@atlasauth/cli 0.12.0 → 0.14.0

package/dist/migrate/entra-external-id/plugin.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entraExternalIdPlugin = void 0;
+const plugin_1 = require("../azure-ad-b2c/plugin");
+/**
+ * `atlas migrate entra-external-id` — Microsoft Entra External ID (external
+ * tenants). Same Graph exporter and translator as Azure AD B2C; lazy
+ * migration through the native authentication API (external tenants have no
+ * ROPC) and the bridge matching on the `oid` claim.
+ */
+exports.entraExternalIdPlugin = (0, plugin_1.azurePlugin)('entra');
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/entra-external-id/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/entra-external-id/plugin.ts"],"names":[],"mappings":";;;AAAA,mDAAqD;AAGrD;;;;;GAKG;AACU,QAAA,qBAAqB,GAAoB,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC"}

package/dist/migrate/export/appwrite-config.d.ts

@@ -0,0 +1,28 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+/**
+ * `atlas migrate appwrite config` — an Appwrite project's auth settings →
+ * Atlas config.
+ *
+ * Two local sources, either or both (Appwrite's Projects API is console-only,
+ * so no project key can read it — the owner's own CLI can):
+ *   - `appwrite.json` (or `appwrite.config.json`) after `appwrite pull
+ *     settings`: `settings.auth.methods` and `settings.auth.security`, read
+ *     with file:line;
+ *   - the project document (`appwrite projects get --project-id <id> --json`,
+ *     Appwrite 1.x model: `authDuration`, `authLimit`, … and `oAuthProviders`),
+ *     the only place the OAuth providers are listed.
+ */
+export interface AppwriteConfigSnapshot {
+    /** The CLI config file, as text, with its path for the report. */
+    file?: {
+        path: string;
+        text: string;
+    };
+    /** The project document (Projects API / `appwrite projects get --json`). */
+    project?: Obj;
+    endpoint?: string;
+    projectId?: string;
+}
+export declare function parseAppwriteConfigFile(text: string): Obj;
+export declare function translateAppwriteConfig(snap: AppwriteConfigSnapshot): TranslationResult;

package/dist/migrate/export/appwrite-config.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAppwriteConfigFile = parseAppwriteConfigFile;
+exports.translateAppwriteConfig = translateAppwriteConfig;
+const record_set_1 = require("./record-set");
+const source_lines_1 = require("./source-lines");
+const translate_kit_1 = require("./translate-kit");
+/** Appwrite auth method ids (`settings.auth.methods` keys) → Atlas strategy. */
+const METHODS = {
+    'email-password': { atlas: 'strategies.password', note: 'Email + password sign-in. Imported Appwrite hashes verify as they are and are upgraded to Argon2id.' },
+    'magic-url': { atlas: 'strategies.emailLink', note: 'Magic URL sign-in becomes Atlas email links.' },
+    'email-otp': { atlas: 'strategies.emailCode', note: 'Email OTP becomes Atlas email codes.' },
+    phone: { atlas: 'strategies.phoneCode', note: 'Phone (SMS) OTP becomes Atlas SMS codes, sent through your Atlas SMS settings.' },
+    anonymous: { atlas: 'strategies.anonymous', note: 'Anonymous sessions become Atlas anonymous users.' },
+};
+/** The 1.x project model's method flags, in `settings.auth.methods` terms. */
+const PROJECT_METHODS = {
+    authEmailPassword: 'email-password',
+    authUsersAuthMagicURL: 'magic-url',
+    authEmailOtp: 'email-otp',
+    authPhone: 'phone',
+    authAnonymous: 'anonymous',
+    authInvites: 'invites',
+    authJWT: 'jwt',
+};
+const PROJECT_SECURITY = {
+    authDuration: 'duration',
+    authLimit: 'limit',
+    authSessionsLimit: 'sessionsLimit',
+    authPasswordHistory: 'passwordHistory',
+    authPasswordDictionary: 'passwordDictionary',
+    authPersonalDataCheck: 'personalDataCheck',
+    authSessionAlerts: 'sessionAlerts',
+    authMockNumbers: 'mockNumbers',
+};
+function parseAppwriteConfigFile(text) {
+    const parsed = JSON.parse(text);
+    if (!(0, record_set_1.isObj)(parsed))
+        throw new Error('appwrite.json is not a JSON object.');
+    return parsed;
+}
+function translateAppwriteConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const fileDoc = snap.file ? parseAppwriteConfigFile(snap.file.text) : undefined;
+    const settings = (0, record_set_1.isObj)(fileDoc?.settings) ? fileDoc.settings : {};
+    const auth = (0, record_set_1.isObj)(settings.auth) ? settings.auth : {};
+    const project = snap.project ?? {};
+    const projectId = snap.projectId ?? (0, record_set_1.str)(fileDoc?.projectId) ?? (0, record_set_1.str)(project.$id);
+    const filePath = snap.file?.path;
+    // One view of methods and security, from the file (with lines) or the project document.
+    const methods = {};
+    const fileMethods = (0, record_set_1.isObj)(auth.methods) ? auth.methods : {};
+    for (const [k, v] of Object.entries(fileMethods)) {
+        if (typeof v === 'boolean')
+            methods[k] = { on: v, line: (0, source_lines_1.jsonKeyLine)(snap.file.text, ['settings', 'auth', 'methods', k]), from: `settings.auth.methods.${k}` };
+    }
+    for (const [flag, k] of Object.entries(PROJECT_METHODS)) {
+        if (methods[k] || typeof project[flag] !== 'boolean')
+            continue;
+        methods[k] = { on: project[flag], from: flag };
+    }
+    for (const m of (0, record_set_1.objs)(project.authMethods)) {
+        const id = (0, record_set_1.str)(m.$id);
+        if (id && !methods[id] && typeof m.enabled === 'boolean')
+            methods[id] = { on: m.enabled, from: `authMethods.${id}` };
+    }
+    const security = {};
+    const fileSecurity = (0, record_set_1.isObj)(auth.security) ? auth.security : {};
+    for (const [k, v] of Object.entries(fileSecurity))
+        security[k] = { value: v, line: (0, source_lines_1.jsonKeyLine)(snap.file.text, ['settings', 'auth', 'security', k]), from: `settings.auth.security.${k}` };
+    for (const [flag, k] of Object.entries(PROJECT_SECURITY))
+        if (!security[k] && project[flag] !== undefined)
+            security[k] = { value: project[flag], from: flag };
+    const at = (line) => (line ? filePath : undefined);
+    // ── sign-in methods ──
+    for (const [id, m] of Object.entries(methods)) {
+        const known = METHODS[id];
+        if (known) {
+            b.set(known.atlas, m.on);
+            if (m.on)
+                (0, source_lines_1.addAt)(b, at(m.line), m.line, 'mapped', 'auth methods', m.from, known.note, `auth_config.${known.atlas}`);
+        }
+        else if (id === 'invites' && m.on) {
+            (0, source_lines_1.addAt)(b, at(m.line), m.line, 'mapped', 'auth methods', m.from, 'Team invites become Atlas organization invitations (pending ones are imported).', 'organizations');
+        }
+        else if (id === 'jwt' && m.on) {
+            (0, source_lines_1.addAt)(b, at(m.line), m.line, 'differs', 'auth methods', m.from, 'Appwrite JWTs (account.createJWT) are replaced by Atlas session tokens (getToken()); your backend verifies them with Atlas\'s JWKS instead of calling Appwrite.', 'session tokens');
+        }
+        else if (m.on) {
+            (0, source_lines_1.addAt)(b, at(m.line), m.line, 'manual', 'auth methods', m.from, `The Appwrite method "${id}" has no direct Atlas setting: review it.`);
+        }
+    }
+    if (methods['email-password']?.on) {
+        b.set('passwordPolicy.minLength', 8);
+        b.add('mapped', 'auth methods', 'password minimum length', 'Appwrite requires 8 characters; so does Atlas.', 'auth_config.passwordPolicy.minLength');
+    }
+    // ── security ──
+    const sec = (k) => security[k];
+    const duration = sec('duration');
+    if (duration && typeof duration.value === 'number' && duration.value > 0) {
+        const ms = (0, translate_kit_1.clampSessionMs)(duration.value * 1000);
+        b.set('session.absoluteMs', ms);
+        (0, source_lines_1.addAt)(b, at(duration.line), duration.line, ms === duration.value * 1000 ? 'mapped' : 'differs', 'security', duration.from, `${duration.value} s sessions${ms !== duration.value * 1000 ? ' (Appwrite defaults to one year; Atlas allows at most 90 days)' : ''}.`, 'auth_config.session.absoluteMs');
+    }
+    const sessions = sec('sessionsLimit');
+    if (sessions && typeof sessions.value === 'number' && sessions.value > 0) {
+        b.set('session.maxConcurrentSessions', sessions.value);
+        (0, source_lines_1.addAt)(b, at(sessions.line), sessions.line, 'mapped', 'security', sessions.from, `At most ${sessions.value} sessions per user (the oldest is signed out).`, 'auth_config.session.maxConcurrentSessions');
+    }
+    const limit = sec('limit');
+    if (limit && typeof limit.value === 'number' && limit.value > 0) {
+        (0, source_lines_1.addAt)(b, at(limit.line), limit.line, 'manual', 'security', limit.from, `Appwrite caps the project at ${limit.value} users; Atlas has no user cap. Close sign-up (signUpMode "restricted") if that cap was a gate.`, 'auth_config.signUpMode');
+    }
+    const history = sec('passwordHistory');
+    if (history && typeof history.value === 'number' && history.value > 0) {
+        b.set('passwordPolicy.historyCount', history.value);
+        (0, source_lines_1.addAt)(b, at(history.line), history.line, 'mapped', 'security', history.from, `New passwords may not repeat the last ${history.value}. Atlas starts the history at the first password set in Atlas.`, 'auth_config.passwordPolicy.historyCount');
+    }
+    const dict = sec('passwordDictionary');
+    if (dict?.value === true) {
+        b.set('passwordPolicy.checkBreaches', true);
+        (0, source_lines_1.addAt)(b, at(dict.line), dict.line, 'differs', 'security', dict.from, 'Appwrite rejects the 10,000 most common passwords; Atlas rejects passwords found in breach corpora, a superset.', 'auth_config.passwordPolicy.checkBreaches');
+    }
+    const personal = sec('personalDataCheck');
+    if (personal?.value === true) {
+        b.set('passwordPolicy.rejectIdentifierSubstring', true);
+        (0, source_lines_1.addAt)(b, at(personal.line), personal.line, 'mapped', 'security', personal.from, 'Passwords may not contain the user\'s name, email or phone.', 'auth_config.passwordPolicy.rejectIdentifierSubstring');
+    }
+    const alerts = sec('sessionAlerts');
+    if (alerts?.value === true)
+        (0, source_lines_1.addAt)(b, at(alerts.line), alerts.line, 'manual', 'security', alerts.from, 'New-session email alerts: enable Atlas\'s new sign-in notification email in the dashboard (Emails).');
+    const mock = sec('mockNumbers');
+    if (mock && Array.isArray(mock.value) && mock.value.length) {
+        (0, source_lines_1.addAt)(b, at(mock.line), mock.line, 'manual', 'security', mock.from, `${mock.value.length} mock phone number(s) with fixed OTPs: use Atlas development-instance test numbers instead; they are not copied.`);
+    }
+    for (const k of ['membershipsUserName', 'membershipsUserEmail', 'membershipsMfa']) {
+        const flag = `auth${k[0].toUpperCase()}${k.slice(1)}`;
+        if (project[flag] === false)
+            b.add('manual', 'memberships privacy', flag, 'Appwrite hides this member field from team members; Atlas shows members\' names and emails to their organization. Restrict with organization permissions if needed.');
+    }
+    // ── OAuth providers ──
+    for (const p of (0, record_set_1.objs)(project.oAuthProviders)) {
+        const key = (0, record_set_1.str)(p.key);
+        if (!key || p.enabled !== true)
+            continue;
+        const atlas = (0, translate_kit_1.socialKey)(key);
+        const appId = (0, record_set_1.str)(p.appId);
+        if (atlas) {
+            b.socialProvider({ atlasKey: atlas, vendorName: key, area: 'oauth providers', setting: `oAuthProviders.${key}`, clientId: appId });
+        }
+        else {
+            b.add('manual', 'oauth providers', `oAuthProviders.${key}`, `"${key}" is not an Atlas built-in provider: add it as a custom OAuth/OIDC provider (custom_oauth_providers) with the same client id${appId ? ` (${appId})` : ''}.`, 'custom_oauth_providers');
+        }
+    }
+    if (!snap.project && snap.file) {
+        b.add('manual', 'oauth providers', 'oAuthProviders', 'appwrite.json does not list OAuth providers: pass the project document (appwrite projects get --json) to translate them, or add them in the Atlas dashboard with the same client ids.');
+    }
+    // ── always ──
+    b.add('differs', 'sessions', 'a_session_<project> cookie', 'Appwrite sessions live on the Appwrite domain and are stored hashed: the appwrite bridge preset asks Appwrite about each live session once and swaps it for an Atlas session.', 'migrations bridge appwrite');
+    b.add('differs', 'multi-factor', 'TOTP authenticators', 'Appwrite cannot export TOTP secrets: those users enrol an authenticator app again (recovery codes can be exported).', 'auth_config.mfa.factors.totp');
+    const endpoint = snap.endpoint ?? (0, record_set_1.str)(fileDoc?.endpoint);
+    const base = endpoint?.replace(/\/+$/, '');
+    const ids = projectId ? { project_id: projectId } : {};
+    // The bridge preset names the endpoint `endpoint_url`, the lazy preset `endpoint`.
+    return b.result(filePath ?? `appwrite project ${projectId ?? ''}`.trim(), {
+        bridge: { preset: 'appwrite', vars: { ...ids, ...(base ? { endpoint_url: base } : {}) } },
+        lazy: { preset: 'appwrite', config: { ...ids, ...(base ? { endpoint: base } : {}) } },
+    });
+}
+//# sourceMappingURL=appwrite-config.js.map

package/dist/migrate/export/appwrite-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appwrite-config.js","sourceRoot":"","sources":["../../../src/migrate/export/appwrite-config.ts"],"names":[],"mappings":";;AA0DA,0DAIC;AAED,0DAwHC;AAvLD,6CAA0D;AAC1D,iDAAoD;AACpD,mDAA2E;AAwB3E,gFAAgF;AAChF,MAAM,OAAO,GAAoD;IAC/D,gBAAgB,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,qGAAqG,EAAE;IAC/J,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,8CAA8C,EAAE;IACpG,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,sCAAsC,EAAE;IAC5F,KAAK,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,gFAAgF,EAAE;IAChI,SAAS,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,kDAAkD,EAAE;CACvG,CAAC;AAEF,8EAA8E;AAC9E,MAAM,eAAe,GAA2B;IAC9C,iBAAiB,EAAE,gBAAgB;IACnC,qBAAqB,EAAE,WAAW;IAClC,YAAY,EAAE,WAAW;IACzB,SAAS,EAAE,OAAO;IAClB,aAAa,EAAE,WAAW;IAC1B,WAAW,EAAE,SAAS;IACtB,OAAO,EAAE,KAAK;CACf,CAAC;AAEF,MAAM,gBAAgB,GAA2B;IAC/C,YAAY,EAAE,UAAU;IACxB,SAAS,EAAE,OAAO;IAClB,iBAAiB,EAAE,eAAe;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,sBAAsB,EAAE,oBAAoB;IAC5C,qBAAqB,EAAE,mBAAmB;IAC1C,iBAAiB,EAAE,eAAe;IAClC,eAAe,EAAE,aAAa;CAC/B,CAAC;AAEF,SAAgB,uBAAuB,CAAC,IAAY;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IAC3C,IAAI,CAAC,IAAA,kBAAK,EAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,uBAAuB,CAAC,IAA4B;IAClE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAA,kBAAK,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,gBAAG,EAAC,OAAO,EAAE,SAAS,CAAC,IAAI,IAAA,gBAAG,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;IAEjC,wFAAwF;IACxF,MAAM,OAAO,GAAiE,EAAE,CAAC;IACjF,MAAM,WAAW,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAA,0BAAW,EAAC,IAAI,CAAC,IAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,CAAC,EAAE,EAAE,CAAC;IACjK,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC/D,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACvH,CAAC;IACD,MAAM,QAAQ,GAAoE,EAAE,CAAC;IACrF,MAAM,YAAY,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAA,0BAAW,EAAC,IAAI,CAAC,IAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,EAAE,EAAE,CAAC;IAC5L,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAE9J,MAAM,EAAE,GAAG,CAAC,IAAwB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEvE,wBAAwB;IACxB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,EAAE;gBAAE,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACrH,CAAC;aAAM,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACpC,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,iFAAiF,EAAE,eAAe,CAAC,CAAC;QACrK,CAAC;aAAM,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YAChC,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,iKAAiK,EAAE,gBAAgB,CAAC,CAAC;QACvP,CAAC;aAAM,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,wBAAwB,EAAE,2CAA2C,CAAC,CAAC;QACxI,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,yBAAyB,EAAE,gDAAgD,EAAE,sCAAsC,CAAC,CAAC;IACvJ,CAAC;IAED,iBAAiB;IACjB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE,GAAG,IAAA,8BAAc,EAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAChC,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,cAAc,EAAE,KAAK,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;IACvS,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACzE,CAAC,CAAC,GAAG,CAAC,+BAA+B,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvD,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,QAAQ,CAAC,KAAK,gDAAgD,EAAE,2CAA2C,CAAC,CAAC;IAC1M,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAChE,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,gCAAgC,KAAK,CAAC,KAAK,gGAAgG,EAAE,wBAAwB,CAAC,CAAC;IAChP,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACvC,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,yCAAyC,OAAO,CAAC,KAAK,gEAAgE,EAAE,yCAAyC,CAAC,CAAC;IAClP,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACvC,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,iHAAiH,EAAE,0CAA0C,CAAC,CAAC;IACtO,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC1C,IAAI,QAAQ,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC;QACxD,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,6DAA6D,EAAE,sDAAsD,CAAC,CAAC;IACzM,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,MAAM,EAAE,KAAK,KAAK,IAAI;QAAE,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,qGAAqG,CAAC,CAAC;IAC7M,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IAChC,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,kHAAkH,CAAC,CAAC;IAC9M,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,gBAAgB,CAAU,EAAE,CAAC;QAC3F,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,qKAAqK,CAAC,CAAC;IACnP,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;YAAE,SAAS;QACzC,MAAM,KAAK,GAAG,IAAA,yBAAS,EAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrI,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,kBAAkB,GAAG,EAAE,EAAE,IAAI,GAAG,+HAA+H,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC7P,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,uLAAuL,CAAC,CAAC;IAChP,CAAC;IAED,eAAe;IACf,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,4BAA4B,EAAE,+KAA+K,EAAE,4BAA4B,CAAC,CAAC;IAC1Q,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,qBAAqB,EAAE,qHAAqH,EAAE,8BAA8B,CAAC,CAAC;IAE/M,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAA,gBAAG,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAA2B,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,mFAAmF;IACnF,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,oBAAoB,SAAS,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QACxE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACzF,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;KACtF,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/appwrite.d.ts

@@ -0,0 +1,51 @@
+import type { PasswordHash } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export appwrite` — an Appwrite project (Cloud or self-hosted,
+ * 1.5 and later) through the Server API, with an API key the owner creates
+ * (scopes `users.read`, `teams.read`; `users.write` too for recovery codes on
+ * 2.x). The key is used on this machine only.
+ *
+ * Appwrite's Users API returns every user's hash with its algorithm and
+ * options (`password`, `hash`, `hashOptions`), so passwords move as they are:
+ * Argon2 and bcrypt are self-describing, MD5 and the eleven SHA variants are
+ * unsalted hex, phpass keeps its `$P$`/`$H$` digest, plain scrypt carries its
+ * literal N / r / p and string salt, and `scryptMod` is Firebase's modified
+ * scrypt with Appwrite's fixed N=2^14, r=8.
+ *
+ * Teams become organizations (confirmed memberships with their roles,
+ * unconfirmed ones as pending invitations), labels become app roles, prefs
+ * become public metadata (list queries use the JSON syntax of 1.5+). MFA
+ * recovery codes are readable (opt in); TOTP secrets are encrypted at rest
+ * with no read route, so those users enrol again. Sessions are stored as hashes and cannot leave: the `appwrite` bridge
+ * preset asks Appwrite about a live session instead.
+ */
+export interface AppwriteExportOptions {
+    /** The API endpoint including /v1 (default https://cloud.appwrite.io/v1). */
+    endpoint?: string;
+    projectId: string;
+    apiKey: string;
+    /** Read each MFA user's recovery codes (`GET /users/{id}/mfa/recovery-codes`). */
+    recoveryCodes?: boolean;
+    /** Skip teams and memberships. */
+    skipTeams?: boolean;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+export declare const APPWRITE_CLOUD = "https://cloud.appwrite.io/v1";
+export declare function exportAppwrite(opts: AppwriteExportOptions): Promise<RecordSet>;
+/** Appwrite team roles → one Atlas membership role: `owner` is the org admin, else the first custom role. */
+export declare function appwriteTeamRole(roles: string[]): string;
+/**
+ * One Appwrite user's hash in the bundle's terms (see the module comment).
+ * `guessed` marks a SHA hash stored without a version; `problem` is a warning
+ * for a hash that cannot be carried.
+ */
+export declare function appwritePasswordHash(u: Obj): {
+    hash?: PasswordHash;
+    guessed?: boolean;
+    problem?: string;
+};
+/** An Appwrite 1.5+ query (JSON form) for the `queries[]` parameter. */
+export declare function appwriteQuery(method: string, values: unknown[]): string;

package/dist/migrate/export/appwrite.js

@@ -0,0 +1,288 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APPWRITE_CLOUD = void 0;
+exports.exportAppwrite = exportAppwrite;
+exports.appwriteTeamRole = appwriteTeamRole;
+exports.appwritePasswordHash = appwritePasswordHash;
+exports.appwriteQuery = appwriteQuery;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+exports.APPWRITE_CLOUD = 'https://cloud.appwrite.io/v1';
+const PAGE = 100;
+async function exportAppwrite(opts) {
+    const set = new record_set_1.RecordSet();
+    const endpoint = (opts.endpoint ?? exports.APPWRITE_CLOUD).replace(/\/+$/, '');
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'Appwrite',
+        baseUrl: endpoint,
+        headers: { 'x-appwrite-project': opts.projectId, 'x-appwrite-key': opts.apiKey },
+        fetchImpl: opts.fetchImpl,
+        sleep: opts.sleep,
+    });
+    const progress = opts.onProgress ?? (() => undefined);
+    progress('users');
+    const users = await listAll(http, '/users', 'users');
+    const ids = new Set();
+    const labels = new Set();
+    let shaGuessed = 0;
+    for (const u of users) {
+        const id = (0, record_set_1.str)(u.$id);
+        if (!id)
+            continue;
+        ids.add(id);
+        const user = mapUser(u);
+        const pw = appwritePasswordHash(u);
+        if (pw.hash)
+            user.password = pw.hash;
+        if (pw.guessed)
+            shaGuessed++;
+        if (pw.problem)
+            set.warn(pw.problem);
+        for (const l of user.roles ?? [])
+            labels.add(l);
+        set.add('user', (0, record_set_1.compact)(user));
+    }
+    for (const l of [...labels].sort())
+        set.add('role', { key: l, name: l, scope: 'app' }, `app:${l}`);
+    if (shaGuessed) {
+        set.warn(`${shaGuessed} SHA hash(es) were imported without a version: Appwrite 1.x checks those as SHA3-512 and 2.x as SHA-256. The export picked by digest length; a user whose hash still fails signs in through lazy migration or a reset.`);
+    }
+    progress('identities');
+    try {
+        for (const i of await listAll(http, '/users/identities', 'identities')) {
+            const userId = (0, record_set_1.str)(i.userId);
+            const provider = (0, record_set_1.str)(i.provider);
+            const providerUid = (0, record_set_1.str)(i.providerUid);
+            if (!userId || !provider || !providerUid || !ids.has(userId))
+                continue;
+            set.add('identity', (0, record_set_1.compact)({ id: (0, record_set_1.str)(i.$id), user_id: userId, provider, provider_user_id: providerUid, kind: 'oauth', email: (0, record_set_1.str)(i.providerEmail)?.toLowerCase() }), `${provider}:${providerUid}`);
+        }
+    }
+    catch (err) {
+        // `GET /users/identities` exists from 1.5; older servers only list per user.
+        if (!(err instanceof vendor_http_1.VendorApiError && [404, 400].includes(err.status)))
+            throw err;
+        set.warn('This Appwrite server has no identities listing (before 1.5): OAuth links are not exported; users relink by email on first social sign-in.');
+    }
+    progress('two-factor');
+    let totp = 0;
+    for (const u of users) {
+        const id = (0, record_set_1.str)(u.$id);
+        if (!id || u.mfa !== true)
+            continue;
+        const factors = await optionalGet(http, `/users/${id}/mfa/factors`);
+        if (!factors)
+            continue;
+        if (factors.totp === true)
+            totp++;
+        const phone = (0, record_set_1.e164)(u.phone);
+        if (factors.phone === true && phone)
+            set.add('mfa_factor', { user_id: id, type: 'phone', phone, verified: u.phoneVerification === true });
+        if (factors.email === true && (0, record_set_1.str)(u.email))
+            set.add('mfa_factor', { user_id: id, type: 'email', verified: u.emailVerification === true });
+        if (factors.recoveryCode === true && opts.recoveryCodes) {
+            const codes = await optionalGet(http, `/users/${id}/mfa/recovery-codes`);
+            const list = (0, record_set_1.strs)(codes?.recoveryCodes);
+            if (list.length)
+                set.add('mfa_factor', { user_id: id, type: 'backup_codes', backup_codes: list, verified: true });
+        }
+    }
+    if (totp)
+        set.omit('mfa_factor', 'Appwrite keeps TOTP secrets encrypted with no API to read them: those users enrol an authenticator app again', totp);
+    if (!opts.recoveryCodes && users.some((u) => u.mfa === true)) {
+        set.warn('Recovery codes were not read: pass --set appwrite-recovery-codes=true (the API key needs users.read, or users.write on Appwrite 2.x).');
+    }
+    if (!opts.skipTeams) {
+        progress('teams');
+        const teams = await optionalList(http, '/teams', 'teams');
+        const orgRoles = new Set();
+        for (const t of teams) {
+            const teamId = (0, record_set_1.str)(t.$id);
+            const name = (0, record_set_1.str)(t.name);
+            if (!teamId || !name)
+                continue;
+            set.add('organization', (0, record_set_1.compact)({ id: teamId, name, public_metadata: (0, record_set_1.bag)(t.prefs), created_at: (0, record_set_1.str)(t.$createdAt) }));
+            for (const m of await optionalList(http, `/teams/${teamId}/memberships`, 'memberships')) {
+                const role = appwriteTeamRole((0, record_set_1.strs)(m.roles));
+                orgRoles.add(role);
+                const userId = (0, record_set_1.str)(m.userId);
+                if (m.confirm === true && userId && ids.has(userId)) {
+                    set.add('membership', (0, record_set_1.compact)({ id: (0, record_set_1.str)(m.$id), organization_id: teamId, user_id: userId, role, created_at: (0, record_set_1.str)(m.joined) ?? (0, record_set_1.str)(m.$createdAt) }), `${teamId}:${userId}`);
+                }
+                else if (m.confirm !== true) {
+                    const email = (0, record_set_1.str)(m.userEmail);
+                    const id = (0, record_set_1.str)(m.$id);
+                    if (!email || !id) {
+                        set.omit('invitation', 'unconfirmed membership whose email is hidden by the project\'s membership privacy settings');
+                        continue;
+                    }
+                    set.add('invitation', (0, record_set_1.compact)({ id, organization_id: teamId, email: email.toLowerCase(), role, status: 'pending', created_at: (0, record_set_1.str)(m.invited) }));
+                }
+            }
+        }
+        for (const r of [...orgRoles].sort())
+            if (r !== 'admin' && r !== 'member')
+                set.add('role', { key: r, name: r, scope: 'organization' }, `org:${r}`);
+    }
+    const providers = new Set(set.list('identity').map((i) => i.provider));
+    set.manifest = { ...set.manifest, origin: `${endpoint} project ${opts.projectId}`, providers: [...providers].sort() };
+    set.warn('Appwrite sessions are stored as hashes and cannot be exported: enable the appwrite bridge preset so signed-in users move without a new sign-in.');
+    return set;
+}
+// ── users ───────────────────────────────────────────────────────────────────
+function mapUser(u) {
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(u.phone);
+    const labels = (0, record_set_1.strs)(u.labels).map(translate_kit_1.keyOf);
+    const user = {
+        id: (0, record_set_1.str)(u.$id),
+        emails: email ? [{ email, verified: u.emailVerification === true, primary: true }] : undefined,
+        phones: phone ? [{ phone, verified: u.phoneVerification === true, primary: !email }] : undefined,
+        name: (0, record_set_1.str)(u.name),
+        roles: labels.length ? labels : undefined,
+        banned: u.status === false ? true : undefined,
+        public_metadata: (0, record_set_1.bag)(u.prefs),
+        created_at: (0, record_set_1.str)(u.registration) ?? (0, record_set_1.str)(u.$createdAt),
+        last_sign_in_at: (0, record_set_1.str)(u.accessedAt),
+    };
+    if (!email && !phone)
+        user.anonymous = true;
+    return user;
+}
+/** Appwrite team roles → one Atlas membership role: `owner` is the org admin, else the first custom role. */
+function appwriteTeamRole(roles) {
+    if (roles.includes('owner'))
+        return 'admin';
+    const first = roles.find((r) => r.trim());
+    return first ? (0, translate_kit_1.keyOf)(first) : 'member';
+}
+const SHA_VERSIONS = {
+    sha1: 'sha1',
+    sha224: 'sha224',
+    sha256: 'sha256',
+    sha384: 'sha384',
+    sha512: 'sha512',
+    'sha512/224': 'sha512_224',
+    'sha512/256': 'sha512_256',
+    'sha3-224': 'sha3_224',
+    'sha3-256': 'sha3_256',
+    'sha3-384': 'sha3_384',
+    'sha3-512': 'sha3_512',
+};
+/**
+ * One Appwrite user's hash in the bundle's terms (see the module comment).
+ * `guessed` marks a SHA hash stored without a version; `problem` is a warning
+ * for a hash that cannot be carried.
+ */
+function appwritePasswordHash(u) {
+    const digest = (0, record_set_1.str)(u.password);
+    if (!digest)
+        return {};
+    const options = (0, record_set_1.isObj)(u.hashOptions) ? u.hashOptions : {};
+    const type = ((0, record_set_1.str)(u.hash) ?? (0, record_set_1.str)(options.type) ?? '').toLowerCase();
+    switch (type) {
+        case 'argon2':
+        case 'bcrypt':
+            return { hash: { algorithm: 'auto', hash: digest } };
+        case 'md5':
+            return { hash: { algorithm: 'md5', hash: digest.toLowerCase(), params: { encoding: 'hex' } } };
+        case 'sha': {
+            const version = (0, record_set_1.str)(options.version)?.toLowerCase();
+            if (version) {
+                const algorithm = SHA_VERSIONS[version];
+                return algorithm
+                    ? { hash: { algorithm, hash: digest.toLowerCase(), params: { encoding: 'hex' } } }
+                    : { problem: `A SHA hash with the unknown version "${version}" was left out.` };
+            }
+            // No version: 1.x defaults to sha3-512 (128 hex), 2.x to sha256 (64 hex).
+            if (digest.length === 128)
+                return { hash: { algorithm: 'sha3_512', hash: digest.toLowerCase(), params: { encoding: 'hex' } }, guessed: true };
+            if (digest.length === 64)
+                return { hash: { algorithm: 'sha256', hash: digest.toLowerCase(), params: { encoding: 'hex' } }, guessed: true };
+            return { problem: 'A SHA hash without a version and of an unexpected length was left out.' };
+        }
+        case 'phpass':
+            // Appwrite's phpass falls back to crypt() for bcrypt-style digests.
+            return { hash: { algorithm: /^\$2[aby]\$/.test(digest) ? 'auto' : 'phpass', hash: digest } };
+        case 'scrypt': {
+            const salt = (0, record_set_1.str)(options.salt);
+            if (salt === undefined)
+                return { problem: 'A scrypt hash came back without its salt (the server did not return hashOptions.salt) and was left out; those users move by lazy migration.' };
+            return {
+                hash: {
+                    algorithm: 'scrypt',
+                    hash: digest.toLowerCase(),
+                    salt,
+                    params: {
+                        // php-scrypt: N is the literal cost (not log2), the salt string is used as is, the output is hex.
+                        n: num(options.costCpu, 8),
+                        r: num(options.costMemory, 14),
+                        p: num(options.costParallel, 1),
+                        key_length: num(options.length, 64),
+                        salt_encoding: 'utf8',
+                        encoding: 'hex',
+                    },
+                },
+            };
+        }
+        case 'scryptmod': {
+            const signer = (0, record_set_1.str)(options.signerKey);
+            if (!signer)
+                return { problem: 'A scryptMod hash came back without its signer key and was left out.' };
+            return {
+                hash: {
+                    algorithm: 'scrypt_firebase',
+                    hash: digest,
+                    salt: (0, record_set_1.str)(options.salt) ?? '',
+                    // Appwrite hard-codes N=16384 (mem_cost 14), r=8, p=1.
+                    params: { signer_key: signer, salt_separator: (0, record_set_1.str)(options.saltSeparator) ?? '', rounds: 8, mem_cost: 14 },
+                },
+            };
+        }
+        default:
+            return { problem: `A password hash of the unknown type "${type || 'none'}" was left out.` };
+    }
+}
+const num = (v, fallback) => (typeof v === 'number' && Number.isFinite(v) ? v : typeof v === 'string' && v.trim() && Number.isFinite(Number(v)) ? Number(v) : fallback);
+// ── paging ──────────────────────────────────────────────────────────────────
+/** An Appwrite 1.5+ query (JSON form) for the `queries[]` parameter. */
+function appwriteQuery(method, values) {
+    return `queries[]=${encodeURIComponent(JSON.stringify({ method, values }))}`;
+}
+/** Every row of a list endpoint, by cursor (`cursorAfter` the last `$id`, ordered by `$id`). */
+async function listAll(http, path, key) {
+    const out = [];
+    let cursor;
+    for (;;) {
+        const q = [appwriteQuery('limit', [PAGE]), ...(cursor ? [appwriteQuery('cursorAfter', [cursor])] : [])].join('&');
+        const { body } = await http.get(`${path}${path.includes('?') ? '&' : '?'}${q}`);
+        const rows = (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
+        out.push(...rows);
+        const last = rows.length ? (0, record_set_1.str)(rows[rows.length - 1].$id) : undefined;
+        if (rows.length < PAGE || !last)
+            return out;
+        cursor = last;
+    }
+}
+async function optionalList(http, path, key) {
+    try {
+        return await listAll(http, path, key);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [401, 403, 404].includes(err.status))
+            return [];
+        throw err;
+    }
+}
+async function optionalGet(http, path) {
+    try {
+        return (await http.get(path)).body;
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 401, 403, 404].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+//# sourceMappingURL=appwrite.js.map

package/dist/migrate/export/appwrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appwrite.js","sourceRoot":"","sources":["../../../src/migrate/export/appwrite.ts"],"names":[],"mappings":";;;AA2CA,wCA0GC;AAwBD,4CAIC;AAqBD,oDA+DC;AAOD,sCAEC;AA7QD,6CAA+F;AAC/F,mDAAwC;AACxC,+CAA2D;AAqC9C,QAAA,cAAc,GAAG,8BAA8B,CAAC;AAC7D,MAAM,IAAI,GAAG,GAAG,CAAC;AAEV,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,sBAAc,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE;QAChF,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEtD,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,IAAI;YAAE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC;QACrC,IAAI,EAAE,CAAC,OAAO;YAAE,UAAU,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CACN,GAAG,UAAU,wNAAwN,CACtO,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvB,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,YAAY,CAAC,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,SAAS;YACvE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,OAAgB,EAAE,KAAK,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;QAC/M,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC;QACnF,GAAG,CAAC,IAAI,CAAC,2IAA2I,CAAC,CAAC;IACxJ,CAAC;IAED,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI;YAAE,SAAS;QACpC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAM,IAAI,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;YAAE,IAAI,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1I,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1I,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAM,IAAI,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,8GAA8G,EAAE,IAAI,CAAC,CAAC;IACvJ,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,uIAAuI,CAAC,CAAC;IACpJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;gBAAE,SAAS;YAC/B,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACrH,KAAK,MAAM,CAAC,IAAI,MAAM,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC7B,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;gBAC5K,CAAC;qBAAM,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;oBAC/B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBACtB,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;wBAClB,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,4FAA4F,CAAC,CAAC;wBACrH,SAAS;oBACX,CAAC;oBACD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAkB,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5J,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACrJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,YAAY,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACtH,GAAG,CAAC,IAAI,CAAC,iJAAiJ,CAAC,CAAC;IAC5J,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAE/E,SAAS,OAAO,CAAC,CAAM;IACrB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,qBAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAE;QACf,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9F,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAChG,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACzC,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7C,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC;QAC7B,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QACpD,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;KACnC,CAAC;IACF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6GAA6G;AAC7G,SAAgB,gBAAgB,CAAC,KAAe;IAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,IAAA,qBAAK,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzC,CAAC;AAED,MAAM,YAAY,GAA2B;IAC3C,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,YAAY;IAC1B,YAAY,EAAE,YAAY;IAC1B,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,UAAU;CACvB,CAAC;AAEF;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,CAAM;IACzC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;QACvD,KAAK,KAAK;YACR,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACjG,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,OAAO,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;YACpD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;gBACxC,OAAO,SAAS;oBACd,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;oBAClF,CAAC,CAAC,EAAE,OAAO,EAAE,wCAAwC,OAAO,iBAAiB,EAAE,CAAC;YACpF,CAAC;YACD,0EAA0E;YAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9I,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3I,OAAO,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;QAC/F,CAAC;QACD,KAAK,QAAQ;YACX,oEAAoE;YACpE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;QAC/F,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,OAAO,EAAE,6IAA6I,EAAE,CAAC;YAC1L,OAAO;gBACL,IAAI,EAAE;oBACJ,SAAS,EAAE,QAAQ;oBACnB,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE;oBAC1B,IAAI;oBACJ,MAAM,EAAE;wBACN,kGAAkG;wBAClG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC1B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;wBAC9B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;wBAC/B,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;wBACnC,aAAa,EAAE,MAAM;wBACrB,QAAQ,EAAE,KAAK;qBAChB;iBACF;aACF,CAAC;QACJ,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,qEAAqE,EAAE,CAAC;YACvG,OAAO;gBACL,IAAI,EAAE;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;oBAC7B,uDAAuD;oBACvD,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;iBAC1G;aACF,CAAC;QACJ,CAAC;QACD;YACE,OAAO,EAAE,OAAO,EAAE,wCAAwC,IAAI,IAAI,MAAM,iBAAiB,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,QAAgB,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAEjM,+EAA+E;AAE/E,wEAAwE;AACxE,SAAgB,aAAa,CAAC,MAAc,EAAE,MAAiB;IAC7D,OAAO,aAAa,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IAChE,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,MAA0B,CAAC;IAC/B,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC;QAC5C,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IACrE,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACrF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAI,IAAgB,EAAE,IAAY;IAC1D,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}