@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/export/fusionauth.js

@@ -0,0 +1,642 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fusionAuthPassword = fusionAuthPassword;
+exports.fusionAuthBase = fusionAuthBase;
+exports.fusionAuthHttp = fusionAuthHttp;
+exports.fetchFusionAuth = fetchFusionAuth;
+exports.fusionAuthSnapshotFromTables = fusionAuthSnapshotFromTables;
+exports.mapFusionAuth = mapFusionAuth;
+exports.exportFusionAuth = exportFusionAuth;
+const node_crypto_1 = require("node:crypto");
+const tables_1 = require("./frameworks/tables");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+// ── password schemes ────────────────────────────────────────────────────────
+/**
+ * A FusionAuth password (`password`, `salt`, `factor`, `encryption_scheme`) →
+ * an Atlas hash. Schemes and their registry ids are documented in core's
+ * fusionauth-hashes.ts; salts are base64 except bcrypt's 22-character salt.
+ */
+function fusionAuthPassword(u) {
+    const value = (0, record_set_1.str)(u.password);
+    if (!value)
+        return null;
+    const scheme = (0, record_set_1.str)(u.encryptionScheme)?.toLowerCase();
+    const salt = (0, record_set_1.str)(u.salt);
+    const factor = Number(u.factor);
+    if (!scheme)
+        return { problem: 'no encryption scheme' };
+    const needs = (what) => ({ problem: `${scheme} without ${what}` });
+    if (scheme === 'bcrypt') {
+        if (!salt || !Number.isInteger(factor) || factor < 4 || factor > 31)
+            return needs('a salt or cost factor');
+        return { hash: { algorithm: 'bcrypt', hash: `$2a$${String(factor).padStart(2, '0')}$${salt}${value}` } };
+    }
+    const pbkdf2 = /^salted-pbkdf2-hmac-(sha256|sha512)(?:-512)?$/.exec(scheme);
+    if (pbkdf2) {
+        if (!salt || !Number.isInteger(factor) || factor < 1)
+            return needs('a salt or iteration count');
+        return { hash: { algorithm: 'pbkdf2', hash: value, salt, params: { digest: pbkdf2[1], iterations: factor, encoding: 'base64', salt_encoding: 'base64' } } };
+    }
+    if (scheme === 'salted-hmac-sha256') {
+        if (!salt)
+            return needs('a salt');
+        return { hash: { algorithm: 'hmac_sha256', hash: value, salt, params: { key_encoding: 'base64', encoding: 'base64' } } };
+    }
+    if (scheme === 'salted-md5' || scheme === 'salted-sha256') {
+        if (!salt || !Number.isInteger(factor) || factor < 1)
+            return needs('a salt or factor');
+        return { hash: { algorithm: 'fusionauth_salted', hash: value, salt, params: { digest: scheme === 'salted-md5' ? 'md5' : 'sha256', iterations: factor } } };
+    }
+    if (scheme === 'phpass-md5' || scheme === 'phppass-sha512' || scheme === 'phpass-sha512') {
+        if (!salt || !Number.isInteger(factor) || factor < 1)
+            return needs('a salt or factor');
+        return { hash: { algorithm: 'fusionauth_phpass', hash: value, salt, params: { digest: scheme === 'phpass-md5' ? 'md5' : 'sha512', iterations: factor } } };
+    }
+    return { problem: `the "${scheme}" scheme (a custom password plugin)` };
+}
+function fusionAuthBase(raw) {
+    const s = raw.trim().replace(/\/+$/, '');
+    return /^https?:\/\//.test(s) ? s : `https://${s}`;
+}
+function fusionAuthHttp(o) {
+    return new vendor_http_1.VendorHttp({
+        vendor: 'FusionAuth',
+        baseUrl: fusionAuthBase(o.baseUrl),
+        headers: { authorization: o.apiKey, ...(o.tenantId ? { 'X-FusionAuth-TenantId': o.tenantId } : {}) },
+        fetchImpl: o.fetchImpl,
+        sleep: o.sleep,
+    });
+}
+/** Read a tenant through the API into a snapshot. */
+async function fetchFusionAuth(http, o) {
+    const progress = o.onProgress ?? (() => undefined);
+    const warn = o.warn ?? (() => undefined);
+    const size = Math.min(Math.max(o.pageSize ?? 100, 1), 1000);
+    /** A resource the key may not read (401/403) or this version lacks (404). */
+    const optional = async (path, what, pick, empty) => {
+        try {
+            const { body } = await http.get(path);
+            return (0, record_set_1.isObj)(body) ? pick(body) : empty;
+        }
+        catch (err) {
+            if (!(err instanceof vendor_http_1.VendorApiError) || ![401, 403, 404].includes(err.status))
+                throw err;
+            if (err.status !== 404)
+                warn(`${what} could not be read with this API key (${err.status}) and were skipped.`);
+            return empty;
+        }
+    };
+    progress('tenants and applications');
+    const tenants = await optional('/api/tenant', 'Tenants', (b) => (0, record_set_1.objs)(b.tenants), []);
+    const applications = await optional('/api/application', 'Applications', (b) => (0, record_set_1.objs)(b.applications), []);
+    progress('groups');
+    const groups = await optional('/api/group', 'Groups', (b) => (0, record_set_1.objs)(b.groups), []);
+    progress('identity providers');
+    const identityProviders = await optional('/api/identity-provider', 'Identity providers', (b) => (0, record_set_1.objs)(b.identityProviders), []);
+    const keys = {};
+    for (const idp of identityProviders) {
+        const keyId = (0, record_set_1.str)(idp.keyId);
+        if (!keyId || keys[keyId])
+            continue;
+        const pem = await optional(`/api/key/${encodeURIComponent(keyId)}`, `Key ${keyId}`, (b) => ((0, record_set_1.isObj)(b.key) ? (0, record_set_1.str)(b.key.publicKey) : undefined), undefined);
+        if (pem)
+            keys[keyId] = pem;
+    }
+    progress('API keys');
+    const apiKeys = await optional('/api/api-key', 'API keys', (b) => (0, record_set_1.objs)(b.apiKeys), []);
+    progress('users');
+    const users = [];
+    for (let startRow = 0;; startRow += size) {
+        const { body } = await http.post('/api/user/search', { search: { queryString: '*', numberOfResults: size, startRow } });
+        const page = (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body.users) : [];
+        users.push(...page);
+        const total = (0, record_set_1.isObj)(body) && typeof body.total === 'number' ? body.total : undefined;
+        if (page.length < size || (total !== undefined && startRow + size >= total))
+            break;
+    }
+    for (const [i, u] of users.entries()) {
+        const id = (0, record_set_1.str)(u.id);
+        if (!id)
+            continue;
+        if (i > 0 && i % 100 === 0)
+            progress(`users (${i}/${users.length})`);
+        u.links = await optional(`/api/identity-provider/link?userId=${encodeURIComponent(id)}`, 'Identity provider links', (b) => (0, record_set_1.objs)(b.identityProviderLinks), []);
+        const methods = (0, record_set_1.isObj)(u.twoFactor) ? (0, record_set_1.objs)(u.twoFactor.methods) : [];
+        if (methods.length)
+            u.recoveryCodes = await optional(`/api/user/two-factor/recovery-code/${encodeURIComponent(id)}`, 'Recovery codes', (b) => (0, record_set_1.strs)(b.recoveryCodes), []);
+    }
+    return { baseUrl: fusionAuthBase(o.baseUrl), tenants, applications, groups, identityProviders, keys, apiKeys, users, source: 'api' };
+}
+const roleLookup = (rows, idCol) => new Map(rows.map((r) => [(0, tables_1.text)((0, tables_1.col)(r, ...idCol)) ?? '', r]));
+/**
+ * A snapshot from a dump of a self-hosted FusionAuth database: one file per
+ * table (`psql \copy users TO 'users.csv' CSV HEADER`, or `mysql … --batch`
+ * converted, or a JSON array), named as in FusionAuth's schema: `users`,
+ * `identities` (1.59+), `tenants`, `applications`, `application_roles`,
+ * `user_registrations`, `user_registrations_application_roles`, `groups`,
+ * `group_members`, `group_application_roles`, `identity_providers`,
+ * `identity_provider_links`, `twofactor_methods`, `twofactor_recovery_codes`,
+ * `api_keys`, `keys`.
+ */
+function fusionAuthSnapshotFromTables(t) {
+    const tenantRows = t.rows('tenants');
+    const tenants = tenantRows.map((r) => {
+        const data = (0, tables_1.json)((0, tables_1.col)(r, 'data')) ?? {};
+        return (0, record_set_1.compact)({ id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), name: (0, tables_1.text)((0, tables_1.col)(r, 'name')), issuer: (0, tables_1.text)(data.issuer) ?? (0, tables_1.text)((0, tables_1.col)(r, 'issuer')) });
+    });
+    const appRoles = t.rows('application_roles');
+    const roleById = roleLookup(appRoles, ['id']);
+    const rolesByApp = new Map();
+    for (const r of appRoles) {
+        const appId = (0, tables_1.text)((0, tables_1.col)(r, 'applications_id', 'application_id'));
+        if (!appId)
+            continue;
+        const list = rolesByApp.get(appId) ?? [];
+        list.push({ id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), name: (0, tables_1.text)((0, tables_1.col)(r, 'name')), isDefault: (0, tables_1.bool)((0, tables_1.col)(r, 'is_default')), isSuperRole: (0, tables_1.bool)((0, tables_1.col)(r, 'is_super_role')) });
+        rolesByApp.set(appId, list);
+    }
+    const applications = t.rows('applications').map((r) => ({
+        id: (0, tables_1.text)((0, tables_1.col)(r, 'id')),
+        name: (0, tables_1.text)((0, tables_1.col)(r, 'name')),
+        tenantId: (0, tables_1.text)((0, tables_1.col)(r, 'tenants_id', 'tenant_id')),
+        roles: rolesByApp.get((0, tables_1.text)((0, tables_1.col)(r, 'id')) ?? '') ?? [],
+    }));
+    const groupRoles = new Map();
+    for (const r of t.rows('group_application_roles')) {
+        const role = roleById.get((0, tables_1.text)((0, tables_1.col)(r, 'application_roles_id', 'application_role_id')) ?? '');
+        const gid = (0, tables_1.text)((0, tables_1.col)(r, 'groups_id', 'group_id'));
+        const name = role && (0, tables_1.text)((0, tables_1.col)(role, 'name'));
+        const appId = role && (0, tables_1.text)((0, tables_1.col)(role, 'applications_id', 'application_id'));
+        if (!gid || !name || !appId)
+            continue;
+        const m = groupRoles.get(gid) ?? {};
+        (m[appId] ??= []).push(name);
+        groupRoles.set(gid, m);
+    }
+    const groups = t.rows('groups').map((r) => ({ id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), name: (0, tables_1.text)((0, tables_1.col)(r, 'name')), tenantId: (0, tables_1.text)((0, tables_1.col)(r, 'tenants_id', 'tenant_id')), roles: groupRoles.get((0, tables_1.text)((0, tables_1.col)(r, 'id')) ?? '') ?? {} }));
+    const memberships = new Map();
+    for (const r of t.rows('group_members')) {
+        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
+        if (!uid)
+            continue;
+        (memberships.get(uid) ?? memberships.set(uid, []).get(uid)).push({ groupId: (0, tables_1.text)((0, tables_1.col)(r, 'groups_id', 'group_id')) });
+    }
+    const regRoles = new Map();
+    for (const r of t.rows('user_registrations_application_roles')) {
+        const role = roleById.get((0, tables_1.text)((0, tables_1.col)(r, 'application_roles_id', 'application_role_id')) ?? '');
+        const rid = (0, tables_1.text)((0, tables_1.col)(r, 'user_registrations_id', 'user_registration_id'));
+        const name = role && (0, tables_1.text)((0, tables_1.col)(role, 'name'));
+        if (rid && name)
+            (regRoles.get(rid) ?? regRoles.set(rid, []).get(rid)).push(name);
+    }
+    const registrations = new Map();
+    for (const r of t.rows('user_registrations')) {
+        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
+        if (!uid)
+            continue;
+        (registrations.get(uid) ?? registrations.set(uid, []).get(uid)).push({
+            applicationId: (0, tables_1.text)((0, tables_1.col)(r, 'applications_id', 'application_id')),
+            username: (0, tables_1.text)((0, tables_1.col)(r, 'username')),
+            verified: (0, tables_1.bool)((0, tables_1.col)(r, 'verified')),
+            roles: regRoles.get((0, tables_1.text)((0, tables_1.col)(r, 'id')) ?? '') ?? [],
+        });
+    }
+    const links = new Map();
+    for (const r of t.rows('identity_provider_links', 'identity_providers_links')) {
+        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
+        if (!uid)
+            continue;
+        (links.get(uid) ?? links.set(uid, []).get(uid)).push({
+            identityProviderId: (0, tables_1.text)((0, tables_1.col)(r, 'identity_providers_id', 'identity_provider_id')),
+            identityProviderUserId: (0, tables_1.text)((0, tables_1.col)(r, 'identity_provider_user_id')),
+            displayName: (0, tables_1.text)((0, tables_1.col)(r, 'display_name')),
+        });
+    }
+    const methods = new Map();
+    for (const r of t.rows('twofactor_methods', 'two_factor_methods')) {
+        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
+        if (!uid)
+            continue;
+        const settings = (0, tables_1.json)((0, tables_1.col)(r, 'settings', 'data')) ?? {};
+        const authenticator = (0, record_set_1.isObj)(settings.authenticator) ? settings.authenticator : {};
+        (methods.get(uid) ?? methods.set(uid, []).get(uid)).push((0, record_set_1.compact)({ id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), method: (0, tables_1.text)((0, tables_1.col)(r, 'method')), mobilePhone: (0, tables_1.text)((0, tables_1.col)(r, 'mobile_phone')), email: (0, tables_1.text)((0, tables_1.col)(r, 'email')), authenticator: (0, record_set_1.compact)({ ...authenticator, secret: (0, tables_1.text)((0, tables_1.col)(r, 'secret')) }) }));
+    }
+    const recovery = new Map();
+    for (const r of t.rows('twofactor_recovery_codes', 'two_factor_recovery_codes')) {
+        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
+        const raw = (0, tables_1.col)(r, 'recovery_codes', 'codes');
+        let codes = [];
+        if (Array.isArray(raw))
+            codes = (0, record_set_1.strs)(raw);
+        else if (typeof raw === 'string') {
+            try {
+                const parsed = JSON.parse(raw);
+                codes = Array.isArray(parsed) ? (0, record_set_1.strs)(parsed) : [];
+            }
+            catch {
+                codes = raw.split(/[\s,;]+/).filter(Boolean);
+            }
+        }
+        if (uid && codes.length)
+            recovery.set(uid, codes);
+    }
+    // 1.59+ keeps email / username in `identities`; older versions have them on `users`.
+    const identities = new Map();
+    for (const r of t.rows('identities')) {
+        const uid = (0, tables_1.text)((0, tables_1.col)(r, 'users_id', 'user_id'));
+        if (uid)
+            (identities.get(uid) ?? identities.set(uid, []).get(uid)).push(r);
+    }
+    const users = t.rows('users').map((r) => {
+        const id = (0, tables_1.text)((0, tables_1.col)(r, 'id'));
+        const idents = identities.get(id) ?? [];
+        const emailRow = idents.find((i) => (0, tables_1.text)((0, tables_1.col)(i, 'email')));
+        const nameRow = idents.find((i) => (0, tables_1.text)((0, tables_1.col)(i, 'username')));
+        const data = (0, tables_1.json)((0, tables_1.col)(r, 'data')) ?? {};
+        const mfa = methods.get(id) ?? [];
+        // Before 1.26 a single secret lived on the user row.
+        const legacySecret = (0, tables_1.text)((0, tables_1.col)(r, 'two_factor_secret'));
+        if (!mfa.length && legacySecret)
+            mfa.push({ method: 'authenticator', authenticator: { secret: legacySecret } });
+        return (0, record_set_1.compact)({
+            id,
+            tenantId: (0, tables_1.text)((0, tables_1.col)(r, 'tenants_id', 'tenant_id')),
+            email: (0, tables_1.text)((0, tables_1.col)(emailRow ?? r, 'email')),
+            verified: (0, tables_1.bool)((0, tables_1.col)(emailRow ?? r, 'verified')),
+            username: (0, tables_1.text)((0, tables_1.col)(nameRow ?? r, 'username')),
+            firstName: (0, tables_1.text)((0, tables_1.col)(r, 'first_name')),
+            lastName: (0, tables_1.text)((0, tables_1.col)(r, 'last_name')),
+            fullName: (0, tables_1.text)((0, tables_1.col)(r, 'full_name')),
+            mobilePhone: (0, tables_1.text)((0, tables_1.col)(r, 'mobile_phone')),
+            imageUrl: (0, tables_1.text)((0, tables_1.col)(r, 'image_url')),
+            active: (0, tables_1.col)(r, 'active') === undefined ? true : (0, tables_1.bool)((0, tables_1.col)(r, 'active')),
+            insertInstant: (0, tables_1.time)((0, tables_1.col)(r, 'insert_instant')),
+            lastLoginInstant: (0, tables_1.time)((0, tables_1.col)(r, 'last_login_instant')),
+            passwordChangeRequired: (0, tables_1.bool)((0, tables_1.col)(r, 'password_change_required')),
+            data,
+            password: (0, tables_1.text)((0, tables_1.col)(r, 'password')),
+            salt: (0, tables_1.text)((0, tables_1.col)(r, 'salt')),
+            factor: (0, tables_1.col)(r, 'factor'),
+            encryptionScheme: (0, tables_1.text)((0, tables_1.col)(r, 'encryption_scheme')),
+            registrations: registrations.get(id) ?? [],
+            memberships: memberships.get(id) ?? [],
+            twoFactor: mfa.length ? { methods: mfa } : undefined,
+            links: links.get(id) ?? [],
+            recoveryCodes: recovery.get(id),
+        });
+    });
+    const idps = t.rows('identity_providers').map((r) => {
+        const data = (0, tables_1.json)((0, tables_1.col)(r, 'data', 'settings')) ?? {};
+        return { ...data, id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), type: (0, tables_1.text)((0, tables_1.col)(r, 'type')), name: (0, tables_1.text)((0, tables_1.col)(r, 'name')), enabled: (0, tables_1.col)(r, 'enabled') === undefined ? true : (0, tables_1.bool)((0, tables_1.col)(r, 'enabled')), keyId: (0, tables_1.text)((0, tables_1.col)(r, 'keys_id', 'key_id')) ?? (0, tables_1.text)(data.keyId) };
+    });
+    const keys = {};
+    for (const r of t.rows('keys')) {
+        const id = (0, tables_1.text)((0, tables_1.col)(r, 'id'));
+        const pem = (0, tables_1.text)((0, tables_1.col)(r, 'public_key', 'certificate'));
+        if (id && pem)
+            keys[id] = pem;
+    }
+    const apiKeys = t.rows('api_keys').map((r) => (0, record_set_1.compact)({
+        id: (0, tables_1.text)((0, tables_1.col)(r, 'id')),
+        key: (0, tables_1.text)((0, tables_1.col)(r, 'key_value', 'key')),
+        keyManager: (0, tables_1.bool)((0, tables_1.col)(r, 'key_manager')),
+        metaData: (0, tables_1.json)((0, tables_1.col)(r, 'meta_data', 'metadata')),
+        tenantId: (0, tables_1.text)((0, tables_1.col)(r, 'tenants_id', 'tenant_id')),
+        expirationInstant: (0, tables_1.time)((0, tables_1.col)(r, 'expiration_instant', 'expiration')),
+        insertInstant: (0, tables_1.time)((0, tables_1.col)(r, 'insert_instant')),
+    }));
+    return { tenants, applications, groups, identityProviders: idps, keys, apiKeys, users, source: 'database' };
+}
+// ── mapping ─────────────────────────────────────────────────────────────────
+/** Enterprise identity providers: SSO connections, not social sign-in. */
+const ENTERPRISE = new Set(['SAMLv2', 'OpenIDConnect', 'SAMLv2IdPInitiated']);
+const epoch = (v) => (typeof v === 'number' && v > 0 ? v : typeof v === 'string' ? (Date.parse(v) || undefined) : undefined);
+function authenticatorSecret(raw) {
+    // FusionAuth keeps the authenticator secret base64 encoded; Atlas wants base32.
+    const bytes = Buffer.from(raw, 'base64');
+    if (!bytes.length)
+        return undefined;
+    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+    let bits = 0;
+    let acc = 0;
+    let out = '';
+    for (const b of bytes) {
+        acc = (acc << 8) | b;
+        bits += 8;
+        while (bits >= 5) {
+            out += alphabet[(acc >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        out += alphabet[(acc << (5 - bits)) & 31];
+    return out;
+}
+/** Map a snapshot (API or database) onto canonical records. */
+function mapFusionAuth(snap, opts = {}) {
+    const set = new record_set_1.RecordSet();
+    const groupsAs = opts.groupsAs ?? 'organizations';
+    const tenantsAs = opts.tenantsAs ?? (snap.tenants.length > 1 ? 'organizations' : 'skip');
+    const tenantName = new Map(snap.tenants.map((t) => [(0, record_set_1.str)(t.id) ?? '', (0, record_set_1.str)(t.name) ?? (0, record_set_1.str)(t.id) ?? '']));
+    const appName = new Map(snap.applications.map((a) => [(0, record_set_1.str)(a.id) ?? '', (0, record_set_1.str)(a.name) ?? '']));
+    // ── organizations: tenants and groups ──
+    const orgIds = new Set();
+    if (tenantsAs === 'organizations') {
+        for (const t of snap.tenants) {
+            const id = (0, record_set_1.str)(t.id);
+            if (!id)
+                continue;
+            orgIds.add(`tenant:${id}`);
+            set.add('organization', (0, record_set_1.compact)({ id: `tenant:${id}`, name: tenantName.get(id), slug: (0, translate_kit_1.keyOf)(tenantName.get(id)).replace(/_/g, '-'), private_metadata: { fusionauth_tenant_id: id, fusionauth_issuer: (0, record_set_1.str)(t.issuer) } }));
+        }
+    }
+    const groups = new Map();
+    for (const g of snap.groups)
+        if ((0, record_set_1.str)(g.id) && (0, record_set_1.str)(g.name))
+            groups.set((0, record_set_1.str)(g.id), g);
+    if (groupsAs === 'organizations') {
+        for (const g of groups.values()) {
+            const id = (0, record_set_1.str)(g.id);
+            orgIds.add(`group:${id}`);
+            set.add('organization', { id: `group:${id}`, name: (0, record_set_1.str)(g.name), slug: (0, translate_kit_1.keyOf)((0, record_set_1.str)(g.name)).replace(/_/g, '-'), private_metadata: { fusionauth_group_id: id } });
+        }
+    }
+    if (orgIds.size)
+        set.add('role', { key: 'member', name: 'Member', scope: 'organization' }, 'org:member');
+    // ── roles: application roles (FusionAuth puts the plain names in the JWT roles claim) ──
+    for (const app of snap.applications) {
+        for (const r of (0, record_set_1.objs)(app.roles)) {
+            const name = (0, record_set_1.str)(r.name);
+            if (!name)
+                continue;
+            set.add('role', (0, record_set_1.compact)({ key: (0, translate_kit_1.keyOf)(name), name, description: r.isSuperRole === true ? `Super role of ${appName.get((0, record_set_1.str)(app.id) ?? '') || 'an application'}` : undefined, scope: 'app' }), (0, translate_kit_1.keyOf)(name));
+        }
+    }
+    if (groupsAs === 'roles') {
+        for (const g of groups.values())
+            set.add('role', { key: `group:${(0, translate_kit_1.keyOf)((0, record_set_1.str)(g.name))}`, name: (0, record_set_1.str)(g.name), description: 'FusionAuth group', scope: 'app' }, `group:${(0, translate_kit_1.keyOf)((0, record_set_1.str)(g.name))}`);
+    }
+    // ── identity providers ──
+    const idps = new Map();
+    for (const idp of snap.identityProviders)
+        if ((0, record_set_1.str)(idp.id))
+            idps.set((0, record_set_1.str)(idp.id), idp);
+    const connections = new Set();
+    for (const [id, idp] of idps) {
+        const type = (0, record_set_1.str)(idp.type) ?? '';
+        if (!ENTERPRISE.has(type))
+            continue;
+        if (type === 'SAMLv2IdPInitiated') {
+            set.omit('sso_connection', `IdP-initiated SAML provider ${(0, record_set_1.str)(idp.name) ?? id}: Atlas SAML connections are SP-initiated`);
+            continue;
+        }
+        set.add('sso_connection', ssoConnection(idp, id, snap, (m) => set.warn(m)));
+        connections.add(id);
+    }
+    // ── users ──
+    const counts = { password: 0, totp: 0, forced: 0, inactive: 0 };
+    const badHashes = new Map();
+    const seenUsernames = new Set();
+    const userIds = new Set();
+    for (const u of snap.users) {
+        const id = (0, record_set_1.str)(u.id);
+        if (!id)
+            continue;
+        const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+        const username = (0, record_set_1.str)(u.username)?.toLowerCase();
+        const phone = (0, record_set_1.e164)(u.mobilePhone);
+        if (!email && !username && !phone) {
+            set.omit('user', 'no email, username or phone');
+            continue;
+        }
+        const name = (0, record_set_1.str)(u.fullName);
+        const user = (0, record_set_1.compact)({
+            id,
+            emails: email ? [{ email, verified: u.verified === true, primary: true }] : [],
+            phones: phone ? [{ phone, verified: false, primary: !email }] : [],
+            username: username && !seenUsernames.has(username) ? username : undefined,
+            first_name: (0, record_set_1.str)(u.firstName),
+            last_name: (0, record_set_1.str)(u.lastName),
+            name: !(0, record_set_1.str)(u.firstName) && !(0, record_set_1.str)(u.lastName) ? name : undefined,
+            image_url: typeof u.imageUrl === 'string' && /^https:\/\//.test(u.imageUrl) ? u.imageUrl : undefined,
+            banned: u.active === false ? true : undefined,
+            ban_reason: u.active === false ? 'Deactivated in FusionAuth' : undefined,
+            private_metadata: (0, record_set_1.bag)((0, record_set_1.compact)({ ...((0, record_set_1.isObj)(u.data) ? u.data : {}), fusionauth_tenant_id: (0, record_set_1.str)(u.tenantId), fusionauth_password_change_required: u.passwordChangeRequired === true ? true : undefined })),
+            created_at: epoch(u.insertInstant),
+            last_sign_in_at: epoch(u.lastLoginInstant),
+        });
+        if (username)
+            seenUsernames.add(username);
+        if (u.active === false)
+            counts.inactive++;
+        if (u.passwordChangeRequired === true)
+            counts.forced++;
+        const pw = fusionAuthPassword(u);
+        if (pw && 'hash' in pw)
+            user.password = pw.hash;
+        else if (pw)
+            badHashes.set(pw.problem, (badHashes.get(pw.problem) ?? 0) + 1);
+        else if (snap.source === 'api')
+            counts.password++;
+        // Application roles from every registration, plus the roles of the user's groups.
+        const roles = new Set();
+        for (const reg of (0, record_set_1.objs)(u.registrations))
+            for (const r of (0, record_set_1.strs)(reg.roles))
+                roles.add((0, translate_kit_1.keyOf)(r));
+        const memberOf = (0, record_set_1.objs)(u.memberships).map((m) => groups.get((0, record_set_1.str)(m.groupId) ?? '')).filter((g) => !!g);
+        for (const g of memberOf) {
+            for (const names of Object.values((0, record_set_1.isObj)(g.roles) ? g.roles : {}))
+                for (const r of (0, record_set_1.strs)(names))
+                    roles.add((0, translate_kit_1.keyOf)(r));
+            if (groupsAs === 'roles')
+                roles.add(`group:${(0, translate_kit_1.keyOf)((0, record_set_1.str)(g.name))}`);
+        }
+        if (roles.size)
+            user.roles = [...roles];
+        set.add('user', (0, record_set_1.compact)(user));
+        userIds.add(id);
+        // Linked identities.
+        for (const link of (0, record_set_1.objs)(u.links)) {
+            const idp = idps.get((0, record_set_1.str)(link.identityProviderId) ?? '');
+            const providerUserId = (0, record_set_1.str)(link.identityProviderUserId);
+            if (!idp || !providerUserId)
+                continue;
+            const identity = linkIdentity(idp, link, id, providerUserId, connections);
+            set.add('identity', identity, `${identity.provider}:${providerUserId}`);
+        }
+        // Second factors.
+        const methods = (0, record_set_1.isObj)(u.twoFactor) ? (0, record_set_1.objs)(u.twoFactor.methods) : [];
+        for (const m of methods) {
+            const method = (0, record_set_1.str)(m.method);
+            if (method === 'authenticator') {
+                const a = (0, record_set_1.isObj)(m.authenticator) ? m.authenticator : {};
+                const secret = (0, record_set_1.str)(a.secret) ? authenticatorSecret((0, record_set_1.str)(a.secret)) : undefined;
+                if (!secret) {
+                    counts.totp++;
+                    continue;
+                }
+                const algo = (0, record_set_1.str)(a.algorithm)?.toUpperCase().replace('HMAC', '').replace('-', '');
+                set.add('mfa_factor', (0, record_set_1.compact)({
+                    user_id: id,
+                    type: 'totp',
+                    secret_base32: secret,
+                    digits: typeof a.codeLength === 'number' ? a.codeLength : 6,
+                    period: typeof a.timeStep === 'number' ? a.timeStep : 30,
+                    algorithm: algo === 'SHA256' || algo === 'SHA512' ? algo : 'SHA1',
+                    verified: true,
+                }), `totp:${id}:${(0, record_set_1.str)(m.id) ?? ''}`);
+            }
+            else if (method === 'sms') {
+                const p = (0, record_set_1.e164)(m.mobilePhone);
+                if (p)
+                    set.add('mfa_factor', { user_id: id, type: 'phone', phone: p, verified: true }, `phone:${id}:${p}`);
+            }
+            else if (method === 'email') {
+                set.add('mfa_factor', { user_id: id, type: 'email', verified: true }, `email:${id}`);
+            }
+            else if (method)
+                set.omit('mfa_factor', `FusionAuth two-factor method "${method}" has no Atlas counterpart`);
+        }
+        const codes = (0, record_set_1.strs)(u.recoveryCodes);
+        if (codes.length)
+            set.add('mfa_factor', { user_id: id, type: 'backup_codes', backup_codes: codes }, `recovery:${id}`);
+        // Memberships.
+        if (tenantsAs === 'organizations' && (0, record_set_1.str)(u.tenantId) && orgIds.has(`tenant:${(0, record_set_1.str)(u.tenantId)}`)) {
+            set.add('membership', { organization_id: `tenant:${(0, record_set_1.str)(u.tenantId)}`, user_id: id, role: 'member' }, `tenant:${(0, record_set_1.str)(u.tenantId)}:${id}`);
+        }
+        if (groupsAs === 'organizations') {
+            for (const g of memberOf)
+                set.add('membership', { organization_id: `group:${(0, record_set_1.str)(g.id)}`, user_id: id, role: 'member' }, `group:${(0, record_set_1.str)(g.id)}:${id}`);
+        }
+    }
+    // ── API keys ──
+    let managers = 0;
+    for (const k of snap.apiKeys) {
+        const key = (0, record_set_1.str)(k.key);
+        const id = (0, record_set_1.str)(k.id);
+        if (!id || !key)
+            continue;
+        if (k.keyManager === true) {
+            managers++;
+            continue;
+        }
+        const meta = (0, record_set_1.isObj)(k.metaData) ? k.metaData : {};
+        const attrs = (0, record_set_1.isObj)(meta.attributes) ? meta.attributes : {};
+        const endpoints = (0, record_set_1.isObj)(k.permissions) && (0, record_set_1.isObj)(k.permissions.endpoints) ? Object.keys(k.permissions.endpoints) : [];
+        const record = (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(attrs.description) ?? `FusionAuth API key ${id.slice(0, 8)}`,
+            hash: (0, node_crypto_1.createHash)('sha256').update(key, 'utf8').digest('hex'),
+            hash_algorithm: 'sha256',
+            start: key.slice(0, 6),
+            scopes: endpoints.length ? endpoints : undefined,
+            expires_at: epoch(k.expirationInstant),
+            created_at: epoch(k.insertInstant),
+        });
+        set.add('api_key', record);
+    }
+    if (managers)
+        set.omit('api_key', 'FusionAuth key-manager API keys (they manage other keys)', managers);
+    if (snap.apiKeys.length)
+        set.warn('FusionAuth API keys are imported as Atlas API keys carrying the endpoint permissions as scopes: review each before cutover (a FusionAuth key authorises FusionAuth endpoints, not Atlas ones).');
+    // ── what could not move ──
+    if (counts.password) {
+        set.warn(`${counts.password} user(s) have a FusionAuth password, but the API never returns password hashes. Export from the database of a self-hosted install (--set fusionauth-dump=<dir>), ask FusionAuth support for the hashes (Cloud), or turn on the fusionauth lazy-migration preset: each password is then checked against FusionAuth on its first Atlas sign-in.`);
+    }
+    if (counts.totp)
+        set.warn(`${counts.totp} user(s) use an authenticator app; FusionAuth returns no authenticator secrets over the API (a database export carries them). Those users enrol again in Atlas.`);
+    if (counts.forced)
+        set.warn(`${counts.forced} user(s) must change their password at next sign-in in FusionAuth; their current password was set by an administrator.`);
+    for (const [problem, n] of badHashes)
+        set.warn(`${n} user(s) were imported without a password (${problem}); they reset it, or use lazy migration.`);
+    set.warn('FusionAuth sessions are not exportable: the fusionauth bridge preset exchanges FusionAuth access tokens for Atlas sessions instead.');
+    const tenant = snap.tenants[0];
+    set.manifest = {
+        origin: snap.baseUrl ?? ((0, record_set_1.str)(tenant?.name) ? `tenant ${(0, record_set_1.str)(tenant?.name)}` : 'fusionauth'),
+        sourceVersion: null,
+        providers: [...new Set(set.list('identity').map((i) => i.provider))].sort(),
+        settings: (0, record_set_1.compact)({
+            source: snap.source === 'api' ? 'api' : 'database',
+            groups_as: groupsAs,
+            tenants_as: tenantsAs,
+            issuer: snap.tenants.length === 1 ? (0, record_set_1.str)(snap.tenants[0].issuer) : undefined,
+        }),
+    };
+    return set;
+}
+function linkIdentity(idp, link, userId, providerUserId, connections) {
+    const id = (0, record_set_1.str)(idp.id);
+    const type = (0, record_set_1.str)(idp.type) ?? '';
+    const enterprise = connections.has(id);
+    return (0, record_set_1.compact)({
+        user_id: userId,
+        provider: enterprise ? id : type.toLowerCase(),
+        provider_user_id: providerUserId,
+        kind: enterprise ? (type === 'SAMLv2' ? 'saml' : 'oidc') : 'oauth',
+        sso_connection_id: enterprise ? id : undefined,
+        profile: (0, record_set_1.bag)((0, record_set_1.compact)({ display_name: (0, record_set_1.str)(link.displayName) })),
+    });
+}
+function ssoConnection(idp, id, snap, warn) {
+    const name = (0, record_set_1.str)(idp.name) ?? id;
+    const domains = (0, record_set_1.strs)(idp.domains).map((d) => d.toLowerCase());
+    if ((0, record_set_1.str)(idp.type) === 'SAMLv2') {
+        const keyId = (0, record_set_1.str)(idp.keyId);
+        const cert = keyId ? snap.keys[keyId] : undefined;
+        if (!cert)
+            warn(`SAML identity provider ${name}: its verification certificate could not be read; add it in Atlas.`);
+        return (0, record_set_1.compact)({
+            id,
+            name,
+            protocol: 'saml',
+            domains,
+            enabled: idp.enabled !== false,
+            saml: (0, record_set_1.compact)({
+                idp_entity_id: (0, record_set_1.str)(idp.issuer),
+                idp_sso_url: (0, record_set_1.str)(idp.idpEndpoint),
+                idp_certificate: cert,
+                attribute_mapping: (0, record_set_1.str)(idp.emailClaim) ? { email: (0, record_set_1.str)(idp.emailClaim) } : undefined,
+            }),
+        });
+    }
+    const o = (0, record_set_1.isObj)(idp.oauth2) ? idp.oauth2 : {};
+    const secret = (0, record_set_1.str)(o.client_secret);
+    // FusionAuth returns the secret to a key that may read identity providers; a masked or absent one cannot be used.
+    const real = secret && !/^\*+$/.test(secret) ? secret : undefined;
+    if (!real)
+        warn(`OIDC identity provider ${name}: its client secret was not available; enter it on the SSO connection after the import.`);
+    const issuer = (0, record_set_1.str)(o.issuer);
+    return (0, record_set_1.compact)({
+        id,
+        name,
+        protocol: 'oidc',
+        domains,
+        enabled: idp.enabled !== false,
+        oidc: (0, record_set_1.compact)({
+            issuer,
+            discovery_url: issuer ? `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration` : undefined,
+            client_id: (0, record_set_1.str)(o.client_id),
+            client_secret: real,
+            scopes: (0, record_set_1.str)(o.scope)?.split(/\s+/).filter(Boolean),
+        }),
+    });
+}
+async function exportFusionAuth(o) {
+    if (o.tables) {
+        const snap = fusionAuthSnapshotFromTables(o.tables);
+        if (o.api?.baseUrl)
+            snap.baseUrl = fusionAuthBase(o.api.baseUrl);
+        return mapFusionAuth(snap, o);
+    }
+    if (!o.api)
+        throw new Error('FusionAuth: pass a database dump, or the URL and an API key.');
+    const warnings = [];
+    const snap = await fetchFusionAuth(fusionAuthHttp(o.api), { baseUrl: o.api.baseUrl, pageSize: o.api.pageSize, onProgress: o.api.onProgress, warn: (m) => warnings.push(m) });
+    const set = mapFusionAuth(snap, o);
+    for (const w of warnings)
+        set.warn(w);
+    return set;
+}
+//# sourceMappingURL=fusionauth.js.map