@atlasauth/cli 0.12.0 → 0.14.0

package/dist/migrate/export/nhost.js

@@ -0,0 +1,304 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GraphqlError = void 0;
+exports.exportNhost = exportNhost;
+exports.refreshTokenHash = refreshTokenHash;
+exports.decryptTotp = decryptTotp;
+exports.byteaToBase64url = byteaToBase64url;
+exports.nhostGraphqlUrl = nhostGraphqlUrl;
+exports.fetchNhostRows = fetchNhostRows;
+exports.readNhostDump = readNhostDump;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const pocketbase_1 = require("./pocketbase");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+/** Roles every Nhost user has implicitly: not carried as Atlas roles. */
+const IMPLICIT_ROLES = new Set(['user', 'me', 'anonymous', 'public']);
+function exportNhost(rows, opts = {}) {
+    const set = new record_set_1.RecordSet();
+    const now = (opts.now ?? Date.now)();
+    const key = opts.encryptionKey ? parseKey(opts.encryptionKey) : undefined;
+    const rolesOf = new Map();
+    for (const r of rows.userRoles) {
+        const userId = (0, record_set_1.str)(r.userId);
+        const role = (0, record_set_1.str)(r.role);
+        if (!userId || !role || IMPLICIT_ROLES.has(role))
+            continue;
+        (rolesOf.get(userId) ?? rolesOf.set(userId, new Set()).get(userId)).add((0, translate_kit_1.keyOf)(role));
+    }
+    const ids = new Set();
+    const allRoles = new Set();
+    let totpLocked = 0;
+    let totpBroken = 0;
+    for (const u of rows.users) {
+        const id = (0, record_set_1.str)(u.id);
+        if (!id)
+            continue;
+        const user = mapUser(u, rolesOf.get(id));
+        if (!user) {
+            set.omit('user', 'user without an email or phone number who is not anonymous');
+            continue;
+        }
+        ids.add(id);
+        for (const r of user.roles ?? [])
+            allRoles.add(r);
+        set.add('user', (0, record_set_1.compact)(user));
+        const mfa = (0, record_set_1.str)(u.activeMfaType);
+        const secret = (0, record_set_1.str)(u.totpSecret);
+        if (mfa === 'totp' && secret) {
+            const plain = secret.length < 64 ? secret : key ? decryptTotp(secret, key) : undefined;
+            if (plain && /^[A-Z2-7]+=*$/i.test(plain))
+                set.add('mfa_factor', { user_id: id, type: 'totp', secret_base32: plain.toUpperCase().replace(/=+$/, ''), digits: 6, period: 30, algorithm: 'SHA1', verified: true });
+            else if (secret.length >= 64 && !key)
+                totpLocked++;
+            else
+                totpBroken++;
+        }
+        else if (mfa === 'sms') {
+            const phone = (0, record_set_1.e164)(u.phoneNumber);
+            if (phone)
+                set.add('mfa_factor', { user_id: id, type: 'phone', phone, verified: truthy(u.phoneNumberVerified) });
+        }
+    }
+    for (const r of [...allRoles].sort())
+        set.add('role', { key: r, name: r, scope: 'app' }, r);
+    if (totpLocked)
+        set.omit('mfa_factor', 'TOTP secret encrypted with AUTH_ENCRYPTION_KEY: pass --set nhost-encryption-key=<hex> to carry it, else those users enrol again', totpLocked);
+    if (totpBroken)
+        set.omit('mfa_factor', 'TOTP secret that does not decrypt with the given AUTH_ENCRYPTION_KEY', totpBroken);
+    for (const p of rows.providers) {
+        const userId = (0, record_set_1.str)(p.userId);
+        const provider = (0, record_set_1.str)(p.providerId);
+        const providerUserId = (0, record_set_1.str)(p.providerUserId);
+        if (!userId || !provider || !providerUserId || !ids.has(userId))
+            continue;
+        set.add('identity', (0, record_set_1.compact)({ id: (0, record_set_1.str)(p.id), user_id: userId, provider, provider_user_id: providerUserId, kind: 'oauth' }), `${provider}:${providerUserId}`);
+    }
+    const keys = rows.securityKeys.filter((k) => ids.has((0, record_set_1.str)(k.userId) ?? ''));
+    if (keys.length && !opts.rpId) {
+        set.omit('passkey', 'security key without a relying-party id: pass --set rp-id=<your WebAuthn rp id> (nhost.toml auth.method.webauthn.relyingParty.id)', keys.length);
+    }
+    else {
+        for (const k of keys) {
+            const credentialId = (0, record_set_1.str)(k.credentialId);
+            const publicKey = byteaToBase64url(k.credentialPublicKey);
+            if (!credentialId || !publicKey) {
+                set.omit('passkey', 'security key without its credential id or public key');
+                continue;
+            }
+            const transports = ((0, record_set_1.str)(k.transports) ?? '').split(',').map((t) => t.trim()).filter(Boolean);
+            set.add('passkey', (0, record_set_1.compact)({ id: (0, record_set_1.str)(k.id), user_id: (0, record_set_1.str)(k.userId), credential_id: credentialId, public_key: publicKey, sign_count: num(k.counter), rp_id: opts.rpId, transports, name: (0, record_set_1.str)(k.nickname) }));
+        }
+    }
+    let pats = 0;
+    let expired = 0;
+    for (const t of rows.refreshTokens) {
+        const userId = (0, record_set_1.str)(t.userId);
+        if (!userId || !ids.has(userId))
+            continue;
+        if (((0, record_set_1.str)(t.type) ?? 'regular') !== 'regular') {
+            pats++;
+            continue;
+        }
+        const expires = Date.parse((0, record_set_1.str)(t.expiresAt) ?? '');
+        if (!Number.isFinite(expires) || expires <= now) {
+            expired++;
+            continue;
+        }
+        const hash = refreshTokenHash(t);
+        if (!hash) {
+            set.omit('session', 'refresh token row without a readable hash');
+            continue;
+        }
+        set.add('session', (0, record_set_1.compact)({ id: (0, record_set_1.str)(t.id) ?? hash.slice(0, 32), user_id: userId, token_hash: hash, expires_at: (0, record_set_1.str)(t.expiresAt), created_at: (0, record_set_1.str)(t.createdAt) }));
+    }
+    if (pats)
+        set.omit('session', 'personal access token (reissue it as an Atlas API key)', pats);
+    if (expired)
+        set.omit('session', 'expired refresh token', expired);
+    const providers = new Set(set.list('identity').map((i) => i.provider));
+    set.manifest = { ...set.manifest, origin: opts.origin ?? 'nhost', providers: [...providers].sort(), ...(opts.rpId ? { rpId: opts.rpId } : {}) };
+    return set;
+}
+function mapUser(u, roles) {
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(u.phoneNumber);
+    const anonymous = truthy(u.isAnonymous);
+    if (!email && !phone && !anonymous)
+        return null;
+    const all = new Set(roles ?? []);
+    const def = (0, record_set_1.str)(u.defaultRole);
+    if (def && !IMPLICIT_ROLES.has(def))
+        all.add((0, translate_kit_1.keyOf)(def));
+    const hash = (0, record_set_1.str)(u.passwordHash);
+    const meta = (0, record_set_1.isObj)(u.metadata) ? u.metadata : typeof u.metadata === 'string' ? safeJson(u.metadata) : undefined;
+    const locale = (0, record_set_1.str)(u.locale);
+    const user = {
+        id: (0, record_set_1.str)(u.id),
+        emails: email ? [{ email, verified: truthy(u.emailVerified), primary: true }] : undefined,
+        phones: phone ? [{ phone, verified: truthy(u.phoneNumberVerified), primary: !email }] : undefined,
+        name: (0, record_set_1.str)(u.displayName),
+        image_url: (0, record_set_1.str)(u.avatarUrl),
+        password: hash && /^\$2[aby]\$\d{2}\$/.test(hash) ? { algorithm: 'auto', hash } : undefined,
+        roles: all.size ? [...all].sort() : undefined,
+        banned: truthy(u.disabled) ? true : undefined,
+        anonymous: anonymous && !email && !phone ? true : undefined,
+        public_metadata: (0, record_set_1.bag)({ ...((0, record_set_1.isObj)(meta) ? meta : {}), ...(locale ? { locale } : {}) }),
+        created_at: (0, record_set_1.str)(u.createdAt),
+        last_sign_in_at: (0, record_set_1.str)(u.lastSeen),
+    };
+    return user;
+}
+/** `\x` + hex(sha256(token)) as Nhost stores it → the bundle's lowercase hex. */
+function refreshTokenHash(t) {
+    const raw = (0, record_set_1.str)(t.refreshTokenHash);
+    if (!raw) {
+        // Legacy hasura-auth kept the token itself (a UUID) in refresh_token.
+        const plain = (0, record_set_1.str)(t.refreshToken);
+        return plain ? (0, node_crypto_1.createHash)('sha256').update(plain, 'utf8').digest('hex') : undefined;
+    }
+    const hex = raw.replace(/^\\x/i, '').toLowerCase();
+    return /^[0-9a-f]{64}$/.test(hex) ? hex : undefined;
+}
+/**
+ * Current Nhost encrypts TOTP secrets: AES-256-GCM, stored as
+ * hex(nonce(12) || ciphertext || tag(16)), key = AUTH_ENCRYPTION_KEY (hex).
+ */
+function decryptTotp(stored, key) {
+    try {
+        const raw = Buffer.from(stored, 'hex');
+        if (raw.length < 12 + 16 + 1)
+            return undefined;
+        const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', key, raw.subarray(0, 12));
+        decipher.setAuthTag(raw.subarray(raw.length - 16));
+        return Buffer.concat([decipher.update(raw.subarray(12, raw.length - 16)), decipher.final()]).toString('utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseKey(hex) {
+    const k = Buffer.from(hex.trim(), 'hex');
+    if (k.length !== 32)
+        throw new Error('The Nhost encryption key (AUTH_ENCRYPTION_KEY) must be 32 bytes as 64 hex characters.');
+    return k;
+}
+/** Postgres bytea as Hasura / psql print it (`\x…` hex), or base64 → base64url. */
+function byteaToBase64url(v) {
+    const s = (0, record_set_1.str)(v);
+    if (!s)
+        return undefined;
+    if (/^\\x[0-9a-f]*$/i.test(s))
+        return Buffer.from(s.slice(2), 'hex').toString('base64url');
+    return Buffer.from(s, 'base64').toString('base64url');
+}
+const truthy = (v) => v === true || v === 1 || v === '1' || v === 't' || v === 'true';
+const num = (v) => (typeof v === 'number' ? v : typeof v === 'string' && /^\d+$/.test(v) ? Number(v) : undefined);
+function safeJson(s) {
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        return undefined;
+    }
+}
+// ── readers ─────────────────────────────────────────────────────────────────
+/** Nhost Cloud's GraphQL endpoint for a subdomain and region. */
+function nhostGraphqlUrl(o) {
+    return `https://${o.subdomain}.graphql.${o.region}.nhost.run/v1`;
+}
+const PAGE = 1000;
+const QUERIES = {
+    users: 'id createdAt lastSeen disabled displayName avatarUrl locale email phoneNumber passwordHash emailVerified phoneNumberVerified defaultRole isAnonymous totpSecret activeMfaType metadata',
+    authUserProviders: 'id userId providerId providerUserId',
+    authUserSecurityKeys: 'id userId credentialId credentialPublicKey counter transports nickname',
+    authUserRoles: 'userId role',
+    authRefreshTokens: 'id userId createdAt expiresAt refreshTokenHash type',
+};
+/** The auth tables through Hasura with the admin secret (sent only to the project). */
+async function fetchNhostRows(opts) {
+    const http = new vendor_http_1.VendorHttp({ vendor: 'Nhost', baseUrl: opts.graphqlUrl, headers: { 'x-hasura-admin-secret': opts.adminSecret }, fetchImpl: opts.fetchImpl, sleep: opts.sleep });
+    const progress = opts.onProgress ?? (() => undefined);
+    const list = async (root, fields, order) => {
+        const out = [];
+        for (let offset = 0;; offset += PAGE) {
+            const query = `query { ${root}(limit: ${PAGE}, offset: ${offset}, order_by: { ${order}: asc }) { ${fields} } }`;
+            const { body } = await http.post(opts.graphqlUrl, { query });
+            const errors = (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body.errors) : [];
+            if (errors.length)
+                throw new GraphqlError((0, record_set_1.str)(errors[0].message) ?? 'GraphQL error');
+            const rows = (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.data) ? (0, record_set_1.objs)(body.data[root]) : [];
+            out.push(...rows);
+            if (rows.length < PAGE)
+                return out;
+        }
+    };
+    progress('users');
+    const users = await list('users', QUERIES.users, 'createdAt');
+    progress('social links');
+    const providers = await list('authUserProviders', QUERIES.authUserProviders, 'id');
+    progress('security keys');
+    const securityKeys = await list('authUserSecurityKeys', QUERIES.authUserSecurityKeys, 'id');
+    progress('roles');
+    const userRoles = await list('authUserRoles', QUERIES.authUserRoles, 'userId');
+    progress('refresh tokens');
+    let refreshTokens;
+    try {
+        refreshTokens = await list('authRefreshTokens', QUERIES.authRefreshTokens, 'createdAt');
+    }
+    catch (err) {
+        // Projects older than personal access tokens have no `type` column.
+        if (!(err instanceof GraphqlError) || !/type/.test(err.message))
+            throw err;
+        refreshTokens = await list('authRefreshTokens', 'id userId createdAt expiresAt refreshTokenHash', 'createdAt');
+    }
+    return { users, providers, securityKeys, userRoles, refreshTokens };
+}
+class GraphqlError extends Error {
+}
+exports.GraphqlError = GraphqlError;
+/** Table names a dump may use for each auth table (`auth.users.csv`, `users.json`, `auth_users.ndjson` …). */
+const DUMP_TABLES = {
+    users: ['auth.users', 'auth_users', 'users'],
+    providers: ['auth.user_providers', 'auth_user_providers', 'user_providers'],
+    securityKeys: ['auth.user_security_keys', 'auth_user_security_keys', 'user_security_keys', 'auth.user_authenticators', 'user_authenticators'],
+    userRoles: ['auth.user_roles', 'auth_user_roles', 'user_roles'],
+    refreshTokens: ['auth.refresh_tokens', 'auth_refresh_tokens', 'refresh_tokens'],
+};
+/** A folder of `auth.*` table dumps (JSON, NDJSON or CSV with a header; snake_case columns). */
+function readNhostDump(dir) {
+    const byName = new Map();
+    for (const file of (0, node_fs_1.readdirSync)(dir).sort()) {
+        const path = (0, node_path_1.join)(dir, file);
+        const ext = (0, node_path_1.extname)(file).toLowerCase();
+        if (!(0, node_fs_1.statSync)(path).isFile() || !['.json', '.ndjson', '.jsonl', '.csv'].includes(ext))
+            continue;
+        byName.set((0, node_path_1.basename)(file, (0, node_path_1.extname)(file)).toLowerCase(), (0, pocketbase_1.parseTable)((0, node_fs_1.readFileSync)(path, 'utf8'), ext).map(camelRow));
+    }
+    const pick = (k) => {
+        for (const n of DUMP_TABLES[k]) {
+            const rows = byName.get(n);
+            if (rows)
+                return rows;
+        }
+        return [];
+    };
+    const rows = { users: pick('users'), providers: pick('providers'), securityKeys: pick('securityKeys'), userRoles: pick('userRoles'), refreshTokens: pick('refreshTokens') };
+    if (!rows.users.length)
+        throw new Error(`No auth.users table in ${dir} (expected users.json, auth.users.csv, …).`);
+    return rows;
+}
+/** `phone_number_verified` → `phoneNumberVerified`; empty CSV cells drop out. */
+function camelRow(r) {
+    const out = {};
+    for (const [k, v] of Object.entries(r)) {
+        if (v === '' || v === null)
+            continue;
+        out[k.replace(/_([a-z])/g, (_, c) => c.toUpperCase())] = v;
+    }
+    return out;
+}
+//# sourceMappingURL=nhost.js.map

package/dist/migrate/export/nhost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nhost.js","sourceRoot":"","sources":["../../../src/migrate/export/nhost.ts"],"names":[],"mappings":";;;AAmDA,kCAgGC;AA+BD,4CASC;AAMD,kCAUC;AASD,4CAKC;AAeD,0CAEC;AAaD,wCAiCC;AAcD,sCAkBC;AAxTD,6CAA2D;AAC3D,qCAA8D;AAC9D,yCAAoD;AAEpD,6CAA0C;AAC1C,6CAAyF;AACzF,mDAAwC;AACxC,+CAA2C;AAyC3C,yEAAyE;AACzE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtE,SAAgB,WAAW,CAAC,IAAe,EAAE,OAA2B,EAAE;IACxE,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3D,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,CAAC,GAAG,CAAC,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,4DAA4D,CAAC,CAAC;YAC/E,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;QAE/B,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,MAAM,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,IAAI,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;iBAC5M,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,GAAG;gBAAE,UAAU,EAAE,CAAC;;gBAC9C,UAAU,EAAE,CAAC;QACpB,CAAC;aAAM,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,iIAAiI,EAAE,UAAU,CAAC,CAAC;IACtL,IAAI,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,sEAAsE,EAAE,UAAU,CAAC,CAAC;IAE3H,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,cAAc,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC1E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,EAAE,GAAG,QAAQ,IAAI,cAAc,EAAE,CAAC,CAAC;IACxK,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,mIAAmI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACxK,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,YAAY,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAC1D,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,sDAAsD,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7F,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAE,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAChN,CAAC;IACH,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,EAAE,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAE,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACtK,CAAC;IACD,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,wDAAwD,EAAE,IAAI,CAAC,CAAC;IAC9F,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAEnE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,CAAM,EAAE,KAA8B;IACrD,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAE;QACd,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACzF,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACjG,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;QACxB,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC3B,QAAQ,EAAE,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3F,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7C,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7C,SAAS,EAAE,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC3D,eAAe,EAAE,IAAA,gBAAG,EAAC,EAAE,GAAG,CAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACrF,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;KACjC,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAgB,gBAAgB,CAAC,CAAM;IACrC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,sEAAsE;QACtE,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,MAAc,EAAE,GAAW;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC9H,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mFAAmF;AACnF,SAAgB,gBAAgB,CAAC,CAAU;IACzC,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,CAAC;AACxG,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC/I,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,iEAAiE;AACjE,SAAgB,eAAe,CAAC,CAAwC;IACtE,OAAO,WAAW,CAAC,CAAC,SAAS,YAAY,CAAC,CAAC,MAAM,eAAe,CAAC;AACnE,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,CAAC;AAElB,MAAM,OAAO,GAAG;IACd,KAAK,EAAE,wLAAwL;IAC/L,iBAAiB,EAAE,qCAAqC;IACxD,oBAAoB,EAAE,wEAAwE;IAC9F,aAAa,EAAE,aAAa;IAC5B,iBAAiB,EAAE,qDAAqD;CAChE,CAAC;AAEX,uFAAuF;AAChF,KAAK,UAAU,cAAc,CAAC,IAAoJ;IACvL,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjL,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,EAAE,IAA0B,EAAE,MAAc,EAAE,KAAa,EAAkB,EAAE;QAC/F,MAAM,GAAG,GAAU,EAAE,CAAC;QACtB,KAAK,IAAI,MAAM,GAAG,CAAC,GAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,IAAI,WAAW,IAAI,aAAa,MAAM,iBAAiB,KAAK,cAAc,MAAM,MAAM,CAAC;YAChH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,YAAY,CAAC,IAAA,gBAAG,EAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,CAAC;YACtF,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YAClB,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;gBAAE,OAAO,GAAG,CAAC;QACrC,CAAC;IACH,CAAC,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9D,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACnF,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC5F,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC/E,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC3B,IAAI,aAAoB,CAAC;IACzB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;QACpE,IAAI,CAAC,CAAC,GAAG,YAAY,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,GAAG,CAAC;QAC3E,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,gDAAgD,EAAE,WAAW,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;AACtE,CAAC;AAED,MAAa,YAAa,SAAQ,KAAK;CAAG;AAA1C,oCAA0C;AAE1C,8GAA8G;AAC9G,MAAM,WAAW,GAAsC;IACrD,KAAK,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC;IAC5C,SAAS,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC;IAC3E,YAAY,EAAE,CAAC,yBAAyB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,qBAAqB,CAAC;IAC7I,SAAS,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,CAAC;IAC/D,aAAa,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC;CAChF,CAAC;AAEF,gGAAgG;AAChG,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAChG,MAAM,CAAC,GAAG,CAAC,IAAA,oBAAQ,EAAC,IAAI,EAAE,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAA,uBAAU,EAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAkB,EAAE,EAAE;QAClC,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,IAAI,GAAc,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;IACvL,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,4CAA4C,CAAC,CAAC;IACnH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAAC,CAAM;IACtB,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QACrC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/onelogin.d.ts

@@ -0,0 +1,22 @@
+import { RecordSet } from './record-set';
+/**
+ * `atlas migrate onelogin export` — a OneLogin account through API v2 with API
+ * credentials (client id + secret, on this machine): users (login, email,
+ * name, phone, status, custom attributes, last login) and roles (as app roles,
+ * with their members).
+ *
+ * OneLogin never returns password hashes or MFA secrets: passwords move by lazy
+ * migration (the `onelogin` preset), second factors are enrolled again.
+ */
+export interface OneLoginExportOptions {
+    subdomain: string;
+    clientId: string;
+    clientSecret: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** `acme`, `acme.onelogin.com` or a URL → `acme`. */
+export declare function oneLoginSubdomain(raw: string): string;
+export declare function oneLoginToken(o: Pick<OneLoginExportOptions, 'subdomain' | 'clientId' | 'clientSecret' | 'fetchImpl'>): Promise<string>;
+export declare function exportOneLogin(o: OneLoginExportOptions): Promise<RecordSet>;

package/dist/migrate/export/onelogin.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oneLoginSubdomain = oneLoginSubdomain;
+exports.oneLoginToken = oneLoginToken;
+exports.exportOneLogin = exportOneLogin;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+/** `acme`, `acme.onelogin.com` or a URL → `acme`. */
+function oneLoginSubdomain(raw) {
+    const s = raw.trim().replace(/^https?:\/\//, '').replace(/[/?#].*$/, '').replace(/\.onelogin\.com$/i, '');
+    if (!/^[a-z0-9][a-z0-9-]{0,62}$/i.test(s))
+        throw new Error(`"${raw}" is not a OneLogin subdomain.`);
+    return s.toLowerCase();
+}
+/** OneLogin user `status` codes. */
+const STATUS = { suspended: 2, locked: 3 };
+async function oneLoginToken(o) {
+    const f = o.fetchImpl ?? fetch;
+    const res = await f(`https://${oneLoginSubdomain(o.subdomain)}.onelogin.com/auth/oauth2/v2/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', authorization: `client_id:${o.clientId}, client_secret:${o.clientSecret}` },
+        body: JSON.stringify({ grant_type: 'client_credentials' }),
+    });
+    const body = (await res.json().catch(() => null));
+    const token = (0, record_set_1.str)(body?.access_token);
+    if (res.status !== 200 || !token)
+        throw new Error(`OneLogin refused the API credentials (${res.status}).`);
+    return token;
+}
+async function pages(http, path) {
+    const out = [];
+    let cursor = null;
+    do {
+        const sep = path.includes('?') ? '&' : '?';
+        const res = await http.get(cursor ? `${path}${sep}cursor=${encodeURIComponent(cursor)}` : path);
+        out.push(...(0, record_set_1.objs)(res.body));
+        cursor = res.headers.get('after-cursor') || null;
+    } while (cursor);
+    return out;
+}
+async function exportOneLogin(o) {
+    const set = new record_set_1.RecordSet();
+    const say = o.onProgress ?? (() => undefined);
+    const sub = oneLoginSubdomain(o.subdomain);
+    set.manifest = { origin: `OneLogin account ${sub}.onelogin.com` };
+    const token = await oneLoginToken(o);
+    const http = new vendor_http_1.VendorHttp({ vendor: 'OneLogin', baseUrl: `https://${sub}.onelogin.com`, headers: { authorization: `Bearer ${token}` }, fetchImpl: o.fetchImpl, sleep: o.sleep });
+    say('roles');
+    const roleKey = new Map();
+    try {
+        for (const r of await pages(http, '/api/2/roles?limit=100')) {
+            const id = (0, record_set_1.str)(r.id);
+            const name = (0, record_set_1.str)(r.name);
+            if (!id || !name)
+                continue;
+            const key = (0, translate_kit_1.keyOf)(name);
+            roleKey.set(id, key);
+            set.add('role', { key, name, scope: 'app' }, key);
+        }
+    }
+    catch (err) {
+        if (!(err instanceof vendor_http_1.VendorApiError && [401, 403, 404].includes(err.status)))
+            throw err;
+        set.warn('Roles could not be read (the API credential lacks the Read roles scope): users are imported without roles.');
+    }
+    say('users');
+    const users = await pages(http, '/api/2/users?limit=100');
+    let unactivated = 0;
+    for (const u of users) {
+        const id = (0, record_set_1.str)(u.id);
+        if (!id)
+            continue;
+        const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+        const emails = email?.includes('@') ? [{ email, verified: false, primary: true }] : [];
+        const phone = (0, record_set_1.e164)(u.phone);
+        const phones = phone ? [{ phone, verified: false, primary: true }] : [];
+        const status = Number(u.status);
+        const roles = (Array.isArray(u.role_ids) ? u.role_ids.map(String) : []).map((r) => roleKey.get(r)).filter((r) => !!r);
+        const record = (0, record_set_1.compact)({
+            id,
+            emails,
+            phones,
+            username: (0, record_set_1.str)(u.username),
+            first_name: (0, record_set_1.str)(u.firstname),
+            last_name: (0, record_set_1.str)(u.lastname),
+            created_at: (0, record_set_1.str)(u.created_at),
+            last_sign_in_at: (0, record_set_1.str)(u.last_login),
+            roles: [...new Set(roles)],
+            private_metadata: {
+                onelogin: (0, record_set_1.compact)({
+                    status,
+                    external_id: (0, record_set_1.str)(u.external_id),
+                    directory_id: (0, record_set_1.str)(u.directory_id),
+                    group_id: (0, record_set_1.str)(u.group_id),
+                    title: (0, record_set_1.str)(u.title),
+                    department: (0, record_set_1.str)(u.department),
+                    company: (0, record_set_1.str)(u.company),
+                    custom_attributes: (0, record_set_1.bag)(u.custom_attributes),
+                }),
+            },
+        });
+        if (status === STATUS.suspended) {
+            record.banned = true;
+            record.ban_reason = 'Suspended in OneLogin';
+        }
+        else if (status === STATUS.locked)
+            record.locked = true;
+        if (status === 0)
+            unactivated++;
+        if (!record.emails?.length && !record.phones?.length && !record.username) {
+            set.omit('user', 'no email, phone or username', 1);
+            continue;
+        }
+        set.add('user', record, id);
+    }
+    set.omit('password', 'OneLogin never exports password hashes', users.length);
+    set.warn('Addresses are imported unverified (OneLogin does not say which were confirmed). Passwords move by lazy migration (preset onelogin); users enrol their second factor again.');
+    if (unactivated)
+        set.warn(`${unactivated} user(s) never activated their OneLogin account (no password to migrate).`);
+    return set;
+}
+//# sourceMappingURL=onelogin.js.map

package/dist/migrate/export/onelogin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onelogin.js","sourceRoot":"","sources":["../../../src/migrate/export/onelogin.ts"],"names":[],"mappings":";;AAyBA,8CAIC;AAKD,sCAWC;AAcD,wCA2EC;AArID,6CAAkF;AAClF,mDAAwC;AACxC,+CAA2D;AAqB3D,qDAAqD;AACrD,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,GAAG,gCAAgC,CAAC,CAAC;IACpG,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,oCAAoC;AACpC,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAW,CAAC;AAE7C,KAAK,UAAU,aAAa,CAAC,CAAuF;IACzH,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,oCAAoC,EAAE;QACjG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,QAAQ,mBAAmB,CAAC,CAAC,YAAY,EAAE,EAAE;QAC1H,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAe,CAAC;IAChE,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC3G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAgB,EAAE,IAAY;IACjD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,GAAG,CAAC;QACF,MAAM,GAAG,GAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnD,MAAM,GAAG,GAAwC,MAAM,IAAI,CAAC,GAAG,CAAU,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9I,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,GAAG,CAAC;AACb,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,CAAwB;IAC3D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3C,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,oBAAoB,GAAG,eAAe,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,GAAG,eAAe,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAEnL,GAAG,CAAC,OAAO,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,EAAE,CAAC;YAC5D,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;gBAAE,SAAS;YAC3B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;IACzH,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAC1D,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAmB,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,QAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClJ,MAAM,MAAM,GAAe,IAAA,oBAAO,EAAC;YACjC,EAAE;YACF,MAAM;YACN,MAAM;YACN,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YACzB,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;YAC5B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YAC1B,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;YAC7B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;YAClC,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1B,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,IAAA,oBAAO,EAAC;oBAChB,MAAM;oBACN,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;oBAC/B,YAAY,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;oBACjC,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;oBACzB,KAAK,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC;oBACnB,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;oBAC7B,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;oBACvB,iBAAiB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC;iBAC5C,CAAC;aACH;SACY,CAAC,CAAC;QACjB,IAAI,MAAM,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,UAAU,GAAG,uBAAuB,CAAC;QAC9C,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1D,IAAI,MAAM,KAAK,CAAC;YAAE,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,wCAAwC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7E,GAAG,CAAC,IAAI,CAAC,4KAA4K,CAAC,CAAC;IACvL,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,2EAA2E,CAAC,CAAC;IACrH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/ory-config.d.ts

@@ -0,0 +1,58 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate ory config` — Ory Kratos and Hydra settings → Atlas config.
+ *
+ * Three readers, one translation:
+ *   - a Kratos config file (`kratos.yml`, or the JSON `ory get identity-config
+ *     --format json` prints), every report line carrying file:line for YAML;
+ *   - an Ory Network project (`ory get project <id> --format json`: the Kratos
+ *     config under `services.identity.config`, Hydra's under
+ *     `services.oauth2.config`);
+ *   - a Hydra config (`hydra.yml`) and the live Hydra Admin API, whose OAuth 2.0
+ *     clients become Atlas OAuth clients (Hydra keeps only hashed client
+ *     secrets: every secret is reissued).
+ * The identity schemas (`identity.schemas`: inline `base64://`, local `file://`,
+ * or the public `GET /schemas` of a running Kratos) say which traits are the
+ * email, username, phone and name and which are custom.
+ */
+/** One config file: its parsed value, with the source line of any dotted path. */
+export interface OryConfigFile {
+    value: Obj;
+    file: string;
+    line(path: string): number | undefined;
+}
+export interface OryIdentitySchema {
+    id: string;
+    schema: Obj;
+}
+export interface OryConfigSnapshot {
+    origin: string;
+    /** Kratos configuration (kratos.yml / `services.identity.config`). */
+    kratos?: OryConfigFile;
+    /** Hydra configuration (hydra.yml / `services.oauth2.config`). */
+    hydra?: OryConfigFile;
+    schemas: OryIdentitySchema[];
+    /** Hydra OAuth 2.0 clients (`GET /admin/clients`). */
+    clients: Obj[];
+    /** Kratos' public URL (the bridge and the lazy preset call it). */
+    publicUrl?: string;
+}
+/** A config file's text: JSON when it starts with `{`, otherwise YAML. */
+export declare function parseOryConfig(text: string, file: string): OryConfigFile;
+/** An `ory get project --format json` document split into its Kratos and Hydra configs; null when it is not one. */
+export declare function splitOryProject(file: OryConfigFile): {
+    kratos: OryConfigFile;
+    hydra?: OryConfigFile;
+    slug?: string;
+} | null;
+/** Identity schemas a Kratos config names that can be read without the network: `base64://` and `file://` (through `readFile`). */
+export declare function resolveOrySchemas(kratos: OryConfigFile | undefined, readFile: (path: string) => string, warn?: (m: string) => void): OryIdentitySchema[];
+/** Kratos' public `GET /schemas`: `[{ id, schema }]`. */
+export declare function fetchOrySchemas(http: VendorHttp): Promise<OryIdentitySchema[]>;
+/** Hydra's `GET /admin/clients`, following the Link header's page_token. */
+export declare function fetchOryClients(http: VendorHttp, pageSize?: number): Promise<Obj[]>;
+/** Go durations (`24h`, `720h`, `1h30m`) → ms. */
+export declare function goDurationMs(v: unknown): number | undefined;
+export declare function translateOryConfig(snap: OryConfigSnapshot): TranslationResult;