@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/okta.d.ts

@@ -1,43 +0,0 @@
-import type { UserRecord } from '@atlasauth/migrate';
-import { RecordSet, type Obj } from './record-set';
-/**
- * `atlas migrate export okta` — Okta Workforce Identity Cloud and Okta
- * Customer Identity Solution orgs onto the canonical bundle models.
- *
- * Read with an API token (`SSWS …`) or an OAuth access token with the
- * okta.users.read / okta.groups.read / okta.idps.read scopes, on this machine.
- *
- *   - users (every status but DEPROVISIONED) with their profile; custom
- *     profile attributes land in private metadata;
- *   - groups, as app roles (default) or as organizations;
- *   - identity providers: social IdPs become identities on their linked
- *     users, SAML 2.0 / OIDC IdPs become enterprise connections (with the
- *     signing certificate);
- *   - with --factors: SMS / voice / email second factors (no secret is
- *     needed for those). TOTP seeds, Okta Verify and WebAuthn credentials
- *     never leave Okta — those users re-enrol.
- *
- * Okta NEVER exports password hashes, by API or support. Passwords move with
- * the `okta` lazy-migration preset: Atlas checks a password against Okta
- * (Authn API or the password grant) on the user's first sign-in.
- */
-export interface OktaExportOptions {
-    /** `acme.okta.com` (or a custom domain serving the API). */
-    domain: string;
-    /** An Okta API token. */
-    apiToken?: string;
-    /** An OAuth 2.0 access token for the Okta management API, instead of an API token. */
-    accessToken?: string;
-    /** How groups move: as Atlas app roles (default) or as organizations. */
-    groupsAs?: 'roles' | 'organizations' | 'skip';
-    /** Read each user's factors (one call per user). */
-    factors?: boolean;
-    /** The authorization server whose signing keys go in the bundle (default `default`). */
-    authorizationServerId?: string;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-export declare function exportOkta(opts: OktaExportOptions): Promise<RecordSet>;
-/** One Okta user → a user record (null when it has nothing to sign in with). */
-export declare function mapOktaUser(u: Obj): UserRecord | null;

package/dist/migrate/export/okta.js

@@ -1,337 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.exportOkta = exportOkta;
-exports.mapOktaUser = mapOktaUser;
-const record_set_1 = require("./record-set");
-const vendor_http_1 = require("./vendor-http");
-/** Profile attributes the user record carries itself; the rest are custom. */
-const BASE_PROFILE = new Set([
-    'login',
-    'email',
-    'secondEmail',
-    'firstName',
-    'lastName',
-    'displayName',
-    'nickName',
-    'mobilePhone',
-    'primaryPhone',
-    'profileUrl',
-]);
-/** Okta social IdP types → the provider name an identity record carries. */
-const SOCIAL = {
-    GOOGLE: 'google',
-    FACEBOOK: 'facebook',
-    MICROSOFT: 'microsoft',
-    APPLE: 'apple',
-    LINKEDIN: 'linkedin',
-    GITHUB: 'github',
-    GITLAB: 'gitlab',
-    AMAZON: 'amazon',
-    DISCORD: 'discord',
-    PAYPAL: 'paypal',
-    SALESFORCE: 'salesforce',
-    SPOTIFY: 'spotify',
-    XERO: 'xero',
-    YAHOO: 'yahoo',
-};
-async function exportOkta(opts) {
-    const set = new record_set_1.RecordSet();
-    const domain = opts.domain.replace(/^https?:\/\//, '').replace(/\/+$/, '');
-    if (!/^[a-z0-9.-]+$/i.test(domain))
-        throw new Error(`Not an Okta domain: ${opts.domain}`);
-    if (!opts.apiToken && !opts.accessToken)
-        throw new Error('Okta export needs an API token (OKTA_API_TOKEN) or an OAuth access token for the management API.');
-    const progress = opts.onProgress ?? (() => undefined);
-    const http = new vendor_http_1.VendorHttp({
-        vendor: 'Okta',
-        baseUrl: `https://${domain}/api/v1`,
-        headers: { authorization: opts.apiToken ? `SSWS ${opts.apiToken}` : `Bearer ${opts.accessToken}` },
-        fetchImpl: opts.fetchImpl,
-        sleep: opts.sleep,
-    });
-    const groupsAs = opts.groupsAs ?? 'roles';
-    progress('groups');
-    const groups = groupsAs === 'skip' ? [] : (await linkAll(http, '/groups?limit=200')).filter((g) => (0, record_set_1.str)(g.type) !== 'BUILT_IN');
-    const groupKey = new Map();
-    const keysUsed = new Set();
-    for (const g of groups) {
-        const id = (0, record_set_1.str)(g.id);
-        const name = (0, record_set_1.str)((0, record_set_1.isObj)(g.profile) ? g.profile.name : undefined);
-        if (!id || !name)
-            continue;
-        let key = slug(name);
-        while (keysUsed.has(key))
-            key = `${key}_${id.slice(-4).toLowerCase()}`;
-        keysUsed.add(key);
-        groupKey.set(id, key);
-        const description = (0, record_set_1.str)((0, record_set_1.isObj)(g.profile) ? g.profile.description : undefined);
-        if (groupsAs === 'organizations') {
-            set.add('organization', (0, record_set_1.compact)({ id, name, slug: key.replace(/_/g, '-'), public_metadata: description ? { description } : undefined, created_at: (0, record_set_1.str)(g.created) }));
-        }
-        else {
-            set.add('role', (0, record_set_1.compact)({ key, name, description, scope: 'app' }));
-        }
-    }
-    if (groupsAs === 'organizations') {
-        set.add('role', { key: 'member', name: 'Member', scope: 'organization' });
-    }
-    progress('users');
-    const users = await linkAll(http, '/users?limit=200');
-    const userIds = new Set();
-    for (const u of users) {
-        const user = mapOktaUser(u);
-        if (!user) {
-            set.omit('user', 'no email, phone number or login');
-            continue;
-        }
-        userIds.add(user.id);
-        set.add('user', user);
-    }
-    if (userIds.size) {
-        set.warn('Okta never exports password hashes. Turn on the okta lazy-migration preset: each password is checked against Okta on its first sign-in in Atlas, then stored as Argon2id.');
-    }
-    // Group memberships: roles on the user, or organization memberships.
-    if (groups.length) {
-        progress('group members');
-        const rolesOf = new Map();
-        for (const g of groups) {
-            const id = (0, record_set_1.str)(g.id);
-            const key = id ? groupKey.get(id) : undefined;
-            if (!id || !key)
-                continue;
-            for (const m of await linkAll(http, `/groups/${id}/users?limit=1000`)) {
-                const uid = (0, record_set_1.str)(m.id);
-                if (!uid || !userIds.has(uid))
-                    continue;
-                if (groupsAs === 'organizations')
-                    set.add('membership', { organization_id: id, user_id: uid, role: 'member' }, `${id}:${uid}`);
-                else
-                    rolesOf.set(uid, [...(rolesOf.get(uid) ?? []), key]);
-            }
-        }
-        for (const user of set.list('user')) {
-            const roles = rolesOf.get(user.id);
-            if (roles?.length)
-                user.roles = roles;
-        }
-    }
-    progress('identity providers');
-    await addIdps(set, http, userIds, domain);
-    if (opts.factors) {
-        progress('factors');
-        for (const id of userIds)
-            await addFactors(set, http, id);
-    }
-    else {
-        set.warn('Second factors were not read (pass --factors to carry SMS / voice / email factors). TOTP seeds and Okta Verify never leave Okta.');
-    }
-    progress('signing keys');
-    const server = opts.authorizationServerId ?? 'default';
-    try {
-        const { body } = await http.get(`https://${domain}/oauth2/${server}/v1/keys`);
-        for (const k of (0, record_set_1.objs)(body?.keys))
-            if ((0, record_set_1.str)(k.kid))
-                set.add('jwks', { kid: (0, record_set_1.str)(k.kid), jwk: k });
-    }
-    catch (err) {
-        if (!(err instanceof vendor_http_1.VendorApiError))
-            throw err;
-        set.warn(`The ${server} authorization server's keys could not be read; the bridge preset fetches them live.`);
-    }
-    set.manifest = {
-        origin: domain,
-        providers: [...new Set(set.list('identity').map((i) => i.provider))].sort(),
-        settings: { groups_as: groupsAs, authorization_server: server },
-    };
-    return set;
-}
-/** One Okta user → a user record (null when it has nothing to sign in with). */
-function mapOktaUser(u) {
-    const id = (0, record_set_1.str)(u.id);
-    const status = (0, record_set_1.str)(u.status);
-    if (!id || status === 'DEPROVISIONED')
-        return null;
-    const p = (0, record_set_1.isObj)(u.profile) ? u.profile : {};
-    const credentials = (0, record_set_1.isObj)(u.credentials) ? u.credentials : {};
-    // Okta reports verified addresses under credentials.emails when it has them;
-    // otherwise an ACTIVE user has proven the primary address during activation.
-    const credEmails = (0, record_set_1.objs)(credentials.emails);
-    const verifiedSet = new Set(credEmails.filter((e) => (0, record_set_1.str)(e.status) === 'VERIFIED').map((e) => (0, record_set_1.str)(e.value)?.toLowerCase()));
-    const activated = status !== 'STAGED' && status !== 'PROVISIONED';
-    const primary = (0, record_set_1.str)(p.email)?.toLowerCase();
-    const second = (0, record_set_1.str)(p.secondEmail)?.toLowerCase();
-    const emails = [
-        ...(primary ? [{ email: primary, verified: credEmails.length ? verifiedSet.has(primary) : activated, primary: true }] : []),
-        ...(second && second !== primary ? [{ email: second, verified: verifiedSet.has(second), primary: false }] : []),
-    ];
-    const phones = [...new Set([(0, record_set_1.e164)(p.mobilePhone), (0, record_set_1.e164)(p.primaryPhone)].filter((x) => !!x))].map((phone, i) => ({
-        phone,
-        verified: false,
-        primary: !emails.length && i === 0,
-    }));
-    const login = (0, record_set_1.str)(p.login);
-    const custom = Object.fromEntries(Object.entries(p).filter(([k, v]) => !BASE_PROFILE.has(k) && v !== null && v !== undefined && v !== ''));
-    const user = (0, record_set_1.compact)({
-        id,
-        emails,
-        phones,
-        // The Okta login is often the email; keep it as the username only when it is not.
-        username: login && login.toLowerCase() !== primary ? login : undefined,
-        first_name: (0, record_set_1.str)(p.firstName),
-        last_name: (0, record_set_1.str)(p.lastName),
-        name: !(0, record_set_1.str)(p.firstName) && !(0, record_set_1.str)(p.lastName) ? (0, record_set_1.str)(p.displayName) : undefined,
-        banned: status === 'SUSPENDED' ? true : undefined,
-        ban_reason: status === 'SUSPENDED' ? 'Suspended in Okta' : undefined,
-        locked: status === 'LOCKED_OUT' ? true : undefined,
-        private_metadata: (0, record_set_1.bag)({ ...custom, ...(status && status !== 'ACTIVE' ? { okta_status: status } : {}) }),
-        created_at: (0, record_set_1.str)(u.created),
-        last_sign_in_at: (0, record_set_1.str)(u.lastLogin),
-    });
-    return user.emails?.length || user.phones?.length || user.username ? user : null;
-}
-async function addIdps(set, http, userIds, domain) {
-    let idps;
-    try {
-        idps = await linkAll(http, '/idps?limit=200');
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 401)) {
-            set.warn('Identity providers were not readable with this token (okta.idps.read): social links and SAML/OIDC connections were skipped.');
-            return;
-        }
-        throw err;
-    }
-    for (const idp of idps) {
-        const id = (0, record_set_1.str)(idp.id);
-        const type = (0, record_set_1.str)(idp.type);
-        if (!id || !type || (0, record_set_1.str)(idp.status) === 'INACTIVE')
-            continue;
-        const name = (0, record_set_1.str)(idp.name) ?? type;
-        let provider;
-        let kind;
-        let connectionId;
-        if (SOCIAL[type]) {
-            provider = SOCIAL[type];
-            kind = 'oauth';
-        }
-        else if (type === 'SAML2' || type === 'OIDC') {
-            connectionId = await addEnterpriseIdp(set, http, idp, domain);
-            if (!connectionId)
-                continue;
-            provider = name;
-            kind = type === 'SAML2' ? 'saml' : 'oidc';
-        }
-        else {
-            set.warn(`Identity provider ${name} (${type}) has no Atlas counterpart and was skipped.`);
-            continue;
-        }
-        for (const link of await linkAll(http, `/idps/${id}/users?limit=200`)) {
-            const uid = (0, record_set_1.str)(link.id);
-            const external = (0, record_set_1.str)(link.externalId);
-            if (!uid || !external || !userIds.has(uid))
-                continue;
-            set.add('identity', (0, record_set_1.compact)({ user_id: uid, provider, provider_user_id: external, kind, sso_connection_id: connectionId, profile: (0, record_set_1.bag)(link.profile) }));
-        }
-    }
-}
-async function addEnterpriseIdp(set, http, idp, domain) {
-    const id = (0, record_set_1.str)(idp.id);
-    const name = (0, record_set_1.str)(idp.name) ?? id;
-    const protocol = (0, record_set_1.isObj)(idp.protocol) ? idp.protocol : {};
-    const endpoints = (0, record_set_1.isObj)(protocol.endpoints) ? protocol.endpoints : {};
-    const credentials = (0, record_set_1.isObj)(protocol.credentials) ? protocol.credentials : {};
-    // Okta routes users to an IdP by routing rules, not by a domain on the IdP:
-    // the Atlas connection's domains are set after the import.
-    const domains = [];
-    if ((0, record_set_1.str)(idp.type) === 'SAML2') {
-        const trust = (0, record_set_1.isObj)(credentials.trust) ? credentials.trust : {};
-        const kid = (0, record_set_1.str)(trust.kid);
-        let cert;
-        if (kid) {
-            try {
-                const { body } = await http.get(`/idps/credentials/keys/${kid}`);
-                const x5c = Array.isArray(body?.x5c) ? (0, record_set_1.str)(body.x5c[0]) : undefined;
-                if (x5c)
-                    cert = `-----BEGIN CERTIFICATE-----\n${x5c.match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----`;
-            }
-            catch (err) {
-                if (!(err instanceof vendor_http_1.VendorApiError))
-                    throw err;
-            }
-        }
-        const sso = (0, record_set_1.isObj)(endpoints.sso) ? endpoints.sso : {};
-        const acs = (0, record_set_1.isObj)(endpoints.acs) ? endpoints.acs : {};
-        set.add('sso_connection', (0, record_set_1.compact)({
-            id,
-            name,
-            protocol: 'saml',
-            domains,
-            enabled: (0, record_set_1.str)(idp.status) !== 'INACTIVE',
-            saml: (0, record_set_1.compact)({
-                idp_entity_id: (0, record_set_1.str)(trust.issuer),
-                idp_sso_url: (0, record_set_1.str)(sso.url),
-                idp_certificate: cert,
-                sp_entity_id: (0, record_set_1.str)(trust.audience),
-                sp_acs_url: (0, record_set_1.str)(acs.url) ?? `https://${domain}/sso/saml2/${id}`,
-            }),
-        }));
-        if (!cert)
-            set.warn(`SAML identity provider ${name}: its signing certificate could not be read; add it in Atlas.`);
-        return id;
-    }
-    const issuer = (0, record_set_1.isObj)(protocol.issuer) ? (0, record_set_1.str)(protocol.issuer.url) : undefined;
-    const client = (0, record_set_1.isObj)(credentials.client) ? credentials.client : {};
-    set.add('sso_connection', (0, record_set_1.compact)({
-        id,
-        name,
-        protocol: 'oidc',
-        domains,
-        enabled: (0, record_set_1.str)(idp.status) !== 'INACTIVE',
-        oidc: (0, record_set_1.compact)({ issuer, client_id: (0, record_set_1.str)(client.client_id), scopes: Array.isArray(protocol.scopes) ? protocol.scopes.map(String) : undefined }),
-    }));
-    set.warn(`OIDC identity provider ${name}: Okta does not return its client secret; enter it in Atlas after the import.`);
-    return id;
-}
-async function addFactors(set, http, userId) {
-    let factors;
-    try {
-        factors = (0, record_set_1.objs)((await http.get(`/users/${userId}/factors`)).body);
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 404))
-            return;
-        throw err;
-    }
-    for (const f of factors) {
-        if ((0, record_set_1.str)(f.status) !== 'ACTIVE')
-            continue;
-        const type = (0, record_set_1.str)(f.factorType);
-        const profile = (0, record_set_1.isObj)(f.profile) ? f.profile : {};
-        if (type === 'sms' || type === 'call') {
-            const phone = (0, record_set_1.e164)(profile.phoneNumber);
-            if (phone)
-                set.add('mfa_factor', { user_id: userId, type: 'phone', phone, verified: true, created_at: (0, record_set_1.str)(f.created) }, `phone:${userId}:${phone}`);
-        }
-        else if (type === 'email') {
-            set.add('mfa_factor', { user_id: userId, type: 'email', verified: true, created_at: (0, record_set_1.str)(f.created) }, `email:${userId}`);
-        }
-        else if (type) {
-            set.omit('mfa_factor', `Okta does not export ${type} secrets; re-enrol in Atlas`);
-        }
-    }
-}
-/** Follow `Link: <…>; rel="next"` until the last page. */
-async function linkAll(http, path) {
-    const out = [];
-    let next = path;
-    while (next) {
-        const res = await http.get(next);
-        out.push(...(0, record_set_1.objs)(res.body));
-        next = (0, vendor_http_1.nextLink)(res.headers.get('link'));
-    }
-    return out;
-}
-function slug(name) {
-    return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '') || 'group';
-}
-//# sourceMappingURL=okta.js.map

package/dist/migrate/export/okta.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"okta.js","sourceRoot":"","sources":["../../../src/migrate/export/okta.ts"],"names":[],"mappings":";;AA4EA,gCAuGC;AAGD,kCAyCC;AA9ND,6CAAyF;AACzF,+CAAqE;AA0CrE,8EAA8E;AAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,OAAO;IACP,OAAO;IACP,aAAa;IACb,WAAW;IACX,UAAU;IACV,aAAa;IACb,UAAU;IACV,aAAa;IACb,cAAc;IACd,YAAY;CACb,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,MAAM,GAA2B;IACrC,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACf,CAAC;AAEK,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IAC7J,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW,MAAM,SAAS;QACnC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE;QAClG,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;IAE1C,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;IAC/H,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAS;QAC3B,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACtB,MAAM,WAAW,GAAG,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACvK,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CACN,2KAA2K,CAC5K,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9C,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;gBAAE,SAAS;YAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBACtE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtB,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACxC,IAAI,QAAQ,KAAK,eAAe;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;;oBAC1H,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,MAAM;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACxC,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC/B,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE1C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,OAAO;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,kIAAkI,CAAC,CAAC;IAC/I,CAAC;IAED,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,IAAI,SAAS,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAqB,WAAW,MAAM,WAAW,MAAM,UAAU,CAAC,CAAC;QAClG,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,EAAE,IAAI,CAAC;YAAE,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC;YAAE,MAAM,GAAG,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,sFAAsF,CAAC,CAAC;IAChH,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG;QACb,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC3E,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE;KAChE,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,SAAgB,WAAW,CAAC,CAAM;IAChC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,MAAM,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,IAAA,iBAAI,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAC5H,MAAM,SAAS,GAAG,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,aAAa,CAAC;IAClE,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3H,GAAG,CAAC,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChH,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1H,KAAK;QACL,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3I,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM;QACN,MAAM;QACN,kFAAkF;QAClF,QAAQ,EAAE,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACtE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5E,MAAM,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACjD,UAAU,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;QACpE,MAAM,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAClD,gBAAgB,EAAE,IAAA,gBAAG,EAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACvG,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;QAC1B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;KAClC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAc,EAAE,IAAgB,EAAE,OAAoB,EAAE,MAAc;IAC3F,IAAI,IAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,6HAA6H,CAAC,CAAC;YACxI,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;YAAE,SAAS;QAC7D,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACnC,IAAI,QAAgB,CAAC;QACrB,IAAI,IAA4B,CAAC;QACjC,IAAI,YAAgC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjB,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAE,CAAC;YACzB,IAAI,GAAG,OAAO,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/C,YAAY,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC,YAAY;gBAAE,SAAS;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,qBAAqB,IAAI,KAAK,IAAI,6CAA6C,CAAC,CAAC;YAC1F,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrD,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,oBAAO,EAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,OAAO,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1K,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAc,EAAE,IAAgB,EAAE,GAAQ,EAAE,MAAc;IACxF,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,WAAW,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,IAAwB,CAAC;QAC7B,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,0BAA0B,GAAG,EAAE,CAAC,CAAC;gBACtE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACpE,IAAI,GAAG;oBAAE,IAAI,GAAG,gCAAgC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC;YACjH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC;oBAAE,MAAM,GAAG,CAAC;YAClD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,IAAI;YACJ,QAAQ,EAAE,MAAe;YACzB,OAAO;YACP,OAAO,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;YACvC,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,aAAa,EAAE,IAAA,gBAAG,EAAC,KAAK,CAAC,MAAM,CAAC;gBAChC,WAAW,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,GAAG,CAAC;gBACzB,eAAe,EAAE,IAAI;gBACrB,YAAY,EAAE,IAAA,gBAAG,EAAC,KAAK,CAAC,QAAQ,CAAC;gBACjC,UAAU,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,MAAM,cAAc,EAAE,EAAE;aAChE,CAAC;SACH,CAAC,CACH,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,+DAA+D,CAAC,CAAC;QACnH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;QACN,EAAE;QACF,IAAI;QACJ,QAAQ,EAAE,MAAe;QACzB,OAAO;QACP,OAAO,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;QACvC,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;KAC9I,CAAC,CACH,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,+EAA+E,CAAC,CAAC;IACxH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAc,EAAE,IAAgB,EAAE,MAAc;IACxE,IAAI,OAAc,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAU,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;YAAE,OAAO;QACxF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,KAAK;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;QACtJ,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;QAC3H,CAAC;aAAM,IAAI,IAAI,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,wBAAwB,IAAI,6BAA6B,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAY;IACnD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,GAAwC,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG,IAAA,sBAAQ,EAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC;AAClG,CAAC"}

package/dist/migrate/export/onelogin.d.ts

@@ -1,22 +0,0 @@
-import { RecordSet } from './record-set';
-/**
- * `atlas migrate onelogin export` — a OneLogin account through API v2 with API
- * credentials (client id + secret, on this machine): users (login, email,
- * name, phone, status, custom attributes, last login) and roles (as app roles,
- * with their members).
- *
- * OneLogin never returns password hashes or MFA secrets: passwords move by lazy
- * migration (the `onelogin` preset), second factors are enrolled again.
- */
-export interface OneLoginExportOptions {
-    subdomain: string;
-    clientId: string;
-    clientSecret: string;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-/** `acme`, `acme.onelogin.com` or a URL → `acme`. */
-export declare function oneLoginSubdomain(raw: string): string;
-export declare function oneLoginToken(o: Pick<OneLoginExportOptions, 'subdomain' | 'clientId' | 'clientSecret' | 'fetchImpl'>): Promise<string>;
-export declare function exportOneLogin(o: OneLoginExportOptions): Promise<RecordSet>;

package/dist/migrate/export/onelogin.js

@@ -1,123 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.oneLoginSubdomain = oneLoginSubdomain;
-exports.oneLoginToken = oneLoginToken;
-exports.exportOneLogin = exportOneLogin;
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-/** `acme`, `acme.onelogin.com` or a URL → `acme`. */
-function oneLoginSubdomain(raw) {
-    const s = raw.trim().replace(/^https?:\/\//, '').replace(/[/?#].*$/, '').replace(/\.onelogin\.com$/i, '');
-    if (!/^[a-z0-9][a-z0-9-]{0,62}$/i.test(s))
-        throw new Error(`"${raw}" is not a OneLogin subdomain.`);
-    return s.toLowerCase();
-}
-/** OneLogin user `status` codes. */
-const STATUS = { suspended: 2, locked: 3 };
-async function oneLoginToken(o) {
-    const f = o.fetchImpl ?? fetch;
-    const res = await f(`https://${oneLoginSubdomain(o.subdomain)}.onelogin.com/auth/oauth2/v2/token`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', authorization: `client_id:${o.clientId}, client_secret:${o.clientSecret}` },
-        body: JSON.stringify({ grant_type: 'client_credentials' }),
-    });
-    const body = (await res.json().catch(() => null));
-    const token = (0, record_set_1.str)(body?.access_token);
-    if (res.status !== 200 || !token)
-        throw new Error(`OneLogin refused the API credentials (${res.status}).`);
-    return token;
-}
-async function pages(http, path) {
-    const out = [];
-    let cursor = null;
-    do {
-        const sep = path.includes('?') ? '&' : '?';
-        const res = await http.get(cursor ? `${path}${sep}cursor=${encodeURIComponent(cursor)}` : path);
-        out.push(...(0, record_set_1.objs)(res.body));
-        cursor = res.headers.get('after-cursor') || null;
-    } while (cursor);
-    return out;
-}
-async function exportOneLogin(o) {
-    const set = new record_set_1.RecordSet();
-    const say = o.onProgress ?? (() => undefined);
-    const sub = oneLoginSubdomain(o.subdomain);
-    set.manifest = { origin: `OneLogin account ${sub}.onelogin.com` };
-    const token = await oneLoginToken(o);
-    const http = new vendor_http_1.VendorHttp({ vendor: 'OneLogin', baseUrl: `https://${sub}.onelogin.com`, headers: { authorization: `Bearer ${token}` }, fetchImpl: o.fetchImpl, sleep: o.sleep });
-    say('roles');
-    const roleKey = new Map();
-    try {
-        for (const r of await pages(http, '/api/2/roles?limit=100')) {
-            const id = (0, record_set_1.str)(r.id);
-            const name = (0, record_set_1.str)(r.name);
-            if (!id || !name)
-                continue;
-            const key = (0, translate_kit_1.keyOf)(name);
-            roleKey.set(id, key);
-            set.add('role', { key, name, scope: 'app' }, key);
-        }
-    }
-    catch (err) {
-        if (!(err instanceof vendor_http_1.VendorApiError && [401, 403, 404].includes(err.status)))
-            throw err;
-        set.warn('Roles could not be read (the API credential lacks the Read roles scope): users are imported without roles.');
-    }
-    say('users');
-    const users = await pages(http, '/api/2/users?limit=100');
-    let unactivated = 0;
-    for (const u of users) {
-        const id = (0, record_set_1.str)(u.id);
-        if (!id)
-            continue;
-        const email = (0, record_set_1.str)(u.email)?.toLowerCase();
-        const emails = email?.includes('@') ? [{ email, verified: false, primary: true }] : [];
-        const phone = (0, record_set_1.e164)(u.phone);
-        const phones = phone ? [{ phone, verified: false, primary: true }] : [];
-        const status = Number(u.status);
-        const roles = (Array.isArray(u.role_ids) ? u.role_ids.map(String) : []).map((r) => roleKey.get(r)).filter((r) => !!r);
-        const record = (0, record_set_1.compact)({
-            id,
-            emails,
-            phones,
-            username: (0, record_set_1.str)(u.username),
-            first_name: (0, record_set_1.str)(u.firstname),
-            last_name: (0, record_set_1.str)(u.lastname),
-            created_at: (0, record_set_1.str)(u.created_at),
-            last_sign_in_at: (0, record_set_1.str)(u.last_login),
-            roles: [...new Set(roles)],
-            private_metadata: {
-                onelogin: (0, record_set_1.compact)({
-                    status,
-                    external_id: (0, record_set_1.str)(u.external_id),
-                    directory_id: (0, record_set_1.str)(u.directory_id),
-                    group_id: (0, record_set_1.str)(u.group_id),
-                    title: (0, record_set_1.str)(u.title),
-                    department: (0, record_set_1.str)(u.department),
-                    company: (0, record_set_1.str)(u.company),
-                    custom_attributes: (0, record_set_1.bag)(u.custom_attributes),
-                }),
-            },
-        });
-        if (status === STATUS.suspended) {
-            record.banned = true;
-            record.ban_reason = 'Suspended in OneLogin';
-        }
-        else if (status === STATUS.locked)
-            record.locked = true;
-        if (status === 0)
-            unactivated++;
-        if (!record.emails?.length && !record.phones?.length && !record.username) {
-            set.omit('user', 'no email, phone or username', 1);
-            continue;
-        }
-        set.add('user', record, id);
-    }
-    set.omit('password', 'OneLogin never exports password hashes', users.length);
-    set.warn('Addresses are imported unverified (OneLogin does not say which were confirmed). Passwords move by lazy migration (preset onelogin); users enrol their second factor again.');
-    if (unactivated)
-        set.warn(`${unactivated} user(s) never activated their OneLogin account (no password to migrate).`);
-    return set;
-}
-//# sourceMappingURL=onelogin.js.map

package/dist/migrate/export/onelogin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"onelogin.js","sourceRoot":"","sources":["../../../src/migrate/export/onelogin.ts"],"names":[],"mappings":";;AAyBA,8CAIC;AAKD,sCAWC;AAcD,wCA2EC;AArID,6CAAkF;AAClF,mDAAwC;AACxC,+CAA2D;AAqB3D,qDAAqD;AACrD,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,GAAG,gCAAgC,CAAC,CAAC;IACpG,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,oCAAoC;AACpC,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAW,CAAC;AAE7C,KAAK,UAAU,aAAa,CAAC,CAAuF;IACzH,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,oCAAoC,EAAE;QACjG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,QAAQ,mBAAmB,CAAC,CAAC,YAAY,EAAE,EAAE;QAC1H,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAe,CAAC;IAChE,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC3G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAgB,EAAE,IAAY;IACjD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,GAAG,CAAC;QACF,MAAM,GAAG,GAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnD,MAAM,GAAG,GAAwC,MAAM,IAAI,CAAC,GAAG,CAAU,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9I,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,GAAG,CAAC;AACb,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,CAAwB;IAC3D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3C,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,oBAAoB,GAAG,eAAe,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,GAAG,eAAe,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAEnL,GAAG,CAAC,OAAO,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,EAAE,CAAC;YAC5D,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;gBAAE,SAAS;YAC3B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;IACzH,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAC1D,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAmB,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,QAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClJ,MAAM,MAAM,GAAe,IAAA,oBAAO,EAAC;YACjC,EAAE;YACF,MAAM;YACN,MAAM;YACN,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YACzB,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;YAC5B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YAC1B,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;YAC7B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;YAClC,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1B,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,IAAA,oBAAO,EAAC;oBAChB,MAAM;oBACN,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;oBAC/B,YAAY,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;oBACjC,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;oBACzB,KAAK,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC;oBACnB,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;oBAC7B,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;oBACvB,iBAAiB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC;iBAC5C,CAAC;aACH;SACY,CAAC,CAAC;QACjB,IAAI,MAAM,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,UAAU,GAAG,uBAAuB,CAAC;QAC9C,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1D,IAAI,MAAM,KAAK,CAAC;YAAE,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,wCAAwC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7E,GAAG,CAAC,IAAI,CAAC,4KAA4K,CAAC,CAAC;IACvL,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,2EAA2E,CAAC,CAAC;IACrH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/ory-config.d.ts

@@ -1,58 +0,0 @@
-import type { TranslationResult } from '../framework/plugin';
-import { type Obj } from './record-set';
-import { VendorHttp } from './vendor-http';
-/**
- * `atlas migrate ory config` — Ory Kratos and Hydra settings → Atlas config.
- *
- * Three readers, one translation:
- *   - a Kratos config file (`kratos.yml`, or the JSON `ory get identity-config
- *     --format json` prints), every report line carrying file:line for YAML;
- *   - an Ory Network project (`ory get project <id> --format json`: the Kratos
- *     config under `services.identity.config`, Hydra's under
- *     `services.oauth2.config`);
- *   - a Hydra config (`hydra.yml`) and the live Hydra Admin API, whose OAuth 2.0
- *     clients become Atlas OAuth clients (Hydra keeps only hashed client
- *     secrets: every secret is reissued).
- * The identity schemas (`identity.schemas`: inline `base64://`, local `file://`,
- * or the public `GET /schemas` of a running Kratos) say which traits are the
- * email, username, phone and name and which are custom.
- */
-/** One config file: its parsed value, with the source line of any dotted path. */
-export interface OryConfigFile {
-    value: Obj;
-    file: string;
-    line(path: string): number | undefined;
-}
-export interface OryIdentitySchema {
-    id: string;
-    schema: Obj;
-}
-export interface OryConfigSnapshot {
-    origin: string;
-    /** Kratos configuration (kratos.yml / `services.identity.config`). */
-    kratos?: OryConfigFile;
-    /** Hydra configuration (hydra.yml / `services.oauth2.config`). */
-    hydra?: OryConfigFile;
-    schemas: OryIdentitySchema[];
-    /** Hydra OAuth 2.0 clients (`GET /admin/clients`). */
-    clients: Obj[];
-    /** Kratos' public URL (the bridge and the lazy preset call it). */
-    publicUrl?: string;
-}
-/** A config file's text: JSON when it starts with `{`, otherwise YAML. */
-export declare function parseOryConfig(text: string, file: string): OryConfigFile;
-/** An `ory get project --format json` document split into its Kratos and Hydra configs; null when it is not one. */
-export declare function splitOryProject(file: OryConfigFile): {
-    kratos: OryConfigFile;
-    hydra?: OryConfigFile;
-    slug?: string;
-} | null;
-/** Identity schemas a Kratos config names that can be read without the network: `base64://` and `file://` (through `readFile`). */
-export declare function resolveOrySchemas(kratos: OryConfigFile | undefined, readFile: (path: string) => string, warn?: (m: string) => void): OryIdentitySchema[];
-/** Kratos' public `GET /schemas`: `[{ id, schema }]`. */
-export declare function fetchOrySchemas(http: VendorHttp): Promise<OryIdentitySchema[]>;
-/** Hydra's `GET /admin/clients`, following the Link header's page_token. */
-export declare function fetchOryClients(http: VendorHttp, pageSize?: number): Promise<Obj[]>;
-/** Go durations (`24h`, `720h`, `1h30m`) → ms. */
-export declare function goDurationMs(v: unknown): number | undefined;
-export declare function translateOryConfig(snap: OryConfigSnapshot): TranslationResult;