@atlasauth/cli 0.12.0 → 0.14.0

package/dist/migrate/export/logto-config.js

@@ -0,0 +1,264 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchLogtoConfig = fetchLogtoConfig;
+exports.translateLogtoConfig = translateLogtoConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+const PAGE = 100;
+async function fetchLogtoConfig(http, endpoint, tenantId) {
+    const optional = async (fn, empty) => {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            if (err instanceof vendor_http_1.VendorApiError && [401, 403, 404, 501].includes(err.status))
+                return empty;
+            throw err;
+        }
+    };
+    const list = (path) => optional(async () => {
+        const out = [];
+        const sep = path.includes('?') ? '&' : '?';
+        for (let page = 1; page <= 10_000; page++) {
+            const rows = (0, record_set_1.objs)((await http.get(`${path}${sep}page=${page}&page_size=${PAGE}`)).body);
+            out.push(...rows);
+            if (rows.length < PAGE)
+                break;
+        }
+        return out;
+    }, []);
+    const resources = (await list('/api/resources'));
+    for (const r of resources) {
+        const id = (0, record_set_1.str)(r.id);
+        if (id)
+            r.scopes = await optional(async () => (0, record_set_1.objs)((await http.get(`/api/resources/${encodeURIComponent(id)}/scopes?page=1&page_size=${PAGE}`)).body), []);
+    }
+    return {
+        endpoint,
+        tenantId,
+        signInExp: await optional(async () => {
+            const { body } = await http.get('/api/sign-in-exp');
+            return (0, record_set_1.isObj)(body) ? body : {};
+        }, {}),
+        connectors: await optional(async () => (0, record_set_1.objs)((await http.get('/api/connectors')).body), []),
+        applications: await list('/api/applications'),
+        resources,
+        roles: (await list('/api/roles')).filter((r) => (0, record_set_1.str)(r.type) !== 'MachineToMachine'),
+        hooks: await optional(async () => (0, record_set_1.objs)((await http.get('/api/hooks')).body), []),
+        jwtCustomizers: await optional(async () => (0, record_set_1.objs)((await http.get('/api/configs/jwt-customizer')).body), []),
+    };
+}
+const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : undefined);
+function translateLogtoConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const exp = snap.signInExp;
+    const area = 'sign-in experience';
+    // ── identifiers and sign-in methods ──
+    const methods = (0, record_set_1.objs)((0, record_set_1.isObj)(exp.signIn) ? exp.signIn.methods : undefined);
+    const signUp = (0, record_set_1.isObj)(exp.signUp) ? exp.signUp : {};
+    const identifiers = new Set([...methods.map((m) => (0, record_set_1.str)(m.identifier)), ...(0, record_set_1.strs)(signUp.identifiers)].filter((x) => !!x));
+    const anyPassword = methods.some((m) => m.password === true) || signUp.password === true;
+    if (anyPassword) {
+        b.set('strategies.password', true);
+        b.add('differs', area, 'signIn.methods[].password', 'Password sign-in. Logto password hashes move with a database export (Argon2, bcrypt, SHA-family); a Management API export carries them from Logto 2026.3, and lazy migration (logto preset) covers the rest.', 'auth_config.strategies.password');
+    }
+    if (identifiers.has('username')) {
+        b.set('strategies.username', true);
+        b.add('mapped', area, 'signIn.methods[identifier=username]', 'Sign in with a username.', 'auth_config.strategies.username');
+    }
+    if (methods.some((m) => (0, record_set_1.str)(m.identifier) === 'email' && m.verificationCode === true)) {
+        b.set('strategies.emailCode', true);
+        b.add('mapped', area, 'signIn.methods[identifier=email].verificationCode', 'Email verification code sign-in.', 'auth_config.strategies.emailCode');
+    }
+    if (methods.some((m) => (0, record_set_1.str)(m.identifier) === 'phone' && m.verificationCode === true)) {
+        b.set('strategies.phoneCode', true);
+        b.add('mapped', area, 'signIn.methods[identifier=phone].verificationCode', 'SMS code sign-in (bring your own SMS provider).', 'auth_config.strategies.phoneCode');
+    }
+    const passkey = (0, record_set_1.isObj)(exp.passkeySignIn) ? exp.passkeySignIn : {};
+    if (passkey.enabled === true) {
+        b.set('strategies.passkey', true);
+        b.add('differs', area, 'passkeySignIn', 'Passkey sign-in. Passkeys move with a database export (public credentials); users keep them when your Atlas domain matches the relying-party id.', 'auth_config.strategies.passkey');
+    }
+    if (signUp.verify === true && identifiers.has('email')) {
+        b.set('requireEmailVerification', true);
+        b.add('mapped', area, 'signUp.verify', 'Emails are verified at sign-up.', 'auth_config.requireEmailVerification');
+    }
+    const mode = (0, record_set_1.str)(exp.signInMode);
+    if (mode === 'SignIn') {
+        b.set('signUpMode', 'restricted');
+        b.add('mapped', area, 'signInMode', 'Self sign-up is closed (invitations and the allowlist still work).', 'auth_config.signUpMode');
+    }
+    else if (mode === 'Register') {
+        b.add('differs', area, 'signInMode', 'Register-only mode has no Atlas counterpart; the sign-in page also signs existing users in.');
+    }
+    if ((0, record_set_1.isObj)(exp.forgotPasswordMethods) || Array.isArray(exp.forgotPasswordMethods)) {
+        b.add('mapped', area, 'forgotPasswordMethods', 'Password reset by email or SMS code follows the enabled strategies.', 'auth_config.accountUx.passwordReset');
+    }
+    if ((0, record_set_1.str)(exp.agreeToTermsPolicy) && (0, record_set_1.str)(exp.agreeToTermsPolicy) !== 'Automatic') {
+        b.add('manual', area, 'agreeToTermsPolicy', 'Terms acceptance at sign-up: configure a policy acceptance requirement in Atlas.', 'policy_acceptance');
+    }
+    // ── password policy ──
+    const pw = (0, record_set_1.isObj)(exp.passwordPolicy) ? exp.passwordPolicy : {};
+    const length = (0, record_set_1.isObj)(pw.length) ? pw.length : {};
+    const min = num(length.min);
+    if (min !== undefined) {
+        b.set('passwordPolicy.minLength', Math.max(8, min));
+        b.add(min < 8 ? 'differs' : 'mapped', `${area} passwordPolicy`, 'length.min', `${min}${min < 8 ? ' (Atlas requires at least 8; existing passwords still sign in)' : ''}.`, 'auth_config.passwordPolicy.minLength');
+    }
+    const max = num(length.max);
+    if (max !== undefined && max >= 8) {
+        b.set('passwordPolicy.maxLength', Math.min(max, 4096));
+        b.add('mapped', `${area} passwordPolicy`, 'length.max', `${max}.`, 'auth_config.passwordPolicy.maxLength');
+    }
+    const rejects = (0, record_set_1.isObj)(pw.rejects) ? pw.rejects : {};
+    if (rejects.pwned === true) {
+        b.set('passwordPolicy.checkBreaches', true);
+        b.add('mapped', `${area} passwordPolicy`, 'rejects.pwned', 'Breached passwords are refused.', 'auth_config.passwordPolicy.checkBreaches');
+    }
+    if (rejects.userInfo === true) {
+        b.set('passwordPolicy.rejectIdentifierSubstring', true);
+        b.add('mapped', `${area} passwordPolicy`, 'rejects.userInfo', 'Passwords containing the user\'s own identifiers are refused.', 'auth_config.passwordPolicy.rejectIdentifierSubstring');
+    }
+    if (rejects.repeatedIdentical === true || rejects.sequential === true || (0, record_set_1.strs)(rejects.words).length) {
+        b.add('differs', `${area} passwordPolicy`, 'rejects.repeatedIdentical / sequential / words', 'Atlas follows NIST 800-63B: length and breached-password checks, no pattern or custom-word rules.', 'auth_config.passwordPolicy');
+    }
+    const types = (0, record_set_1.isObj)(pw.characterTypes) ? num(pw.characterTypes.min) : undefined;
+    if (types && types > 1) {
+        b.add('differs', `${area} passwordPolicy`, 'characterTypes.min', 'Atlas has no character-class rules (NIST 800-63B); length and the breach check apply.', 'auth_config.passwordPolicy');
+    }
+    // ── multi-factor ──
+    const mfa = (0, record_set_1.isObj)(exp.mfa) ? exp.mfa : {};
+    const factors = (0, record_set_1.strs)(mfa.factors);
+    if (factors.includes('Totp')) {
+        b.set('mfa.factors.totp', true);
+        b.add('mapped', `${area} mfa`, 'factors Totp', 'Authenticator apps; TOTP secrets move with a database export.', 'auth_config.mfa.factors.totp');
+    }
+    if (factors.includes('WebAuthn')) {
+        b.set('mfa.factors.passkey', true);
+        b.add('differs', `${area} mfa`, 'factors WebAuthn', 'Security keys and passkeys as a second factor; credentials move with a database export.', 'auth_config.mfa.factors.passkey');
+    }
+    if (factors.includes('BackupCode'))
+        b.add('mapped', `${area} mfa`, 'factors BackupCode', 'Backup codes (unused ones move with a database export).', 'auth_config.mfa');
+    const policy = (0, record_set_1.str)(mfa.policy);
+    if (policy === 'Mandatory') {
+        b.set('mfaPolicy', 'required');
+        b.add('mapped', `${area} mfa`, 'policy Mandatory', 'A second factor on every sign-in.', 'auth_config.mfaPolicy');
+    }
+    else if (factors.length) {
+        b.set('mfaPolicy', 'optional');
+        b.add('differs', `${area} mfa`, `policy ${policy ?? 'UserControlled'}`, 'Users may enrol a second factor; Atlas does not prompt for enrolment at sign-in (use a step-up rule or require MFA).', 'auth_config.mfaPolicy');
+    }
+    if ((0, record_set_1.isObj)(exp.adaptiveMfa) && exp.adaptiveMfa.enabled === true)
+        b.add('differs', `${area} mfa`, 'adaptiveMfa', 'Adaptive MFA: Atlas uses step-up and risk policies instead; review auth_config.stepUp.', 'auth_config.stepUp');
+    // ── social and message connectors ──
+    for (const c of snap.connectors) {
+        const target = (0, record_set_1.str)(c.target) ?? (0, record_set_1.str)(c.connectorId) ?? '';
+        const type = (0, record_set_1.str)(c.type);
+        const name = (0, record_set_1.str)((0, record_set_1.isObj)(c.metadata) && (0, record_set_1.isObj)(c.metadata.name) ? c.metadata.name.en : undefined) ?? (0, record_set_1.str)(c.connectorId) ?? target;
+        if (type === 'Email' || type === 'Sms' || /-(mail|sms)$/.test(target)) {
+            b.add('manual', 'connectors', `${name} (${type ?? target})`, 'Message delivery: Atlas sends through your own email / SMS provider (bring-your-own keys): configure it in the dashboard.', 'email_provider');
+            continue;
+        }
+        const key = (0, translate_kit_1.socialKey)(target);
+        if (!key) {
+            b.add('manual', 'connectors', `${name} (${target})`, 'No built-in Atlas provider: add it as a custom OAuth provider.', 'custom_oauth_providers');
+            continue;
+        }
+        const config = (0, record_set_1.isObj)(c.config) ? c.config : {};
+        b.socialProvider({ atlasKey: key, vendorName: name, area: 'connectors', setting: `${name} (${target})`, clientId: (0, record_set_1.str)(config.clientId), scopes: (0, record_set_1.str)(config.scope)?.split(/[ ,]+/).filter(Boolean) });
+    }
+    const targets = (0, record_set_1.strs)(exp.socialSignInConnectorTargets);
+    if (targets.length)
+        b.add('mapped', area, 'socialSignInConnectorTargets', `${targets.join(', ')} shown on the sign-in page: each enabled provider appears on Atlas's.`, 'oauth_providers');
+    if (exp.singleSignOnEnabled === true)
+        b.add('mapped', area, 'singleSignOnEnabled', 'Enterprise SSO connectors move with the data export as Atlas SSO connections (update each IdP with Atlas\'s ACS URL / redirect URI).', 'sso_connections');
+    // ── applications → redirect URLs and origins ──
+    const origins = new Set();
+    const redirects = new Set();
+    for (const app of snap.applications) {
+        const type = (0, record_set_1.str)(app.type);
+        const appName = (0, record_set_1.str)(app.name) ?? (0, record_set_1.str)(app.id) ?? '?';
+        if (type === 'MachineToMachine') {
+            b.add('manual', `applications ${appName}`, 'type MachineToMachine', 'A service app: create an Atlas M2M client for it.', 'oauth_clients');
+            continue;
+        }
+        if (type === 'SAML') {
+            b.add('manual', `applications ${appName}`, 'type SAML', 'Logto acting as a SAML identity provider for this app: register it as an Atlas SAML application.', 'oauth_clients');
+            continue;
+        }
+        if (type === 'Protected') {
+            b.add('manual', `applications ${appName}`, 'type Protected', 'A Logto protected app (the hosted reverse proxy) has no Atlas counterpart: protect the origin with the Atlas middleware.');
+            continue;
+        }
+        const oidc = (0, record_set_1.isObj)(app.oidcClientMetadata) ? app.oidcClientMetadata : {};
+        for (const u of [...(0, record_set_1.strs)(oidc.redirectUris), ...(0, record_set_1.strs)(oidc.postLogoutRedirectUris)])
+            redirects.add(u);
+        const custom = (0, record_set_1.isObj)(app.customClientMetadata) ? app.customClientMetadata : {};
+        for (const o of (0, record_set_1.strs)(custom.corsAllowedOrigins))
+            origins.add(o);
+        if (num(custom.idTokenTtl) || num(custom.refreshTokenTtl)) {
+            b.add('differs', `applications ${appName}`, 'customClientMetadata idTokenTtl / refreshTokenTtl', 'Atlas sets token lifetimes per instance (auth_config.session), not per application.', 'auth_config.session');
+        }
+    }
+    let exact = 0;
+    for (const url of redirects) {
+        if (url.includes('*')) {
+            b.add('differs', 'applications', `redirectUris ${url}`, 'Atlas redirect URLs are exact (no wildcards).', 'redirect_urls');
+            continue;
+        }
+        if (!/^https?:\/\//.test(url)) {
+            b.add('differs', 'applications', `redirectUris ${url}`, 'A native-app scheme: register it with the Atlas native app, not as a web redirect URL.', 'native_apps');
+            continue;
+        }
+        b.push('redirect_urls', { url });
+        exact++;
+    }
+    if (exact)
+        b.add('mapped', 'applications', 'oidcClientMetadata.redirectUris / postLogoutRedirectUris', `${exact} redirect URL(s).`, 'redirect_urls');
+    if (origins.size) {
+        b.instance.allowed_origins = [...origins].filter((o) => !o.includes('*'));
+        b.add('mapped', 'applications', 'customClientMetadata.corsAllowedOrigins', 'Allowed origins for the browser SDK.', 'instance.allowed_origins');
+    }
+    // ── API resources ──
+    for (const r of snap.resources) {
+        const indicator = (0, record_set_1.str)(r.indicator);
+        if (!indicator)
+            continue;
+        const scopes = (r.scopes ?? []).map((s) => (0, record_set_1.str)(s.name)).filter((s) => !!s);
+        b.push('resource_servers', { identifier: indicator, name: (0, record_set_1.str)(r.name) ?? indicator, scopes });
+        b.add('mapped', `api resources ${(0, record_set_1.str)(r.name) ?? indicator}`, `indicator ${indicator}`, `An API with ${scopes.length} scope(s); Atlas access tokens for it keep "aud": "${indicator}".`, `resource_servers ${indicator}`);
+        if (num(r.accessTokenTtl) && num(r.accessTokenTtl) !== 3600)
+            b.add('differs', `api resources ${(0, record_set_1.str)(r.name) ?? indicator}`, 'accessTokenTtl', 'Atlas access-token lifetime is an instance setting (auth_config.session.jwtTtlSeconds).', 'auth_config.session.jwtTtlSeconds');
+    }
+    // ── roles ──
+    for (const r of snap.roles) {
+        const name = (0, record_set_1.str)(r.name);
+        if (!name)
+            continue;
+        const key = (0, translate_kit_1.keyOf)(name);
+        b.roles[name] = key;
+        b.push('roles', { key, name, description: (0, record_set_1.str)(r.description) ?? '', permissions: [] });
+    }
+    if (snap.roles.length)
+        b.add('differs', 'roles', 'roles', `${snap.roles.length} role(s) become Atlas app roles; their API permissions and the user assignments move with the data export.`, 'roles');
+    // ── things with no 1:1 ──
+    for (const h of snap.hooks) {
+        if (h.enabled === false)
+            continue;
+        const events = [...(0, record_set_1.strs)(h.events), ...((0, record_set_1.str)(h.event) ? [(0, record_set_1.str)(h.event)] : [])];
+        b.add('manual', 'webhooks', `${(0, record_set_1.str)(h.name) ?? (0, record_set_1.str)(h.id) ?? '?'} (${events.join(', ') || 'events unknown'})`, 'A Logto webhook: create an Atlas webhook endpoint for the matching events and re-verify the signature in your receiver.', 'webhooks');
+    }
+    for (const j of snap.jwtCustomizers) {
+        const kind = (0, record_set_1.str)(j.key) ?? 'custom JWT';
+        b.add('manual', 'custom token claims', kind, 'A custom claims script: recreate its claims as an Atlas JWT template / session claims.', 'jwt_templates');
+    }
+    if ((0, record_set_1.str)(exp.customCss) || (0, record_set_1.str)(exp.customContent))
+        b.add('manual', area, 'customCss / customContent', 'Custom CSS and page content: restyle the Atlas components with the appearance settings.', 'branding');
+    b.add('differs', 'sessions', 'session lifetime', 'Logto sessions are not configurable per tenant; set the idle and absolute session windows you want in Atlas (auth_config.session).', 'auth_config.session');
+    return b.result(`Logto tenant ${snap.tenantId} (${snap.endpoint})`, {
+        bridge: { preset: 'logto', vars: { base_url: snap.endpoint } },
+        lazy: { preset: 'logto', config: { base_url: snap.endpoint } },
+    });
+}
+//# sourceMappingURL=logto-config.js.map

package/dist/migrate/export/logto-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logto-config.js","sourceRoot":"","sources":["../../../src/migrate/export/logto-config.ts"],"names":[],"mappings":";;AA6BA,4CAuCC;AAID,oDA4MC;AAlRD,6CAAgE;AAChE,mDAAkE;AAClE,+CAAgE;AAuBhE,MAAM,IAAI,GAAG,GAAG,CAAC;AAEV,KAAK,UAAU,gBAAgB,CAAC,IAAgB,EAAE,QAAgB,EAAE,QAAgB;IACzF,MAAM,QAAQ,GAAG,KAAK,EAAK,EAAoB,EAAE,KAAQ,EAAc,EAAE;QACvE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7F,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,GAAG,GAAU,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAU,GAAG,IAAI,GAAG,GAAG,QAAQ,IAAI,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YAClB,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;gBAAE,MAAM;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAW,CAAC,CAAC;IAClB,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAqC,CAAC;IACrF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,EAAE;YAAE,CAAC,CAAC,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAU,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAW,CAAC,CAAC;IAC/K,CAAC;IACD,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,SAAS,EAAE,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,kBAAkB,CAAC,CAAC;YAC7D,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,CAAC,EAAE,EAAS,CAAC;QACb,UAAU,EAAE,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAU,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAW,CAAC;QAC5G,YAAY,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC;QAC7C,SAAS;QACT,KAAK,EAAE,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC;QACnF,KAAK,EAAE,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAU,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAW,CAAC;QAClG,cAAc,EAAE,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAU,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAW,CAAC;KAC7H,CAAC;AACJ,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE9G,SAAgB,oBAAoB,CAAC,IAAyB;IAC5D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC;IAElC,wCAAwC;IACxC,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrI,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzF,IAAI,WAAW,EAAE,CAAC;QAChB,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,2BAA2B,EAAE,8MAA8M,EAAE,iCAAiC,CAAC,CAAC;IACzS,CAAC;IACD,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,qCAAqC,EAAE,0BAA0B,EAAE,iCAAiC,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,EAAE,CAAC;QACtF,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,mDAAmD,EAAE,kCAAkC,EAAE,kCAAkC,CAAC,CAAC;IACrJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,EAAE,CAAC;QACtF,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,mDAAmD,EAAE,iDAAiD,EAAE,kCAAkC,CAAC,CAAC;IACpK,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,kJAAkJ,EAAE,gCAAgC,CAAC,CAAC;IAChO,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,iCAAiC,EAAE,sCAAsC,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,oEAAoE,EAAE,wBAAwB,CAAC,CAAC;IACtI,CAAC;SAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,6FAA6F,CAAC,CAAC;IACtI,CAAC;IACD,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjF,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,EAAE,qEAAqE,EAAE,qCAAqC,CAAC,CAAC;IAC/J,CAAC;IACD,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,WAAW,EAAE,CAAC;QAC/E,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE,kFAAkF,EAAE,mBAAmB,CAAC,CAAC;IACvJ,CAAC;IAED,wBAAwB;IACxB,MAAM,EAAE,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,iBAAiB,EAAE,YAAY,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;IACrN,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,iBAAiB,EAAE,YAAY,EAAE,GAAG,GAAG,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,iBAAiB,EAAE,eAAe,EAAE,iCAAiC,EAAE,0CAA0C,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,iBAAiB,EAAE,kBAAkB,EAAE,+DAA+D,EAAE,sDAAsD,CAAC,CAAC;IACzL,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,IAAA,iBAAI,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACpG,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,IAAI,iBAAiB,EAAE,gDAAgD,EAAE,mGAAmG,EAAE,4BAA4B,CAAC,CAAC;IAClO,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACvB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,IAAI,iBAAiB,EAAE,oBAAoB,EAAE,uFAAuF,EAAE,4BAA4B,CAAC,CAAC;IAC1L,CAAC;IAED,qBAAqB;IACrB,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,MAAM,EAAE,cAAc,EAAE,+DAA+D,EAAE,8BAA8B,CAAC,CAAC;IAClJ,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,IAAI,MAAM,EAAE,kBAAkB,EAAE,yFAAyF,EAAE,iCAAiC,CAAC,CAAC;IACpL,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,MAAM,EAAE,oBAAoB,EAAE,yDAAyD,EAAE,iBAAiB,CAAC,CAAC;IACvK,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,MAAM,EAAE,kBAAkB,EAAE,mCAAmC,EAAE,uBAAuB,CAAC,CAAC;IACnH,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,IAAI,MAAM,EAAE,UAAU,MAAM,IAAI,gBAAgB,EAAE,EAAE,sHAAsH,EAAE,uBAAuB,CAAC,CAAC;IAC3N,CAAC;IACD,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,IAAI,MAAM,EAAE,aAAa,EAAE,wFAAwF,EAAE,oBAAoB,CAAC,CAAC;IAE/N,sCAAsC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC;QAC/H,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM,GAAG,EAAE,2HAA2H,EAAE,gBAAgB,CAAC,CAAC;YAC5M,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,gEAAgE,EAAE,wBAAwB,CAAC,CAAC;YACjJ,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvM,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,uEAAuE,EAAE,iBAAiB,CAAC,CAAC;IAC3L,IAAI,GAAG,CAAC,mBAAmB,KAAK,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,sIAAsI,EAAE,iBAAiB,CAAC,CAAC;IAE9O,iDAAiD;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC;QACpD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,OAAO,EAAE,EAAE,uBAAuB,EAAE,mDAAmD,EAAE,eAAe,CAAC,CAAC;YAC1I,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,OAAO,EAAE,EAAE,WAAW,EAAE,kGAAkG,EAAE,eAAe,CAAC,CAAC;YAC7K,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,OAAO,EAAE,EAAE,gBAAgB,EAAE,0HAA0H,CAAC,CAAC;YACzL,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,MAAM,CAAC,kBAAkB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,OAAO,EAAE,EAAE,mDAAmD,EAAE,qFAAqF,EAAE,qBAAqB,CAAC,CAAC;QACjN,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,GAAG,EAAE,EAAE,+CAA+C,EAAE,eAAe,CAAC,CAAC;YAC1H,SAAS;QACX,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,GAAG,EAAE,EAAE,wFAAwF,EAAE,aAAa,CAAC,CAAC;YACjK,SAAS;QACX,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,0DAA0D,EAAE,GAAG,KAAK,mBAAmB,EAAE,eAAe,CAAC,CAAC;IACrJ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,eAAe,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,yCAAyC,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC;IACjJ,CAAC;IAED,sBAAsB;IACtB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,MAAM,EAAU,CAAC,CAAC;QACtG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,SAAS,EAAE,EAAE,eAAe,MAAM,CAAC,MAAM,sDAAsD,SAAS,IAAI,EAAE,oBAAoB,SAAS,EAAE,CAAC,CAAC;QACzN,IAAI,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,EAAE,gBAAgB,EAAE,yFAAyF,EAAE,mCAAmC,CAAC,CAAC;IAC/Q,CAAC;IAED,cAAc;IACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,4GAA4G,EAAE,OAAO,CAAC,CAAC;IAErM,2BAA2B;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK;YAAE,SAAS;QAClC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,GAAG,EAAE,yHAAyH,EAAE,UAAU,CAAC,CAAC;IACtP,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC;QACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,wFAAwF,EAAE,eAAe,CAAC,CAAC;IAC1J,CAAC;IACD,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,aAAa,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,yFAAyF,EAAE,UAAU,CAAC,CAAC;IAC5M,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,oIAAoI,EAAE,qBAAqB,CAAC,CAAC;IAE9M,OAAO,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,EAAE;QAClE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;QAC9D,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;KAC/D,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/logto.d.ts

@@ -0,0 +1,150 @@
+import type { PasswordHash, UserRecord } from '@atlasauth/migrate';
+import { type Row, type Tables } from './frameworks/tables';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export logto` — Logto (self-hosted OSS and Logto Cloud) onto
+ * the canonical bundle models. Two ways in:
+ *
+ *   - a DATABASE DUMP of a self-hosted Logto (one file per table, made with
+ *     `psql \copy … csv header` or `json_agg`, see the guide): everything,
+ *     including MFA secrets — TOTP keys, WebAuthn credentials (passkeys) and
+ *     backup codes live in `users.mfa_verifications`, which no API returns;
+ *   - the MANAGEMENT API with a machine-to-machine app (`client_credentials`
+ *     against `{endpoint}/oidc/token`, resource `https://{tenant}.logto.app/api`,
+ *     `default` for OSS): users, roles, organizations, invitations, SSO
+ *     connectors. The API is asked for password hashes too
+ *     (`includePasswordHash=true`) and uses them when a Logto version returns
+ *     them; otherwise passwords move by lazy migration. MFA secrets never
+ *     leave over the API: those users enrol again.
+ *
+ * What maps where:
+ *   - users: username, primary email / phone (Logto only stores them once
+ *     verified, or set by an admin), name, avatar, OIDC profile, custom data;
+ *     suspended users arrive banned. `user.id` is the Logto user id, the `sub`
+ *     of every Logto token.
+ *   - passwords: Argon2i/id/d PHC strings, bcrypt, unsalted MD5/SHA1/SHA256
+ *     hex, and `Legacy` expressions (`["sha256", ["salt", "@"], "…"]`): the
+ *     plain shapes map onto the registry's ids, the rest keep the expression
+ *     for the `logto_legacy` verifier.
+ *   - social identities (`users.identities`, keyed by connector target) and
+ *     enterprise SSO identities (`user_sso_identities`, with their connector);
+ *   - roles (tenant "User" roles with their API scopes as permissions; M2M
+ *     roles are app credentials and stay behind), organizations (JIT email
+ *     domains as verified domains), organization roles with organization and
+ *     API scopes, memberships, invitations;
+ *   - personal access tokens (stored in plain text by Logto: Atlas keeps the
+ *     sha256, so they keep working);
+ *   - the tenant's public signing keys (`/oidc/jwks`) for the cutover.
+ */
+export interface LogtoExportOptions {
+    /** A self-hosted Logto database dump (one table per file). */
+    tables?: Tables;
+    /** The Logto endpoint (`https://auth.example.com`, `https://abc123.logto.app`): the Management API, the JWKS, the passkey rp id and SAML SP URLs. */
+    endpoint?: string;
+    /** A machine-to-machine app with the Management API role (API export). */
+    m2m?: {
+        appId: string;
+        appSecret: string;
+    };
+    /** The tenant: `default` on a self-hosted Logto, the Cloud tenant id (the `abc123` of abc123.logto.app). */
+    tenantId?: string;
+    /** The WebAuthn relying-party id passkeys were registered on (default: the endpoint's host). */
+    rpId?: string;
+    /** API export: read each user's personal access tokens too (one call per user). */
+    personalAccessTokens?: boolean;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** Everything the record mapping needs, the same shape from a dump or the API (camelCase rows). */
+export interface LogtoSnapshot {
+    source: 'database' | 'api';
+    users: Obj[];
+    /** Tenant roles of type User (machine-to-machine roles are left out). */
+    roles: Obj[];
+    /** Role id → permission (scope) names. */
+    rolePermissions: Map<string, string[]>;
+    /** User id → role ids. */
+    userRoles: Map<string, string[]>;
+    organizations: Obj[];
+    organizationRoles: Obj[];
+    /** Organization role id → organization scope and API scope names. */
+    organizationRolePermissions: Map<string, string[]>;
+    members: Array<{
+        organizationId: string;
+        userId: string;
+        roleIds: string[];
+    }>;
+    invitations: Array<{
+        row: Obj;
+        roleIds: string[];
+    }>;
+    /** Organization id → JIT email domains. */
+    organizationDomains: Map<string, string[]>;
+    ssoConnectors: Obj[];
+    ssoIdentities: Obj[];
+    personalAccessTokens: Obj[];
+    jwks: Obj[];
+    /** Users carry `mfaVerifications` (a database dump); the API never returns factor secrets. */
+    hasFactors: boolean;
+}
+export declare function exportLogto(opts: LogtoExportOptions): Promise<RecordSet>;
+/** `https://auth.example.com/` → `https://auth.example.com` (https only, no path). */
+export declare function normalizeEndpoint(raw: string): string;
+/** The Cloud tenant id of `https://abc123.logto.app`, or null for any other host. */
+export declare function tenantOfEndpoint(endpoint: string): string | null;
+/** The Management API resource indicator of a tenant. */
+export declare function managementResource(tenantId: string): string;
+/** A database row as the Management API would spell it: camelCase keys, JSONB parsed. */
+export declare function logtoRow(row: Row): Obj;
+/** One table's rows of one tenant (a dump made with `where tenant_id = …` has every row already). */
+export declare function tenantRows(tables: Tables, name: string, tenantId: string): Obj[];
+export declare function snapshotFromTables(tables: Tables, tenantId: string): LogtoSnapshot;
+/** A Management API client: an M2M access token fetched (and refreshed) on this machine. */
+export declare function logtoManagementHttp(o: {
+    endpoint: string;
+    m2m: {
+        appId: string;
+        appSecret: string;
+    };
+    tenantId: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+}): VendorHttp;
+export declare function fetchLogtoSnapshot(o: Omit<LogtoExportOptions, 'tables' | 'endpoint' | 'm2m'> & {
+    endpoint: string;
+    m2m: {
+        appId: string;
+        appSecret: string;
+    };
+    tenantId: string;
+    onProgress: (m: string) => void;
+    warnings?: string[];
+}): Promise<LogtoSnapshot & {
+    warnings: string[];
+}>;
+/** A Logto `Legacy` expression `["algorithm", [args with "@"], "hash"]`, or null. */
+export declare function parseLegacyExpression(value: string): {
+    algorithm: string;
+    args: string[];
+    hash: string;
+} | null;
+/**
+ * A Logto password digest and its `password_encryption_method` → the bundle's
+ * password. Null when the user has none or Logto itself could not verify it.
+ */
+export declare function mapLogtoPassword(digest: unknown, method: unknown): PasswordHash | null;
+/** One Logto user → a user record (null when it has nothing to sign in with). */
+export declare function mapLogtoUser(u: Obj, roles?: string[]): {
+    user: UserRecord | null;
+    passwordUnsupported: boolean;
+};
+export declare function buildLogtoRecordSet(snap: LogtoSnapshot & {
+    warnings?: string[];
+}, o: {
+    endpoint?: string;
+    tenantId: string;
+    rpId?: string;
+}): RecordSet;