@crombolo/import-umbraco 0.11.0 → 0.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/import-umbraco",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "Imports an existing Umbraco site into crombolo: a compatibility report, then schema files, a content bundle and view stubs.",
   "license": "MIT",
   "author": "Crombolo",
@@ -28,10 +28,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@crombolo/core": "0.11.0",
-    "@crombolo/data": "0.11.0",
-    "@crombolo/schema": "0.11.0",
-    "@crombolo/transfer": "0.11.0",
+    "@crombolo/core": "0.12.1",
+    "@crombolo/data": "0.12.1",
+    "@crombolo/schema": "0.12.1",
+    "@crombolo/transfer": "0.12.1",
     "@kineco-au/bacpac-importer": "^0.1.0"
   }
 }

package/src/content.ts

@@ -90,7 +90,7 @@ function blobKeyOf(value: unknown): string | undefined {
   return undefined
 }
 
-type ValueRow = {
+export type ValueRow = {
   versionId: number
   propertyTypeId: number
   languageId: number | null
@@ -98,7 +98,7 @@ type ValueRow = {
 } & Record<ValueColumn, unknown>
 
 /** What the editor would be handed for a stored cell. */
-function editorValue(editor: string, dbType: string, row: ValueRow): unknown {
+export function editorValue(editor: string, dbType: string, row: ValueRow): unknown {
   // The declared column first; an older database may still hold the value in
   // another, as checkbox lists did before 17 moved them.
   const declared = COLUMN_OF[dbType]
@@ -343,6 +343,36 @@ export function convertContent(
     })
   }
 
+  const rules = attachRules(source, schema, bundleNodes)
+  findings.some({
+    class: 'migrates',
+    code: 'public-access',
+    title: 'Protected pages',
+    detail:
+      'With the member groups and members allowed to see them, and their sign-in and no-access pages.',
+    count: rules.access,
+  })
+  findings.some({
+    class: 'migrates',
+    code: 'redirects',
+    title: 'Redirects',
+    detail: 'The addresses pages had before they moved, which keep sending visitors to them.',
+    count: rules.redirects,
+  })
+  findings.some({
+    class: 'migrates',
+    code: 'schedules',
+    title: 'Scheduled publishes',
+    detail: 'Pending publish and unpublish dates, which run here at the same times.',
+    count: rules.schedules,
+  })
+  findings.some({
+    class: 'dropped',
+    code: 'rules-for-missing-pages',
+    title: 'Protection, redirects or schedules for pages not imported',
+    count: rules.orphaned,
+  })
+
   const bundleBlobs: BundleBlob[] = blobs.map((blob) => ({
     key: blob.key,
     node: blob.node,
@@ -433,3 +463,105 @@ export function convertContent(
     },
   }
 }
+
+/**
+ * Umbraco's protected pages, scheduled publishes and recorded redirects, onto
+ * the nodes they belong to. Counts what was attached, and what named a page
+ * that is not being imported.
+ */
+function attachRules(
+  source: Source,
+  schema: ConvertedSchema,
+  nodes: BundleNode[],
+): { access: number; schedules: number; redirects: number; orphaned: number } {
+  const counts = { access: 0, schedules: 0, redirects: 0, orphaned: 0 }
+  const byKey = new Map(nodes.map((node) => [node.key, node]))
+  const keyOf = new Map(
+    source
+      .all<{ id: number; key: string }>('SELECT id, uniqueId AS key FROM umbracoNode')
+      .map((row) => [Number(row.id), key(row.key)]),
+  )
+  const nodeFor = (id: unknown) => byKey.get(keyOf.get(Number(id)) ?? '')
+
+  if (source.has('umbracoAccess')) {
+    const rulesOf = new Map<string, Array<{ type: string; value: string }>>()
+    if (source.has('umbracoAccessRule'))
+      for (const row of source.all<{ accessId: unknown; ruleType: string; ruleValue: string }>(
+        'SELECT accessId, ruleType, ruleValue FROM umbracoAccessRule',
+      )) {
+        const id = String(row.accessId).toLowerCase()
+        rulesOf.set(id, [...(rulesOf.get(id) ?? []), { type: row.ruleType, value: row.ruleValue }])
+      }
+    for (const row of source.all<{
+      id: unknown
+      nodeId: number
+      loginNodeId: number
+      noAccessNodeId: number
+    }>('SELECT id, nodeId, loginNodeId, noAccessNodeId FROM umbracoAccess')) {
+      const node = nodeFor(row.nodeId)
+      const login = keyOf.get(Number(row.loginNodeId))
+      const error = keyOf.get(Number(row.noAccessNodeId))
+      if (!node || !login || !error || !byKey.has(login) || !byKey.has(error)) {
+        counts.orphaned++
+        continue
+      }
+      const rules = rulesOf.get(String(row.id).toLowerCase()) ?? []
+      node.access = {
+        loginNode: login,
+        errorNode: error,
+        memberGroups: rules.filter((r) => r.type === 'MemberRole').map((r) => r.value),
+        memberUserNames: rules.filter((r) => r.type === 'MemberUsername').map((r) => r.value),
+      }
+      counts.access++
+    }
+  }
+
+  if (source.has('umbracoContentSchedule'))
+    for (const row of source.all<{
+      nodeId: number
+      languageId: number | null
+      date: string
+      action: string
+    }>('SELECT nodeId, languageId, date, action FROM umbracoContentSchedule ORDER BY date')) {
+      const node = nodeFor(row.nodeId)
+      const when = wallClock(row.date)
+      if (node?.kind !== 'document' || !when) {
+        counts.orphaned++
+        continue
+      }
+      // Umbraco stores the time in UTC.
+      node.schedule = [
+        ...(node.schedule ?? []),
+        {
+          culture:
+            row.languageId === null
+              ? null
+              : (schema.languages.get(Number(row.languageId))?.iso ?? null),
+          action: row.action === 'Expire' ? 'unpublish' : 'publish',
+          date: new Date(`${when.replace(' ', 'T')}Z`).toISOString(),
+        },
+      ]
+      counts.schedules++
+    }
+
+  if (source.has('umbracoRedirectUrl'))
+    for (const row of source.all<{ contentKey: string; url: string; culture: string | null }>(
+      'SELECT contentKey, url, culture FROM umbracoRedirectUrl ORDER BY createDateUtc',
+    )) {
+      const node = byKey.get(key(row.contentKey))
+      // `1234/about/` under a hostname root, or `/about/` without one.
+      const match = /^(\d+)?(\/.*)$/.exec(row.url)
+      if (!node || !match) {
+        counts.orphaned++
+        continue
+      }
+      const path = (match[2] as string).replace(/\/+$/, '').toLowerCase() || '/'
+      const root = match[1] ? (keyOf.get(Number(match[1])) ?? null) : null
+      const culture = row.culture ? row.culture : null
+      if (node.redirects?.some((r) => r.path === path && r.root === root && r.culture === culture))
+        continue
+      node.redirects = [...(node.redirects ?? []), { path, root, culture }]
+      counts.redirects++
+    }
+  return counts
+}

package/src/index.ts

@@ -18,10 +18,11 @@ import {
   writeMemberType,
   writeSchemaVersion,
 } from '@crombolo/schema'
-import { writeBundle, writeBundlePackage } from '@crombolo/transfer'
+import { newSeal, writeBundle, writeBundlePackage } from '@crombolo/transfer'
 import { convertContent } from './content.ts'
 import { Findings } from './findings.ts'
 import { type DictionaryItem, type DomainEntry, takeInventory } from './inventory.ts'
+import { convertPeople } from './people.ts'
 import { buildReport, type ImportReport, reportJson, reportMarkdown } from './report.ts'
 import { convertSchema } from './schema.ts'
 import { readSiteFiles, type SiteFiles } from './site-files.ts'
@@ -38,6 +39,7 @@ export {
   reportSummary,
 } from './report.ts'
 export { SUPPORTED_EDITORS } from './schema.ts'
+export { hideTopLevelFrom, parseAppSettings } from './site-files.ts'
 export { openSource, type Source } from './source.ts'
 export {
   type DetectedVersion,
@@ -71,6 +73,15 @@ export interface ImportOptions {
    * as its peer range. The importer does not know it itself: the CLI does.
    */
   coreVersion: string
+  /**
+   * Property values and media files: left out (the default), sealed under the
+   * passphrase, or in the open. Names, the tree and the rules travel regardless.
+   */
+  content?: 'omitted' | 'sealed' | 'open'
+  withMembers?: boolean
+  withUsers?: boolean
+  /** Seals the content and the people; needed for either. */
+  passphrase?: string
 }
 
 /** One file of the new site: literal text, or a file to copy. */
@@ -96,6 +107,10 @@ export interface ImportPlan {
 }
 
 export async function planImport(options: ImportOptions): Promise<ImportPlan> {
+  const mode = options.content ?? 'omitted'
+  const withPeople = Boolean(options.withMembers || options.withUsers)
+  if ((mode === 'sealed' || withPeople) && !options.passphrase)
+    throw new Error('Encrypted content and people need a passphrase.')
   const source = await openSource(options.source, { staging: options.staging })
   try {
     const findings = new Findings()
@@ -175,11 +190,50 @@ export async function planImport(options: ImportOptions): Promise<ImportPlan> {
       siteName,
     })
     const inventory = takeInventory(source, schema, files, findings)
+    const people = convertPeople(source, schema, findings, {
+      members: options.withMembers ?? false,
+      users: options.withUsers ?? false,
+    })
+    // What was left out by asking for less, and how to bring it.
+    if (!options.withMembers)
+      findings.some({
+        class: 'dropped',
+        code: 'members-left-out',
+        title: 'Members',
+        detail:
+          'Not asked for. Pass --with-members to bring them, with their groups and passwords, encrypted.',
+        count: source.count('cmsMember'),
+      })
+    if (!options.withUsers)
+      findings.some({
+        class: 'dropped',
+        code: 'users-left-out',
+        title: 'Backoffice users',
+        detail:
+          'Not asked for: `crombolo start` creates an administrator. Pass --with-users to bring them, with their groups and passwords, encrypted.',
+        count: source.count('umbracoUser', 'id > 0'),
+      })
+    if (mode === 'omitted')
+      findings.some({
+        class: 'dropped',
+        code: 'content-left-out',
+        title: 'Property values and media files',
+        detail:
+          'Not asked for: pages and media are created with their names, places and templates, and are empty. Pass --include-content to bring what they hold, encrypted.',
+        count: content.set.nodes.filter((node) => node.values.length > 0).length,
+      })
 
     const out: SiteFile[] = []
 
     // Schema
-    out.push({ path: 'schema/schema.toml', text: writeSchemaVersion(schema.set.version) })
+    // The source's address setting travels, so its URLs stay what they were.
+    out.push({
+      path: 'schema/schema.toml',
+      text: writeSchemaVersion(
+        schema.set.version,
+        files?.hideTopLevelNodeFromPath === false ? { hideTopLevel: false } : undefined,
+      ),
+    })
     for (const type of schema.set.contentTypes)
       out.push({
         path: `schema/content-types/${fileNameFor(type.alias)}`,
@@ -262,7 +316,7 @@ export async function planImport(options: ImportOptions): Promise<ImportPlan> {
     // the values name, so nothing has to hold a whole media library in memory.
     const missing: string[] = []
     const seen = new Set<string>()
-    for (const blob of content.blobs) {
+    for (const blob of mode === 'omitted' ? [] : content.blobs) {
       if (seen.has(blob.key)) continue
       seen.add(blob.key)
       const file = files?.mediaDir ? join(files.mediaDir, blob.key) : undefined
@@ -301,14 +355,25 @@ export async function planImport(options: ImportOptions): Promise<ImportPlan> {
     })
 
     // The content, as the private bundle package `content import` reads.
-    const imported = writeBundlePackage(writeBundle(content.set), {
-      name: 'umbraco-import',
-      version: '1.0.0',
-      id: 'umbraco-import',
-      label: `Content imported from ${siteName}`,
-      private: true,
-      peerRange: `^${options.coreVersion}`,
-    })
+    const seal =
+      options.passphrase && (mode === 'sealed' || withPeople)
+        ? newSeal(options.passphrase)
+        : undefined
+    const imported = writeBundlePackage(
+      writeBundle(content.set, undefined, [], {
+        content: mode,
+        seal,
+        people: withPeople ? people : undefined,
+      }),
+      {
+        name: 'umbraco-import',
+        version: '1.0.0',
+        id: 'umbraco-import',
+        label: `Content imported from ${siteName}`,
+        private: true,
+        peerRange: `^${options.coreVersion}`,
+      },
+    )
     for (const file of imported)
       out.push({ path: `${IMPORT_BUNDLE}/${file.path}`, text: file.text, bytes: file.bytes })
 

package/src/inventory.ts

@@ -277,40 +277,6 @@ export function takeInventory(
     items: domains.map((d) => d.host || `(culture ${d.defaultCulture ?? 'default'})`),
   })
 
-  // What a later version of the importer could carry, and this one does not.
-  const notYet = (code: string, title: string, count: number, detail: string) =>
-    findings.some({ class: 'not-yet', code, title, count, detail })
-  notYet(
-    'members',
-    'Members',
-    source.count('cmsMember'),
-    'Members, their groups and their passwords are not imported. Member types are.',
-  )
-  notYet(
-    'users',
-    'Backoffice users',
-    source.count('umbracoUser', 'id > 0'),
-    'Users and user groups are not imported. `crombolo start` creates an administrator.',
-  )
-  notYet(
-    'redirects',
-    'Redirects',
-    source.count('umbracoRedirectUrl'),
-    'Redirects Umbraco recorded when pages moved are not imported.',
-  )
-  notYet(
-    'public-access',
-    'Protected pages',
-    source.count('umbracoAccess'),
-    'Public access rules are not imported: these pages will be public until the rules are set again.',
-  )
-  notYet(
-    'schedules',
-    'Scheduled publishes',
-    source.count('umbracoContentSchedule'),
-    'Pending publish and unpublish dates are not imported.',
-  )
-
   // What has no equivalent.
   findings.some({
     class: 'cannot-migrate',
@@ -402,7 +368,7 @@ export function takeInventory(
       code: 'app-plugins',
       title: 'Backoffice plugins in App_Plugins',
       detail:
-        'A plugin that is client-side only may work if copied into the new site’s App_Plugins; one with a server side will not.',
+        'A plugin that is client-side only may work once repackaged as a bundle in the new site’s bundles/; one with a server side will not.',
       count: files.plugins.length,
       items: files.plugins,
     })

package/src/people.ts

@@ -0,0 +1,275 @@
+/**
+ * Umbraco's members, member groups, users and user groups → a bundle's people
+ * (story 071), each password hash kept with its algorithm marker so it still
+ * verifies here and is re-hashed on the next sign-in.
+ */
+import { ObjectTypes } from '@crombolo/core'
+import type {
+  BundleMember,
+  BundlePeople,
+  BundleUser,
+  BundleUserGroup,
+  BundleValue,
+} from '@crombolo/transfer'
+import { editorValue, type ValueRow } from './content.ts'
+import type { Findings } from './findings.ts'
+import type { ConvertedSchema } from './schema.ts'
+import { key, type Source } from './source.ts'
+
+export interface PeopleOptions {
+  members: boolean
+  users: boolean
+}
+
+const truthy = (value: unknown): boolean => value === 1 || value === true || value === '1'
+const text = (value: unknown): string | null =>
+  value === null || value === undefined || value === '' ? null : String(value)
+
+export function convertPeople(
+  source: Source,
+  schema: ConvertedSchema,
+  findings: Findings,
+  options: PeopleOptions,
+): BundlePeople {
+  const people: BundlePeople = { memberGroups: [], members: [], userGroups: [], users: [] }
+  const nodeKeys = new Map(
+    source
+      .all<{ id: number; key: string }>('SELECT id, uniqueId AS key FROM umbracoNode')
+      .map((row) => [Number(row.id), key(row.key)]),
+  )
+  if (options.members) convertMembers(source, schema, nodeKeys, people)
+  if (options.users) convertUsers(source, nodeKeys, people)
+
+  findings.some({
+    class: 'migrates',
+    code: 'members',
+    title: 'Members',
+    detail:
+      'With their groups and their passwords, which keep working and are re-hashed the first time each member signs in. They travel encrypted.',
+    count: people.members.length,
+  })
+  findings.some({
+    class: 'migrates',
+    code: 'users',
+    title: 'Backoffice users',
+    detail:
+      'With their groups and their passwords, which keep working and are re-hashed the first time each user signs in. They travel encrypted.',
+    count: people.users.length,
+  })
+  return people
+}
+
+function convertMembers(
+  source: Source,
+  schema: ConvertedSchema,
+  nodeKeys: ReadonlyMap<number, string>,
+  people: BundlePeople,
+): void {
+  people.memberGroups = source
+    .all<{ key: string; name: string }>(
+      `SELECT uniqueId AS key, "text" AS name FROM umbracoNode
+       WHERE nodeObjectType = ? COLLATE NOCASE AND trashed = 0 ORDER BY "text"`,
+      ObjectTypes.MemberGroup,
+    )
+    .map((row) => ({ key: key(row.key), name: row.name }))
+  if (!source.has('cmsMember')) return
+
+  const groupsOf = new Map<number, string[]>()
+  if (source.has('cmsMember2MemberGroup'))
+    for (const row of source.all<{ member: number; group: number }>(
+      'SELECT Member AS member, MemberGroup AS "group" FROM cmsMember2MemberGroup',
+    )) {
+      const group = nodeKeys.get(Number(row.group))
+      if (!group) continue
+      const list = groupsOf.get(Number(row.member)) ?? []
+      list.push(group)
+      groupsOf.set(Number(row.member), list)
+    }
+
+  const rows = source.all<{
+    id: number
+    name: string | null
+    contentTypeId: number
+    versionId: number | null
+    email: string
+    login: string
+    password: string | null
+    passwordConfig: string | null
+    isApproved: unknown
+    isLockedOut: unknown
+  }>(
+    `SELECT n.id AS id, n."text" AS name, c.contentTypeId AS contentTypeId, cv.id AS versionId,
+            m.Email AS email, m.LoginName AS login, m.Password AS password,
+            m.passwordConfig AS passwordConfig, m.isApproved AS isApproved, m.isLockedOut AS isLockedOut
+     FROM cmsMember m
+     JOIN umbracoNode n ON n.id = m.nodeId
+     JOIN umbracoContent c ON c.nodeId = n.id
+     LEFT JOIN umbracoContentVersion cv ON cv.nodeId = n.id AND cv."current" = 1
+     ORDER BY n.id`,
+  )
+  const versions = new Set(
+    rows.flatMap((row) => (row.versionId === null ? [] : [Number(row.versionId)])),
+  )
+  const valuesByVersion = new Map<number, ValueRow[]>()
+  for (const row of source.all<ValueRow>(
+    `SELECT versionId, propertyTypeId, languageId, segment, intValue, decimalValue, dateValue,
+            varcharValue, textValue FROM umbracoPropertyData`,
+  )) {
+    const version = Number(row.versionId)
+    if (!versions.has(version)) continue
+    const list = valuesByVersion.get(version) ?? []
+    list.push(row)
+    valuesByVersion.set(version, list)
+  }
+
+  for (const row of rows) {
+    const type = schema.contentTypes.get(Number(row.contentTypeId))
+    const memberKey = nodeKeys.get(Number(row.id))
+    if (!type || !memberKey) continue
+    const values: BundleValue[] = []
+    for (const cell of row.versionId === null
+      ? []
+      : (valuesByVersion.get(Number(row.versionId)) ?? [])) {
+      const property = schema.propertyTypes.get(Number(cell.propertyTypeId))
+      if (!property) continue
+      const value = editorValue(property.dataType.editor, property.dataType.dbType, cell)
+      if (value === null || value === undefined) continue
+      values.push({
+        property: property.alias,
+        culture: null,
+        segment: cell.segment ?? null,
+        editor: property.dataType.editor,
+        value,
+      })
+    }
+    const member: BundleMember = {
+      key: memberKey,
+      name: row.name ?? row.login,
+      memberTypeAlias: type.alias,
+      email: row.email,
+      username: row.login,
+      isApproved: truthy(row.isApproved),
+      isLockedOut: truthy(row.isLockedOut),
+      passwordHash: text(row.password),
+      passwordConfig: text(row.passwordConfig),
+      groupKeys: groupsOf.get(Number(row.id)) ?? [],
+      values,
+    }
+    people.members.push(member)
+  }
+}
+
+function convertUsers(
+  source: Source,
+  nodeKeys: ReadonlyMap<number, string>,
+  people: BundlePeople,
+): void {
+  if (!source.has('umbracoUserGroup') || !source.has('umbracoUser')) return
+  const groupRows = source.all<{
+    id: number
+    key: string | null
+    alias: string
+    name: string
+    icon: string | null
+    allLanguages: unknown
+    startContentId: number | null
+    startMediaId: number | null
+  }>(
+    `SELECT id, "key" AS key, userGroupAlias AS alias, userGroupName AS name, icon,
+            hasAccessToAllLanguages AS allLanguages, startContentId, startMediaId
+     FROM umbracoUserGroup ORDER BY id`,
+  )
+  const appsOf = new Map<number, string[]>()
+  if (source.has('umbracoUserGroup2App'))
+    for (const row of source.all<{ group: number; app: string }>(
+      'SELECT userGroupId AS "group", app FROM umbracoUserGroup2App ORDER BY app',
+    ))
+      appsOf.set(Number(row.group), [...(appsOf.get(Number(row.group)) ?? []), row.app])
+  const permissionsOf = new Map<string, string[]>()
+  if (source.has('umbracoUserGroup2Permission'))
+    for (const row of source.all<{ group: string; permission: string }>(
+      'SELECT userGroupKey AS "group", permission FROM umbracoUserGroup2Permission ORDER BY permission',
+    ))
+      permissionsOf.set(key(row.group), [
+        ...(permissionsOf.get(key(row.group)) ?? []),
+        row.permission,
+      ])
+  const languagesOf = new Map<number, string[]>()
+  if (source.has('umbracoUserGroup2Language') && source.has('umbracoLanguage'))
+    for (const row of source.all<{ group: number; iso: string }>(
+      `SELECT g.userGroupId AS "group", l.languageISOCode AS iso
+       FROM umbracoUserGroup2Language g JOIN umbracoLanguage l ON l.id = g.languageId`,
+    ))
+      languagesOf.set(Number(row.group), [...(languagesOf.get(Number(row.group)) ?? []), row.iso])
+
+  const aliasOf = new Map<number, string>()
+  for (const row of groupRows) {
+    // Before Umbraco 14 a group had no key: one derived from its alias is stable across runs.
+    const groupKey = row.key ? key(row.key) : derivedKey(`user-group:${row.alias}`)
+    aliasOf.set(Number(row.id), row.alias)
+    const group: BundleUserGroup = {
+      key: groupKey,
+      alias: row.alias,
+      name: row.name,
+      icon: row.icon,
+      sections: appsOf.get(Number(row.id)) ?? [],
+      permissions: permissionsOf.get(groupKey) ?? [],
+      hasAccessToAllLanguages: truthy(row.allLanguages),
+      languages: languagesOf.get(Number(row.id)) ?? [],
+      documentStartNodeKey:
+        row.startContentId === null ? null : (nodeKeys.get(Number(row.startContentId)) ?? null),
+      mediaStartNodeKey:
+        row.startMediaId === null ? null : (nodeKeys.get(Number(row.startMediaId)) ?? null),
+    }
+    people.userGroups.push(group)
+  }
+
+  const groupsOf = new Map<number, string[]>()
+  if (source.has('umbracoUser2UserGroup'))
+    for (const row of source.all<{ user: number; group: number }>(
+      'SELECT userId AS "user", userGroupId AS "group" FROM umbracoUser2UserGroup',
+    )) {
+      const alias = aliasOf.get(Number(row.group))
+      if (alias) groupsOf.set(Number(row.user), [...(groupsOf.get(Number(row.user)) ?? []), alias])
+    }
+
+  const hasKind = source.hasColumn('umbracoUser', 'kind')
+  for (const row of source.all<{
+    id: number
+    key: string | null
+    name: string
+    login: string
+    email: string
+    language: string | null
+    disabled: unknown
+    password: string | null
+    passwordConfig: string | null
+    kind: number | null
+  }>(
+    `SELECT id, "key" AS key, userName AS name, userLogin AS login, userEmail AS email,
+            userLanguage AS language, userDisabled AS disabled, userPassword AS password,
+            passwordConfig, ${hasKind ? 'kind' : 'NULL AS kind'}
+     FROM umbracoUser ORDER BY id`,
+  )) {
+    // API users sign in with client credentials, which do not travel.
+    if (Number(row.kind ?? 0) !== 0) continue
+    const user: BundleUser = {
+      key: row.key ? key(row.key) : derivedKey(`user:${row.login}`),
+      name: row.name,
+      userName: row.login,
+      email: row.email,
+      languageIsoCode: row.language,
+      disabled: truthy(row.disabled),
+      passwordHash: text(row.password),
+      passwordConfig: text(row.passwordConfig),
+      groupAliases: groupsOf.get(Number(row.id)) ?? [],
+    }
+    people.users.push(user)
+  }
+}
+
+/** A uuid-shaped key from a name, the same every run. Pure. */
+function derivedKey(name: string): string {
+  const hex = new Bun.CryptoHasher('sha256').update(name).digest('hex')
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`
+}

package/src/site-files.ts

@@ -20,6 +20,51 @@ export interface SiteFiles {
   csharp: number
   /** Stylesheets and scripts under the web root, relative to it. */
   assets: Array<{ path: string; file: string }>
+  /** `Umbraco:CMS:Global:HideTopLevelNodeFromPath`, when the settings name it. */
+  hideTopLevelNodeFromPath?: boolean
+}
+
+/** JSON as .NET reads appsettings: comments and trailing commas allowed. Pure. */
+export function parseAppSettings(text: string): unknown {
+  let out = ''
+  let inString = false
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i] as string
+    if (inString) {
+      out += c
+      if (c === '\\') out += text[++i] ?? ''
+      else if (c === '"') inString = false
+    } else if (c === '"') {
+      inString = true
+      out += c
+    } else if (c === '/' && text[i + 1] === '/') {
+      while (i < text.length && text[i] !== '\n') i++
+    } else if (c === '/' && text[i + 1] === '*') {
+      i = text.indexOf('*/', i + 2)
+      if (i < 0) break
+      i++
+    } else out += c
+  }
+  try {
+    return JSON.parse(out.replace(/,(\s*[}\]])/g, '$1'))
+  } catch {
+    return undefined
+  }
+}
+
+/** The setting from parsed appsettings, matching keys as .NET does, ignoring case. Pure. */
+export function hideTopLevelFrom(settings: unknown): boolean | undefined {
+  let at: unknown = settings
+  for (const name of ['umbraco', 'cms', 'global', 'hidetoplevelnodefrompath']) {
+    if (!at || typeof at !== 'object') return undefined
+    const entry = Object.entries(at as Record<string, unknown>).find(
+      ([key]) => key.toLowerCase() === name,
+    )
+    at = entry?.[1]
+  }
+  if (typeof at === 'boolean') return at
+  if (typeof at === 'string' && /^(true|false)$/i.test(at)) return at.toLowerCase() === 'true'
+  return undefined
 }
 
 const SKIP = new Set(['bin', 'obj', 'node_modules', '.git', '.vs', 'umbraco'])
@@ -114,5 +159,18 @@ export function readSiteFiles(root: string, mediaOverride?: string): SiteFiles {
     plugins: plugins.sort(),
     csharp,
     assets: assets.sort((a, b) => a.path.localeCompare(b.path)),
+    ...urlSettingsIn(webRoot),
+  }
+}
+
+/** The production settings override the base ones, as they do when the site runs. */
+function urlSettingsIn(webRoot: string): Pick<SiteFiles, 'hideTopLevelNodeFromPath'> {
+  let found: boolean | undefined
+  for (const name of ['appsettings.json', 'appsettings.Production.json']) {
+    const file = join(webRoot, name)
+    if (!existsSync(file)) continue
+    const value = hideTopLevelFrom(parseAppSettings(readFileSync(file, 'utf8')))
+    if (value !== undefined) found = value
   }
+  return found === undefined ? {} : { hideTopLevelNodeFromPath: found }
 }

package/src/source.ts

@@ -41,6 +41,10 @@ const WANTED_TABLES = [
   'umbracoAccessRule',
   'umbracoUser',
   'umbracoUserGroup',
+  'umbracoUser2UserGroup',
+  'umbracoUserGroup2App',
+  'umbracoUserGroup2Permission',
+  'umbracoUserGroup2Language',
   'umbracoExternalLogin',
   'umbracoTwoFactorLogin',
   'umbracoWebhook',