@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/export/password-detect.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLAINTEXT_PBKDF2_ITERATIONS = void 0;
+exports.detectPasswordHash = detectPasswordHash;
+exports.isKnownAlgorithm = isKnownAlgorithm;
+const node_crypto_1 = require("node:crypto");
+const migrate_1 = require("@atlasauth/migrate");
+const SHAPES = [
+    { re: /^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/, algorithm: 'bcrypt' },
+    { re: /^\$argon2(id|i|d)\$/, algorithm: 'argon2' },
+    { re: /^\$6\$(rounds=\d{1,9}\$)?[^$]{0,16}\$[./0-9A-Za-z]{86}$/, algorithm: 'sha_crypt' },
+    { re: /^\$5\$(rounds=\d{1,9}\$)?[^$]{0,16}\$[./0-9A-Za-z]{43}$/, algorithm: 'sha_crypt' },
+    { re: /^\$(1|apr1)\$[^$]{0,8}\$[./0-9A-Za-z]{22}$/, algorithm: 'md5_crypt', weak: true },
+    { re: /^pbkdf2_(sha1|sha256|sha512)\$\d+\$[^$]+\$.+$/, algorithm: 'pbkdf2_django' },
+    { re: /^bcrypt_sha256\$\$2[aby]\$/, algorithm: 'bcrypt_sha256_django' },
+    { re: /^\$pbkdf2-(sha1|sha256|sha512)\$\d+\$[^$]*\$.+$/, algorithm: 'pbkdf2_phc' },
+    { re: /^\$scrypt\$ln=\d+,r=\d+,p=\d+\$/, algorithm: 'scrypt_phc' },
+    { re: /^pbkdf2:(sha1|sha256|sha512)(:\d+)?\$[^$]+\$[0-9a-f]+$/, algorithm: 'pbkdf2_werkzeug' },
+    { re: /^scrypt:\d+:\d+:\d+\$[^$]+\$[0-9a-f]+$/, algorithm: 'scrypt_werkzeug' },
+    { re: /^\$[PH]\$[./0-9A-Za-z]{31}$/, algorithm: 'phpass', weak: true },
+    { re: /^\{(SSHA|SHA|SSHA256|SSHA512|SHA256|SHA512)\}[A-Za-z0-9+/=]+$/i, algorithm: 'ldap_ssha', weak: true },
+    { re: /^\{(MD5|SMD5|SHA384|SSHA384)\}[A-Za-z0-9+/=]+$/i, algorithm: 'ldap_digest', weak: true },
+    { re: /^\{PBKDF2(-(SHA1|SHA256|SHA512))?\}\d+\$/i, algorithm: 'ldap_pbkdf2' },
+    { re: /^\{PBKDF2_SHA256\}[A-Za-z0-9+/=]+$/i, algorithm: 'ldap_pbkdf2' },
+];
+/** `{CRYPT}` / `{BCRYPT}` / `{ARGON2}` around one of the crypt-style shapes above. */
+const WRAPPED = /^\{(CRYPT|BCRYPT|ARGON2)\}(\$.+)$/i;
+/** Directory schemes that are not hashes Atlas can check (pass-through or Kerberos). */
+const DELEGATED = /^\{(SASL|K5KEY|KERBEROS|UNIX|NS-MTA-MD5|RADIUS|TOTP)\}/i;
+/**
+ * Identify a self-describing hash. `{CLEARTEXT}` (and a plaintext value when
+ * `plaintext` is allowed) is hashed here with PBKDF2 before it is written, so
+ * no password is ever stored in the clear (Atlas re-hashes it to Argon2id on
+ * the first sign-in).
+ */
+function detectPasswordHash(raw, options = {}) {
+    const value = raw?.trim();
+    if (!value)
+        return { ok: false, reason: 'no password' };
+    for (const s of SHAPES)
+        if (s.re.test(value))
+            return { ok: true, password: { algorithm: s.algorithm, hash: value }, weak: s.weak === true };
+    const wrapped = WRAPPED.exec(value);
+    if (wrapped) {
+        const inner = wrapped[2];
+        const known = SHAPES.find((s) => s.re.test(inner) && ['bcrypt', 'argon2', 'sha_crypt', 'sha_crypt', 'md5_crypt'].includes(s.algorithm));
+        if (known)
+            return { ok: true, password: { algorithm: 'ldap_crypt', hash: value }, weak: known.weak === true };
+        return { ok: false, reason: `{${wrapped[1].toUpperCase()}} hash in a format Atlas cannot verify` };
+    }
+    if (/^\{CRYPT\}/i.test(value))
+        return { ok: false, reason: 'traditional DES {CRYPT} hash (not verifiable)' };
+    if (DELEGATED.test(value))
+        return { ok: false, reason: `${/^\{[^}]+\}/.exec(value)[0]} is checked by another service (pass-through authentication)` };
+    const clear = /^\{CLEARTEXT\}(.*)$/i.exec(value);
+    if (clear)
+        return hashPlaintext(clear[1]);
+    if (/^\{[A-Z0-9_-]+\}/i.test(value))
+        return { ok: false, reason: `unsupported scheme ${/^\{[^}]+\}/.exec(value)[0]}` };
+    if (options.plaintext)
+        return hashPlaintext(value);
+    return { ok: false, reason: 'unrecognised hash format (name its algorithm)' };
+}
+/** PBKDF2-SHA256 rounds for a plaintext password hashed on export (re-hashed to Argon2id on first sign-in). */
+exports.PLAINTEXT_PBKDF2_ITERATIONS = 10_000;
+function hashPlaintext(password) {
+    if (!password)
+        return { ok: false, reason: 'empty password' };
+    const salt = (0, node_crypto_1.randomBytes)(16);
+    const hash = (0, node_crypto_1.pbkdf2Sync)(password, salt, exports.PLAINTEXT_PBKDF2_ITERATIONS, 32, 'sha256');
+    return {
+        ok: true,
+        password: { algorithm: 'pbkdf2', hash: hash.toString('base64'), salt: salt.toString('base64'), params: { digest: 'sha256', iterations: exports.PLAINTEXT_PBKDF2_ITERATIONS, encoding: 'base64', salt_encoding: 'base64' } },
+        weak: false,
+    };
+}
+/** Whether Atlas's registry has a verifier id (or `auto`). */
+function isKnownAlgorithm(id) {
+    return migrate_1.PASSWORD_HASH_ALGORITHMS.includes(id);
+}
+//# sourceMappingURL=password-detect.js.map

package/dist/migrate/export/password-detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-detect.js","sourceRoot":"","sources":["../../../src/migrate/export/password-detect.ts"],"names":[],"mappings":";;;AA4CA,gDAkBC;AAiBD,4CAEC;AAjFD,6CAAsD;AACtD,gDAAiF;AAYjF,MAAM,MAAM,GAA6D;IACvE,EAAE,EAAE,EAAE,sCAAsC,EAAE,SAAS,EAAE,QAAQ,EAAE;IACnE,EAAE,EAAE,EAAE,qBAAqB,EAAE,SAAS,EAAE,QAAQ,EAAE;IAClD,EAAE,EAAE,EAAE,yDAAyD,EAAE,SAAS,EAAE,WAAW,EAAE;IACzF,EAAE,EAAE,EAAE,yDAAyD,EAAE,SAAS,EAAE,WAAW,EAAE;IACzF,EAAE,EAAE,EAAE,4CAA4C,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE;IACxF,EAAE,EAAE,EAAE,+CAA+C,EAAE,SAAS,EAAE,eAAe,EAAE;IACnF,EAAE,EAAE,EAAE,4BAA4B,EAAE,SAAS,EAAE,sBAAsB,EAAE;IACvE,EAAE,EAAE,EAAE,iDAAiD,EAAE,SAAS,EAAE,YAAY,EAAE;IAClF,EAAE,EAAE,EAAE,iCAAiC,EAAE,SAAS,EAAE,YAAY,EAAE;IAClE,EAAE,EAAE,EAAE,wDAAwD,EAAE,SAAS,EAAE,iBAAiB,EAAE;IAC9F,EAAE,EAAE,EAAE,wCAAwC,EAAE,SAAS,EAAE,iBAAiB,EAAE;IAC9E,EAAE,EAAE,EAAE,6BAA6B,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;IACtE,EAAE,EAAE,EAAE,gEAAgE,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5G,EAAE,EAAE,EAAE,iDAAiD,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;IAC/F,EAAE,EAAE,EAAE,2CAA2C,EAAE,SAAS,EAAE,aAAa,EAAE;IAC7E,EAAE,EAAE,EAAE,qCAAqC,EAAE,SAAS,EAAE,aAAa,EAAE;CACxE,CAAC;AAEF,sFAAsF;AACtF,MAAM,OAAO,GAAG,oCAAoC,CAAC;AAErD,wFAAwF;AACxF,MAAM,SAAS,GAAG,yDAAyD,CAAC;AAE5E;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,GAAuB,EAAE,UAAmC,EAAE;IAC/F,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;IAC5I,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACxI,IAAI,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAC7G,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,8DAA8D,EAAE,CAAC;IACvJ,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxH,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;AAChF,CAAC;AAED,+GAA+G;AAClG,QAAA,2BAA2B,GAAG,MAAM,CAAC;AAElD,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,EAAE,mCAA2B,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,mCAA2B,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE;QACnN,IAAI,EAAE,KAAK;KACZ,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAQ,kCAA8C,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/migrate/export/pingone.d.ts

@@ -0,0 +1,36 @@
+import type { SsoConnectionRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate ping-identity export` — a PingOne environment through its
+ * management API with a worker application (client id + secret, on this
+ * machine): users (login, email and verification, name, phones, enabled /
+ * locked state, population, last sign-on), groups (as roles, with their
+ * members), external-IdP identities and the environment's SAML / OIDC identity
+ * providers (as SSO connections).
+ *
+ * PingOne never returns password hashes, TOTP secrets or FIDO2 credentials:
+ * passwords move by lazy migration (the `ping_identity` preset checks them with
+ * PingOne's password-check call), second factors are enrolled again.
+ */
+/** auth.pingone.<tld> / api.pingone.<tld> for a region code. */
+export declare function pingRegion(region: string | undefined): string;
+export interface PingOneExportOptions {
+    environmentId: string;
+    clientId: string;
+    clientSecret: string;
+    region?: string;
+    /** Read each user's group memberships (one call per user; off for very large environments). */
+    groups?: boolean;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** A client-credentials access token for the worker application. */
+export declare function pingOneToken(o: Pick<PingOneExportOptions, 'environmentId' | 'clientId' | 'clientSecret' | 'region' | 'fetchImpl'>): Promise<string>;
+export declare function pingOneHttp(o: PingOneExportOptions, token: string): VendorHttp;
+/** Every item of a PingOne collection (`_embedded.<key>`, next page in `_links.next.href`). */
+export declare function pingOneList(http: VendorHttp, path: string, key: string): Promise<Obj[]>;
+/** A PingOne identity provider → an SSO connection (SAML / OIDC); other types are social logins. */
+export declare function ssoConnectionOf(idp: Obj): SsoConnectionRecord | null;
+export declare function exportPingOne(o: PingOneExportOptions): Promise<RecordSet>;

package/dist/migrate/export/pingone.js

@@ -0,0 +1,218 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pingRegion = pingRegion;
+exports.pingOneToken = pingOneToken;
+exports.pingOneHttp = pingOneHttp;
+exports.pingOneList = pingOneList;
+exports.ssoConnectionOf = ssoConnectionOf;
+exports.exportPingOne = exportPingOne;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+/**
+ * `atlas migrate ping-identity export` — a PingOne environment through its
+ * management API with a worker application (client id + secret, on this
+ * machine): users (login, email and verification, name, phones, enabled /
+ * locked state, population, last sign-on), groups (as roles, with their
+ * members), external-IdP identities and the environment's SAML / OIDC identity
+ * providers (as SSO connections).
+ *
+ * PingOne never returns password hashes, TOTP secrets or FIDO2 credentials:
+ * passwords move by lazy migration (the `ping_identity` preset checks them with
+ * PingOne's password-check call), second factors are enrolled again.
+ */
+/** auth.pingone.<tld> / api.pingone.<tld> for a region code. */
+function pingRegion(region) {
+    const r = (region ?? 'com').toLowerCase().replace(/^\./, '');
+    if (!/^(com|eu|asia|ca|com\.au|sg)$/.test(r))
+        throw new Error(`Unknown PingOne region "${region}" (use com, eu, asia, ca, com.au or sg).`);
+    return r;
+}
+/** A client-credentials access token for the worker application. */
+async function pingOneToken(o) {
+    const f = o.fetchImpl ?? fetch;
+    const res = await f(`https://auth.pingone.${pingRegion(o.region)}/${o.environmentId}/as/token`, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/x-www-form-urlencoded',
+            authorization: `Basic ${Buffer.from(`${encodeURIComponent(o.clientId)}:${encodeURIComponent(o.clientSecret)}`).toString('base64')}`,
+        },
+        body: 'grant_type=client_credentials',
+    });
+    const body = (await res.json().catch(() => null));
+    const token = (0, record_set_1.str)(body?.access_token);
+    if (res.status !== 200 || !token)
+        throw new Error(`PingOne refused the worker application's credentials (${res.status}${(0, record_set_1.str)(body?.error_description) ? `: ${(0, record_set_1.str)(body?.error_description)}` : ''}).`);
+    return token;
+}
+function pingOneHttp(o, token) {
+    return new vendor_http_1.VendorHttp({
+        vendor: 'PingOne',
+        baseUrl: `https://api.pingone.${pingRegion(o.region)}/v1/environments/${o.environmentId}`,
+        headers: { authorization: `Bearer ${token}` },
+        fetchImpl: o.fetchImpl,
+        sleep: o.sleep,
+    });
+}
+/** Every item of a PingOne collection (`_embedded.<key>`, next page in `_links.next.href`). */
+async function pingOneList(http, path, key) {
+    const out = [];
+    let next = path;
+    while (next) {
+        const res = await http.get(next);
+        const body = (0, record_set_1.isObj)(res.body) ? res.body : {};
+        out.push(...(0, record_set_1.objs)((0, record_set_1.isObj)(body._embedded) ? body._embedded[key] : undefined));
+        const href = (0, record_set_1.isObj)(body._links) && (0, record_set_1.isObj)(body._links.next) ? body._links.next.href : undefined;
+        next = typeof href === 'string' ? href : undefined;
+    }
+    return out;
+}
+async function listOrEmpty(http, path, key) {
+    try {
+        return await pingOneList(http, path, key);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [403, 404].includes(err.status))
+            return [];
+        throw err;
+    }
+}
+/** A PingOne identity provider → an SSO connection (SAML / OIDC); other types are social logins. */
+function ssoConnectionOf(idp) {
+    const type = (0, record_set_1.str)(idp.type);
+    const id = (0, record_set_1.str)(idp.id);
+    if (!id)
+        return null;
+    if (type === 'SAML') {
+        const certs = (0, record_set_1.isObj)(idp.idpVerification) ? (0, record_set_1.objs)(idp.idpVerification.certificates) : [];
+        return (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(idp.name),
+            protocol: 'saml',
+            enabled: idp.enabled !== false,
+            saml: (0, record_set_1.compact)({
+                idp_entity_id: (0, record_set_1.str)(idp.idpEntityId),
+                idp_sso_url: (0, record_set_1.str)(idp.ssoEndpoint),
+                sp_entity_id: (0, record_set_1.str)(idp.spEntityId),
+                // The signing certificate itself is not in the list answer: fetch the certificate id's key from PingOne or paste the IdP metadata.
+                idp_certificate: (0, record_set_1.str)(certs[0]?.certificate),
+            }),
+        });
+    }
+    if (type === 'OPENID_CONNECT') {
+        return (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(idp.name),
+            protocol: 'oidc',
+            enabled: idp.enabled !== false,
+            oidc: (0, record_set_1.compact)({
+                issuer: (0, record_set_1.str)(idp.issuer),
+                discovery_url: (0, record_set_1.str)(idp.discoveryEndpoint),
+                client_id: (0, record_set_1.str)(idp.clientId),
+                scopes: Array.isArray(idp.scopes) ? idp.scopes.map(String) : undefined,
+            }),
+        });
+    }
+    return null;
+}
+async function exportPingOne(o) {
+    const set = new record_set_1.RecordSet();
+    const say = o.onProgress ?? (() => undefined);
+    set.manifest = { origin: `PingOne environment ${o.environmentId}` };
+    const http = pingOneHttp(o, await pingOneToken(o));
+    say('identity providers');
+    const connections = new Set();
+    for (const idp of await listOrEmpty(http, '/identityProviders', 'identityProviders')) {
+        const sso = ssoConnectionOf(idp);
+        if (sso) {
+            set.add('sso_connection', sso, sso.id);
+            connections.add(sso.id);
+        }
+        else if ((0, record_set_1.str)(idp.type))
+            set.warn(`Social identity provider "${(0, record_set_1.str)(idp.name) ?? (0, record_set_1.str)(idp.type)}" (${(0, record_set_1.str)(idp.type)}) is configured in Atlas as an OAuth provider (atlas migrate ping-identity config), not imported as a connection.`);
+    }
+    say('groups');
+    const groups = await listOrEmpty(http, '/groups', 'groups');
+    const roleOf = new Map();
+    for (const g of groups) {
+        const id = (0, record_set_1.str)(g.id);
+        const name = (0, record_set_1.str)(g.name);
+        if (!id || !name)
+            continue;
+        const key = (0, translate_kit_1.keyOf)(name);
+        roleOf.set(id, key);
+        set.add('role', { key, name, scope: 'app', description: (0, record_set_1.str)(g.description) }, key);
+    }
+    say('users');
+    const users = await pingOneList(http, '/users?limit=100', 'users');
+    let i = 0;
+    for (const u of users) {
+        const id = (0, record_set_1.str)(u.id);
+        if (!id)
+            continue;
+        if (++i % 500 === 0)
+            say(`  ${i} of ${users.length} users`);
+        const name = (0, record_set_1.isObj)(u.name) ? u.name : {};
+        const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+        const emails = email ? [{ email, verified: u.emailVerified === true || (0, record_set_1.str)(u.verifyStatus) === 'VERIFIED', primary: true }] : [];
+        const phones = [];
+        for (const raw of [u.mobilePhone, u.primaryPhone]) {
+            const p = (0, record_set_1.e164)(raw);
+            if (p && !phones.some((x) => x.phone === p))
+                phones.push({ phone: p, verified: false, primary: phones.length === 0 });
+        }
+        const account = (0, record_set_1.isObj)(u.account) ? u.account : {};
+        const lifecycle = (0, record_set_1.isObj)(u.lifecycle) ? u.lifecycle : {};
+        const record = (0, record_set_1.compact)({
+            id,
+            emails,
+            phones,
+            username: (0, record_set_1.str)(u.username),
+            first_name: (0, record_set_1.str)(name.given),
+            last_name: (0, record_set_1.str)(name.family),
+            name: (0, record_set_1.str)(name.formatted),
+            created_at: (0, record_set_1.str)(u.createdAt),
+            last_sign_in_at: (0, record_set_1.isObj)(u.lastSignOn) ? (0, record_set_1.str)(u.lastSignOn.at) : undefined,
+            private_metadata: { pingone: (0, record_set_1.compact)({ population: (0, record_set_1.isObj)(u.population) ? (0, record_set_1.str)(u.population.id) : undefined, type: (0, record_set_1.str)(u.type), mfa_enabled: u.mfaEnabled === true ? true : undefined }) },
+        });
+        if (u.enabled === false) {
+            record.banned = true;
+            record.ban_reason = 'Disabled in PingOne';
+        }
+        else if ((0, record_set_1.str)(account.status) === 'LOCKED')
+            record.locked = true;
+        if (['ACCOUNT_DISABLED', 'DISABLED'].includes((0, record_set_1.str)(lifecycle.status) ?? ''))
+            record.banned = true;
+        if (!record.emails?.length && !record.phones?.length && !record.username) {
+            set.omit('user', 'no email, phone or username', 1);
+            continue;
+        }
+        if (o.groups !== false && roleOf.size) {
+            const memberOf = await listOrEmpty(http, `/users/${encodeURIComponent(id)}/memberOfGroups`, 'groups');
+            const roles = memberOf.map((g) => roleOf.get((0, record_set_1.str)(g.id) ?? '')).filter((r) => !!r);
+            if (roles.length)
+                record.roles = roles;
+        }
+        set.add('user', record, id);
+        // A user who signs in through an external IdP keeps that link.
+        const ext = (0, record_set_1.isObj)(u.identityProvider) ? u.identityProvider : undefined;
+        const extType = (0, record_set_1.str)(ext?.type);
+        if (ext && extType && extType !== 'PING_ONE') {
+            const link = (0, record_set_1.compact)({
+                user_id: id,
+                provider: extType.toLowerCase(),
+                provider_user_id: (0, record_set_1.str)(ext.id) ?? id,
+                kind: connections.has((0, record_set_1.str)(ext.id) ?? '') ? 'enterprise' : 'oauth',
+                sso_connection_id: connections.has((0, record_set_1.str)(ext.id) ?? '') ? (0, record_set_1.str)(ext.id) : undefined,
+                email,
+                profile: (0, record_set_1.bag)({ external_id: (0, record_set_1.str)(u.externalId) }),
+            });
+            set.add('identity', link);
+        }
+    }
+    set.omit('password', 'PingOne never exports password hashes', users.length);
+    set.omit('mfa_factor', 'PingOne never exports TOTP secrets or FIDO2 credentials', 0);
+    set.warn('Passwords move by lazy migration (preset ping_identity); users enrol their second factor again.');
+    return set;
+}
+//# sourceMappingURL=pingone.js.map

package/dist/migrate/export/pingone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pingone.js","sourceRoot":"","sources":["../../../src/migrate/export/pingone.ts"],"names":[],"mappings":";;AAmBA,gCAIC;AAeD,oCAcC;AAED,kCAQC;AAGD,kCAWC;AAYD,0CAmCC;AAED,sCA8FC;AA1ND,6CAAyF;AACzF,mDAAwC;AACxC,+CAA2D;AAE3D;;;;;;;;;;;GAWG;AAEH,gEAAgE;AAChE,SAAgB,UAAU,CAAC,MAA0B;IACnD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,0CAA0C,CAAC,CAAC;IAC3I,OAAO,CAAC,CAAC;AACX,CAAC;AAcD,oEAAoE;AAC7D,KAAK,UAAU,YAAY,CAAC,CAAqG;IACtI,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,wBAAwB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,WAAW,EAAE;QAC9F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;SACpI;QACD,IAAI,EAAE,+BAA+B;KACtC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAe,CAAC;IAChE,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,CAAC,MAAM,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,IAAA,gBAAG,EAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrM,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,WAAW,CAAC,CAAuB,EAAE,KAAa;IAChE,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,uBAAuB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,aAAa,EAAE;QACzF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AACxF,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IAC3E,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,GAAsB,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAY,IAAA,kBAAK,EAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IACpE,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAChF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAgB,eAAe,CAAC,GAAQ;IACtC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,IAAA,oBAAO,EAAsB;YAClC,EAAE;YACF,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,KAAK;YAC9B,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,aAAa,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC;gBACnC,WAAW,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC;gBACjC,YAAY,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,UAAU,CAAC;gBACjC,mIAAmI;gBACnI,eAAe,EAAE,IAAA,gBAAG,EAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;aAC5C,CAAC;SACoB,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,IAAA,oBAAO,EAAsB;YAClC,EAAE;YACF,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,KAAK;YAC9B,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,MAAM,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC;gBACvB,aAAa,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,iBAAiB,CAAC;gBACzC,SAAS,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC;gBAC5B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;aACtF,CAAC;SACoB,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,CAAuB;IACzD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,EAAE,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnD,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,MAAM,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACvC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,6BAA6B,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,mHAAmH,CAAC,CAAC;IACxO,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,IAAI,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,KAAK,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjJ,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAe,IAAA,oBAAO,EAAC;YACjC,EAAE;YACF,MAAM;YACN,MAAM;YACN,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YACzB,UAAU,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,KAAK,CAAC;YAC3B,SAAS,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,SAAS,CAAC;YACzB,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;YAC5B,eAAe,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YACvE,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAA,oBAAO,EAAC,EAAE,UAAU,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE;SAC3K,CAAC,CAAC;QACjB,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,UAAU,GAAG,qBAAqB,CAAC;QAC5C,CAAC;aAAM,IAAI,IAAA,gBAAG,EAAC,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAClE,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAA,gBAAG,EAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,UAAU,kBAAkB,CAAC,EAAE,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YACtG,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/F,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACzC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAE5B,+DAA+D;QAC/D,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,OAAO,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAmB,IAAA,oBAAO,EAAC;gBACnC,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;gBAC/B,gBAAgB,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;gBACnC,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO;gBACjE,iBAAiB,EAAE,WAAW,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/E,KAAK;gBACL,OAAO,EAAE,IAAA,gBAAG,EAAC,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;aAC/B,CAAC,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,uCAAuC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5E,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,yDAAyD,EAAE,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;IAC5G,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/plugin-kit.d.ts

@@ -0,0 +1,25 @@
+import type { MigrationBundleWriter } from '@atlasauth/migrate';
+import type { CredentialSpec, ExportCursor, PluginContext } from '../framework/plugin';
+import type { RecordSet } from './record-set';
+/**
+ * Write a vendor export through the sealed-bundle writer: the manifest fields
+ * and warnings the exporter learned, what it had to leave out, then every
+ * record in canonical order. On `--resume` the vendor is read again and the
+ * records an earlier segment already holds are skipped (vendor listings are
+ * returned in a stable order).
+ */
+export declare function writeRecordSet(set: RecordSet, writer: MigrationBundleWriter, resume: {
+    cursor: ExportCursor | null;
+    checkpoint(cursor: ExportCursor): void;
+}, say: (line: string) => void): Promise<void>;
+/** A credential, or a CliError naming every way to pass it. */
+export declare function need(p: PluginContext, spec: CredentialSpec): string;
+/** A boolean flag (`--factors`). */
+export declare function flag(p: PluginContext, name: string): boolean;
+/** A local file named by a credential spec (flag or env var), as text or bytes; undefined when not given. */
+export declare function localFile(p: PluginContext, spec: CredentialSpec, as: 'text'): string | undefined;
+export declare function localFile(p: PluginContext, spec: CredentialSpec, as: 'bytes'): Buffer | undefined;
+/** A vendor host (`acme.us.auth0.com`) from a host or URL. */
+export declare function hostOf(raw: string): string;
+/** Vendor errors become CLI errors with the vendor's own words (never a stack). */
+export declare function vendorStep<T>(label: string, fn: () => Promise<T>): Promise<T>;

package/dist/migrate/export/plugin-kit.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeRecordSet = writeRecordSet;
+exports.need = need;
+exports.flag = flag;
+exports.localFile = localFile;
+exports.hostOf = hostOf;
+exports.vendorStep = vendorStep;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+/**
+ * What every vendor plugin shares: replaying an exporter's {@link RecordSet}
+ * through the framework's bundle writer, and reading the owner's local files
+ * and flags.
+ */
+/** Records between two export checkpoints. */
+const CHECKPOINT_EVERY = 1000;
+/**
+ * Write a vendor export through the sealed-bundle writer: the manifest fields
+ * and warnings the exporter learned, what it had to leave out, then every
+ * record in canonical order. On `--resume` the vendor is read again and the
+ * records an earlier segment already holds are skipped (vendor listings are
+ * returned in a stable order).
+ */
+async function writeRecordSet(set, writer, resume, say) {
+    const start = typeof resume.cursor === 'number' ? resume.cursor : 0;
+    writer.describe(set.manifest);
+    for (const w of set.warnings)
+        writer.warn(w);
+    if (!start)
+        for (const [model, o] of Object.entries(set.omitted))
+            writer.omit(model, o.reason, o.count);
+    if (start)
+        say(`  resuming after record ${start}`);
+    let i = 0;
+    for (const r of set.ordered()) {
+        i++;
+        if (i <= start)
+            continue;
+        const issues = await writer.add(r.model, r.data);
+        if (issues.length)
+            say(`  left out ${r.model} #${i}: ${issues[0].message}`);
+        if (i % CHECKPOINT_EVERY === 0)
+            resume.checkpoint(i);
+    }
+}
+/** A credential, or a CliError naming every way to pass it. */
+function need(p, spec) {
+    return p.credential({ ...spec, required: true });
+}
+/** A boolean flag (`--factors`). */
+function flag(p, name) {
+    return p.args.values[name] === true;
+}
+function localFile(p, spec, as) {
+    const path = p.credential({ ...spec, required: false });
+    if (!path)
+        return undefined;
+    try {
+        return as === 'text' ? p.ctx.readFile((0, node_path_1.resolve)(path)) : (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(path));
+    }
+    catch (err) {
+        throw new errors_1.CliError(`Could not read ${spec.label} at ${path}: ${err.message}`);
+    }
+}
+/** A vendor host (`acme.us.auth0.com`) from a host or URL. */
+function hostOf(raw) {
+    return raw.trim().replace(/^https?:\/\//, '').replace(/[/?#].*$/, '');
+}
+/** Vendor errors become CLI errors with the vendor's own words (never a stack). */
+async function vendorStep(label, fn) {
+    try {
+        return await fn();
+    }
+    catch (err) {
+        if (err instanceof errors_1.CliError)
+            throw err;
+        throw new errors_1.CliError(`${label}: ${err.message}`);
+    }
+}
+//# sourceMappingURL=plugin-kit.js.map

package/dist/migrate/export/plugin-kit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-kit.js","sourceRoot":"","sources":["../../../src/migrate/export/plugin-kit.ts"],"names":[],"mappings":";;AAuBA,wCAmBC;AAGD,oBAEC;AAGD,oBAEC;AAKD,8BAQC;AAGD,wBAEC;AAGD,gCAOC;AAhFD,qCAAuC;AACvC,yCAAoC;AAEpC,yCAAwC;AAIxC;;;;GAIG;AAEH,8CAA8C;AAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;;GAMG;AACI,KAAK,UAAU,cAAc,CAClC,GAAc,EACd,MAA6B,EAC7B,MAA+E,EAC/E,GAA2B;IAE3B,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACxG,IAAI,KAAK;QAAE,GAAG,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9B,CAAC,EAAE,CAAC;QACJ,IAAI,CAAC,IAAI,KAAK;YAAE,SAAS;QACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAa,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,gBAAgB,KAAK,CAAC;YAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,SAAgB,IAAI,CAAC,CAAgB,EAAE,IAAoB;IACzD,OAAO,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;AACpD,CAAC;AAED,oCAAoC;AACpC,SAAgB,IAAI,CAAC,CAAgB,EAAE,IAAY;IACjD,OAAQ,CAAC,CAAC,IAAI,CAAC,MAAkC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACnE,CAAC;AAKD,SAAgB,SAAS,CAAC,CAAgB,EAAE,IAAoB,EAAE,EAAoB;IACpF,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,kBAAkB,IAAI,CAAC,KAAK,OAAO,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAgB,MAAM,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,UAAU,CAAI,KAAa,EAAE,EAAoB;IACrE,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAQ;YAAE,MAAM,GAAG,CAAC;QACvC,MAAM,IAAI,iBAAQ,CAAC,GAAG,KAAK,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/migrate/export/pocketbase-config.d.ts

@@ -0,0 +1,28 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+/**
+ * `atlas migrate pocketbase config` — a PocketBase app's auth-collection
+ * options → Atlas config.
+ *
+ * Read from `_collections` (the data.db or its dump — the same source the
+ * export reads) or from a collections export file (Settings → Export
+ * collections, `pb_schema.json`), with file:line for the file. v0.23+
+ * options (`passwordAuth`, `oauth2`, `mfa`, `otp`, `authToken`, `authRule`,
+ * flattened onto the collection in an export file, under `options` in the
+ * database) and ≤0.22 options (`allowEmailAuth`, `minPasswordLength`,
+ * `onlyVerified` …) are both understood. Token secrets and OAuth client
+ * secrets are never copied.
+ */
+export interface PocketBaseConfigSnapshot {
+    /** `_collections` rows, or the collections array of an export file. */
+    collections: Obj[];
+    /** The export file, for file:line in the report. */
+    file?: {
+        path: string;
+        text: string;
+    };
+    /** The public PocketBase URL (bridge and lazy-migration presets). */
+    url?: string;
+}
+export declare function parsePocketBaseSchema(text: string): Obj[];
+export declare function translatePocketBaseConfig(snap: PocketBaseConfigSnapshot): TranslationResult;