@atlasauth/cli 0.12.0 → 0.13.0

package/dist/migrate/export/password-detect.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLAINTEXT_PBKDF2_ITERATIONS = void 0;
+exports.detectPasswordHash = detectPasswordHash;
+exports.isKnownAlgorithm = isKnownAlgorithm;
+const node_crypto_1 = require("node:crypto");
+const migrate_1 = require("@atlasauth/migrate");
+const SHAPES = [
+    { re: /^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/, algorithm: 'bcrypt' },
+    { re: /^\$argon2(id|i|d)\$/, algorithm: 'argon2' },
+    { re: /^\$6\$(rounds=\d{1,9}\$)?[^$]{0,16}\$[./0-9A-Za-z]{86}$/, algorithm: 'sha_crypt' },
+    { re: /^\$5\$(rounds=\d{1,9}\$)?[^$]{0,16}\$[./0-9A-Za-z]{43}$/, algorithm: 'sha_crypt' },
+    { re: /^\$(1|apr1)\$[^$]{0,8}\$[./0-9A-Za-z]{22}$/, algorithm: 'md5_crypt', weak: true },
+    { re: /^pbkdf2_(sha1|sha256|sha512)\$\d+\$[^$]+\$.+$/, algorithm: 'pbkdf2_django' },
+    { re: /^bcrypt_sha256\$\$2[aby]\$/, algorithm: 'bcrypt_sha256_django' },
+    { re: /^\$pbkdf2-(sha1|sha256|sha512)\$\d+\$[^$]*\$.+$/, algorithm: 'pbkdf2_phc' },
+    { re: /^\$scrypt\$ln=\d+,r=\d+,p=\d+\$/, algorithm: 'scrypt_phc' },
+    { re: /^pbkdf2:(sha1|sha256|sha512)(:\d+)?\$[^$]+\$[0-9a-f]+$/, algorithm: 'pbkdf2_werkzeug' },
+    { re: /^scrypt:\d+:\d+:\d+\$[^$]+\$[0-9a-f]+$/, algorithm: 'scrypt_werkzeug' },
+    { re: /^\$[PH]\$[./0-9A-Za-z]{31}$/, algorithm: 'phpass', weak: true },
+    { re: /^\{(SSHA|SHA|SSHA256|SSHA512|SHA256|SHA512)\}[A-Za-z0-9+/=]+$/i, algorithm: 'ldap_ssha', weak: true },
+    { re: /^\{(MD5|SMD5|SHA384|SSHA384)\}[A-Za-z0-9+/=]+$/i, algorithm: 'ldap_digest', weak: true },
+    { re: /^\{PBKDF2(-(SHA1|SHA256|SHA512))?\}\d+\$/i, algorithm: 'ldap_pbkdf2' },
+    { re: /^\{PBKDF2_SHA256\}[A-Za-z0-9+/=]+$/i, algorithm: 'ldap_pbkdf2' },
+];
+/** `{CRYPT}` / `{BCRYPT}` / `{ARGON2}` around one of the crypt-style shapes above. */
+const WRAPPED = /^\{(CRYPT|BCRYPT|ARGON2)\}(\$.+)$/i;
+/** Directory schemes that are not hashes Atlas can check (pass-through or Kerberos). */
+const DELEGATED = /^\{(SASL|K5KEY|KERBEROS|UNIX|NS-MTA-MD5|RADIUS|TOTP)\}/i;
+/**
+ * Identify a self-describing hash. `{CLEARTEXT}` (and a plaintext value when
+ * `plaintext` is allowed) is hashed here with PBKDF2 before it is written, so
+ * no password is ever stored in the clear (Atlas re-hashes it to Argon2id on
+ * the first sign-in).
+ */
+function detectPasswordHash(raw, options = {}) {
+    const value = raw?.trim();
+    if (!value)
+        return { ok: false, reason: 'no password' };
+    for (const s of SHAPES)
+        if (s.re.test(value))
+            return { ok: true, password: { algorithm: s.algorithm, hash: value }, weak: s.weak === true };
+    const wrapped = WRAPPED.exec(value);
+    if (wrapped) {
+        const inner = wrapped[2];
+        const known = SHAPES.find((s) => s.re.test(inner) && ['bcrypt', 'argon2', 'sha_crypt', 'sha_crypt', 'md5_crypt'].includes(s.algorithm));
+        if (known)
+            return { ok: true, password: { algorithm: 'ldap_crypt', hash: value }, weak: known.weak === true };
+        return { ok: false, reason: `{${wrapped[1].toUpperCase()}} hash in a format Atlas cannot verify` };
+    }
+    if (/^\{CRYPT\}/i.test(value))
+        return { ok: false, reason: 'traditional DES {CRYPT} hash (not verifiable)' };
+    if (DELEGATED.test(value))
+        return { ok: false, reason: `${/^\{[^}]+\}/.exec(value)[0]} is checked by another service (pass-through authentication)` };
+    const clear = /^\{CLEARTEXT\}(.*)$/i.exec(value);
+    if (clear)
+        return hashPlaintext(clear[1]);
+    if (/^\{[A-Z0-9_-]+\}/i.test(value))
+        return { ok: false, reason: `unsupported scheme ${/^\{[^}]+\}/.exec(value)[0]}` };
+    if (options.plaintext)
+        return hashPlaintext(value);
+    return { ok: false, reason: 'unrecognised hash format (name its algorithm)' };
+}
+/** PBKDF2-SHA256 rounds for a plaintext password hashed on export (re-hashed to Argon2id on first sign-in). */
+exports.PLAINTEXT_PBKDF2_ITERATIONS = 10_000;
+function hashPlaintext(password) {
+    if (!password)
+        return { ok: false, reason: 'empty password' };
+    const salt = (0, node_crypto_1.randomBytes)(16);
+    const hash = (0, node_crypto_1.pbkdf2Sync)(password, salt, exports.PLAINTEXT_PBKDF2_ITERATIONS, 32, 'sha256');
+    return {
+        ok: true,
+        password: { algorithm: 'pbkdf2', hash: hash.toString('base64'), salt: salt.toString('base64'), params: { digest: 'sha256', iterations: exports.PLAINTEXT_PBKDF2_ITERATIONS, encoding: 'base64', salt_encoding: 'base64' } },
+        weak: false,
+    };
+}
+/** Whether Atlas's registry has a verifier id (or `auto`). */
+function isKnownAlgorithm(id) {
+    return migrate_1.PASSWORD_HASH_ALGORITHMS.includes(id);
+}
+//# sourceMappingURL=password-detect.js.map

package/dist/migrate/export/password-detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-detect.js","sourceRoot":"","sources":["../../../src/migrate/export/password-detect.ts"],"names":[],"mappings":";;;AA4CA,gDAkBC;AAiBD,4CAEC;AAjFD,6CAAsD;AACtD,gDAAiF;AAYjF,MAAM,MAAM,GAA6D;IACvE,EAAE,EAAE,EAAE,sCAAsC,EAAE,SAAS,EAAE,QAAQ,EAAE;IACnE,EAAE,EAAE,EAAE,qBAAqB,EAAE,SAAS,EAAE,QAAQ,EAAE;IAClD,EAAE,EAAE,EAAE,yDAAyD,EAAE,SAAS,EAAE,WAAW,EAAE;IACzF,EAAE,EAAE,EAAE,yDAAyD,EAAE,SAAS,EAAE,WAAW,EAAE;IACzF,EAAE,EAAE,EAAE,4CAA4C,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE;IACxF,EAAE,EAAE,EAAE,+CAA+C,EAAE,SAAS,EAAE,eAAe,EAAE;IACnF,EAAE,EAAE,EAAE,4BAA4B,EAAE,SAAS,EAAE,sBAAsB,EAAE;IACvE,EAAE,EAAE,EAAE,iDAAiD,EAAE,SAAS,EAAE,YAAY,EAAE;IAClF,EAAE,EAAE,EAAE,iCAAiC,EAAE,SAAS,EAAE,YAAY,EAAE;IAClE,EAAE,EAAE,EAAE,wDAAwD,EAAE,SAAS,EAAE,iBAAiB,EAAE;IAC9F,EAAE,EAAE,EAAE,wCAAwC,EAAE,SAAS,EAAE,iBAAiB,EAAE;IAC9E,EAAE,EAAE,EAAE,6BAA6B,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;IACtE,EAAE,EAAE,EAAE,gEAAgE,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5G,EAAE,EAAE,EAAE,iDAAiD,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;IAC/F,EAAE,EAAE,EAAE,2CAA2C,EAAE,SAAS,EAAE,aAAa,EAAE;IAC7E,EAAE,EAAE,EAAE,qCAAqC,EAAE,SAAS,EAAE,aAAa,EAAE;CACxE,CAAC;AAEF,sFAAsF;AACtF,MAAM,OAAO,GAAG,oCAAoC,CAAC;AAErD,wFAAwF;AACxF,MAAM,SAAS,GAAG,yDAAyD,CAAC;AAE5E;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,GAAuB,EAAE,UAAmC,EAAE;IAC/F,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;IAC5I,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACxI,IAAI,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAC7G,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,8DAA8D,EAAE,CAAC;IACvJ,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxH,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;AAChF,CAAC;AAED,+GAA+G;AAClG,QAAA,2BAA2B,GAAG,MAAM,CAAC;AAElD,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,EAAE,mCAA2B,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,mCAA2B,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE;QACnN,IAAI,EAAE,KAAK;KACZ,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAQ,kCAA8C,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/migrate/export/pingone.d.ts

@@ -0,0 +1,36 @@
+import type { SsoConnectionRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate ping-identity export` — a PingOne environment through its
+ * management API with a worker application (client id + secret, on this
+ * machine): users (login, email and verification, name, phones, enabled /
+ * locked state, population, last sign-on), groups (as roles, with their
+ * members), external-IdP identities and the environment's SAML / OIDC identity
+ * providers (as SSO connections).
+ *
+ * PingOne never returns password hashes, TOTP secrets or FIDO2 credentials:
+ * passwords move by lazy migration (the `ping_identity` preset checks them with
+ * PingOne's password-check call), second factors are enrolled again.
+ */
+/** auth.pingone.<tld> / api.pingone.<tld> for a region code. */
+export declare function pingRegion(region: string | undefined): string;
+export interface PingOneExportOptions {
+    environmentId: string;
+    clientId: string;
+    clientSecret: string;
+    region?: string;
+    /** Read each user's group memberships (one call per user; off for very large environments). */
+    groups?: boolean;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** A client-credentials access token for the worker application. */
+export declare function pingOneToken(o: Pick<PingOneExportOptions, 'environmentId' | 'clientId' | 'clientSecret' | 'region' | 'fetchImpl'>): Promise<string>;
+export declare function pingOneHttp(o: PingOneExportOptions, token: string): VendorHttp;
+/** Every item of a PingOne collection (`_embedded.<key>`, next page in `_links.next.href`). */
+export declare function pingOneList(http: VendorHttp, path: string, key: string): Promise<Obj[]>;
+/** A PingOne identity provider → an SSO connection (SAML / OIDC); other types are social logins. */
+export declare function ssoConnectionOf(idp: Obj): SsoConnectionRecord | null;
+export declare function exportPingOne(o: PingOneExportOptions): Promise<RecordSet>;

package/dist/migrate/export/pingone.js

@@ -0,0 +1,218 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pingRegion = pingRegion;
+exports.pingOneToken = pingOneToken;
+exports.pingOneHttp = pingOneHttp;
+exports.pingOneList = pingOneList;
+exports.ssoConnectionOf = ssoConnectionOf;
+exports.exportPingOne = exportPingOne;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+/**
+ * `atlas migrate ping-identity export` — a PingOne environment through its
+ * management API with a worker application (client id + secret, on this
+ * machine): users (login, email and verification, name, phones, enabled /
+ * locked state, population, last sign-on), groups (as roles, with their
+ * members), external-IdP identities and the environment's SAML / OIDC identity
+ * providers (as SSO connections).
+ *
+ * PingOne never returns password hashes, TOTP secrets or FIDO2 credentials:
+ * passwords move by lazy migration (the `ping_identity` preset checks them with
+ * PingOne's password-check call), second factors are enrolled again.
+ */
+/** auth.pingone.<tld> / api.pingone.<tld> for a region code. */
+function pingRegion(region) {
+    const r = (region ?? 'com').toLowerCase().replace(/^\./, '');
+    if (!/^(com|eu|asia|ca|com\.au|sg)$/.test(r))
+        throw new Error(`Unknown PingOne region "${region}" (use com, eu, asia, ca, com.au or sg).`);
+    return r;
+}
+/** A client-credentials access token for the worker application. */
+async function pingOneToken(o) {
+    const f = o.fetchImpl ?? fetch;
+    const res = await f(`https://auth.pingone.${pingRegion(o.region)}/${o.environmentId}/as/token`, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/x-www-form-urlencoded',
+            authorization: `Basic ${Buffer.from(`${encodeURIComponent(o.clientId)}:${encodeURIComponent(o.clientSecret)}`).toString('base64')}`,
+        },
+        body: 'grant_type=client_credentials',
+    });
+    const body = (await res.json().catch(() => null));
+    const token = (0, record_set_1.str)(body?.access_token);
+    if (res.status !== 200 || !token)
+        throw new Error(`PingOne refused the worker application's credentials (${res.status}${(0, record_set_1.str)(body?.error_description) ? `: ${(0, record_set_1.str)(body?.error_description)}` : ''}).`);
+    return token;
+}
+function pingOneHttp(o, token) {
+    return new vendor_http_1.VendorHttp({
+        vendor: 'PingOne',
+        baseUrl: `https://api.pingone.${pingRegion(o.region)}/v1/environments/${o.environmentId}`,
+        headers: { authorization: `Bearer ${token}` },
+        fetchImpl: o.fetchImpl,
+        sleep: o.sleep,
+    });
+}
+/** Every item of a PingOne collection (`_embedded.<key>`, next page in `_links.next.href`). */
+async function pingOneList(http, path, key) {
+    const out = [];
+    let next = path;
+    while (next) {
+        const res = await http.get(next);
+        const body = (0, record_set_1.isObj)(res.body) ? res.body : {};
+        out.push(...(0, record_set_1.objs)((0, record_set_1.isObj)(body._embedded) ? body._embedded[key] : undefined));
+        const href = (0, record_set_1.isObj)(body._links) && (0, record_set_1.isObj)(body._links.next) ? body._links.next.href : undefined;
+        next = typeof href === 'string' ? href : undefined;
+    }
+    return out;
+}
+async function listOrEmpty(http, path, key) {
+    try {
+        return await pingOneList(http, path, key);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [403, 404].includes(err.status))
+            return [];
+        throw err;
+    }
+}
+/** A PingOne identity provider → an SSO connection (SAML / OIDC); other types are social logins. */
+function ssoConnectionOf(idp) {
+    const type = (0, record_set_1.str)(idp.type);
+    const id = (0, record_set_1.str)(idp.id);
+    if (!id)
+        return null;
+    if (type === 'SAML') {
+        const certs = (0, record_set_1.isObj)(idp.idpVerification) ? (0, record_set_1.objs)(idp.idpVerification.certificates) : [];
+        return (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(idp.name),
+            protocol: 'saml',
+            enabled: idp.enabled !== false,
+            saml: (0, record_set_1.compact)({
+                idp_entity_id: (0, record_set_1.str)(idp.idpEntityId),
+                idp_sso_url: (0, record_set_1.str)(idp.ssoEndpoint),
+                sp_entity_id: (0, record_set_1.str)(idp.spEntityId),
+                // The signing certificate itself is not in the list answer: fetch the certificate id's key from PingOne or paste the IdP metadata.
+                idp_certificate: (0, record_set_1.str)(certs[0]?.certificate),
+            }),
+        });
+    }
+    if (type === 'OPENID_CONNECT') {
+        return (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(idp.name),
+            protocol: 'oidc',
+            enabled: idp.enabled !== false,
+            oidc: (0, record_set_1.compact)({
+                issuer: (0, record_set_1.str)(idp.issuer),
+                discovery_url: (0, record_set_1.str)(idp.discoveryEndpoint),
+                client_id: (0, record_set_1.str)(idp.clientId),
+                scopes: Array.isArray(idp.scopes) ? idp.scopes.map(String) : undefined,
+            }),
+        });
+    }
+    return null;
+}
+async function exportPingOne(o) {
+    const set = new record_set_1.RecordSet();
+    const say = o.onProgress ?? (() => undefined);
+    set.manifest = { origin: `PingOne environment ${o.environmentId}` };
+    const http = pingOneHttp(o, await pingOneToken(o));
+    say('identity providers');
+    const connections = new Set();
+    for (const idp of await listOrEmpty(http, '/identityProviders', 'identityProviders')) {
+        const sso = ssoConnectionOf(idp);
+        if (sso) {
+            set.add('sso_connection', sso, sso.id);
+            connections.add(sso.id);
+        }
+        else if ((0, record_set_1.str)(idp.type))
+            set.warn(`Social identity provider "${(0, record_set_1.str)(idp.name) ?? (0, record_set_1.str)(idp.type)}" (${(0, record_set_1.str)(idp.type)}) is configured in Atlas as an OAuth provider (atlas migrate ping-identity config), not imported as a connection.`);
+    }
+    say('groups');
+    const groups = await listOrEmpty(http, '/groups', 'groups');
+    const roleOf = new Map();
+    for (const g of groups) {
+        const id = (0, record_set_1.str)(g.id);
+        const name = (0, record_set_1.str)(g.name);
+        if (!id || !name)
+            continue;
+        const key = (0, translate_kit_1.keyOf)(name);
+        roleOf.set(id, key);
+        set.add('role', { key, name, scope: 'app', description: (0, record_set_1.str)(g.description) }, key);
+    }
+    say('users');
+    const users = await pingOneList(http, '/users?limit=100', 'users');
+    let i = 0;
+    for (const u of users) {
+        const id = (0, record_set_1.str)(u.id);
+        if (!id)
+            continue;
+        if (++i % 500 === 0)
+            say(`  ${i} of ${users.length} users`);
+        const name = (0, record_set_1.isObj)(u.name) ? u.name : {};
+        const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+        const emails = email ? [{ email, verified: u.emailVerified === true || (0, record_set_1.str)(u.verifyStatus) === 'VERIFIED', primary: true }] : [];
+        const phones = [];
+        for (const raw of [u.mobilePhone, u.primaryPhone]) {
+            const p = (0, record_set_1.e164)(raw);
+            if (p && !phones.some((x) => x.phone === p))
+                phones.push({ phone: p, verified: false, primary: phones.length === 0 });
+        }
+        const account = (0, record_set_1.isObj)(u.account) ? u.account : {};
+        const lifecycle = (0, record_set_1.isObj)(u.lifecycle) ? u.lifecycle : {};
+        const record = (0, record_set_1.compact)({
+            id,
+            emails,
+            phones,
+            username: (0, record_set_1.str)(u.username),
+            first_name: (0, record_set_1.str)(name.given),
+            last_name: (0, record_set_1.str)(name.family),
+            name: (0, record_set_1.str)(name.formatted),
+            created_at: (0, record_set_1.str)(u.createdAt),
+            last_sign_in_at: (0, record_set_1.isObj)(u.lastSignOn) ? (0, record_set_1.str)(u.lastSignOn.at) : undefined,
+            private_metadata: { pingone: (0, record_set_1.compact)({ population: (0, record_set_1.isObj)(u.population) ? (0, record_set_1.str)(u.population.id) : undefined, type: (0, record_set_1.str)(u.type), mfa_enabled: u.mfaEnabled === true ? true : undefined }) },
+        });
+        if (u.enabled === false) {
+            record.banned = true;
+            record.ban_reason = 'Disabled in PingOne';
+        }
+        else if ((0, record_set_1.str)(account.status) === 'LOCKED')
+            record.locked = true;
+        if (['ACCOUNT_DISABLED', 'DISABLED'].includes((0, record_set_1.str)(lifecycle.status) ?? ''))
+            record.banned = true;
+        if (!record.emails?.length && !record.phones?.length && !record.username) {
+            set.omit('user', 'no email, phone or username', 1);
+            continue;
+        }
+        if (o.groups !== false && roleOf.size) {
+            const memberOf = await listOrEmpty(http, `/users/${encodeURIComponent(id)}/memberOfGroups`, 'groups');
+            const roles = memberOf.map((g) => roleOf.get((0, record_set_1.str)(g.id) ?? '')).filter((r) => !!r);
+            if (roles.length)
+                record.roles = roles;
+        }
+        set.add('user', record, id);
+        // A user who signs in through an external IdP keeps that link.
+        const ext = (0, record_set_1.isObj)(u.identityProvider) ? u.identityProvider : undefined;
+        const extType = (0, record_set_1.str)(ext?.type);
+        if (ext && extType && extType !== 'PING_ONE') {
+            const link = (0, record_set_1.compact)({
+                user_id: id,
+                provider: extType.toLowerCase(),
+                provider_user_id: (0, record_set_1.str)(ext.id) ?? id,
+                kind: connections.has((0, record_set_1.str)(ext.id) ?? '') ? 'enterprise' : 'oauth',
+                sso_connection_id: connections.has((0, record_set_1.str)(ext.id) ?? '') ? (0, record_set_1.str)(ext.id) : undefined,
+                email,
+                profile: (0, record_set_1.bag)({ external_id: (0, record_set_1.str)(u.externalId) }),
+            });
+            set.add('identity', link);
+        }
+    }
+    set.omit('password', 'PingOne never exports password hashes', users.length);
+    set.omit('mfa_factor', 'PingOne never exports TOTP secrets or FIDO2 credentials', 0);
+    set.warn('Passwords move by lazy migration (preset ping_identity); users enrol their second factor again.');
+    return set;
+}
+//# sourceMappingURL=pingone.js.map

package/dist/migrate/export/pingone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pingone.js","sourceRoot":"","sources":["../../../src/migrate/export/pingone.ts"],"names":[],"mappings":";;AAmBA,gCAIC;AAeD,oCAcC;AAED,kCAQC;AAGD,kCAWC;AAYD,0CAmCC;AAED,sCA8FC;AA1ND,6CAAyF;AACzF,mDAAwC;AACxC,+CAA2D;AAE3D;;;;;;;;;;;GAWG;AAEH,gEAAgE;AAChE,SAAgB,UAAU,CAAC,MAA0B;IACnD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,0CAA0C,CAAC,CAAC;IAC3I,OAAO,CAAC,CAAC;AACX,CAAC;AAcD,oEAAoE;AAC7D,KAAK,UAAU,YAAY,CAAC,CAAqG;IACtI,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,wBAAwB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,WAAW,EAAE;QAC9F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;SACpI;QACD,IAAI,EAAE,+BAA+B;KACtC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAe,CAAC;IAChE,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,CAAC,MAAM,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,IAAA,gBAAG,EAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrM,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,WAAW,CAAC,CAAuB,EAAE,KAAa;IAChE,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,uBAAuB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,aAAa,EAAE;QACzF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AACxF,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IAC3E,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,GAAsB,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAY,IAAA,kBAAK,EAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IACpE,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAChF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAgB,eAAe,CAAC,GAAQ;IACtC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,IAAA,oBAAO,EAAsB;YAClC,EAAE;YACF,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,KAAK;YAC9B,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,aAAa,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC;gBACnC,WAAW,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC;gBACjC,YAAY,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,UAAU,CAAC;gBACjC,mIAAmI;gBACnI,eAAe,EAAE,IAAA,gBAAG,EAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;aAC5C,CAAC;SACoB,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,IAAA,oBAAO,EAAsB;YAClC,EAAE;YACF,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,KAAK;YAC9B,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,MAAM,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC;gBACvB,aAAa,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,iBAAiB,CAAC;gBACzC,SAAS,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC;gBAC5B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;aACtF,CAAC;SACoB,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,CAAuB;IACzD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,EAAE,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnD,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,MAAM,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACvC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,6BAA6B,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,mHAAmH,CAAC,CAAC;IACxO,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,IAAI,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,KAAK,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjJ,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAe,IAAA,oBAAO,EAAC;YACjC,EAAE;YACF,MAAM;YACN,MAAM;YACN,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YACzB,UAAU,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,KAAK,CAAC;YAC3B,SAAS,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,SAAS,CAAC;YACzB,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;YAC5B,eAAe,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YACvE,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAA,oBAAO,EAAC,EAAE,UAAU,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE;SAC3K,CAAC,CAAC;QACjB,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,UAAU,GAAG,qBAAqB,CAAC;QAC5C,CAAC;aAAM,IAAI,IAAA,gBAAG,EAAC,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAClE,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAA,gBAAG,EAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,UAAU,kBAAkB,CAAC,EAAE,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YACtG,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/F,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACzC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAE5B,+DAA+D;QAC/D,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,OAAO,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAmB,IAAA,oBAAO,EAAC;gBACnC,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;gBAC/B,gBAAgB,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;gBACnC,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO;gBACjE,iBAAiB,EAAE,WAAW,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/E,KAAK;gBACL,OAAO,EAAE,IAAA,gBAAG,EAAC,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;aAC/B,CAAC,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,uCAAuC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5E,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,yDAAyD,EAAE,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;IAC5G,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/pocketbase-config.d.ts

@@ -0,0 +1,28 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+/**
+ * `atlas migrate pocketbase config` — a PocketBase app's auth-collection
+ * options → Atlas config.
+ *
+ * Read from `_collections` (the data.db or its dump — the same source the
+ * export reads) or from a collections export file (Settings → Export
+ * collections, `pb_schema.json`), with file:line for the file. v0.23+
+ * options (`passwordAuth`, `oauth2`, `mfa`, `otp`, `authToken`, `authRule`,
+ * flattened onto the collection in an export file, under `options` in the
+ * database) and ≤0.22 options (`allowEmailAuth`, `minPasswordLength`,
+ * `onlyVerified` …) are both understood. Token secrets and OAuth client
+ * secrets are never copied.
+ */
+export interface PocketBaseConfigSnapshot {
+    /** `_collections` rows, or the collections array of an export file. */
+    collections: Obj[];
+    /** The export file, for file:line in the report. */
+    file?: {
+        path: string;
+        text: string;
+    };
+    /** The public PocketBase URL (bridge and lazy-migration presets). */
+    url?: string;
+}
+export declare function parsePocketBaseSchema(text: string): Obj[];
+export declare function translatePocketBaseConfig(snap: PocketBaseConfigSnapshot): TranslationResult;

package/dist/migrate/export/pocketbase-config.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePocketBaseSchema = parsePocketBaseSchema;
+exports.translatePocketBaseConfig = translatePocketBaseConfig;
+const record_set_1 = require("./record-set");
+const source_lines_1 = require("./source-lines");
+const translate_kit_1 = require("./translate-kit");
+function parsePocketBaseSchema(text) {
+    const parsed = JSON.parse(text);
+    if (Array.isArray(parsed))
+        return (0, record_set_1.objs)(parsed);
+    if ((0, record_set_1.isObj)(parsed) && Array.isArray(parsed.collections))
+        return (0, record_set_1.objs)(parsed.collections);
+    throw new Error('Not a PocketBase collections export (expected a JSON array of collections).');
+}
+/** Options of a collection, wherever this PocketBase version keeps them. */
+function optionsOf(c) {
+    const o = typeof c.options === 'string' ? safeJson(c.options) : c.options;
+    return { ...((0, record_set_1.isObj)(o) ? o : {}), ...c };
+}
+function safeJson(s) {
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        return undefined;
+    }
+}
+function translatePocketBaseConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const auth = snap.collections.filter((c) => (0, record_set_1.str)(c.type) === 'auth' && (0, record_set_1.str)(c.name) !== '_superusers');
+    const main = auth.find((c) => (0, record_set_1.str)(c.name) === 'users') ?? auth[0];
+    if (!main) {
+        b.add('manual', 'collections', '_collections', 'No auth collection found: nothing to translate.');
+        return b.result(snap.file?.path ?? 'pocketbase _collections');
+    }
+    const name = (0, record_set_1.str)(main.name);
+    const o = optionsOf(main);
+    const file = snap.file;
+    // Lines are searched from the collection's own "name" key onwards.
+    const start = file ? Math.max(0, file.text.search(new RegExp(`"name"\\s*:\\s*"${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}"`))) : 0;
+    const line = (...keys) => {
+        if (!file)
+            return undefined;
+        // The collection's "id" may come before "name": search the whole object for the first key.
+        const from = file.text.lastIndexOf('{', start);
+        let at = from < 0 ? 0 : from;
+        for (const k of keys) {
+            const i = file.text.indexOf(`"${k}"`, at);
+            if (i < 0)
+                return undefined;
+            at = i + k.length + 2;
+        }
+        return (0, source_lines_1.lineAt)(file.text, at);
+    };
+    const where = (...keys) => {
+        const l = line(...keys);
+        return { f: l ? file.path : undefined, l };
+    };
+    const area = `collection ${name}`;
+    const put = (status, keys, note, atlas) => {
+        const w = where(...keys);
+        (0, source_lines_1.addAt)(b, w.f, w.l, status, area, keys.join('.'), note, atlas);
+    };
+    if (auth.length > 1) {
+        b.add('differs', 'collections', 'auth collections', `${auth.length} auth collections (${auth.map((c) => (0, record_set_1.str)(c.name)).join(', ')}): Atlas has one user pool per instance. Their records are imported together, each tagged with private_metadata.pocketbase_collection; use app roles to tell them apart.`, 'users');
+    }
+    // ── password and identity fields ──
+    const pa = (0, record_set_1.isObj)(o.passwordAuth) ? o.passwordAuth : undefined;
+    if (pa) {
+        const on = pa.enabled !== false;
+        b.set('strategies.password', on);
+        if (on)
+            put('mapped', ['passwordAuth', 'enabled'], 'Password sign-in. Imported bcrypt hashes verify as they are and are upgraded to Argon2id.', 'auth_config.strategies.password');
+        const fields = (0, record_set_1.strs)(pa.identityFields);
+        if (fields.includes('username')) {
+            b.set('strategies.username', true);
+            put('mapped', ['passwordAuth', 'identityFields'], 'Username sign-in.', 'auth_config.strategies.username');
+        }
+        const other = fields.filter((f) => f !== 'email' && f !== 'username');
+        if (other.length)
+            put('manual', ['passwordAuth', 'identityFields'], `Sign-in by ${other.join(', ')} has no Atlas equivalent: those users sign in by email or username.`);
+    }
+    else if (typeof o.allowEmailAuth === 'boolean' || typeof o.allowUsernameAuth === 'boolean') {
+        // ≤0.22
+        const email = o.allowEmailAuth === true;
+        const username = o.allowUsernameAuth === true;
+        b.set('strategies.password', email || username);
+        if (email || username)
+            put('mapped', ['allowEmailAuth'], 'Password sign-in. Imported bcrypt hashes verify as they are and are upgraded to Argon2id.', 'auth_config.strategies.password');
+        if (username) {
+            b.set('strategies.username', true);
+            put('mapped', ['allowUsernameAuth'], 'Username sign-in.', 'auth_config.strategies.username');
+        }
+    }
+    const minPw = typeof o.minPasswordLength === 'number' ? o.minPasswordLength : passwordFieldMin(main);
+    if (minPw !== undefined) {
+        b.set('passwordPolicy.minLength', Math.max(8, minPw));
+        put(minPw < 8 ? 'differs' : 'mapped', typeof o.minPasswordLength === 'number' ? ['minPasswordLength'] : ['fields', 'password', 'min'], minPw < 8 ? `PocketBase allows ${minPw}; Atlas requires at least 8 (existing passwords still sign in).` : `${minPw} characters minimum.`, 'auth_config.passwordPolicy.minLength');
+    }
+    if (o.onlyVerified === true) {
+        b.set('requireEmailVerification', true);
+        put('mapped', ['onlyVerified'], 'Only verified users may sign in.', 'auth_config.requireEmailVerification');
+    }
+    if ((0, record_set_1.strs)(o.onlyEmailDomains).length)
+        put('manual', ['onlyEmailDomains'], `Sign-up limited to ${(0, record_set_1.strs)(o.onlyEmailDomains).join(', ')}: add these domains to the Atlas allowlist (restrictions.allowlistOnly).`, 'auth_config.restrictions');
+    if ((0, record_set_1.strs)(o.exceptEmailDomains).length)
+        put('manual', ['exceptEmailDomains'], `Blocked domains ${(0, record_set_1.strs)(o.exceptEmailDomains).join(', ')}: add them to the Atlas blocklist.`, 'blocklist');
+    // ── OAuth2 ──
+    const oauth = (0, record_set_1.isObj)(o.oauth2) ? o.oauth2 : undefined;
+    if (oauth?.enabled === true || o.allowOAuth2Auth === true) {
+        const providers = (0, record_set_1.objs)(oauth?.providers);
+        for (const p of providers) {
+            const pname = (0, record_set_1.str)(p.name);
+            if (!pname)
+                continue;
+            const atlas = (0, translate_kit_1.socialKey)(pname);
+            const w = where('oauth2', 'providers', pname);
+            if (atlas) {
+                b.socialProvider({ atlasKey: atlas, vendorName: pname, area: `${area} oauth2`, setting: `oauth2.providers.${pname}`, clientId: (0, record_set_1.str)(p.clientId) });
+                if (w.l)
+                    Object.assign(b.report[b.report.length - 1], { file: w.f, line: w.l });
+            }
+            else {
+                (0, source_lines_1.addAt)(b, w.f, w.l, 'manual', `${area} oauth2`, `oauth2.providers.${pname}`, `"${pname}" is not an Atlas built-in provider: add it as a custom OAuth/OIDC provider with the same client id${(0, record_set_1.str)(p.clientId) ? ` (${(0, record_set_1.str)(p.clientId)})` : ''} and authorization / token / userinfo URLs.`, 'custom_oauth_providers');
+            }
+        }
+        if (!providers.length)
+            put('manual', ['allowOAuth2Auth'], 'OAuth2 is on but the providers live in the app settings (≤0.22): add each one in the Atlas dashboard with the same client id so imported links keep working.', 'oauth_providers');
+        const mapped = (0, record_set_1.isObj)(oauth?.mappedFields) ? oauth.mappedFields : undefined;
+        if (mapped && Object.values(mapped).some((v) => (0, record_set_1.str)(v)))
+            put('differs', ['oauth2', 'mappedFields'], 'PocketBase copies provider fields onto the record; Atlas fills first/last name and image from the provider profile automatically.', 'user profile');
+    }
+    // ── OTP and MFA ──
+    const otp = (0, record_set_1.isObj)(o.otp) ? o.otp : undefined;
+    if (otp?.enabled === true) {
+        b.set('strategies.emailCode', true);
+        put('mapped', ['otp', 'enabled'], 'One-time email codes become Atlas email-code sign-in.', 'auth_config.strategies.emailCode');
+        if (typeof otp.duration === 'number')
+            put('differs', ['otp', 'duration'], `Codes live ${otp.duration} s in PocketBase; set verification.emailCode.ttlMinutes (whole minutes).`, 'auth_config.verification.emailCode.ttlMinutes');
+        if (typeof otp.length === 'number' && otp.length !== 6)
+            put('differs', ['otp', 'length'], `PocketBase sends ${otp.length}-digit codes; Atlas's length is set in verification.emailCode.length.`, 'auth_config.verification.emailCode.length');
+    }
+    const mfa = (0, record_set_1.isObj)(o.mfa) ? o.mfa : undefined;
+    if (mfa?.enabled === true) {
+        b.set('mfaPolicy', (0, record_set_1.str)(mfa.rule) ? 'optional' : 'required');
+        put('differs', ['mfa', 'enabled'], `PocketBase MFA asks for a second, different sign-in method (password then OTP)${(0, record_set_1.str)(mfa.rule) ? ` when "${(0, record_set_1.str)(mfa.rule)}" matches` : ''}. Atlas MFA is an enrolled second factor (authenticator app, SMS, passkey or email code): users enrol one after the move.`, 'auth_config.mfaPolicy');
+    }
+    // ── tokens, rules, emails ──
+    const token = (0, record_set_1.isObj)(o.authToken) ? o.authToken : undefined;
+    if (typeof token?.duration === 'number' && token.duration > 0) {
+        const ms = (0, translate_kit_1.clampSessionMs)(token.duration * 1000);
+        b.set('session.absoluteMs', ms);
+        put(ms === token.duration * 1000 ? 'mapped' : 'differs', ['authToken', 'duration'], `Auth tokens last ${token.duration} s; Atlas sessions last as long (and refresh short-lived session tokens on their own). The token secret is not copied.`, 'auth_config.session.absoluteMs');
+    }
+    if ((0, record_set_1.str)(o.authRule))
+        put('manual', ['authRule'], `Sign-in is limited by the rule "${(0, record_set_1.str)(o.authRule)}": express it as an Atlas pre-sign-in action or restriction.`, 'actions');
+    if ((0, record_set_1.str)(o.manageRule))
+        put('manual', ['manageRule'], `"${(0, record_set_1.str)(o.manageRule)}" may manage other users: give those users an Atlas app role with the users:write permission.`, 'roles');
+    if ((0, record_set_1.isObj)(o.authAlert) && o.authAlert.enabled === true)
+        put('manual', ['authAlert', 'enabled'], 'New-device sign-in alerts: enable Atlas\'s new sign-in notification email (Emails).');
+    for (const tpl of ['verificationTemplate', 'resetPasswordTemplate', 'confirmEmailChangeTemplate']) {
+        if ((0, record_set_1.isObj)(o[tpl]) && (0, record_set_1.str)(o[tpl].body))
+            put('manual', [tpl], 'Custom email template: recreate it in Atlas Emails (Atlas variables differ).', 'email_templates');
+    }
+    const vars = { collection: name };
+    if (snap.url)
+        vars.url = snap.url.replace(/\/+$/, '');
+    return b.result(file?.path ?? `pocketbase collection ${name}`, {
+        bridge: { preset: 'pocketbase', vars: { ...vars } },
+        lazy: { preset: 'pocketbase', config: { ...vars } },
+    });
+}
+/** v0.23+ keeps the minimum length on the password field. */
+function passwordFieldMin(c) {
+    const fields = typeof c.fields === 'string' ? safeJson(c.fields) : c.fields;
+    const pw = (0, record_set_1.objs)(fields).find((f) => (0, record_set_1.str)(f.name) === 'password' && (0, record_set_1.str)(f.type) === 'password');
+    return typeof pw?.min === 'number' && pw.min > 0 ? pw.min : undefined;
+}
+//# sourceMappingURL=pocketbase-config.js.map

package/dist/migrate/export/pocketbase-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pocketbase-config.js","sourceRoot":"","sources":["../../../src/migrate/export/pocketbase-config.ts"],"names":[],"mappings":";;AA2BA,sDAKC;AAgBD,8DAkIC;AAjLD,6CAAgE;AAChE,iDAA+C;AAC/C,mDAA2E;AAwB3E,SAAgB,qBAAqB,CAAC,IAAY;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,IAAA,kBAAK,EAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxF,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;AACjG,CAAC;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAAC,CAAM;IACvB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,OAAO,EAAE,GAAG,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAgB,yBAAyB,CAAC,IAA8B;IACtE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,iDAAiD,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,yBAAyB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,IAAI,CAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,mEAAmE;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtI,MAAM,IAAI,GAAG,CAAC,GAAG,IAAc,EAAsB,EAAE;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,2FAA2F;QAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC5B,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,IAAA,qBAAM,EAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAc,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACxB,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;IAC9C,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,cAAc,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,MAAuC,EAAE,IAAc,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE;QACpG,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QACzB,IAAA,oBAAK,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,MAAM,sBAAsB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0KAA0K,EAAE,OAAO,CAAC,CAAC;IACtT,CAAC;IAED,qCAAqC;IACrC,MAAM,EAAE,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,EAAE;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,2FAA2F,EAAE,iCAAiC,CAAC,CAAC;QACnL,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,EAAE,CAAC,cAAc,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,gBAAgB,CAAC,EAAE,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,gBAAgB,CAAC,EAAE,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;IAC3K,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC7F,QAAQ;QACR,MAAM,KAAK,GAAG,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,CAAC,CAAC,iBAAiB,KAAK,IAAI,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,IAAI,QAAQ,CAAC,CAAC;QAChD,IAAI,KAAK,IAAI,QAAQ;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,gBAAgB,CAAC,EAAE,2FAA2F,EAAE,iCAAiC,CAAC,CAAC;QACzL,IAAI,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,GAAG,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,KAAK,iEAAiE,CAAC,CAAC,CAAC,GAAG,KAAK,sBAAsB,EAAE,sCAAsC,CAAC,CAAC;IAC3T,CAAC;IACD,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,kCAAkC,EAAE,sCAAsC,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,IAAA,iBAAI,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0EAA0E,EAAE,0BAA0B,CAAC,CAAC;IAC1O,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,oBAAoB,CAAC,EAAE,mBAAmB,IAAA,iBAAI,EAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,EAAE,WAAW,CAAC,CAAC;IAExL,eAAe;IACf,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAA,iBAAI,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,KAAK,GAAG,IAAA,yBAAS,EAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9C,IAAI,KAAK,EAAE,CAAC;gBACV,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,OAAO,EAAE,oBAAoB,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAClJ,IAAI,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnF,CAAC;iBAAM,CAAC;gBACN,IAAA,oBAAK,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,SAAS,EAAE,oBAAoB,KAAK,EAAE,EAAE,IAAI,KAAK,sGAAsG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,6CAA6C,EAAE,wBAAwB,CAAC,CAAC;YACpT,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE,8JAA8J,EAAE,iBAAiB,CAAC,CAAC;QAC7O,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,mIAAmI,EAAE,cAAc,CAAC,CAAC;IAC3P,CAAC;IAED,oBAAoB;IACpB,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,uDAAuD,EAAE,kCAAkC,CAAC,CAAC;QAC/H,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,cAAc,GAAG,CAAC,QAAQ,0EAA0E,EAAE,+CAA+C,CAAC,CAAC;QACjO,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,CAAC,MAAM,uEAAuE,EAAE,2CAA2C,CAAC,CAAC;IAChP,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC5D,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,iFAAiF,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,2HAA2H,EAAE,uBAAuB,CAAC,CAAC;IACnU,CAAC;IAED,8BAA8B;IAC9B,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,EAAE,GAAG,IAAA,8BAAc,EAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,oBAAoB,KAAK,CAAC,QAAQ,wHAAwH,EAAE,gCAAgC,CAAC,CAAC;IACpR,CAAC;IACD,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,mCAAmC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,8DAA8D,EAAE,SAAS,CAAC,CAAC;IAC9K,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,+FAA+F,EAAE,OAAO,CAAC,CAAC;IACpL,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,KAAK,IAAI;QAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,qFAAqF,CAAC,CAAC;IACvL,KAAK,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,uBAAuB,EAAE,4BAA4B,CAAC,EAAE,CAAC;QAClG,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAA,gBAAG,EAAE,CAAC,CAAC,GAAG,CAAS,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,8EAA8E,EAAE,iBAAiB,CAAC,CAAC;IAC1K,CAAC;IAED,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,IAAI,CAAC,GAAG;QAAE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,yBAAyB,IAAI,EAAE,EAAE;QAC7D,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE;QACnD,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE;KACpD,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,SAAS,gBAAgB,CAAC,CAAM;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,GAAG,IAAA,iBAAI,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;IAC9F,OAAO,OAAO,EAAE,EAAE,GAAG,KAAK,QAAQ,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC"}