAAC,CAAC;QACnE,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;YAChE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,+BAA+B,EAAE,GAAG,WAAW,2BAA2B,EAAE,gCAAgC,CAAC,CAAC;QAC1I,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,KAAK,OAAO;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,6JAA6J,CAAC,CAAC;QAC3O,IAAI,GAAG,CAAC,aAAa,KAAK,KAAK,IAAI,GAAG,CAAC,mBAAmB,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,qCAAqC,EAAE,sKAAsK,CAAC,CAAC;QAC/S,IAAI,GAAG,CAAC,mBAAmB,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACrI,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,kBAAkB,EAAE,6GAA6G,EAAE,eAAe,CAAC,CAAC;QACrN,IAAI,GAAG,CAAC,qBAAqB,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,yEAAyE,CAAC,CAAC;IAChL,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,uHAAuH,EAAE,wBAAwB,CAAC,CAAC;IAC5M,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;IACzB,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;QACtC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACpD,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;QACtM,CAAC;QACD,IAAI,EAAE,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,qBAAqB,EAAE,iCAAiC,EAAE,0CAA0C,CAAC,CAAC;QACpI,CAAC;QACD,IAAI,IAAA,kBAAK,EAAC,EAAE,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,+BAA+B,EAAE,4FAA4F,EAAE,4BAA4B,CAAC,CAAC;QAC5L,CAAC;QACD,IAAI,EAAE,CAAC,gBAAgB,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,8EAA8E,CAAC,CAAC;IACpK,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;IAC1B,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,WAAW,IAAI,GAAG,uEAAuE,EAAE,uBAAuB,CAAC,CAAC;IACjM,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;IAC3B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,OAAO,mGAAmG,EAAE,uBAAuB,CAAC,CAAC;QACnL,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,OAAO,0FAA0F,EAAE,iBAAiB,CAAC,CAAC;QACrK,CAAC;QACD,IAAI,GAAG,CAAC,qBAAqB,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,uBAAuB,EAAE,qFAAqF,EAAE,iBAAiB,CAAC,CAAC;IACpM,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAA,8BAAc,EAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACrE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,iCAAiC,EAAE,GAAG,IAAI,CAAC,OAAO,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC;QACnG,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACxE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,6BAA6B,EAAE,GAAG,GAAG,CAAC,OAAO,8BAA8B,EAAE,gCAAgC,CAAC,CAAC;QAC7I,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1G,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,gCAAgC,EAAE,wCAAwC,IAAI,CAAC,WAAW,IAAI,GAAG,gFAAgF,CAAC,CAAC;IACrP,CAAC;IAED,+FAA+F;IAC/F,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,EAAE;YAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAU,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACzI,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpB,WAAW,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACnB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5G,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAU,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,wEAAwE,EAAE,OAAO,CAAC,CAAC;IACxJ,IAAI,WAAW;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,wBAAwB,EAAE,GAAG,WAAW,0GAA0G,EAAE,OAAO,CAAC,CAAC;IAEhN,2BAA2B;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC;QACxE,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE;YAC/B,GAAG;YACH,IAAI;YACJ,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,KAAK;YAC3B,SAAS,EAAE,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,YAAY,CAAC;YAC3F,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,IAAI,gBAAgB,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,kJAAkJ,EAAE,wBAAwB,CAAC,CAAC;IAC9N,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,mDAAmD,EAAE,mLAAmL,EAAE,iBAAiB,CAAC,CAAC;IAE7R,oCAAoC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC,IAAI,uFAAuF,EAAE,eAAe,CAAC,CAAC;IAC1L,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,uBAAuB,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,2IAA2I,CAAC,CAAC;IAEnQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,0EAA0E,EAAE,eAAe,CAAC,CAAC;IACjM,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,2BAA2B,EAAE,oGAAoG,EAAE,wBAAwB,CAAC,CAAC;IAEhP,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,+CAA+C,EAAE,uCAAuC,CAAC;QAC1F,CAAC,uCAAuC,EAAE,2EAA2E,CAAC;QACtH,CAAC,4BAA4B,EAAE,4BAA4B,CAAC;QAC5D,CAAC,gCAAgC,EAAE,uGAAuG,CAAC;KACnI,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,OAAO,EAAE,qDAAqD,KAAK,IAAI,CAAC,CAAC;IACtH,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,yBAAyB,IAAI,CAAC,MAAM,GAAG,EAAE;QACvD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;KACxF,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/frontegg.d.ts

@@ -0,0 +1,67 @@
+import type { SsoConnectionRecord, UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export frontegg` — a Frontegg environment onto the canonical
+ * bundle models, read with the environment's client id and API key on this
+ * machine (`POST /auth/vendor` → a management token).
+ *
+ *   - users (email, verified flag, phone, name, picture, metadata and
+ *     vendorMetadata, usernames, locked / disabled state) with each account
+ *     (tenant) membership and its roles;
+ *   - accounts (tenants) → organizations (verified SSO domains included), roles
+ *     and their permissions, user groups (kept on the user, their roles folded
+ *     into the member's roles), invitations, and each account's SAML / OIDC
+ *     SSO configuration;
+ *   - password hashes: Frontegg never returns them (its API and its docs only
+ *     IMPORT bcrypt / scrypt / firebase hashes). Turn on the `frontegg`
+ *     lazy-migration preset: Atlas checks each password against Frontegg on
+ *     the user's first sign-in.
+ *
+ * Authenticator-app and SMS second factors, passkeys, social-login provider
+ * user ids and API token secrets are not exportable: they are reported as left
+ * out with what to do instead.
+ */
+export declare const FRONTEGG_REGIONS: Record<string, string>;
+export interface FronteggConnection {
+    clientId: string;
+    apiKey: string;
+    /** `eu` (default), `us`, `ca` or `au`. */
+    region?: string;
+    /** API root override (tests, private deployments). */
+    baseUrl?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+}
+export interface FronteggExportOptions extends FronteggConnection {
+    onProgress?: (message: string) => void;
+}
+/** The API root for a region name (or an explicit override). */
+export declare function fronteggApiRoot(region: string | undefined, baseUrl?: string): string;
+/** The management client plus per-account clients (the `frontegg-tenant-id` header), all sharing one token. */
+export interface FronteggApi {
+    http: VendorHttp;
+    tenant(tenantId: string): VendorHttp;
+}
+/**
+ * Authenticates with the environment credentials (`POST /auth/vendor`) and
+ * renews the management token a minute before it expires.
+ */
+export declare function fronteggApi(c: FronteggConnection): FronteggApi;
+/** A body that is a list, or wraps one under a known key. */
+export declare function listOf(body: unknown, ...keys: string[]): Obj[];
+/** A call whose "not available" answers (feature off, no permission) mean "nothing there". */
+export declare function optional<T>(http: VendorHttp, path: string): Promise<T | null>;
+/** A metadata field: Frontegg stores it as a JSON string. */
+export declare function metadataOf(v: unknown): Obj | undefined;
+export declare function exportFrontegg(opts: FronteggExportOptions): Promise<RecordSet>;
+/** One Frontegg user (v3 listing) → a user record. */
+export declare function mapFronteggUser(u: Obj, usernames?: ReadonlyMap<string, string>): UserRecord | null;
+/**
+ * One SSO configuration of an account → a connection. The listing's exact
+ * shape is not in the public reference beyond its create request, so both the
+ * flat request names (`ssoEndpoint`, `publicCertificate`, `acsUrl`,
+ * `spEntityId`, `oidcClientId`) and `configMetadata` are read.
+ */
+export declare function mapSsoConfig(c: Obj, tenantId: string): SsoConnectionRecord | null;