@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/export/corbado.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CORBADO_BACKEND = void 0;
+exports.corbadoHttp = corbadoHttp;
+exports.exportCorbado = exportCorbado;
+exports.mapCorbadoUser = mapCorbadoUser;
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+const PAGE = 100;
+exports.CORBADO_BACKEND = 'https://backendapi.cloud.corbado.io';
+function corbadoHttp(o) {
+    if (!/^pro-\d+$/.test(o.projectId))
+        throw new Error(`Not a Corbado project id (pro-…): ${o.projectId}`);
+    if (!o.apiSecret)
+        throw new Error('Corbado needs an API secret (CORBADO_API_SECRET).');
+    return new vendor_http_1.VendorHttp({
+        vendor: 'Corbado',
+        baseUrl: (o.baseUrl ?? exports.CORBADO_BACKEND).replace(/\/+$/, ''),
+        headers: { authorization: `Basic ${Buffer.from(`${o.projectId}:${o.apiSecret}`).toString('base64')}` },
+        fetchImpl: o.fetchImpl,
+        sleep: o.sleep,
+    });
+}
+async function exportCorbado(opts) {
+    const set = new record_set_1.RecordSet();
+    const progress = opts.onProgress ?? (() => undefined);
+    const http = corbadoHttp(opts);
+    progress('users');
+    const userIds = [];
+    for (let page = 1;; page++) {
+        const { body } = await http.get(`/v2/users?page=${page}&pageSize=${PAGE}&sort=%2Bcreated&includeIdentifiers=true`);
+        const users = (0, record_set_1.objs)(body?.users);
+        for (const u of users) {
+            const mapped = mapCorbadoUser(u);
+            if (mapped === 'deleted') {
+                set.omit('user', 'deleted in Corbado');
+                continue;
+            }
+            if (!mapped) {
+                set.omit('user', 'no email, phone number or username');
+                continue;
+            }
+            set.add('user', mapped, mapped.id);
+            userIds.push(mapped.id);
+        }
+        const paging = (0, record_set_1.isObj)(body?.paging) ? body.paging : {};
+        const totalPages = typeof paging.totalPages === 'number' ? paging.totalPages : undefined;
+        if (users.length === 0 || (totalPages !== undefined ? page >= totalPages : users.length < PAGE))
+            break;
+    }
+    if (!opts.rpId) {
+        if (userIds.length > 0) {
+            set.warn('Passkeys were not exported: Corbado does not return the relying-party id they are bound to. Pass it with --corbado-rp-id and run the export again.');
+        }
+    }
+    else {
+        progress('passkeys');
+        let denied = false;
+        for (const id of userIds) {
+            if (denied)
+                break;
+            let creds;
+            try {
+                creds = (0, record_set_1.objs)((await http.get(`/v2/users/${encodeURIComponent(id)}/fullCredentials`)).body?.fullCredentials);
+            }
+            catch (err) {
+                if (err instanceof vendor_http_1.VendorApiError && err.status === 404)
+                    continue;
+                if (err instanceof vendor_http_1.VendorApiError && err.status === 403) {
+                    denied = true;
+                    set.warn('Corbado refused the passkey export (the API secret lacks the credentials:export permission): passkeys were not exported; members register them again.');
+                    continue;
+                }
+                throw err;
+            }
+            for (const c of creds) {
+                const credentialId = (0, record_set_1.str)(c.credentialID);
+                const publicKey = (0, record_set_1.str)(c.publicKey);
+                if (!credentialId || !publicKey)
+                    continue;
+                set.add('passkey', (0, record_set_1.compact)({
+                    user_id: id,
+                    credential_id: credentialId,
+                    public_key: publicKey,
+                    sign_count: typeof c.authenticatorSignCount === 'number' ? c.authenticatorSignCount : undefined,
+                    rp_id: opts.rpId,
+                    transports: (0, record_set_1.strs)(c.transports),
+                    aaguid: (0, record_set_1.str)(c.authenticatorAAGUID),
+                    backed_up: typeof c.backupState === 'boolean' ? c.backupState : undefined,
+                    created_at: typeof c.createdMs === 'number' ? c.createdMs : undefined,
+                }), credentialId);
+            }
+        }
+        if (!denied && set.count('passkey') > 0) {
+            set.warn(`Passkeys are bound to ${opts.rpId}: Atlas must be served from that domain (or one of its subdomains) for them to keep working.`);
+        }
+    }
+    set.manifest = { origin: opts.projectId, settings: { project_id: opts.projectId }, ...(opts.rpId ? { rpId: opts.rpId } : {}) };
+    return set;
+}
+/** One Corbado `userAggregate` → a user record; 'deleted' for removed users. */
+function mapCorbadoUser(u) {
+    const id = (0, record_set_1.str)(u.userID);
+    if (!id)
+        return null;
+    const status = (0, record_set_1.str)(u.status);
+    if (status === 'deleted')
+        return 'deleted';
+    const verified = (i) => (0, record_set_1.str)(i.status) !== 'pending';
+    const emails = (0, record_set_1.objs)(u.emailIdentifiers)
+        .map((i) => ({ email: (0, record_set_1.str)(i.value)?.toLowerCase(), verified: verified(i), primary: (0, record_set_1.str)(i.status) === 'primary' }))
+        .filter((e) => !!e.email && e.email.includes('@'));
+    if (emails.length > 0 && !emails.some((e) => e.primary))
+        emails[0].primary = true;
+    const phones = (0, record_set_1.objs)(u.phoneNumberIdentifiers)
+        .map((i) => ({ phone: (0, record_set_1.e164)(i.value), verified: verified(i), primary: (0, record_set_1.str)(i.status) === 'primary' }))
+        .filter((p) => !!p.phone);
+    if (phones.length > 0 && !phones.some((p) => p.primary))
+        phones[0].primary = emails.length === 0;
+    const username = (0, record_set_1.objs)(u.usernameIdentifiers).map((i) => (0, record_set_1.str)(i.value)).find(Boolean);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails: emails.map((e) => ({ ...e })),
+        phones: phones.map((p) => ({ ...p })),
+        username,
+        name: (0, record_set_1.str)(u.fullName),
+        banned: status === 'disabled' ? true : undefined,
+        created_at: typeof u.createdMS === 'number' ? u.createdMS : undefined,
+    });
+    return user.emails?.length || user.phones?.length || user.username ? user : null;
+}
+//# sourceMappingURL=corbado.js.map

package/dist/migrate/export/corbado.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"corbado.js","sourceRoot":"","sources":["../../../src/migrate/export/corbado.ts"],"names":[],"mappings":";;;AAsCA,kCAUC;AAED,sCA6EC;AAGD,wCAyBC;AA1JD,6CAA0F;AAC1F,+CAA2D;AAiC3D,MAAM,IAAI,GAAG,GAAG,CAAC;AACJ,QAAA,eAAe,GAAG,qCAAqC,CAAC;AAErE,SAAgB,WAAW,CAAC,CAA4F;IACtH,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACxG,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvF,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,uBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE;QACtG,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAE/B,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,kBAAkB,IAAI,aAAa,IAAI,0CAA0C,CAAC,CAAC;QACxH,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;gBACvD,SAAS;YACX,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;YAAE,MAAM;IACzG,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,oJAAoJ,CAAC,CAAC;QACjK,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,KAAY,CAAC;YACjB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,aAAa,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACnH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,4BAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,SAAS;gBAClE,IAAI,GAAG,YAAY,4BAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACxD,MAAM,GAAG,IAAI,CAAC;oBACd,GAAG,CAAC,IAAI,CAAC,uJAAuJ,CAAC,CAAC;oBAClK,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,YAAY,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBACzC,MAAM,SAAS,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACnC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;oBAAE,SAAS;gBAC1C,GAAG,CAAC,GAAG,CACL,SAAS,EACT,IAAA,oBAAO,EAAC;oBACN,OAAO,EAAE,EAAE;oBACX,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS;oBAC/F,KAAK,EAAE,IAAI,CAAC,IAAI;oBAChB,UAAU,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC;oBAC9B,MAAM,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,mBAAmB,CAAC;oBAClC,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;oBACzE,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;iBACtE,CAAC,EACF,YAAY,CACb,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,8FAA8F,CAAC,CAAC;QAC7I,CAAC;IACH,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/H,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,SAAgB,cAAc,CAAC,CAAM;IACnC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,CAAM,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC;IACzD,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,gBAAgB,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;SACjH,MAAM,CAAC,CAAC,CAAC,EAA+D,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,GAAG,IAAI,CAAC;IACnF,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,sBAAsB,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;SACnG,MAAM,CAAC,CAAC,CAAC,EAA+D,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAClG,MAAM,QAAQ,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,QAAQ;QACR,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;QACrB,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAChD,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC"}

package/dist/migrate/export/descope.d.ts

@@ -0,0 +1,35 @@
+import type { UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export descope` — a Descope project onto the canonical
+ * bundle models, read with a management key on this machine.
+ *
+ *   - users (login ids, verified email / phone, names, custom attributes,
+ *     project roles, tenant memberships with their roles); test users skipped;
+ *   - tenants → organizations (self-provisioning domains included), roles and
+ *     permissions, and each tenant's SSO configuration (SAML or OIDC);
+ *   - password hashes: Descope does not return them by API. Its support team
+ *     can export them (Descope stores Argon2id); pass that file with
+ *     --descope-hashes-file. Otherwise turn on the `descope` lazy-migration preset: Atlas
+ *     checks each password against Descope's password sign-in on first use.
+ *
+ * Descope does not export TOTP seeds, passkeys or access-key secrets; those
+ * are re-enrolled / reissued. Sessions are Descope JWTs, bridged by the
+ * `descope` bridge preset (project JWKS).
+ */
+export interface DescopeExportOptions {
+    projectId: string;
+    managementKey: string;
+    /** API base, for regional or custom-domain projects (default https://api.descope.com). */
+    baseUrl?: string;
+    /** The password-hash export from Descope support (CSV or NDJSON). */
+    hashesText?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+export declare function exportDescope(opts: DescopeExportOptions): Promise<RecordSet>;
+/** One Descope user (search result) → a user record. */
+export declare function mapDescopeUser(u: Obj): UserRecord | null;
+/** Descope role names are free text: `Tenant Admin` → `tenant_admin`. */
+export declare function roleKey(name: string): string;

package/dist/migrate/export/descope.js

@@ -0,0 +1,208 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportDescope = exportDescope;
+exports.mapDescopeUser = mapDescopeUser;
+exports.roleKey = roleKey;
+const csv_1 = require("../../import/csv");
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+const PAGE = 100;
+async function exportDescope(opts) {
+    const set = new record_set_1.RecordSet();
+    if (!/^P[A-Za-z0-9]{10,}$/.test(opts.projectId))
+        throw new Error(`Not a Descope project id: ${opts.projectId}`);
+    if (!opts.managementKey)
+        throw new Error('Descope export needs a management key (DESCOPE_MANAGEMENT_KEY).');
+    const progress = opts.onProgress ?? (() => undefined);
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'Descope',
+        baseUrl: (opts.baseUrl ?? 'https://api.descope.com').replace(/\/+$/, ''),
+        headers: { authorization: `Bearer ${opts.projectId}:${opts.managementKey}` },
+        fetchImpl: opts.fetchImpl,
+        sleep: opts.sleep,
+    });
+    progress('tenants');
+    const tenants = (0, record_set_1.objs)((await http.get('/v1/mgmt/tenant/all')).body?.tenants);
+    const tenantIds = new Set();
+    for (const t of tenants) {
+        const id = (0, record_set_1.str)(t.id);
+        const name = (0, record_set_1.str)(t.name) ?? id;
+        if (!id || !name)
+            continue;
+        tenantIds.add(id);
+        set.add('organization', (0, record_set_1.compact)({ id, name, domains: (0, record_set_1.strs)(t.selfProvisioningDomains), public_metadata: (0, record_set_1.bag)(t.customAttributes) }));
+    }
+    progress('roles');
+    const roles = (0, record_set_1.objs)((await optional(http, 'GET', '/v1/mgmt/role/all'))?.roles);
+    for (const r of roles) {
+        const name = (0, record_set_1.str)(r.name);
+        if (!name)
+            continue;
+        const tenantId = (0, record_set_1.str)(r.tenantId);
+        const key = roleKey(name);
+        // A Descope role serves both project-level assignment and tenant
+        // membership: it becomes an app role and an organization role.
+        set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(r.description), scope: 'app', permissions: (0, record_set_1.strs)(r.permissionNames) }), `app:${key}`);
+        set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(r.description), scope: 'organization', organization_id: tenantId && tenantIds.has(tenantId) ? tenantId : undefined, permissions: (0, record_set_1.strs)(r.permissionNames) }), `org:${tenantId ?? ''}:${key}`);
+    }
+    progress('users');
+    const hashes = opts.hashesText ? indexHashes(opts.hashesText) : null;
+    const userIds = new Set();
+    let withHash = 0;
+    for (let page = 0;; page++) {
+        const { body } = await http.post('/v2/mgmt/user/search', { limit: PAGE, page, withTestUser: false });
+        const users = (0, record_set_1.objs)(body?.users);
+        for (const u of users) {
+            const user = mapDescopeUser(u);
+            if (!user) {
+                set.omit('user', u.test === true ? 'test user' : 'no email, phone number or login id');
+                continue;
+            }
+            const h = hashes ? (hashes.get(user.id) ?? (0, record_set_1.strs)(u.loginIds).map((l) => hashes.get(l.toLowerCase())).find(Boolean)) : undefined;
+            if (h) {
+                user.password = { algorithm: 'auto', hash: h };
+                withHash++;
+            }
+            set.add('user', user);
+            userIds.add(user.id);
+            for (const t of (0, record_set_1.objs)(u.userTenants)) {
+                const tid = (0, record_set_1.str)(t.tenantId);
+                if (!tid || !tenantIds.has(tid))
+                    continue;
+                set.add('membership', { organization_id: tid, user_id: user.id, role: (0, record_set_1.strs)(t.roleNames)[0] ? roleKey((0, record_set_1.strs)(t.roleNames)[0]) : 'member' }, `${tid}:${user.id}`);
+                if ((0, record_set_1.strs)(t.roleNames).length > 1)
+                    set.warn('Some tenant members hold several Descope roles; Atlas seats each member with one role (the first).');
+            }
+            if ((0, record_set_1.isObj)(u.OAuth) && Object.values(u.OAuth).some(Boolean)) {
+                set.omit('identity', "Descope does not export social accounts' provider user ids: they relink by verified email on first social sign-in");
+            }
+            if (u.TOTP === true)
+                set.omit('mfa_factor', 'Descope does not export TOTP seeds; re-enrol in Atlas');
+            if (u.webauthn === true)
+                set.omit('passkey', 'Descope does not export passkey public keys; register again in Atlas');
+        }
+        const total = typeof body?.total === 'number' ? body.total : undefined;
+        if (users.length < PAGE || (total !== undefined && (page + 1) * PAGE >= total))
+            break;
+    }
+    if (!hashes && set.count('user') > 0) {
+        set.warn('No password hashes: Descope exports them only through its support team. Pass that file with --descope-hashes-file, or turn on the descope lazy-migration preset so each password moves on its first sign-in.');
+    }
+    else if (hashes && withHash === 0) {
+        set.warn('The hash file matched no user (by user id or login id): check its columns.');
+    }
+    progress('sso');
+    for (const tid of tenantIds)
+        await addSso(set, http, tid);
+    progress('access keys');
+    const keys = (0, record_set_1.objs)((await optional(http, 'POST', '/v1/mgmt/accesskey/search', { tenantIds: [] }))?.keys);
+    if (keys.length)
+        set.omit('api_key', 'Descope never reveals access-key secrets: reissue them as Atlas API keys', keys.length);
+    set.manifest = { origin: opts.projectId, settings: { project_id: opts.projectId } };
+    return set;
+}
+/** One Descope user (search result) → a user record. */
+function mapDescopeUser(u) {
+    const id = (0, record_set_1.str)(u.userId);
+    if (!id || u.test === true)
+        return null;
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(u.phone);
+    const loginIds = (0, record_set_1.strs)(u.loginIds);
+    // A login id that is neither the email nor the phone is a username.
+    const username = loginIds.find((l) => l.toLowerCase() !== email && (0, record_set_1.e164)(l) !== phone && !l.includes('@'));
+    const status = (0, record_set_1.str)(u.status);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails: email ? [{ email, verified: u.verifiedEmail === true, primary: true }] : [],
+        phones: phone ? [{ phone, verified: u.verifiedPhone === true, primary: !email }] : [],
+        username,
+        first_name: (0, record_set_1.str)(u.givenName),
+        last_name: (0, record_set_1.str)(u.familyName),
+        name: !(0, record_set_1.str)(u.givenName) && !(0, record_set_1.str)(u.familyName) ? (0, record_set_1.str)(u.name) : undefined,
+        image_url: (0, record_set_1.str)(u.picture),
+        roles: (0, record_set_1.strs)(u.roleNames).map(roleKey),
+        banned: status === 'disabled' ? true : undefined,
+        private_metadata: (0, record_set_1.bag)({ ...((0, record_set_1.isObj)(u.customAttributes) ? u.customAttributes : {}), ...((0, record_set_1.strs)(u.externalIds).length ? { descope_external_ids: (0, record_set_1.strs)(u.externalIds) } : {}) }),
+        created_at: typeof u.createdTime === 'number' ? u.createdTime * 1000 : undefined,
+    });
+    return user.emails?.length || user.phones?.length || user.username ? user : null;
+}
+/** Descope role names are free text: `Tenant Admin` → `tenant_admin`. */
+function roleKey(name) {
+    return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '') || 'role';
+}
+/**
+ * The support export, by user id and login id (lowercased). Its exact layout
+ * is not published: accepted as CSV with a hash column and a user id / login
+ * id / email column, or NDJSON objects with the same names.
+ */
+function indexHashes(text) {
+    const t = text.trim();
+    const rows = t.startsWith('{') ? t.split(/\r?\n/).filter((l) => l.trim()).map((l) => JSON.parse(l)) : (0, csv_1.parseCsv)(t);
+    const out = new Map();
+    for (const r of rows) {
+        const keys = Object.keys(r);
+        const hashKey = keys.find((k) => /hash/i.test(k) && !/algo/i.test(k));
+        const hash = hashKey ? (0, record_set_1.str)(r[hashKey]) : undefined;
+        if (!hash)
+            continue;
+        for (const k of keys) {
+            if (/^(user_?id|userid|login_?id|loginid|email|login_?ids)$/i.test(k)) {
+                for (const v of String(r[k] ?? '').split(/[|,;]/))
+                    if (v.trim())
+                        out.set(/user_?id/i.test(k) ? v.trim() : v.trim().toLowerCase(), hash);
+            }
+        }
+    }
+    return out;
+}
+async function addSso(set, http, tenantId) {
+    const body = (await optional(http, 'GET', `/v2/mgmt/sso/settings?tenantId=${encodeURIComponent(tenantId)}`)) ?? (await optional(http, 'GET', `/v1/mgmt/sso/settings?tenantId=${encodeURIComponent(tenantId)}`));
+    if (!body)
+        return;
+    const saml = (0, record_set_1.isObj)(body.saml) ? body.saml : undefined;
+    const oidc = (0, record_set_1.isObj)(body.oidc) ? body.oidc : undefined;
+    const domains = [...(0, record_set_1.strs)(body.domains), ...((0, record_set_1.str)(body.domain) ? [(0, record_set_1.str)(body.domain)] : []), ...((0, record_set_1.isObj)(body.tenant) ? (0, record_set_1.strs)(body.tenant.domains) : [])];
+    if (saml && ((0, record_set_1.str)(saml.idpEntityId) || (0, record_set_1.str)(saml.idpMetadataUrl) || (0, record_set_1.str)(saml.idpSSOUrl))) {
+        const mapping = (0, record_set_1.isObj)(saml.attributeMapping) ? saml.attributeMapping : undefined;
+        set.add('sso_connection', (0, record_set_1.compact)({
+            id: `${tenantId}:saml`,
+            name: `${tenantId} SAML`,
+            organization_id: tenantId,
+            protocol: 'saml',
+            domains: [...new Set(domains)],
+            saml: (0, record_set_1.compact)({
+                idp_entity_id: (0, record_set_1.str)(saml.idpEntityId),
+                idp_sso_url: (0, record_set_1.str)(saml.idpSSOUrl),
+                idp_certificate: (0, record_set_1.str)(saml.idpCertificate),
+                idp_metadata_url: (0, record_set_1.str)(saml.idpMetadataUrl),
+                sp_entity_id: (0, record_set_1.str)(saml.spEntityId),
+                sp_acs_url: (0, record_set_1.str)(saml.spACSUrl),
+                attribute_mapping: mapping ? Object.fromEntries(Object.entries(mapping).filter(([, v]) => typeof v === 'string' && v)) : undefined,
+            }),
+        }));
+    }
+    else if (oidc && ((0, record_set_1.str)(oidc.issuer) || (0, record_set_1.str)(oidc.clientId))) {
+        set.add('sso_connection', (0, record_set_1.compact)({
+            id: `${tenantId}:oidc`,
+            name: (0, record_set_1.str)(oidc.name) ?? `${tenantId} OIDC`,
+            organization_id: tenantId,
+            protocol: 'oidc',
+            domains: [...new Set(domains)],
+            oidc: (0, record_set_1.compact)({ issuer: (0, record_set_1.str)(oidc.issuer), discovery_url: (0, record_set_1.str)(oidc.wellKnownUrl), client_id: (0, record_set_1.str)(oidc.clientId), scopes: (0, record_set_1.strs)(oidc.scope) }),
+        }));
+        set.warn(`Tenant ${tenantId} OIDC SSO: Descope does not return the client secret; enter it in Atlas after the import.`);
+    }
+}
+async function optional(http, method, path, body) {
+    try {
+        return (await http.request(method, path, body)).body;
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404, 405].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+//# sourceMappingURL=descope.js.map

package/dist/migrate/export/descope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descope.js","sourceRoot":"","sources":["../../../src/migrate/export/descope.ts"],"names":[],"mappings":";;AAqCA,sCAgGC;AAGD,wCAwBC;AAGD,0BAEC;AApKD,0CAA4C;AAC5C,6CAA+F;AAC/F,+CAA2D;AAgC3D,MAAM,IAAI,GAAG,GAAG,CAAC;AAEV,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC5G,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,yBAAyB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE;QAC5E,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,QAAQ,CAAC,SAAS,CAAC,CAAC;IACpB,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAS;QAC3B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,GAAG,CAAC,GAAG,CACL,cAAc,EACd,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAC1G,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,MAAM,QAAQ,CAAM,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,iEAAiE;QACjE,+DAA+D;QAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;QACpJ,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,cAAuB,EAAE,eAAe,EAAE,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,EAC1M,OAAO,QAAQ,IAAI,EAAE,IAAI,GAAG,EAAE,CAC/B,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,sBAAsB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1G,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC;gBACvF,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/H,IAAI,CAAC,EAAE,CAAC;gBACN,IAAI,CAAC,QAAQ,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/C,QAAQ,EAAE,CAAC;YACb,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC1C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/J,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;YACnJ,CAAC;YACD,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,mHAAmH,CAAC,CAAC;YAC5I,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,uDAAuD,CAAC,CAAC;YACrG,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,sEAAsE,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM;IACxF,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CACN,8MAA8M,CAC/M,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IACzF,CAAC;IAED,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,SAAS;QAAE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAE1D,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,CAAC,MAAM,QAAQ,CAAM,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7G,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,0EAA0E,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE9H,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wDAAwD;AACxD,SAAgB,cAAc,CAAC,CAAM;IACnC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClC,oEAAoE;IACpE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACnF,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACrF,QAAQ;QACR,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;QACzB,KAAK,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACrC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAChD,gBAAgB,EAAE,IAAA,gBAAG,EAAC,EAAE,GAAG,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACzK,UAAU,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;KACjF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED,yEAAyE;AACzE,SAAgB,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,IAAI,GAAU,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,cAAQ,EAAC,CAAC,CAAC,CAAC;IAChI,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,yDAAyD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,IAAI,CAAC,CAAC,IAAI,EAAE;wBAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;YAC1I,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAc,EAAE,IAAgB,EAAE,QAAgB;IACtE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAM,IAAI,EAAE,KAAK,EAAE,kCAAkC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAM,IAAI,EAAE,KAAK,EAAE,kCAAkC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1N,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpJ,IAAI,IAAI,IAAI,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,cAAc,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;YACN,EAAE,EAAE,GAAG,QAAQ,OAAO;YACtB,IAAI,EAAE,GAAG,QAAQ,OAAO;YACxB,eAAe,EAAE,QAAQ;YACzB,QAAQ,EAAE,MAAe;YACzB,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,aAAa,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,WAAW,CAAC;gBACpC,WAAW,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,SAAS,CAAC;gBAChC,eAAe,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,cAAc,CAAC;gBACzC,gBAAgB,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,cAAc,CAAC;gBAC1C,YAAY,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,UAAU,CAAC;gBAClC,UAAU,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,QAAQ,CAAC;gBAC9B,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,SAAS;aAC/J,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,IAAI,IAAI,IAAI,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;YACN,EAAE,EAAE,GAAG,QAAQ,OAAO;YACtB,IAAI,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,QAAQ,OAAO;YAC1C,eAAe,EAAE,QAAQ;YACzB,QAAQ,EAAE,MAAe;YACzB,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;SAC5I,CAAC,CACH,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,UAAU,QAAQ,2FAA2F,CAAC,CAAC;IAC1H,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,IAAgB,EAAE,MAAsB,EAAE,IAAY,EAAE,IAAc;IAC/F,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/migrate/export/fake-vendor.test-helper.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A fake vendor API for exporter tests: routes are `METHOD path?query` (the
+ * query as the exporter sends it) → a JSON body, a status + body, or a
+ * function of the request. Unrouted calls answer 404, so an exporter that
+ * calls something unexpected degrades the way it would against a vendor that
+ * lacks the endpoint. Every call is recorded (with its headers) for assertions.
+ */
+export type Route = unknown | {
+    status: number;
+    body?: unknown;
+    headers?: Record<string, string>;
+} | ((req: {
+    url: URL;
+    body: unknown;
+    headers: Headers;
+}) => unknown);
+export interface FakeVendor {
+    fetchImpl: typeof fetch;
+    calls: Array<{
+        method: string;
+        url: string;
+        headers: Headers;
+        body: unknown;
+    }>;
+}
+export declare function fakeVendor(origin: string, routes: Record<string, Route>): FakeVendor;
+export declare const noSleep: () => Promise<undefined>;

package/dist/migrate/export/fake-vendor.test-helper.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noSleep = void 0;
+exports.fakeVendor = fakeVendor;
+const isStatus = (v) => typeof v === 'object' && v !== null && 'status' in v && typeof v.status === 'number' && Object.keys(v).every((k) => ['status', 'body', 'headers'].includes(k));
+function fakeVendor(origin, routes) {
+    const calls = [];
+    const fetchImpl = (async (input, init = {}) => {
+        const url = new URL(String(input));
+        const method = (init.method ?? 'GET').toUpperCase();
+        const headers = new Headers(init.headers);
+        let body = init.body;
+        if (typeof body === 'string') {
+            try {
+                body = JSON.parse(body);
+            }
+            catch {
+                // form-encoded or plain text: kept as the string
+            }
+        }
+        calls.push({ method, url: url.toString(), headers, body });
+        const key = url.origin === origin ? `${method} ${url.pathname}${url.search}` : `${method} ${url.toString()}`;
+        let route = routes[key];
+        if (route === undefined)
+            route = routes[`${method} ${url.pathname}`];
+        if (route === undefined)
+            return new Response(JSON.stringify({ message: `no route for ${key}` }), { status: 404 });
+        const value = typeof route === 'function' ? route({ url, body, headers }) : route;
+        if (value instanceof Uint8Array)
+            return new Response(value, { status: 200 });
+        const resolved = isStatus(value) ? value : { status: 200, body: value };
+        return new Response(resolved.body === undefined ? '' : JSON.stringify(resolved.body), {
+            status: resolved.status,
+            headers: { 'content-type': 'application/json', ...(resolved.headers ?? {}) },
+        });
+    });
+    return { fetchImpl, calls };
+}
+const noSleep = async () => undefined;
+exports.noSleep = noSleep;
+//# sourceMappingURL=fake-vendor.test-helper.js.map

package/dist/migrate/export/fake-vendor.test-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-vendor.test-helper.js","sourceRoot":"","sources":["../../../src/migrate/export/fake-vendor.test-helper.ts"],"names":[],"mappings":";;;AAiBA,gCA4BC;AA/BD,MAAM,QAAQ,GAAG,CAAC,CAAU,EAA6E,EAAE,CACzG,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,QAAQ,IAAI,CAAC,IAAI,OAAQ,CAAyB,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1L,SAAgB,UAAU,CAAC,MAAc,EAAE,MAA6B;IACtE,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,KAA6B,EAAE,OAAoB,EAAE,EAAE,EAAE;QACjF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,IAAI,GAAY,IAAI,CAAC,IAAI,CAAC;QAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,iDAAiD;YACnD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7G,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,GAAG,MAAM,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAuE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACrJ,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACpF,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC,CAAiB,CAAC;IACnB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAEM,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;AAAhC,QAAA,OAAO,WAAyB"}

package/dist/migrate/export/firebase-config.d.ts

@@ -0,0 +1,24 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { type VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate firebase config` — a Firebase / Identity Platform project's
+ * auth settings → Atlas config.
+ *
+ * Read with the same credentials as the export from the Identity Toolkit
+ * admin v2 API: the project `config` (sign-in methods, MFA, password policy,
+ * authorized domains, blocking functions …), the built-in social providers
+ * (`defaultSupportedIdpConfigs`), OIDC providers (`oauthIdpConfigs`), SAML
+ * providers (`inboundSamlConfigs`) and, on Identity Platform, the tenants.
+ * Every report line names the setting path in that API.
+ */
+export interface FirebaseConfigSnapshot {
+    projectId: string;
+    config: Obj;
+    defaultIdps: Obj[];
+    oidcIdps: Obj[];
+    samlIdps: Obj[];
+    tenants: Obj[];
+}
+export declare function fetchFirebaseConfig(http: VendorHttp, projectId: string): Promise<FirebaseConfigSnapshot>;
+export declare function translateFirebaseConfig(snap: FirebaseConfigSnapshot): TranslationResult;