@atlasauth/cli 0.12.0 → 0.14.0

package/dist/migrate/export/cognito.js

@@ -0,0 +1,441 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CognitoApi = void 0;
+exports.regionOfPool = regionOfPool;
+exports.amzDate = amzDate;
+exports.sigV4Key = sigV4Key;
+exports.signAwsRequest = signAwsRequest;
+exports.attributesOf = attributesOf;
+exports.parseIdentities = parseIdentities;
+exports.mapCognitoUser = mapCognitoUser;
+exports.cognitoIdentities = cognitoIdentities;
+exports.cognitoFactors = cognitoFactors;
+exports.parseListUsersOutput = parseListUsersOutput;
+exports.cognitoSsoConnection = cognitoSsoConnection;
+exports.exportCognito = exportCognito;
+const node_crypto_1 = require("node:crypto");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+const POOL_ID = /^([a-z]{2}(?:-[a-z]+)+-\d)_[0-9A-Za-z]+$/;
+/** The region of a user pool id (`us-east-1_AbC123` → `us-east-1`), or undefined. */
+function regionOfPool(poolId) {
+    return POOL_ID.exec(poolId.trim())?.[1];
+}
+// ── AWS Signature Version 4 ─────────────────────────────────────────────────
+const sha256Hex = (data) => (0, node_crypto_1.createHash)('sha256').update(data).digest('hex');
+const hmac = (key, data) => (0, node_crypto_1.createHmac)('sha256', key).update(data, 'utf8').digest();
+/** `20150830T123600Z`. */
+function amzDate(d) {
+    return d.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '');
+}
+/** The SigV4 signing key: HMAC chain over date, region, service. */
+function sigV4Key(secret, date, region, service) {
+    return hmac(hmac(hmac(hmac(`AWS4${secret}`, date), region), service), 'aws4_request');
+}
+/**
+ * Sign a request with AWS Signature Version 4 (header form). `headers` must
+ * not yet carry `authorization`; the result adds `host`, `x-amz-date`, the
+ * session token when there is one, and `authorization`. Only a path without
+ * a query string is signed (every Cognito call is `POST /`).
+ */
+function signAwsRequest(o) {
+    const url = new URL(o.url);
+    const stamp = amzDate(o.now);
+    const date = stamp.slice(0, 8);
+    const headers = {};
+    for (const [k, v] of Object.entries(o.headers))
+        headers[k.toLowerCase()] = v;
+    headers.host = url.host;
+    headers['x-amz-date'] = stamp;
+    if (o.credentials.sessionToken)
+        headers['x-amz-security-token'] = o.credentials.sessionToken;
+    const names = Object.keys(headers).sort();
+    const canonicalHeaders = names.map((n) => `${n}:${headers[n].trim().replace(/\s+/g, ' ')}\n`).join('');
+    const signedHeaders = names.join(';');
+    const canonical = [o.method.toUpperCase(), url.pathname || '/', url.search.slice(1), canonicalHeaders, signedHeaders, sha256Hex(o.body)].join('\n');
+    const scope = `${date}/${o.region}/${o.service}/aws4_request`;
+    const toSign = ['AWS4-HMAC-SHA256', stamp, scope, sha256Hex(canonical)].join('\n');
+    const signature = (0, node_crypto_1.createHmac)('sha256', sigV4Key(o.credentials.secretAccessKey, date, o.region, o.service)).update(toSign, 'utf8').digest('hex');
+    headers.authorization = `AWS4-HMAC-SHA256 Credential=${o.credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+    return headers;
+}
+// ── the cognito-idp JSON API ────────────────────────────────────────────────
+const RETRYABLE = new Set(['TooManyRequestsException', 'LimitExceededException', 'InternalErrorException', 'ThrottlingException']);
+class CognitoApi {
+    o;
+    endpoint;
+    constructor(o) {
+        this.o = o;
+        this.endpoint = `https://cognito-idp.${o.region}.amazonaws.com/`;
+    }
+    /** One API call (`ListUsers`, `DescribeUserPool` …). Throttling and 5xx are retried. */
+    async call(action, input) {
+        const fetchImpl = this.o.fetchImpl ?? fetch;
+        const sleep = this.o.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        const attempts = Math.max(1, this.o.attempts ?? 6);
+        const body = JSON.stringify(input);
+        for (let attempt = 1;; attempt++) {
+            const headers = signAwsRequest({
+                method: 'POST',
+                url: this.endpoint,
+                headers: { 'content-type': 'application/x-amz-json-1.1', 'x-amz-target': `AWSCognitoIdentityProviderService.${action}` },
+                body,
+                region: this.o.region,
+                service: 'cognito-idp',
+                credentials: this.o.credentials,
+                now: (this.o.now ?? (() => new Date()))(),
+            });
+            delete headers.host; // fetch sets it (and refuses a manual one)
+            let res;
+            try {
+                res = await fetchImpl(this.endpoint, { method: 'POST', headers, body });
+            }
+            catch (err) {
+                if (attempt < attempts) {
+                    await sleep(backoff(attempt));
+                    continue;
+                }
+                throw new vendor_http_1.VendorApiError('Cognito', 0, action, err instanceof Error ? err.message : String(err));
+            }
+            const text = await res.text();
+            let parsed = {};
+            try {
+                parsed = text ? JSON.parse(text) : {};
+            }
+            catch {
+                parsed = { message: text.slice(0, 200) };
+            }
+            if (res.ok)
+                return parsed;
+            const o = (0, record_set_1.isObj)(parsed) ? parsed : {};
+            const type = ((0, record_set_1.str)(o.__type) ?? '').split('#').pop() ?? '';
+            if ((res.status >= 500 || RETRYABLE.has(type)) && attempt < attempts) {
+                await sleep(backoff(attempt));
+                continue;
+            }
+            throw new vendor_http_1.VendorApiError('Cognito', res.status, action, [type, (0, record_set_1.str)(o.message) ?? (0, record_set_1.str)(o.Message)].filter(Boolean).join(': '));
+        }
+    }
+    /** Every page of a token-paged list. */
+    async all(action, input, listKey, tokenKey) {
+        const out = [];
+        let token;
+        do {
+            const page = await this.call(action, { ...input, ...(token ? { [tokenKey]: token } : {}) });
+            out.push(...(0, record_set_1.objs)(page[listKey]));
+            token = (0, record_set_1.str)(page[tokenKey]);
+        } while (token);
+        return out;
+    }
+}
+exports.CognitoApi = CognitoApi;
+function backoff(attempt) {
+    return Math.min(250 * 2 ** (attempt - 1), 20_000);
+}
+// ── mapping ─────────────────────────────────────────────────────────────────
+/** Attributes the user record carries itself (the rest of the standard ones go to private metadata). */
+const MAPPED = new Set(['sub', 'email', 'email_verified', 'phone_number', 'phone_number_verified', 'given_name', 'family_name', 'name', 'picture', 'preferred_username', 'identities']);
+/** Cognito provider names → the provider an identity record carries. */
+const SOCIAL = { Google: 'google', Facebook: 'facebook', SignInWithApple: 'apple', LoginWithAmazon: 'amazon' };
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function attributesOf(u) {
+    const out = {};
+    // ListUsers says Attributes, AdminGetUser says UserAttributes.
+    for (const a of [...(0, record_set_1.objs)(u.Attributes), ...(0, record_set_1.objs)(u.UserAttributes)]) {
+        const name = (0, record_set_1.str)(a.Name);
+        if (name && typeof a.Value === 'string')
+            out[name] = a.Value;
+    }
+    return out;
+}
+/** Epoch seconds (the API) or an ISO string (the AWS CLI) → a bundle timestamp. */
+function cognitoTime(v) {
+    if (typeof v === 'number' && Number.isFinite(v))
+        return Math.round(v * 1000);
+    return (0, record_set_1.str)(v);
+}
+/** The `identities` attribute (a JSON string; `primary` / `dateCreated` typed loosely). */
+function parseIdentities(raw) {
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        return (0, record_set_1.objs)(parsed);
+    }
+    catch {
+        return [];
+    }
+}
+/** Map one Cognito UserType onto a user record (null when it has no sub or no identifier). */
+function mapCognitoUser(u) {
+    const a = attributesOf(u);
+    const sub = (0, record_set_1.str)(a.sub);
+    if (!sub)
+        return null;
+    const cognitoUsername = (0, record_set_1.str)(u.Username);
+    const federated = (0, record_set_1.str)(u.UserStatus) === 'EXTERNAL_PROVIDER';
+    const email = (0, record_set_1.str)(a.email)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(a.phone_number);
+    // A username Cognito users typed (not the generated sub / UUID, an email or a federated `Google_…` id).
+    const typed = cognitoUsername && !UUID.test(cognitoUsername) && !cognitoUsername.includes('@') && !federated && !/^\+\d+$/.test(cognitoUsername) ? cognitoUsername : undefined;
+    const username = (0, record_set_1.str)(a.preferred_username) ?? typed;
+    const custom = {};
+    const standard = {};
+    for (const [k, v] of Object.entries(a)) {
+        if (k.startsWith('custom:'))
+            custom[k.slice(7)] = v;
+        else if (k.startsWith('dev:'))
+            continue;
+        else if (!MAPPED.has(k))
+            standard[k] = v;
+    }
+    const user = (0, record_set_1.compact)({
+        id: sub,
+        emails: email ? [{ email, verified: a.email_verified === 'true', primary: true }] : undefined,
+        phones: phone ? [{ phone, verified: a.phone_number_verified === 'true', primary: !email }] : undefined,
+        username,
+        first_name: (0, record_set_1.str)(a.given_name),
+        last_name: (0, record_set_1.str)(a.family_name),
+        name: (0, record_set_1.str)(a.name),
+        image_url: (0, record_set_1.str)(a.picture),
+        banned: u.Enabled === false ? true : undefined,
+        public_metadata: Object.keys(custom).length ? custom : undefined,
+        private_metadata: (0, record_set_1.compact)({ cognito_username: cognitoUsername, cognito_status: (0, record_set_1.str)(u.UserStatus), cognito_attributes: Object.keys(standard).length ? standard : undefined }),
+        created_at: cognitoTime(u.UserCreateDate),
+    });
+    if (!user.emails && !user.phones && !user.username) {
+        // A pool keyed on a bare username nobody typed (federated users without an email): keep the Cognito username.
+        if (!cognitoUsername)
+            return null;
+        user.username = cognitoUsername;
+    }
+    return user;
+}
+/** The identity records of one user's `identities` attribute. */
+function cognitoIdentities(userId, raw) {
+    const out = [];
+    for (const i of parseIdentities(raw)) {
+        const providerName = (0, record_set_1.str)(i.providerName);
+        const providerUserId = (0, record_set_1.str)(i.userId);
+        if (!providerName || !providerUserId)
+            continue;
+        const type = (0, record_set_1.str)(i.providerType) ?? providerName;
+        const kind = type === 'SAML' ? 'saml' : type === 'OIDC' ? 'oidc' : 'oauth';
+        out.push((0, record_set_1.compact)({
+            user_id: userId,
+            provider: SOCIAL[providerName] ?? providerName,
+            provider_user_id: providerUserId,
+            kind: kind,
+            sso_connection_id: kind === 'saml' || kind === 'oidc' ? providerName : undefined,
+        }));
+    }
+    return out;
+}
+/** SMS / email factors from legacy MFAOptions or a UserMFASettingList. */
+function cognitoFactors(userId, u, attrs) {
+    const settings = new Set((0, record_set_1.strs)(u.UserMFASettingList));
+    for (const o of (0, record_set_1.objs)(u.MFAOptions))
+        if ((0, record_set_1.str)(o.DeliveryMedium) === 'SMS')
+            settings.add('SMS_MFA');
+    const factors = [];
+    const phone = (0, record_set_1.e164)(attrs.phone_number);
+    if (settings.has('SMS_MFA') && phone)
+        factors.push({ user_id: userId, type: 'phone', phone, verified: true });
+    if (settings.has('EMAIL_OTP') && attrs.email)
+        factors.push({ user_id: userId, type: 'email', verified: true });
+    return { factors, totp: settings.has('SOFTWARE_TOKEN_MFA') };
+}
+/** The users of `aws cognito-idp list-users` output (`{ "Users": [...] }`, or a bare array). */
+function parseListUsersOutput(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error('The users file is not `aws cognito-idp list-users --output json` output.');
+    }
+    if (Array.isArray(parsed))
+        return (0, record_set_1.objs)(parsed);
+    if ((0, record_set_1.isObj)(parsed) && Array.isArray(parsed.Users))
+        return (0, record_set_1.objs)(parsed.Users);
+    throw new Error('The users file has no "Users" list (expected `aws cognito-idp list-users --output json` output).');
+}
+/** A SAML / OIDC identity provider → an SSO connection record (social providers are null). */
+function cognitoSsoConnection(idp) {
+    const name = (0, record_set_1.str)(idp.ProviderName);
+    const type = (0, record_set_1.str)(idp.ProviderType);
+    if (!name || (type !== 'SAML' && type !== 'OIDC'))
+        return null;
+    const d = (0, record_set_1.isObj)(idp.ProviderDetails) ? idp.ProviderDetails : {};
+    const mapping = {};
+    if ((0, record_set_1.isObj)(idp.AttributeMapping))
+        for (const [k, v] of Object.entries(idp.AttributeMapping))
+            if (typeof v === 'string')
+                mapping[k] = v;
+    const domains = (0, record_set_1.strs)(idp.IdpIdentifiers).filter((x) => /^[a-z0-9-]+(\.[a-z0-9-]+)+$/i.test(x));
+    if (type === 'SAML') {
+        return (0, record_set_1.compact)({
+            id: name,
+            name,
+            protocol: 'saml',
+            domains,
+            saml: (0, record_set_1.compact)({ idp_metadata_url: (0, record_set_1.str)(d.MetadataURL), idp_metadata_xml: (0, record_set_1.str)(d.MetadataFile), attribute_mapping: Object.keys(mapping).length ? mapping : undefined }),
+            enabled: true,
+        });
+    }
+    const issuer = (0, record_set_1.str)(d.oidc_issuer);
+    return (0, record_set_1.compact)({
+        id: name,
+        name,
+        protocol: 'oidc',
+        domains,
+        oidc: (0, record_set_1.compact)({
+            issuer,
+            discovery_url: issuer ? `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration` : undefined,
+            client_id: (0, record_set_1.str)(d.client_id),
+            client_secret: (0, record_set_1.str)(d.client_secret),
+            scopes: (0, record_set_1.str)(d.authorize_scopes)?.split(/[\s,]+/).filter(Boolean),
+        }),
+        enabled: true,
+    });
+}
+// ── the export ──────────────────────────────────────────────────────────────
+async function exportCognito(opts) {
+    const set = new record_set_1.RecordSet();
+    const poolId = opts.userPoolId.trim();
+    const region = opts.region ?? regionOfPool(poolId);
+    if (!region)
+        throw new Error(`Not a Cognito user pool id: ${opts.userPoolId} (expected <region>_<id>, e.g. us-east-1_AbC123xyz).`);
+    if (!opts.usersText && !opts.credentials)
+        throw new Error('Cognito export needs AWS credentials (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) or a list-users output file.');
+    const progress = opts.onProgress ?? (() => undefined);
+    const api = opts.credentials ? new CognitoApi({ region, credentials: opts.credentials, fetchImpl: opts.fetchImpl, sleep: opts.sleep, now: opts.now }) : undefined;
+    set.manifest.origin = `Cognito user pool ${poolId}`;
+    // Groups → app roles.
+    const groupKeys = new Map();
+    if (api && opts.groups !== 'skip') {
+        progress('groups');
+        for (const g of await api.all('ListGroups', { UserPoolId: poolId, Limit: 60 }, 'Groups', 'NextToken')) {
+            const name = (0, record_set_1.str)(g.GroupName);
+            if (!name)
+                continue;
+            const key = (0, translate_kit_1.keyOf)(name);
+            groupKeys.set(name, key);
+            set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(g.Description), scope: 'app' }), key);
+        }
+    }
+    // Identity providers → SSO connections.
+    const providers = new Set();
+    if (api) {
+        progress('identity providers');
+        let idps = [];
+        try {
+            idps = await api.all('ListIdentityProviders', { UserPoolId: poolId, MaxResults: 60 }, 'Providers', 'NextToken');
+        }
+        catch (err) {
+            if (!(err instanceof vendor_http_1.VendorApiError && (err.status === 400 || err.status === 403)))
+                throw err;
+            set.warn(`Could not list identity providers (${err.message}); enterprise connections were not exported.`);
+        }
+        for (const summary of idps) {
+            const name = (0, record_set_1.str)(summary.ProviderName);
+            if (!name)
+                continue;
+            providers.add(SOCIAL[name] ?? name);
+            if ((0, record_set_1.str)(summary.ProviderType) !== 'SAML' && (0, record_set_1.str)(summary.ProviderType) !== 'OIDC')
+                continue;
+            const res = await api.call('DescribeIdentityProvider', { UserPoolId: poolId, ProviderName: name });
+            const conn = cognitoSsoConnection((0, record_set_1.isObj)(res.IdentityProvider) ? res.IdentityProvider : {});
+            if (conn)
+                set.add('sso_connection', conn, conn.id);
+        }
+    }
+    // Users.
+    progress('users');
+    const raw = opts.usersText !== undefined ? parseListUsersOutput(opts.usersText) : await api.all('ListUsers', { UserPoolId: poolId, Limit: 60 }, 'Users', 'PaginationToken');
+    const byUsername = new Map();
+    const status = {};
+    let totpUsers = 0;
+    for (const u of raw) {
+        const user = mapCognitoUser(u);
+        if (!user) {
+            set.omit('user', 'no sub, or no email, phone number or username');
+            continue;
+        }
+        const username = (0, record_set_1.str)(u.Username);
+        if (username)
+            byUsername.set(username, user.id);
+        const st = (0, record_set_1.str)(u.UserStatus) ?? 'UNKNOWN';
+        status[st] = (status[st] ?? 0) + 1;
+        set.add('user', user, user.id);
+        const attrs = attributesOf(u);
+        for (const identity of cognitoIdentities(user.id, attrs.identities)) {
+            set.add('identity', identity, `${identity.provider}:${identity.provider_user_id}`);
+            providers.add(identity.provider);
+        }
+        let detail = u;
+        if (opts.mfa && api && username && st !== 'EXTERNAL_PROVIDER') {
+            detail = { ...u, ...(await api.call('AdminGetUser', { UserPoolId: poolId, Username: username })) };
+        }
+        const { factors, totp } = cognitoFactors(user.id, detail, attrs);
+        for (const f of factors)
+            set.add('mfa_factor', f);
+        if (totp)
+            totpUsers++;
+    }
+    if (totpUsers)
+        set.omit('mfa_factor', 'Cognito never exports TOTP secrets: these users enrol an authenticator app again in Atlas', totpUsers);
+    if (!opts.mfa && api && raw.length) {
+        set.warn('Only legacy SMS MFA settings were read. Pass the mfa option (one AdminGetUser per user, billed by AWS) to export every user\'s SMS and email factors and count TOTP users.');
+    }
+    // Group members → user roles.
+    if (api && groupKeys.size) {
+        progress('group members');
+        const rolesOf = new Map();
+        for (const [name, key] of groupKeys) {
+            for (const m of await api.all('ListUsersInGroup', { UserPoolId: poolId, GroupName: name, Limit: 60 }, 'Users', 'NextToken')) {
+                const id = (0, record_set_1.str)(attributesOf(m).sub) ?? byUsername.get((0, record_set_1.str)(m.Username) ?? '');
+                if (!id)
+                    continue;
+                const list = rolesOf.get(id) ?? [];
+                list.push(key);
+                rolesOf.set(id, list);
+            }
+        }
+        for (const user of set.list('user')) {
+            const roles = rolesOf.get(user.id);
+            if (roles?.length)
+                user.roles = [...new Set(roles)];
+        }
+    }
+    // The pool's public signing keys (no credentials needed).
+    try {
+        const res = await (opts.fetchImpl ?? fetch)(`https://cognito-idp.${region}.amazonaws.com/${poolId}/.well-known/jwks.json`);
+        if (res.ok) {
+            const body = await res.json();
+            for (const jwk of (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.keys : undefined)) {
+                const kid = (0, record_set_1.str)(jwk.kid);
+                if (kid)
+                    set.add('jwks', { kid, jwk }, kid);
+            }
+        }
+    }
+    catch {
+        set.warn('Could not read the user pool\'s JWKS; old tokens verify through the bridge only.');
+    }
+    if (set.count('user')) {
+        set.warn('Cognito never exports password hashes. Turn on the cognito lazy-migration preset: each password is checked against Cognito (InitiateAuth, USER_PASSWORD_AUTH) on its first Atlas sign-in, then stored as Argon2id.');
+        set.omit('password', 'Cognito does not export password hashes (lazy migration moves them)', set.count('user') - (status.EXTERNAL_PROVIDER ?? 0));
+    }
+    if (status.FORCE_CHANGE_PASSWORD)
+        set.warn(`${status.FORCE_CHANGE_PASSWORD} user(s) still have an admin-set temporary password (FORCE_CHANGE_PASSWORD): Cognito answers lazy migration with a new-password challenge, so they reset their password in Atlas.`);
+    if (status.RESET_REQUIRED)
+        set.warn(`${status.RESET_REQUIRED} user(s) must reset their password (RESET_REQUIRED): they cannot move by lazy migration and reset it in Atlas.`);
+    if (status.UNCONFIRMED)
+        set.warn(`${status.UNCONFIRMED} user(s) never confirmed their sign-up (UNCONFIRMED): imported with unverified addresses.`);
+    set.manifest.providers = [...providers].sort();
+    set.manifest.settings = { user_pool_id: poolId, region, user_status: status };
+    return set;
+}
+//# sourceMappingURL=cognito.js.map

package/dist/migrate/export/cognito.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito.js","sourceRoot":"","sources":["../../../src/migrate/export/cognito.ts"],"names":[],"mappings":";;;AA0DA,oCAEC;AAQD,0BAEC;AAGD,4BAEC;AAQD,wCA2BC;AAwFD,oCAQC;AASD,0CAQC;AAGD,wCAsCC;AAGD,8CAmBC;AAGD,wCAQC;AAGD,oDAUC;AAGD,oDAiCC;AAID,sCA2HC;AAzdD,6CAAqD;AAErD,6CAA0F;AAC1F,mDAAwC;AACxC,+CAA+C;AAmD/C,MAAM,OAAO,GAAG,0CAA0C,CAAC;AAE3D,qFAAqF;AACrF,SAAgB,YAAY,CAAC,MAAc;IACzC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,MAAM,SAAS,GAAG,CAAC,IAAqB,EAAE,EAAE,CAAC,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7F,MAAM,IAAI,GAAG,CAAC,GAAoB,EAAE,IAAY,EAAE,EAAE,CAAC,IAAA,wBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAE7G,0BAA0B;AAC1B,SAAgB,OAAO,CAAC,CAAO;IAC7B,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,oEAAoE;AACpE,SAAgB,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc,EAAE,OAAe;IACpF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,CAS9B;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7E,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACxB,OAAO,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;IAC9B,IAAI,CAAC,CAAC,WAAW,CAAC,YAAY;QAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC;IAC7F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpJ,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,eAAe,CAAC;IAC9D,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChJ,OAAO,CAAC,aAAa,GAAG,+BAA+B,CAAC,CAAC,WAAW,CAAC,WAAW,IAAI,KAAK,mBAAmB,aAAa,eAAe,SAAS,EAAE,CAAC;IACpJ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAE/E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAEnI,MAAa,UAAU;IAIF;IAHV,QAAQ,CAAS;IAE1B,YACmB,CAAwJ;QAAxJ,MAAC,GAAD,CAAC,CAAuJ;QAEzK,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CAAC,CAAC,MAAM,iBAAiB,CAAC;IACnE,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,IAAI,CAAU,MAAc,EAAE,KAAU;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,cAAc,CAAC;gBAC7B,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,OAAO,EAAE,EAAE,cAAc,EAAE,4BAA4B,EAAE,cAAc,EAAE,qCAAqC,MAAM,EAAE,EAAE;gBACxH,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;gBACrB,OAAO,EAAE,aAAa;gBACtB,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW;gBAC/B,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,2CAA2C;YAChE,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;oBACvB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,4BAAc,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,MAAM,GAAY,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3C,CAAC;YACD,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,MAAW,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;gBACrE,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,IAAI,4BAAc,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,KAAU,EAAE,OAAe,EAAE,QAAyC;QAC9F,MAAM,GAAG,GAAU,EAAE,CAAC;QACtB,IAAI,KAAyB,CAAC;QAC9B,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACjC,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9B,CAAC,QAAQ,KAAK,EAAE;QAChB,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAlED,gCAkEC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,+EAA+E;AAE/E,wGAAwG;AACxG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,uBAAuB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC;AAExL,wEAAwE;AACxE,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;AAEvI,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,SAAgB,YAAY,CAAC,CAAM;IACjC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7E,OAAO,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,SAAgB,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAgB,cAAc,CAAC,CAAM;IACnC,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,eAAe,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,KAAK,mBAAmB,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACnC,wGAAwG;IACxG,MAAM,KAAK,GAAG,eAAe,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/K,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC;IACpD,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAQ,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;aAC/C,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;aACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE,EAAE,GAAG;QACP,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7F,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,qBAAqB,KAAK,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ;QACR,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;QAC7B,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;QACjB,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC9C,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAChE,gBAAgB,EAAE,IAAA,oBAAO,EAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAQ;QACnL,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnD,8GAA8G;QAC9G,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iEAAiE;AACjE,SAAgB,iBAAiB,CAAC,MAAc,EAAE,GAAuB;IACvE,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc;YAAE,SAAS;QAC/C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3E,GAAG,CAAC,IAAI,CACN,IAAA,oBAAO,EAAC;YACN,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,YAAY;YAC9C,gBAAgB,EAAE,cAAc;YAChC,IAAI,EAAE,IAA8B;YACpC,iBAAiB,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,SAAgB,cAAc,CAAC,MAAc,EAAE,CAAM,EAAE,KAA6B;IAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC;QAAE,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC,KAAK,KAAK;YAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjG,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9G,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,gGAAgG;AAChG,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,IAAA,kBAAK,EAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;AACtH,CAAC;AAED,8FAA8F;AAC9F,SAAgB,oBAAoB,CAAC,GAAQ;IAC3C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,gBAAgB,CAAC;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtI,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,IAAA,oBAAO,EAAC;YACb,EAAE,EAAE,IAAI;YACR,IAAI;YACJ,QAAQ,EAAE,MAAe;YACzB,OAAO;YACP,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACpK,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAClC,OAAO,IAAA,oBAAO,EAAC;QACb,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,QAAQ,EAAE,MAAe;QACzB,OAAO;QACP,IAAI,EAAE,IAAA,oBAAO,EAAC;YACZ,MAAM;YACN,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC,CAAC,CAAC,SAAS;YACpG,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;YAC3B,aAAa,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,aAAa,CAAC;YACnC,MAAM,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SACjE,CAAC;QACF,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAExE,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,UAAU,sDAAsD,CAAC,CAAC;IACnI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC,CAAC;IAC3K,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClK,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,qBAAqB,MAAM,EAAE,CAAC;IAEpD,sBAAsB;IACtB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;YACxB,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,GAAG,EAAE,CAAC;QACR,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAU,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAClH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC9F,GAAG,CAAC,IAAI,CAAC,sCAAsC,GAAG,CAAC,OAAO,8CAA8C,CAAC,CAAC;QAC5G,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACpC,IAAI,IAAA,gBAAG,EAAC,OAAO,CAAC,YAAY,CAAC,KAAK,MAAM,IAAI,IAAA,gBAAG,EAAC,OAAO,CAAC,YAAY,CAAC,KAAK,MAAM;gBAAE,SAAS;YAC3F,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAM,0BAA0B,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACxG,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3F,IAAI,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,SAAS;IACT,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,GAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC7K,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,QAAQ;YAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,KAAK,MAAM,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACnF,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,QAAQ,IAAI,EAAE,KAAK,mBAAmB,EAAE,CAAC;YAC9D,MAAM,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAM,cAAc,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAClD,IAAI,IAAI;YAAE,SAAS,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,2FAA2F,EAAE,SAAS,CAAC,CAAC;IAC9I,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,4KAA4K,CAAC,CAAC;IACzL,CAAC;IAED,8BAA8B;IAC9B,IAAI,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1B,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC5H,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7E,IAAI,CAAC,EAAE;oBAAE,SAAS;gBAClB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,MAAM;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,uBAAuB,MAAM,kBAAkB,MAAM,wBAAwB,CAAC,CAAC;QAC3H,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACzB,IAAI,GAAG;oBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,oNAAoN,CAAC,CAAC;QAC/N,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,qEAAqE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,CAAC;IACnJ,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,qBAAqB,mLAAmL,CAAC,CAAC;IAC/P,IAAI,MAAM,CAAC,cAAc;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,cAAc,gHAAgH,CAAC,CAAC;IAC9K,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,2FAA2F,CAAC,CAAC;IACnJ,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/corbado-config.d.ts

@@ -0,0 +1,20 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate corbado config` — Corbado exposes no settings API worth
+ * reading, so the sign-in methods are inferred from what the project's users
+ * actually have (login identifiers by type, from the Backend API) and the
+ * rest is reported by where it lives in the Corbado console.
+ */
+export interface CorbadoConfigSnapshot {
+    projectId: string;
+    rpId?: string;
+    /** Number of login identifiers by type; null when the count could not be read. */
+    identifiers: {
+        email: number | null;
+        phone: number | null;
+        username: number | null;
+    };
+}
+export declare function fetchCorbadoConfig(http: VendorHttp, projectId: string, rpId?: string): Promise<CorbadoConfigSnapshot>;
+export declare function translateCorbadoConfig(snap: CorbadoConfigSnapshot): TranslationResult;

package/dist/migrate/export/corbado-config.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchCorbadoConfig = fetchCorbadoConfig;
+exports.translateCorbadoConfig = translateCorbadoConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function count(http, type) {
+    try {
+        const { body } = await http.get(`/v2/identifiers?page=1&pageSize=1&filter%5B%5D=${encodeURIComponent(`identifierType:eq:${type}`)}`);
+        const total = (0, record_set_1.isObj)(body?.paging) ? body.paging.totalItems : undefined;
+        return typeof total === 'number' ? total : null;
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+async function fetchCorbadoConfig(http, projectId, rpId) {
+    return {
+        projectId,
+        ...(rpId ? { rpId } : {}),
+        identifiers: { email: await count(http, 'email'), phone: await count(http, 'phone'), username: await count(http, 'username') },
+    };
+}
+function translateCorbadoConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    b.set('strategies.passkey', true);
+    b.add('mapped', 'authentication', 'passkeys', 'Passkey sign-in stays on; exported credentials keep working while Atlas is served from the same relying-party domain.', 'auth_config.strategies.passkey');
+    b.set('accountUx.passkeySignUp.enabled', true);
+    b.add('mapped', 'authentication', 'passkey-first sign-up', 'Corbado accounts start from a passkey: Atlas offers passkey sign-up.', 'auth_config.accountUx.passkeySignUp');
+    const { email, phone, username } = snap.identifiers;
+    if (email) {
+        b.set('strategies.emailCode', true);
+        b.add('mapped', 'identifiers', 'email', `${email} email identifier(s): email code sign-in (the fallback when a passkey is not available).`, 'auth_config.strategies.emailCode');
+    }
+    if (phone) {
+        b.set('strategies.phoneCode', true);
+        b.add('mapped', 'identifiers', 'phone', `${phone} phone identifier(s): SMS code sign-in.`, 'auth_config.strategies.phoneCode');
+    }
+    if (username) {
+        b.set('strategies.username', true);
+        b.add('mapped', 'identifiers', 'username', `${username} username identifier(s).`, 'auth_config.strategies.username');
+    }
+    if (email === null && phone === null && username === null) {
+        b.add('manual', 'identifiers', 'login identifiers', 'Corbado did not list your identifiers; turn on the matching Atlas sign-in methods (emailCode, phoneCode, username) yourself.', 'auth_config.strategies');
+    }
+    if (snap.rpId)
+        b.add('differs', 'passkeys', 'relying party', `Passkeys are bound to ${snap.rpId}: serve Atlas from that domain or a subdomain (a custom domain) so exported passkeys keep working.`);
+    else
+        b.add('manual', 'passkeys', 'relying party', 'Corbado does not return the relying-party id: pass it with --corbado-rp-id so passkeys can be exported, and serve Atlas from that domain.');
+    for (const [setting, where] of [
+        ['allowed origins and redirect URLs', 'Developer panel → Application URLs'],
+        ['session lifetimes (short and long session)', 'Developer panel → Sessions'],
+        ['social login', 'Developer panel → Authentication methods'],
+        ['webhooks and email / SMS templates', 'Developer panel → Webhooks, Communication'],
+    ]) {
+        b.add('manual', 'settings not in the API', setting, `Corbado does not expose this by API; copy it from the Corbado console (${where}). Atlas: dashboard → Sessions / Redirect URLs / Providers / Webhooks.`);
+    }
+    return b.result(`Corbado project ${snap.projectId}`, { bridge: { preset: 'corbado', vars: { project_id: snap.projectId } } });
+}
+//# sourceMappingURL=corbado-config.js.map

package/dist/migrate/export/corbado-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"corbado-config.js","sourceRoot":"","sources":["../../../src/migrate/export/corbado-config.ts"],"names":[],"mappings":";;AA6BA,gDAMC;AAED,wDAiCC;AArED,6CAA+C;AAC/C,mDAAgD;AAChD,+CAAgE;AAehE,KAAK,UAAU,KAAK,CAAC,IAAgB,EAAE,IAAoC;IACzE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,kDAAkD,kBAAkB,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1I,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,IAAgB,EAAE,SAAiB,EAAE,IAAa;IACzF,OAAO;QACL,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE;KAC/H,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,IAA2B;IAChE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,uHAAuH,EAAE,gCAAgC,CAAC,CAAC;IACzM,CAAC,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sEAAsE,EAAE,qCAAqC,CAAC,CAAC;IAC1K,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;IACpD,IAAI,KAAK,EAAE,CAAC;QACV,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,KAAK,0FAA0F,EAAE,kCAAkC,CAAC,CAAC;IAClL,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,KAAK,yCAAyC,EAAE,kCAAkC,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,QAAQ,0BAA0B,EAAE,iCAAiC,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,mBAAmB,EAAE,8HAA8H,EAAE,wBAAwB,CAAC,CAAC;IAChN,CAAC;IACD,IAAI,IAAI,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,yBAAyB,IAAI,CAAC,IAAI,oGAAoG,CAAC,CAAC;;QAChM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,2IAA2I,CAAC,CAAC;IAC/L,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,mCAAmC,EAAE,oCAAoC,CAAC;QAC3E,CAAC,4CAA4C,EAAE,4BAA4B,CAAC;QAC5E,CAAC,cAAc,EAAE,0CAA0C,CAAC;QAC5D,CAAC,oCAAoC,EAAE,2CAA2C,CAAC;KAC3E,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,OAAO,EAAE,0EAA0E,KAAK,wEAAwE,CAAC,CAAC;IAC/M,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;AAChI,CAAC"}

package/dist/migrate/export/corbado.d.ts

@@ -0,0 +1,37 @@
+import type { UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export corbado` — a Corbado project onto the canonical bundle
+ * models, read with the project id and API secret (Backend API v2, HTTP Basic)
+ * on this machine.
+ *
+ *   - users (`GET /v2/users`, with their email, phone and username
+ *     identifiers; a `pending` identifier is unverified, `verified` and
+ *     `primary` are verified); deleted users skipped, disabled users banned;
+ *   - passkeys: `GET /v2/users/{id}/fullCredentials` returns each credential id
+ *     AND its public key (base64url), so passkeys move and keep working. A
+ *     passkey is bound to its relying-party id, which the API does not return:
+ *     pass it with --corbado-rp-id (your Corbado relying party / domain), and
+ *     Atlas must be served from that domain (or a subdomain of it) for the
+ *     passkeys to keep working;
+ *   - Corbado holds no passwords, TOTP seeds, organizations or API keys.
+ *
+ * Sessions are Corbado short-session JWTs, bridged by the `corbado` preset.
+ */
+export interface CorbadoExportOptions {
+    projectId: string;
+    apiSecret: string;
+    /** Backend API origin (default https://backendapi.cloud.corbado.io). */
+    baseUrl?: string;
+    /** The passkeys' relying-party id; without it passkeys are not exported. */
+    rpId?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+export declare const CORBADO_BACKEND = "https://backendapi.cloud.corbado.io";
+export declare function corbadoHttp(o: Pick<CorbadoExportOptions, 'projectId' | 'apiSecret' | 'baseUrl' | 'fetchImpl' | 'sleep'>): VendorHttp;
+export declare function exportCorbado(opts: CorbadoExportOptions): Promise<RecordSet>;
+/** One Corbado `userAggregate` → a user record; 'deleted' for removed users. */
+export declare function mapCorbadoUser(u: Obj): UserRecord | 'deleted' | null;