@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/export/workos.js

@@ -0,0 +1,272 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportWorkos = exportWorkos;
+exports.mapWorkosUser = mapWorkosUser;
+exports.providerKey = providerKey;
+const csv_1 = require("../../import/csv");
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+const PAGE = 100;
+async function exportWorkos(opts) {
+    const set = new record_set_1.RecordSet();
+    if (!/^sk_[A-Za-z0-9_]+$/.test(opts.apiKey)) {
+        throw new Error('Not a WorkOS API key: it starts with sk_ (WORKOS_API_KEY).');
+    }
+    const progress = opts.onProgress ?? (() => undefined);
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'WorkOS',
+        baseUrl: (opts.baseUrl ?? 'https://api.workos.com').replace(/\/+$/, ''),
+        headers: { authorization: `Bearer ${opts.apiKey}` },
+        fetchImpl: opts.fetchImpl,
+        sleep: opts.sleep,
+    });
+    progress('organizations');
+    const orgIds = [];
+    for (const o of await listAll(http, '/organizations')) {
+        const id = (0, record_set_1.str)(o.id);
+        const name = (0, record_set_1.str)(o.name);
+        if (!id || !name)
+            continue;
+        orgIds.push(id);
+        set.add('organization', (0, record_set_1.compact)({
+            id,
+            name,
+            // Only domains WorkOS has verified let members join by domain.
+            domains: (0, record_set_1.objs)(o.domains)
+                .filter((d) => ['verified', 'legacy_verified'].includes((0, record_set_1.str)(d.state) ?? ''))
+                .map((d) => (0, record_set_1.str)(d.domain)?.toLowerCase())
+                .filter((d) => !!d),
+            public_metadata: (0, record_set_1.bag)(o.metadata),
+            private_metadata: (0, record_set_1.str)(o.external_id) ? { workos_external_id: (0, record_set_1.str)(o.external_id) } : undefined,
+            created_at: (0, record_set_1.str)(o.created_at),
+        }));
+    }
+    progress('roles');
+    const envRoles = await optional(http, '/authorization/roles');
+    for (const r of (0, record_set_1.objs)(envRoles?.data))
+        addRole(set, r, undefined);
+    for (const id of orgIds) {
+        for (const r of (0, record_set_1.objs)((await optional(http, `/authorization/organizations/${encodeURIComponent(id)}/roles`))?.data)) {
+            // The listing repeats the environment roles; only the organization's own are new.
+            if ((0, record_set_1.str)(r.type) === 'OrganizationRole')
+                addRole(set, r, id);
+        }
+    }
+    progress('users');
+    const hashes = opts.hashesText ? indexHashes(opts.hashesText) : null;
+    let withHash = 0;
+    let factorUsers = 0;
+    let passkeyUsers = 0;
+    for (const u of await listAll(http, '/user_management/users')) {
+        const user = mapWorkosUser(u);
+        if (!user) {
+            set.omit('user', 'no email address');
+            continue;
+        }
+        const h = hashes && (hashes.get(user.id) ?? hashes.get(user.emails[0].email) ?? ((0, record_set_1.str)(u.external_id) ? hashes.get((0, record_set_1.str)(u.external_id)) : undefined));
+        if (h) {
+            user.password = { algorithm: 'auto', hash: h };
+            withHash++;
+        }
+        set.add('user', user);
+        const email = user.emails[0];
+        const identities = await optional(http, `/user_management/users/${encodeURIComponent(user.id)}/identities`);
+        // The identities endpoint answers with a bare array.
+        for (const i of (0, record_set_1.objs)(Array.isArray(identities) ? identities : identities?.data)) {
+            const sub = (0, record_set_1.str)(i.idp_id);
+            const provider = (0, record_set_1.str)(i.provider);
+            if (!sub || !provider)
+                continue;
+            set.add('identity', (0, record_set_1.compact)({ user_id: user.id, provider: providerKey(provider), provider_user_id: sub, kind: 'oauth', email: email.email, email_verified: email.verified }), `${user.id}:${provider}:${sub}`);
+        }
+        if (opts.countFactors) {
+            const factors = (0, record_set_1.objs)((await optional(http, `/user_management/users/${encodeURIComponent(user.id)}/auth_factors`))?.data);
+            if (factors.some((f) => ['totp', 'sms', 'generic_otp'].includes((0, record_set_1.str)(f.type) ?? '')))
+                factorUsers++;
+            if (factors.some((f) => (0, record_set_1.str)(f.type) === 'webauthn'))
+                passkeyUsers++;
+        }
+    }
+    if (factorUsers)
+        set.omit('mfa_factor', 'WorkOS never returns TOTP secrets (they are shown only when a factor is enrolled); users enrol again in Atlas', factorUsers);
+    if (passkeyUsers)
+        set.omit('passkey', 'WorkOS does not export WebAuthn public keys; users register a passkey again in Atlas', passkeyUsers);
+    if (!opts.countFactors && set.count('user') > 0) {
+        set.warn('Second factors were not counted: WorkOS never exports TOTP secrets or passkeys, so users with a second factor enrol again (pass --set workos-factors=1 to count them).');
+    }
+    if (!hashes && set.count('user') > 0) {
+        set.warn('No password hashes: WorkOS has no password export. If WorkOS support provided one, pass it with --workos-hashes-file; otherwise turn on the workos lazy-migration preset so each password moves on its first sign-in.');
+    }
+    else if (hashes && withHash === 0) {
+        set.warn('The hash file matched no user (by user id, email or external id): check its columns.');
+    }
+    progress('memberships');
+    let multiRole = false;
+    for (const id of orgIds) {
+        for (const m of await listAll(http, '/user_management/organization_memberships', { organization_id: id, statuses: 'active' })) {
+            const userId = (0, record_set_1.str)(m.user_id);
+            if (!userId)
+                continue;
+            const roles = [(0, record_set_1.str)((0, record_set_1.isObj)(m.role) ? m.role.slug : undefined), ...(0, record_set_1.objs)(m.roles).map((r) => (0, record_set_1.str)(r.slug))].filter((s) => !!s);
+            const unique = [...new Set(roles)];
+            if (unique.length > 1)
+                multiRole = true;
+            set.add('membership', (0, record_set_1.compact)({ id: (0, record_set_1.str)(m.id), organization_id: id, user_id: userId, role: unique[0] ?? 'member', created_at: (0, record_set_1.str)(m.created_at) }), `${id}:${userId}`);
+        }
+    }
+    if (multiRole)
+        set.warn('Some members hold several WorkOS roles; Atlas seats each member with one role (the first).');
+    progress('invitations');
+    for (const inv of await optionalAll(http, '/user_management/invitations')) {
+        const id = (0, record_set_1.str)(inv.id);
+        const email = (0, record_set_1.str)(inv.email)?.toLowerCase();
+        if (!id || !email)
+            continue;
+        const state = (0, record_set_1.str)(inv.state);
+        set.add('invitation', (0, record_set_1.compact)({
+            id,
+            organization_id: (0, record_set_1.str)(inv.organization_id),
+            email,
+            role: (0, record_set_1.str)(inv.role_slug),
+            status: state && ['pending', 'accepted', 'revoked', 'expired'].includes(state) ? state : undefined,
+            inviter_user_id: (0, record_set_1.str)(inv.inviter_user_id),
+            expires_at: (0, record_set_1.str)(inv.expires_at),
+            created_at: (0, record_set_1.str)(inv.created_at),
+        }));
+    }
+    progress('sso');
+    let idpManual = 0;
+    for (const c of await optionalAll(http, '/connections')) {
+        const id = (0, record_set_1.str)(c.id);
+        if (!id)
+            continue;
+        const type = (0, record_set_1.str)(c.connection_type) ?? '';
+        const protocol = /oidc/i.test(type) ? 'oidc' : 'saml';
+        let cert;
+        if (protocol === 'saml') {
+            const certs = await optional(http, `/connections/${encodeURIComponent(id)}/saml_idp_signing_certs`);
+            cert = (0, record_set_1.str)((0, record_set_1.objs)(certs?.data)[0]?.value);
+        }
+        idpManual++;
+        set.add('sso_connection', (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(c.name) ?? `${type || protocol} ${id}`,
+            organization_id: (0, record_set_1.str)(c.organization_id),
+            protocol,
+            domains: (0, record_set_1.objs)(c.domains).map((d) => (0, record_set_1.str)(d.domain)?.toLowerCase()).filter((d) => !!d),
+            saml: protocol === 'saml' && cert ? { idp_certificate: cert } : undefined,
+            enabled: (0, record_set_1.str)(c.state) ? (0, record_set_1.str)(c.state) === 'active' : undefined,
+        }));
+    }
+    if (idpManual) {
+        set.warn(`${idpManual} SSO connection(s): WorkOS does not return the identity provider's entity id, SSO URL or OIDC client secret. Each customer's IdP admin sets the connection up again against the new Atlas service-provider details (or send them Atlas's metadata URL).`);
+    }
+    progress('directories');
+    const directories = await optionalAll(http, '/directories');
+    if (directories.length) {
+        set.warn(`${directories.length} Directory Sync directory(ies): reconnect each through Atlas SCIM provisioning (the directory's users and groups are re-provisioned by the identity provider).`);
+    }
+    progress('api keys');
+    let keys = 0;
+    for (const id of orgIds)
+        keys += (await optionalAll(http, `/organizations/${encodeURIComponent(id)}/api_keys`)).length;
+    if (keys)
+        set.omit('api_key', 'WorkOS shows an API key secret only once: reissue them as Atlas API keys', keys);
+    set.manifest = { origin: opts.clientId ?? 'api.workos.com', ...(opts.clientId ? { settings: { client_id: opts.clientId } } : {}) };
+    return set;
+}
+function addRole(set, r, organizationId) {
+    const key = (0, record_set_1.str)(r.slug);
+    if (!key)
+        return;
+    set.add('role', (0, record_set_1.compact)({ key, name: (0, record_set_1.str)(r.name), description: (0, record_set_1.str)(r.description), scope: 'organization', organization_id: organizationId, permissions: (0, record_set_1.strs)(r.permissions) }), `${organizationId ?? ''}:${key}`);
+}
+/** One WorkOS user → a user record (a user always has an email). */
+function mapWorkosUser(u) {
+    const id = (0, record_set_1.str)(u.id);
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    if (!id || !email)
+        return null;
+    const metadata = (0, record_set_1.bag)(u.metadata);
+    return (0, record_set_1.compact)({
+        id,
+        emails: [{ email, verified: u.email_verified === true, primary: true }],
+        first_name: (0, record_set_1.str)(u.first_name),
+        last_name: (0, record_set_1.str)(u.last_name),
+        image_url: (0, record_set_1.str)(u.profile_picture_url),
+        public_metadata: metadata,
+        private_metadata: (0, record_set_1.str)(u.external_id) ? { workos_external_id: (0, record_set_1.str)(u.external_id) } : undefined,
+        created_at: (0, record_set_1.str)(u.created_at),
+        last_sign_in_at: (0, record_set_1.str)(u.last_sign_in_at),
+    });
+}
+/** `GoogleOAuth` → `google`, `GitHubOAuth` → `github`: the provider name an Atlas provider key is looked up by. */
+function providerKey(provider) {
+    return provider.replace(/OAuth$/i, '').toLowerCase();
+}
+/**
+ * The support hash file, by user id, email and external id. Its layout is not
+ * published: CSV with a hash column and an id / email column, or NDJSON.
+ */
+function indexHashes(text) {
+    const t = text.trim();
+    const rows = t.startsWith('{') ? t.split(/\r?\n/).filter((l) => l.trim()).map((l) => JSON.parse(l)) : (0, csv_1.parseCsv)(t);
+    const out = new Map();
+    for (const r of rows) {
+        const keys = Object.keys(r);
+        const hashKey = keys.find((k) => /hash/i.test(k) && !/type|algo/i.test(k));
+        const hash = hashKey ? (0, record_set_1.str)(r[hashKey]) : undefined;
+        if (!hash)
+            continue;
+        for (const k of keys) {
+            const v = (0, record_set_1.str)(r[k]);
+            if (!v)
+                continue;
+            if (/^(user_?id|id|external_?id)$/i.test(k))
+                out.set(v, hash);
+            else if (/^email$/i.test(k))
+                out.set(v.toLowerCase(), hash);
+        }
+    }
+    return out;
+}
+/** Every page of a WorkOS list endpoint (`{ data, list_metadata: { after } }`), in a stable order. */
+async function listAll(http, path, params = {}) {
+    const out = [];
+    let after;
+    for (;;) {
+        const q = new URLSearchParams({ limit: String(PAGE), order: 'asc', ...params });
+        if (after)
+            q.set('after', after);
+        const body = (await http.get(`${path}?${q.toString()}`)).body;
+        out.push(...(0, record_set_1.objs)(body?.data));
+        const next = (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.list_metadata) ? (0, record_set_1.str)(body.list_metadata.after) : undefined;
+        if (!next || next === after)
+            break;
+        after = next;
+    }
+    return out;
+}
+/** A call whose absence (feature off, no permission, unknown path) is not an export failure. */
+async function optional(http, path) {
+    try {
+        return (await http.get(path)).body;
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+/** {@link listAll} for an endpoint the environment may not have (feature off, no permission). */
+async function optionalAll(http, path, params = {}) {
+    try {
+        return await listAll(http, path, params);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
+            return [];
+        throw err;
+    }
+}
+//# sourceMappingURL=workos.js.map

package/dist/migrate/export/workos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../../src/migrate/export/workos.ts"],"names":[],"mappings":";;AAgDA,oCAqLC;AAaD,sCAgBC;AAGD,kCAEC;AAtQD,0CAA4C;AAC5C,6CAAyF;AACzF,+CAA2D;AA2C3D,MAAM,IAAI,GAAG,GAAG,CAAC;AAEV,KAAK,UAAU,YAAY,CAAC,IAAyB;IAC1D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;QACnD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACtD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAS;QAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,GAAG,CAAC,GAAG,CACL,cAAc,EACd,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,IAAI;YACJ,+DAA+D;YAC/D,OAAO,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC;iBACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;iBAC3E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;iBACxC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YAChC,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7F,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;SAC9B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACjE,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,gCAAgC,kBAAkB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YACnH,kFAAkF;YAClF,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,kBAAkB;gBAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,CAAC,QAAQ,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,QAAQ,EAAE,CAAC;QACb,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAO,CAAC,CAAC,CAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,0BAA0B,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;QAC5G,qDAAqD;QACrD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;YAChF,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAChC,GAAG,CAAC,GAAG,CACL,UAAU,EACV,IAAA,oBAAO,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,OAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,EACjK,GAAG,IAAI,CAAC,EAAE,IAAI,QAAQ,IAAI,GAAG,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,0BAA0B,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACzH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAE,WAAW,EAAE,CAAC;YACnG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC;gBAAE,YAAY,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,+GAA+G,EAAE,WAAW,CAAC,CAAC;IACtK,IAAI,YAAY;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,sFAAsF,EAAE,YAAY,CAAC,CAAC;IAC5I,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,wKAAwK,CAAC,CAAC;IACrL,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CACN,uNAAuN,CACxN,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACnG,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,2CAA2C,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC9H,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,KAAK,GAAG,CAAC,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvI,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;YACxC,GAAG,CAAC,GAAG,CACL,YAAY,EACZ,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,EAC5H,GAAG,EAAE,IAAI,MAAM,EAAE,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;IAEtH,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,MAAM,WAAW,CAAC,IAAI,EAAE,8BAA8B,CAAC,EAAE,CAAC;QAC1E,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK;YAAE,SAAS;QAC5B,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,CACL,YAAY,EACZ,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,eAAe,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,eAAe,CAAC;YACzC,KAAK;YACL,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,KAAK,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAwD,CAAC,CAAC,CAAC,SAAS;YACtJ,eAAe,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,eAAe,CAAC;YACzC,UAAU,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,UAAU,CAAC;YAC/B,UAAU,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,UAAU,CAAC;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,MAAM,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;QACxD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,MAAgB,CAAC;QAC5E,IAAI,IAAwB,CAAC;QAC7B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC;YACpG,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,iBAAI,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,SAAS,EAAE,CAAC;QACZ,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAI,EAAE,EAAE;YAChD,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC;YACvC,QAAQ;YACR,OAAO,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACjG,IAAI,EAAE,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YACzE,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS;SAC9D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CACN,GAAG,SAAS,yPAAyP,CACtQ,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC5D,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,gKAAgK,CAAC,CAAC;IAClM,CAAC;IAED,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,MAAM;QAAE,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;IACvH,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,0EAA0E,EAAE,IAAI,CAAC,CAAC;IAEhH,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,IAAI,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnI,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,GAAc,EAAE,CAAM,EAAE,cAAkC;IACzE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,cAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EACvK,GAAG,cAAc,IAAI,EAAE,IAAI,GAAG,EAAE,CACjC,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,aAAa,CAAC,CAAM;IAClC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,IAAA,oBAAO,EAAC;QACb,EAAE;QACF,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC3B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,mBAAmB,CAAC;QACrC,eAAe,EAAE,QAAQ;QACzB,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7F,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC;KACxC,CAAe,CAAC;AACnB,CAAC;AAED,mHAAmH;AACnH,SAAgB,WAAW,CAAC,QAAgB;IAC1C,OAAO,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,IAAI,GAAU,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,cAAQ,EAAC,CAAC,CAAC,CAAC;IAChI,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;iBACzD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAY,EAAE,SAAiC,EAAE;IACxF,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,KAAyB,CAAC;IAC9B,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAChF,IAAI,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,KAAK;YAAE,MAAM;QACnC,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,QAAQ,CAAC,IAAgB,EAAE,IAAY;IACpD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAA2B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY,EAAE,SAAiC,EAAE;IAC5F,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACrF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/migrate/export/zip.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Read the files of a ZIP archive held in memory (stored or deflated entries,
+ * via the central directory). Enough for a vendor's data-export archive; no
+ * dependency. Refuses ZIP64, encryption and sizes past `maxBytes` per entry.
+ */
+export declare function readZip(buf: Buffer, maxBytes?: number): Map<string, Buffer>;
+/** A file in the archive by its base name (exports often nest files in a folder). */
+export declare function zipFile(files: Map<string, Buffer>, baseName: string): Buffer | undefined;

package/dist/migrate/export/zip.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readZip = readZip;
+exports.zipFile = zipFile;
+const node_zlib_1 = require("node:zlib");
+/**
+ * Read the files of a ZIP archive held in memory (stored or deflated entries,
+ * via the central directory). Enough for a vendor's data-export archive; no
+ * dependency. Refuses ZIP64, encryption and sizes past `maxBytes` per entry.
+ */
+function readZip(buf, maxBytes = 2 * 1024 ** 3) {
+    const out = new Map();
+    // End of central directory: signature 0x06054b50, within the last 64 KiB + 22.
+    let eocd = -1;
+    for (let i = buf.length - 22; i >= Math.max(0, buf.length - 65_557); i--) {
+        if (buf.readUInt32LE(i) === 0x06054b50) {
+            eocd = i;
+            break;
+        }
+    }
+    if (eocd < 0)
+        throw new Error('Not a ZIP archive (no end-of-central-directory record).');
+    const entries = buf.readUInt16LE(eocd + 10);
+    let p = buf.readUInt32LE(eocd + 16);
+    if (p === 0xffffffff)
+        throw new Error('ZIP64 archives are not supported; extract the files and pass them directly.');
+    for (let n = 0; n < entries; n++) {
+        if (buf.readUInt32LE(p) !== 0x02014b50)
+            throw new Error('Corrupt ZIP central directory.');
+        const flags = buf.readUInt16LE(p + 8);
+        const method = buf.readUInt16LE(p + 10);
+        const compressed = buf.readUInt32LE(p + 20);
+        const size = buf.readUInt32LE(p + 24);
+        const nameLen = buf.readUInt16LE(p + 28);
+        const extraLen = buf.readUInt16LE(p + 30);
+        const commentLen = buf.readUInt16LE(p + 32);
+        const local = buf.readUInt32LE(p + 42);
+        const name = buf.subarray(p + 46, p + 46 + nameLen).toString('utf8');
+        p += 46 + nameLen + extraLen + commentLen;
+        if (name.endsWith('/'))
+            continue;
+        if (flags & 0x1)
+            throw new Error(`ZIP entry ${name} is encrypted.`);
+        if (size > maxBytes)
+            throw new Error(`ZIP entry ${name} is too large.`);
+        if (buf.readUInt32LE(local) !== 0x04034b50)
+            throw new Error('Corrupt ZIP local header.');
+        const start = local + 30 + buf.readUInt16LE(local + 26) + buf.readUInt16LE(local + 28);
+        const data = buf.subarray(start, start + compressed);
+        if (method === 0)
+            out.set(name, Buffer.from(data));
+        else if (method === 8)
+            out.set(name, (0, node_zlib_1.inflateRawSync)(data, { maxOutputLength: Math.max(size, 1) }));
+        else
+            throw new Error(`ZIP entry ${name} uses compression method ${method}, which is not supported.`);
+    }
+    return out;
+}
+/** A file in the archive by its base name (exports often nest files in a folder). */
+function zipFile(files, baseName) {
+    for (const [name, data] of files)
+        if (name === baseName || name.endsWith(`/${baseName}`))
+            return data;
+    return undefined;
+}
+//# sourceMappingURL=zip.js.map

package/dist/migrate/export/zip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip.js","sourceRoot":"","sources":["../../../src/migrate/export/zip.ts"],"names":[],"mappings":";;AAOA,0BAqCC;AAGD,0BAGC;AAlDD,yCAA2C;AAE3C;;;;GAIG;AACH,SAAgB,OAAO,CAAC,GAAW,EAAE,QAAQ,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,+EAA+E;IAC/E,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzE,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,CAAC;YACT,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACrH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC,IAAI,EAAE,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,IAAI,KAAK,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC;QACpE,IAAI,IAAI,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC;QACxE,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,KAAK,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aAC9C,IAAI,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAA,0BAAc,EAAC,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;;YAC9F,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,4BAA4B,MAAM,2BAA2B,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qFAAqF;AACrF,SAAgB,OAAO,CAAC,KAA0B,EAAE,QAAgB;IAClE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK;QAAE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACtG,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/migrate/export/zitadel-config.d.ts

@@ -0,0 +1,37 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type ZitadelApiOptions } from './zitadel';
+import { type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate zitadel config` — ZITADEL settings → Atlas config.
+ *
+ * One reader, two sources: ZITADEL's own export document (`zitadel export`, or
+ * `POST /admin/v1/export` with passwords and secrets OFF), which carries each
+ * organization's policies, projects with their roles, OIDC / API applications,
+ * identity providers and actions; plus, through the API, the INSTANCE default
+ * policies (login, password complexity, lockout, second factors), which an
+ * organization without an override inherits.
+ */
+export interface ZitadelPolicies {
+    login?: Obj;
+    passwordComplexity?: Obj;
+    lockout?: Obj;
+    secondFactors?: string[];
+    multiFactors?: string[];
+}
+export interface ZitadelConfigSnapshot {
+    origin: string;
+    orgs: Obj[];
+    idpTemplates: Obj[];
+    /** Instance default policies (live API read only). */
+    defaults: ZitadelPolicies;
+    /** The instance URL: the bridge issuer and the lazy-migration base URL. */
+    instance?: string;
+}
+/** An export document (`{ orgs }`) as a config snapshot; no instance defaults. */
+export declare function configSnapshotFromExport(doc: unknown, origin: string, instance?: string): ZitadelConfigSnapshot;
+/** The instance's default policies, best effort (a narrow role or an old version answers 4xx for some). */
+export declare function fetchZitadelPolicies(http: VendorHttp): Promise<ZitadelPolicies>;
+/** Read the instance through the Admin API (an IAM_OWNER token): the export WITHOUT secrets, plus the default policies. */
+export declare function fetchZitadelConfig(o: Pick<ZitadelApiOptions, 'instance' | 'token' | 'fetchImpl' | 'sleep'>): Promise<ZitadelConfigSnapshot>;
+export declare function translateZitadelConfig(snap: ZitadelConfigSnapshot): TranslationResult;