@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/ory-config.js

@@ -1,451 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseOryConfig = parseOryConfig;
-exports.splitOryProject = splitOryProject;
-exports.resolveOrySchemas = resolveOrySchemas;
-exports.fetchOrySchemas = fetchOrySchemas;
-exports.fetchOryClients = fetchOryClients;
-exports.goDurationMs = goDurationMs;
-exports.translateOryConfig = translateOryConfig;
-const mini_yaml_1 = require("./mini-yaml");
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-// ── reading ─────────────────────────────────────────────────────────────────
-/** A config file's text: JSON when it starts with `{`, otherwise YAML. */
-function parseOryConfig(text, file) {
-    const trimmed = text.trim();
-    if (trimmed.startsWith('{')) {
-        const value = JSON.parse(trimmed);
-        if (!(0, record_set_1.isObj)(value))
-            throw new Error(`${file} is not a configuration object.`);
-        return { value, file, line: () => undefined };
-    }
-    const doc = (0, mini_yaml_1.parseYaml)(text);
-    if (!(0, record_set_1.isObj)(doc.value))
-        throw new Error(`${file} is not a configuration (a YAML mapping was expected).`);
-    return { value: doc.value, file, line: (path) => doc.line(path) };
-}
-/** An `ory get project --format json` document split into its Kratos and Hydra configs; null when it is not one. */
-function splitOryProject(file) {
-    const services = file.value.services;
-    if (!(0, record_set_1.isObj)(services) || !(0, record_set_1.isObj)(services.identity) || !(0, record_set_1.isObj)(services.identity.config))
-        return null;
-    const wrap = (value, name) => ({ value, file: `${file.file} (${name})`, line: () => undefined });
-    return {
-        kratos: wrap(services.identity.config, 'services.identity.config'),
-        hydra: (0, record_set_1.isObj)(services.oauth2) && (0, record_set_1.isObj)(services.oauth2.config) ? wrap(services.oauth2.config, 'services.oauth2.config') : undefined,
-        slug: (0, record_set_1.str)(file.value.slug),
-    };
-}
-/** Identity schemas a Kratos config names that can be read without the network: `base64://` and `file://` (through `readFile`). */
-function resolveOrySchemas(kratos, readFile, warn = () => undefined) {
-    const identity = kratos?.value.identity;
-    const out = [];
-    for (const s of (0, record_set_1.isObj)(identity) ? (0, record_set_1.objs)(identity.schemas) : []) {
-        const id = (0, record_set_1.str)(s.id);
-        const url = (0, record_set_1.str)(s.url);
-        if (!id || !url)
-            continue;
-        try {
-            let text;
-            if (url.startsWith('base64://'))
-                text = Buffer.from(url.slice('base64://'.length), 'base64').toString('utf8');
-            else if (url.startsWith('file://'))
-                text = readFile(decodeURIComponent(url.slice('file://'.length)));
-            if (text === undefined) {
-                warn(`Identity schema "${id}" is at ${url}: pass its file, or give Kratos' public URL so it is read from /schemas.`);
-                continue;
-            }
-            const schema = JSON.parse(text);
-            if ((0, record_set_1.isObj)(schema))
-                out.push({ id, schema });
-        }
-        catch (err) {
-            warn(`Identity schema "${id}" could not be read (${err.message}).`);
-        }
-    }
-    return out;
-}
-/** Kratos' public `GET /schemas`: `[{ id, schema }]`. */
-async function fetchOrySchemas(http) {
-    const { body } = await http.get('/schemas');
-    return (Array.isArray(body) ? body : []).flatMap((s) => ((0, record_set_1.isObj)(s) && (0, record_set_1.str)(s.id) && (0, record_set_1.isObj)(s.schema) ? [{ id: (0, record_set_1.str)(s.id), schema: s.schema }] : []));
-}
-/** Hydra's `GET /admin/clients`, following the Link header's page_token. */
-async function fetchOryClients(http, pageSize = 250) {
-    const out = [];
-    const seen = new Set();
-    let path = `/admin/clients?page_size=${pageSize}`;
-    for (;;) {
-        const res = await http.get(path);
-        out.push(...(0, record_set_1.objs)(res.body));
-        const next = (0, vendor_http_1.nextLink)(res.headers.get('link'));
-        const token = next ? new URL(next, 'https://hydra.invalid').searchParams.get('page_token') : null;
-        if (!token || seen.has(token))
-            break;
-        seen.add(token);
-        path = `/admin/clients?page_size=${pageSize}&page_token=${encodeURIComponent(token)}`;
-    }
-    return out;
-}
-// ── translation ─────────────────────────────────────────────────────────────
-/** Go durations (`24h`, `720h`, `1h30m`) → ms. */
-function goDurationMs(v) {
-    if (typeof v !== 'string' || !v.trim())
-        return undefined;
-    const text = v.trim();
-    let total = 0;
-    let matched = '';
-    for (const m of text.matchAll(/(\d+(?:\.\d+)?)(h|m|s|ms)/g)) {
-        matched += m[0];
-        total += Number(m[1]) * { h: 3_600_000, m: 60_000, s: 1000, ms: 1 }[m[2]];
-    }
-    return matched === text && total > 0 ? total : undefined;
-}
-/** Traits Atlas has a column for. */
-const KNOWN_TRAITS = [
-    { keys: ['email', 'email_address', 'mail'], atlas: 'user email address' },
-    { keys: ['username', 'user_name', 'login', 'handle'], atlas: 'user username' },
-    { keys: ['phone', 'phone_number', 'mobile', 'tel'], atlas: 'user phone number' },
-    { keys: ['name', 'full_name', 'first_name', 'last_name', 'given_name', 'family_name'], atlas: 'user first / last name' },
-    { keys: ['picture', 'avatar', 'avatar_url', 'image'], atlas: 'user image' },
-];
-function translateOryConfig(snap) {
-    const b = new translate_kit_1.ConfigBuilder();
-    const k = snap.kratos;
-    const h = snap.hydra;
-    const at = (cfg, path) => path.split('.').reduce((v, key) => ((0, record_set_1.isObj)(v) ? v[key] : undefined), cfg?.value);
-    const kv = (path) => at(k, path);
-    const hv = (path) => at(h, path);
-    const note = (cfg, status, area, path, text, atlas) => {
-        const line = cfg?.line(path);
-        b.report.push({ status, area, setting: path, note: text, ...(atlas ? { atlas } : {}), ...(cfg && line ? { file: cfg.file, line } : {}) });
-    };
-    const add = (status, area, path, text, atlas) => note(k, status, area, path, text, atlas);
-    const bool = (path, fallback) => (typeof kv(path) === 'boolean' ? kv(path) : fallback);
-    const has = (path) => kv(path) !== undefined;
-    // ── flows ──
-    if (k) {
-        const signUp = bool('selfservice.flows.registration.enabled', true);
-        b.set('signUpMode', signUp ? 'public' : 'restricted');
-        add('mapped', 'flows', 'selfservice.flows.registration.enabled', signUp ? 'Public sign-up.' : 'Sign-up closed (invitations and the allowlist still work).', 'auth_config.signUpMode');
-        if (bool('selfservice.flows.verification.enabled', false)) {
-            const use = (0, record_set_1.str)(kv('selfservice.flows.verification.use')) ?? 'code';
-            add('mapped', 'flows', 'selfservice.flows.verification.enabled', `Email verification (${use === 'link' ? 'by link' : 'by code'}): Atlas verifies addresses with a code or link.`, 'auth_config.strategies.emailCode');
-        }
-        if (bool('selfservice.flows.recovery.enabled', false))
-            add('mapped', 'flows', 'selfservice.flows.recovery.enabled', 'Account recovery becomes Atlas password reset (a code or link by email).', 'auth_config.strategies.password');
-        if (has('selfservice.flows.settings.privileged_session_max_age')) {
-            add('differs', 'flows', 'selfservice.flows.settings.privileged_session_max_age', `Kratos asks for a fresh sign-in after ${String(kv('selfservice.flows.settings.privileged_session_max_age'))} before settings changes; Atlas re-verifies sensitive changes with its own window (auth_config.stepUp).`, 'auth_config.stepUp');
-        }
-        for (const flow of ['login', 'registration', 'settings', 'recovery', 'verification', 'error']) {
-            const ui = (0, record_set_1.str)(kv(`selfservice.flows.${flow}.ui_url`));
-            if (ui)
-                add('manual', 'flows', `selfservice.flows.${flow}.ui_url`, `Your ${flow} page (${ui}) is replaced by Atlas's hosted page or its components; update links to /sign-in and /sign-up.`);
-        }
-    }
-    // ── hooks ──
-    if (k) {
-        const flows = (0, record_set_1.isObj)(kv('selfservice.flows')) ? kv('selfservice.flows') : {};
-        for (const [flow, def] of Object.entries(flows)) {
-            if (!(0, record_set_1.isObj)(def))
-                continue;
-            for (const when of ['before', 'after']) {
-                const section = def[when];
-                if (!(0, record_set_1.isObj)(section))
-                    continue;
-                // `after.hooks` (every method) and `after.<method>.hooks` (one of them).
-                const groups = [[`${when}.hooks`, section.hooks]];
-                for (const [method, v] of Object.entries(section))
-                    if ((0, record_set_1.isObj)(v))
-                        groups.push([`${when}.${method}.hooks`, v.hooks]);
-                for (const [where, hooks] of groups) {
-                    for (const [n, hook] of (0, record_set_1.objs)(hooks).entries()) {
-                        const name = (0, record_set_1.str)(hook.hook);
-                        const path = `selfservice.flows.${flow}.${where}.${n}`;
-                        if (name === 'web_hook')
-                            add('manual', 'hooks', path, `A web hook (${(0, record_set_1.str)((0, record_set_1.isObj)(hook.config) ? hook.config.url : undefined) ?? 'url'}) moves to an Atlas webhook endpoint or a before-sign-up action; its Jsonnet body is rebuilt as the event payload.`);
-                        else if (name === 'require_verified_address') {
-                            b.set('requireEmailVerification', true);
-                            add('mapped', 'hooks', path, 'Unverified addresses cannot sign in.', 'auth_config.requireEmailVerification');
-                        }
-                        else if (name === 'session')
-                            add('mapped', 'hooks', path, 'Atlas signs the user in after registration.');
-                        else if (name === 'revoke_active_sessions')
-                            add('differs', 'hooks', path, 'Atlas revokes sessions on password change and on the user\'s request; a blanket revoke after sign-in has no switch.');
-                        else if (name === 'verify' || name === 'show_verification_ui')
-                            add('mapped', 'hooks', path, 'Atlas starts address verification after sign-up when verification is required.');
-                        else if (name)
-                            add('manual', 'hooks', path, `The "${name}" hook has no Atlas counterpart.`);
-                    }
-                }
-            }
-        }
-    }
-    // ── methods ──
-    if (k) {
-        const password = bool('selfservice.methods.password.enabled', true);
-        b.set('strategies.password', password);
-        add('mapped', 'methods', 'selfservice.methods.password.enabled', password ? 'Password sign-in on.' : 'Password sign-in off.', 'auth_config.strategies.password');
-        if (password) {
-            const min = typeof kv('selfservice.methods.password.config.min_password_length') === 'number' ? kv('selfservice.methods.password.config.min_password_length') : 8;
-            b.set('passwordPolicy.minLength', Math.max(min, 6));
-            add('mapped', 'methods', 'selfservice.methods.password.config.min_password_length', `Minimum ${min} characters.`, 'auth_config.passwordPolicy.minLength');
-            const pwned = bool('selfservice.methods.password.config.haveibeenpwned_enabled', true);
-            b.set('passwordPolicy.checkBreaches', pwned);
-            add('mapped', 'methods', 'selfservice.methods.password.config.haveibeenpwned_enabled', pwned ? 'Breached passwords are refused.' : 'Breached-password check off.', 'auth_config.passwordPolicy.checkBreaches');
-            if (has('selfservice.methods.password.config.max_breaches'))
-                add('differs', 'methods', 'selfservice.methods.password.config.max_breaches', 'Atlas refuses any breached password; there is no breach-count threshold.');
-            if (bool('selfservice.methods.password.config.identifier_similarity_check_enabled', true))
-                add('differs', 'methods', 'selfservice.methods.password.config.identifier_similarity_check_enabled', 'Atlas does not compare the password with the identifier.');
-        }
-        if (bool('selfservice.methods.code.enabled', false) || bool('selfservice.methods.code.passwordless_enabled', false) || bool('selfservice.methods.code.config.passwordless_enabled', false)) {
-            b.set('strategies.emailCode', true);
-            add('mapped', 'methods', 'selfservice.methods.code.enabled', 'One-time code sign-in (and the code second factor).', 'auth_config.strategies.emailCode');
-        }
-        if (bool('selfservice.methods.link.enabled', false)) {
-            b.set('strategies.emailLink', true);
-            add('mapped', 'methods', 'selfservice.methods.link.enabled', 'Magic-link sign-in.', 'auth_config.strategies.emailLink');
-        }
-        if (bool('selfservice.methods.totp.enabled', false)) {
-            b.set('mfa.factors.totp', true);
-            add('mapped', 'methods', 'selfservice.methods.totp.enabled', 'Authenticator apps as a second factor. Seeds move with a database export; an Admin API export has none, so users enrol again.', 'auth_config.mfa.factors.totp');
-        }
-        if (bool('selfservice.methods.lookup_secret.enabled', false))
-            add('mapped', 'methods', 'selfservice.methods.lookup_secret.enabled', 'Backup codes accompany an authenticator in Atlas (unused codes move with a database export).', 'auth_config.mfa.backupCodes');
-        const webauthn = bool('selfservice.methods.webauthn.enabled', false);
-        const passkey = bool('selfservice.methods.passkey.enabled', false);
-        if (webauthn) {
-            const passwordless = bool('selfservice.methods.webauthn.config.passwordless', false);
-            b.set(passwordless ? 'strategies.passkey' : 'mfa.factors.passkey', true);
-            add('mapped', 'methods', 'selfservice.methods.webauthn.enabled', passwordless ? 'Passwordless WebAuthn becomes passkey sign-in.' : 'Security keys as a second factor.', passwordless ? 'auth_config.strategies.passkey' : 'auth_config.mfa.factors.passkey');
-        }
-        if (passkey) {
-            b.set('strategies.passkey', true);
-            add('mapped', 'methods', 'selfservice.methods.passkey.enabled', 'Passkey sign-in on.', 'auth_config.strategies.passkey');
-        }
-        if (webauthn || passkey) {
-            const rp = webauthn && has('selfservice.methods.webauthn.config.rp.id') ? 'selfservice.methods.webauthn.config.rp.id' : 'selfservice.methods.passkey.config.rp.id';
-            const rpId = (0, record_set_1.str)(kv(rp));
-            if (rpId)
-                add('differs', 'methods', rp, `Passkeys were registered for "${rpId}": they keep working only when Atlas serves sign-in on that domain (export with --set ory-rp-id=${rpId}).`);
-        }
-        // ── social and enterprise sign-in ──
-        const providers = (0, record_set_1.objs)(kv('selfservice.methods.oidc.config.providers'));
-        if (bool('selfservice.methods.oidc.enabled', false) || providers.length) {
-            for (const [n, p] of providers.entries()) {
-                const path = `selfservice.methods.oidc.config.providers.${n}`;
-                const id = (0, record_set_1.str)(p.id);
-                const kind = ((0, record_set_1.str)(p.provider) ?? 'generic').toLowerCase();
-                if (!id)
-                    continue;
-                const atlasKey = kind === 'github-app' ? 'github' : (0, translate_kit_1.socialKey)(kind);
-                const clientId = (0, record_set_1.str)(p.client_id);
-                if (atlasKey) {
-                    b.socialProvider({ atlasKey, vendorName: id, area: 'sign-in with', setting: path, clientId, scopes: (0, record_set_1.strs)(p.scope).length ? (0, record_set_1.strs)(p.scope) : undefined });
-                    const last = b.report[b.report.length - 1];
-                    const line = k.line(path);
-                    if (line)
-                        Object.assign(last, { file: k.file, line });
-                    if (id !== atlasKey)
-                        last.note += ` Imported identities keep the Kratos provider id "${id}": map it with provider_map ${id}=${atlasKey}.`;
-                }
-                else {
-                    const providerKey = (0, translate_kit_1.keyOf)(id).replace(/:/g, '_').slice(0, 48) || 'oidc';
-                    const upper = providerKey.toUpperCase();
-                    const issuer = (0, record_set_1.str)(p.issuer_url);
-                    const doc = {
-                        provider_key: providerKey,
-                        display_name: (0, record_set_1.str)(p.label) ?? id,
-                        protocol: 'oidc',
-                        client_id: clientId ?? b.placeholder(`${upper}_CLIENT_ID`, `${id} client id`),
-                        client_secret: b.placeholder(`${upper}_CLIENT_SECRET`, `${id} client secret`),
-                        enabled: true,
-                        allow_sign_in: true,
-                        allow_sign_up: true,
-                    };
-                    if (issuer) {
-                        doc.issuer = issuer;
-                        doc.discovery_url = `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`;
-                    }
-                    if ((0, record_set_1.strs)(p.scope).length)
-                        doc.scopes = (0, record_set_1.strs)(p.scope);
-                    b.push('custom_oauth_providers', doc);
-                    b.providers[id] = providerKey;
-                    note(k, 'differs', 'sign-in with', path, `"${id}" (${kind}) becomes the custom OIDC provider "${providerKey}"${issuer ? ` (issuer ${issuer})` : ''}. Add Atlas's redirect URI at the provider and set ${upper}_CLIENT_SECRET. Imported identities keep provider "${id}": map it with provider_map ${id}=${providerKey}.`, `custom_oauth_providers ${providerKey}`);
-                }
-                if ((0, record_set_1.str)(p.mapper_url))
-                    note(k, 'manual', 'sign-in with', `${path}.mapper_url`, `The Jsonnet claims mapper (${(0, record_set_1.str)(p.mapper_url)}) has no direct counterpart: Atlas copies name, email and picture from the provider; rebuild any trait mapping as a claim mapping or user metadata.`);
-                if ((0, record_set_1.str)(p.requested_claims) || (0, record_set_1.isObj)(p.requested_claims))
-                    note(k, 'manual', 'sign-in with', `${path}.requested_claims`, 'Requested OIDC claims are not translated: set the scopes on the Atlas provider.');
-            }
-        }
-    }
-    // ── sessions ──
-    if (k) {
-        const lifespan = goDurationMs(kv('session.lifespan')) ?? 24 * 3_600_000;
-        b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(lifespan));
-        add((0, translate_kit_1.clampSessionMs)(lifespan) === lifespan ? 'mapped' : 'differs', 'sessions', 'session.lifespan', `Session lifespan ${String(kv('session.lifespan') ?? '24h')} becomes the absolute session lifetime.`, 'auth_config.session.absoluteMs');
-        if (has('session.earliest_possible_extend'))
-            add('differs', 'sessions', 'session.earliest_possible_extend', 'Atlas sessions refresh on use; there is no extension window.');
-        if (kv('session.cookie.persistent') === false)
-            add('differs', 'sessions', 'session.cookie.persistent', 'Kratos used a browser-session cookie; Atlas sessions are persistent up to their lifetime.');
-        for (const p of ['session.cookie.domain', 'session.cookie.name', 'session.cookie.same_site', 'session.cookie.path']) {
-            if (has(p))
-                add('differs', 'sessions', p, 'Atlas names and scopes its own session cookie (cross-subdomain on custom domains); the old cookie is cleared by the session bridge.');
-        }
-        const aal = (0, record_set_1.str)(kv('session.whoami.required_aal'));
-        if (aal === 'aal2') {
-            b.set('mfaPolicy', 'required');
-            add('mapped', 'sessions', 'session.whoami.required_aal', 'Every session needs a second factor.', 'auth_config.mfaPolicy');
-        }
-        else if (aal === 'highest_available' || aal === undefined) {
-            if (aal)
-                add('mapped', 'sessions', 'session.whoami.required_aal', 'A second factor is required exactly when the user has enrolled one: the Atlas default.', 'auth_config.mfaPolicy');
-        }
-    }
-    // ── URLs and origins ──
-    if (k) {
-        const urls = [(0, record_set_1.str)(kv('selfservice.default_browser_return_url')), ...(0, record_set_1.strs)(kv('selfservice.allowed_return_urls'))].filter((u) => !!u);
-        let exact = 0;
-        for (const url of new Set(urls)) {
-            if (url.includes('*')) {
-                add('differs', 'URLs', 'selfservice.allowed_return_urls', `${url}: Atlas redirect URLs are exact (no wildcards); list each URL.`, 'redirect_urls');
-                continue;
-            }
-            b.push('redirect_urls', { url });
-            exact++;
-        }
-        if (exact)
-            add('mapped', 'URLs', has('selfservice.allowed_return_urls') ? 'selfservice.allowed_return_urls' : 'selfservice.default_browser_return_url', `${exact} return URL(s) become redirect URLs.`, 'redirect_urls');
-        const origins = (0, record_set_1.strs)(kv('serve.public.cors.allowed_origins')).filter((o) => !o.includes('*'));
-        if (origins.length) {
-            b.instance.allowed_origins = origins;
-            add('mapped', 'URLs', 'serve.public.cors.allowed_origins', 'Allowed origins for the browser SDK.', 'instance.allowed_origins');
-        }
-        if ((0, record_set_1.strs)(kv('serve.public.cors.allowed_origins')).some((o) => o.includes('*')))
-            add('differs', 'URLs', 'serve.public.cors.allowed_origins', 'Wildcard origins are not allowed in Atlas: list each origin.');
-    }
-    // ── email, SMS, hashing, schemas ──
-    if (k) {
-        if (has('courier.smtp.connection_uri'))
-            add('manual', 'email', 'courier.smtp.connection_uri', 'Configure your SMTP server (or email provider) in Atlas; the connection URI carries credentials and is not copied.');
-        for (const p of ['courier.smtp.from_address', 'courier.smtp.from_name'])
-            if (has(p))
-                add('manual', 'email', p, `Set the sender (${String(kv(p))}) on the Atlas email provider.`);
-        if (has('courier.templates'))
-            add('manual', 'email', 'courier.templates', 'Recreate your courier templates in Atlas (Kratos uses Go templates; Atlas has its own template variables).');
-        if ((0, record_set_1.objs)(kv('courier.channels')).some((c) => (0, record_set_1.str)(c.id) === 'sms'))
-            add('manual', 'phone', 'courier.channels', 'The SMS channel (HTTP request config) is replaced by an Atlas SMS provider: connect Twilio or another one (credentials are not copied).');
-        if ((0, record_set_1.str)(kv('hashers.algorithm')))
-            add('mapped', 'passwords', 'hashers.algorithm', `Passwords hashed with ${String(kv('hashers.algorithm'))} import in that algorithm and are re-hashed to Argon2id on each user's first sign-in.`);
-        if ((0, record_set_1.str)(kv('oauth2_provider.url')))
-            add('differs', 'OAuth', 'oauth2_provider.url', 'Kratos delegated login to Hydra. Atlas is its own OAuth 2.0 / OIDC provider: your login and consent apps are no longer needed.');
-        if (bool('security.account_enumeration.mitigate', false))
-            add('differs', 'security', 'security.account_enumeration.mitigate', 'Atlas gives uniform responses on sign-in and reset by default.');
-        const schemaPaths = Array.isArray(kv('identity.schemas')) ? kv('identity.schemas') : [];
-        if (schemaPaths.length && !snap.schemas.length)
-            add('manual', 'identity schema', 'identity.schemas', 'The identity schemas could not be read: pass them with --set ory-schema=<file>, or give the public URL of Kratos.');
-    }
-    for (const { id, schema } of snap.schemas)
-        schemaReport(b, id, schema);
-    // ── Hydra ──
-    if (h) {
-        const hnote = (status, path, text, atlas) => note(h, status, 'OAuth 2.0 server', path, text, atlas);
-        if ((0, record_set_1.str)(hv('urls.self.issuer')))
-            hnote('differs', 'urls.self.issuer', `Tokens were issued by ${String(hv('urls.self.issuer'))}. Atlas issues under its own issuer: add Hydra's issuer as a legacy issuer so existing tokens stay valid during the move, and point resource servers at Atlas's JWKS.`, 'auth_config.legacyIssuers');
-        for (const p of ['urls.login', 'urls.consent', 'urls.logout'])
-            if (hv(p) !== undefined)
-                hnote('manual', p, 'Atlas hosts login, consent and logout itself: this app is no longer needed.');
-        for (const [p, what] of [['ttl.access_token', 'access token'], ['ttl.refresh_token', 'refresh token'], ['ttl.id_token', 'ID token'], ['ttl.auth_code', 'authorization code']]) {
-            if (hv(p) !== undefined)
-                hnote('differs', p, `${what} lifetime ${String(hv(p))}: set the lifetimes on each Atlas OAuth client or resource server.`);
-        }
-        if ((0, record_set_1.str)(hv('strategies.access_token')) === 'jwt')
-            hnote('mapped', 'strategies.access_token', 'JWT access tokens: Atlas access tokens are JWTs verified with the instance JWKS.');
-        else if (hv('strategies.access_token') !== undefined)
-            hnote('differs', 'strategies.access_token', 'Opaque access tokens: Atlas access tokens are JWTs; resource servers verify them with the instance JWKS instead of introspecting.');
-        if ((0, record_set_1.strs)(hv('oidc.subject_identifiers.supported_types')).includes('pairwise'))
-            hnote('manual', 'oidc.subject_identifiers.supported_types', 'Pairwise subject identifiers are not supported: Atlas issues public subjects (the user id), so clients that stored pairwise subjects must re-link.');
-        if (hv('oidc.dynamic_client_registration.enabled') === true)
-            hnote('manual', 'oidc.dynamic_client_registration.enabled', 'Open dynamic client registration is not enabled in Atlas: register clients through the dashboard or API.');
-        if (hv('oauth2.pkce.enforced') === true)
-            hnote('mapped', 'oauth2.pkce.enforced', 'Atlas requires PKCE for public clients.');
-    }
-    // ── Hydra clients ──
-    let secrets = 0;
-    for (const c of snap.clients) {
-        const id = (0, record_set_1.str)(c.client_id);
-        if (!id)
-            continue;
-        const name = (0, record_set_1.str)(c.client_name) ?? id;
-        const grants = (0, record_set_1.strs)(c.grant_types);
-        const redirects = (0, record_set_1.strs)(c.redirect_uris);
-        const method = (0, record_set_1.str)(c.token_endpoint_auth_method) ?? 'client_secret_basic';
-        const doc = { name };
-        if (redirects.length)
-            doc.redirect_uris = redirects;
-        const scopes = typeof c.scope === 'string' ? c.scope.split(/\s+/).filter(Boolean) : (0, record_set_1.strs)(c.scope);
-        if (scopes.length)
-            doc.allowed_scopes = scopes;
-        if (grants.length)
-            doc.grant_types = grants;
-        doc.token_endpoint_auth_method = method;
-        if ((0, record_set_1.str)(c.logo_uri))
-            doc.logo_url = (0, record_set_1.str)(c.logo_uri);
-        if (c.skip_consent === true)
-            doc.first_party = true;
-        b.push('oauth_clients', doc);
-        const where = `clients ${id}`;
-        b.add('mapped', 'OAuth clients', where, `"${name}" becomes an Atlas OAuth client (${grants.join(', ') || 'no grant types'}; ${redirects.length} redirect URI(s)${c.skip_consent === true ? '; consent skipped = first party' : ''}).`, 'oauth_clients');
-        if (method !== 'none')
-            secrets++;
-        if (method === 'private_key_jwt')
-            b.add('manual', 'OAuth clients', `${where} token_endpoint_auth_method`, 'private_key_jwt: register the client\'s public key (jwks / jwks_uri) on the Atlas client again.');
-        if ((0, record_set_1.str)(c.subject_type) === 'pairwise')
-            b.add('manual', 'OAuth clients', `${where} subject_type`, 'Pairwise subjects are not supported: this client receives the user id as sub.');
-        if ((0, record_set_1.strs)(c.audience).length)
-            b.add('manual', 'OAuth clients', `${where} audience`, `Audience ${(0, record_set_1.strs)(c.audience).join(', ')}: register each as an API (resource server) in Atlas and grant this client access.`, 'resource_servers');
-        if ((0, record_set_1.str)(c.backchannel_logout_uri) || (0, record_set_1.str)(c.frontchannel_logout_uri))
-            b.add('manual', 'OAuth clients', `${where} logout uris`, 'Front- and back-channel logout URIs are set on the Atlas client after import.');
-    }
-    if (secrets)
-        b.add('manual', 'OAuth clients', 'client_secret', `${secrets} client(s) authenticate with a secret. Hydra keeps only hashes, so Atlas issues new secrets: give each client its new secret.`);
-    const publicUrl = snap.publicUrl ?? (0, record_set_1.str)(kv('serve.public.base_url'));
-    const slug = publicUrl ? /^https:\/\/([a-z0-9-]+)\.projects\.oryapis\.com/i.exec(publicUrl)?.[1] : undefined;
-    const cookie = (0, record_set_1.str)(kv('session.cookie.name')) ?? (slug ? `ory_session_${slug}` : 'ory_kratos_session');
-    const vars = { cookie_name: cookie };
-    if (publicUrl)
-        vars.base_url = publicUrl.replace(/\/+$/, '');
-    return b.result(snap.origin, {
-        bridge: { preset: 'ory_whoami', vars },
-        ...(publicUrl ? { lazy: { preset: 'ory', config: { base_url: publicUrl.replace(/\/+$/, '') } } } : {}),
-    });
-}
-/** One identity schema's traits → report lines (what Atlas stores where, what stays in metadata). */
-function schemaReport(b, id, schema) {
-    const traits = (0, record_set_1.isObj)(schema.properties) && (0, record_set_1.isObj)(schema.properties.traits) ? schema.properties.traits : undefined;
-    const props = traits && (0, record_set_1.isObj)(traits.properties) ? traits.properties : {};
-    const required = new Set(traits ? (0, record_set_1.strs)(traits.required) : []);
-    for (const [name, def] of Object.entries(props)) {
-        if (!(0, record_set_1.isObj)(def))
-            continue;
-        const ory = (0, record_set_1.isObj)(def['ory.sh/kratos']) ? def['ory.sh/kratos'] : {};
-        const creds = (0, record_set_1.isObj)(ory.credentials) ? ory.credentials : {};
-        const identifierFor = Object.entries(creds).filter(([, v]) => (0, record_set_1.isObj)(v) && v.identifier === true).map(([c]) => c);
-        const known = KNOWN_TRAITS.find((t) => t.keys.includes(name.toLowerCase()));
-        const where = `identity schema ${id} traits.${name}`;
-        const via = (0, record_set_1.isObj)(ory.verification) ? (0, record_set_1.str)(ory.verification.via) : undefined;
-        if (known) {
-            b.add('mapped', 'identity schema', where, `Becomes the ${known.atlas}${identifierFor.length ? ` and signs in via ${identifierFor.join(', ')}` : ''}${via ? `; verified by ${via}` : ''}.`);
-        }
-        else if ((0, record_set_1.isObj)(def.properties) && ['first', 'last'].some((n) => n in def.properties)) {
-            b.add('mapped', 'identity schema', where, 'Its first / last fields become the user\'s first and last name.');
-        }
-        else {
-            b.add('differs', 'identity schema', where, `A custom trait${required.has(name) ? ' (required at sign-up)' : ''}: it is kept on the user as unsafe_metadata.ory_traits.${name}; add it as an Atlas sign-up field to keep collecting it.`);
-        }
-    }
-}
-//# sourceMappingURL=ory-config.js.map

package/dist/migrate/export/ory-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ory-config.js","sourceRoot":"","sources":["../../../src/migrate/export/ory-config.ts"],"names":[],"mappings":";;AAoDA,wCAUC;AAGD,0CASC;AAGD,8CAsBC;AAGD,0CAGC;AAGD,0CAcC;AAKD,oCAUC;AAWD,gDAoQC;AAtZD,2CAAwC;AACxC,6CAAgE;AAChE,mDAAkF;AAClF,+CAAqD;AA4CrD,+EAA+E;AAE/E,0EAA0E;AAC1E,SAAgB,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;QAC7C,IAAI,CAAC,IAAA,kBAAK,EAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iCAAiC,CAAC,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,qBAAS,EAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wDAAwD,CAAC,CAAC;IACxG,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,oHAAoH;AACpH,SAAgB,eAAe,CAAC,IAAmB;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;IACrC,IAAI,CAAC,IAAA,kBAAK,EAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,kBAAK,EAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,kBAAK,EAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,MAAM,IAAI,GAAG,CAAC,KAAU,EAAE,IAAY,EAAiB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7H,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;QAClE,KAAK,EAAE,IAAA,kBAAK,EAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAA,kBAAK,EAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,SAAS;QACnI,IAAI,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,mIAAmI;AACnI,SAAgB,iBAAiB,CAAC,MAAiC,EAAE,QAAkC,EAAE,OAA4B,GAAG,EAAE,CAAC,SAAS;IAClJ,MAAM,QAAQ,GAAG,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;IACxC,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAA,kBAAK,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9D,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;YAAE,SAAS;QAC1B,IAAI,CAAC;YACH,IAAI,IAAwB,CAAC;YAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;gBAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;iBACzG,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,IAAI,GAAG,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,oBAAoB,EAAE,WAAW,GAAG,0EAA0E,CAAC,CAAC;gBACrH,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;YAC3C,IAAI,IAAA,kBAAK,EAAC,MAAM,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,oBAAoB,EAAE,wBAAyB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yDAAyD;AAClD,KAAK,UAAU,eAAe,CAAC,IAAgB;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,UAAU,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7J,CAAC;AAED,4EAA4E;AACrE,KAAK,UAAU,eAAe,CAAC,IAAgB,EAAE,QAAQ,GAAG,GAAG;IACpE,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,IAAI,GAAG,4BAA4B,QAAQ,EAAE,CAAC;IAClD,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,sBAAQ,EAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM;QACrC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,GAAG,4BAA4B,QAAQ,eAAe,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAE/E,kDAAkD;AAClD,SAAgB,YAAY,CAAC,CAAU;IACrC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAA2B,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,OAAO,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,qCAAqC;AACrC,MAAM,YAAY,GAA6C;IAC7D,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACzE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE;IAC9E,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE;IAChF,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE;IACxH,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE;CAC5E,CAAC;AAEF,SAAgB,kBAAkB,CAAC,IAAuB;IACxD,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACrB,MAAM,EAAE,GAAG,CAAC,GAA8B,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/J,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,GAA8B,EAAE,MAAuC,EAAE,IAAY,EAAE,IAAY,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE;QACjJ,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,MAAuC,EAAE,IAAY,EAAE,IAAY,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5J,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,QAAiB,EAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAE,EAAE,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9H,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IAErD,cAAc;IACd,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,MAAM,GAAG,IAAI,CAAC,wCAAwC,EAAE,IAAI,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACtD,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,wCAAwC,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,4DAA4D,EAAE,wBAAwB,CAAC,CAAC;QACtL,IAAI,IAAI,CAAC,wCAAwC,EAAE,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,oCAAoC,CAAC,CAAC,IAAI,MAAM,CAAC;YACpE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,wCAAwC,EAAE,uBAAuB,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,kDAAkD,EAAE,kCAAkC,CAAC,CAAC;QACxN,CAAC;QACD,IAAI,IAAI,CAAC,oCAAoC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,oCAAoC,EAAE,0EAA0E,EAAE,iCAAiC,CAAC,CAAC;QACnO,IAAI,GAAG,CAAC,uDAAuD,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,uDAAuD,EAAE,yCAAyC,MAAM,CAAC,EAAE,CAAC,uDAAuD,CAAC,CAAC,yGAAyG,EAAE,oBAAoB,CAAC,CAAC;QAChU,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,CAAU,EAAE,CAAC;YACvG,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,qBAAqB,IAAI,SAAS,CAAC,CAAC,CAAC;YACvD,IAAI,EAAE;gBAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,qBAAqB,IAAI,SAAS,EAAE,QAAQ,IAAI,UAAU,EAAE,gGAAgG,CAAC,CAAC;QAC/L,CAAC;IACH,CAAC;IAED,cAAc;IACd,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,mBAAmB,CAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC;gBAAE,SAAS;YAC1B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAU,EAAE,CAAC;gBAChD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAA,kBAAK,EAAC,OAAO,CAAC;oBAAE,SAAS;gBAC9B,yEAAyE;gBACzE,MAAM,MAAM,GAA6B,CAAC,CAAC,GAAG,IAAI,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC5E,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;oBAAE,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC;wBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;gBACnH,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;oBACpC,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAA,iBAAI,EAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;wBAC9C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAC5B,MAAM,IAAI,GAAG,qBAAqB,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;wBACvD,IAAI,IAAI,KAAK,UAAU;4BAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,oHAAoH,CAAC,CAAC;6BACpP,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;4BAC7C,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;4BACxC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,sCAAsC,EAAE,sCAAsC,CAAC,CAAC;wBAC/G,CAAC;6BAAM,IAAI,IAAI,KAAK,SAAS;4BAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;6BACtG,IAAI,IAAI,KAAK,wBAAwB;4BAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,qHAAqH,CAAC,CAAC;6BAC5L,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,sBAAsB;4BAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,gFAAgF,CAAC,CAAC;6BACzK,IAAI,IAAI;4BAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,kCAAkC,CAAC,CAAC;oBAC9F,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,QAAQ,GAAG,IAAI,CAAC,sCAAsC,EAAE,IAAI,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QACvC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,sCAAsC,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,uBAAuB,EAAE,iCAAiC,CAAC,CAAC;QACjK,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,yDAAyD,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,yDAAyD,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9K,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACpD,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,yDAAyD,EAAE,WAAW,GAAG,cAAc,EAAE,sCAAsC,CAAC,CAAC;YAC1J,MAAM,KAAK,GAAG,IAAI,CAAC,4DAA4D,EAAE,IAAI,CAAC,CAAC;YACvF,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAC7C,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,4DAA4D,EAAE,KAAK,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,8BAA8B,EAAE,0CAA0C,CAAC,CAAC;YAC/M,IAAI,GAAG,CAAC,kDAAkD,CAAC;gBAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,kDAAkD,EAAE,0EAA0E,CAAC,CAAC;YACvN,IAAI,IAAI,CAAC,yEAAyE,EAAE,IAAI,CAAC;gBAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,yEAAyE,EAAE,0DAA0D,CAAC,CAAC;QAC9P,CAAC;QACD,IAAI,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,+CAA+C,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,sDAAsD,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3L,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACpC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,kCAAkC,EAAE,qDAAqD,EAAE,kCAAkC,CAAC,CAAC;QAC1J,CAAC;QACD,IAAI,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,EAAE,CAAC;YACpD,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACpC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,kCAAkC,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,EAAE,CAAC;YACpD,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;YAChC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,kCAAkC,EAAE,+HAA+H,EAAE,8BAA8B,CAAC,CAAC;QAChO,CAAC;QACD,IAAI,IAAI,CAAC,2CAA2C,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,2CAA2C,EAAE,8FAA8F,EAAE,6BAA6B,CAAC,CAAC;QACnQ,MAAM,QAAQ,GAAG,IAAI,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,IAAI,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;YACrF,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACzE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,sCAAsC,EAAE,YAAY,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,mCAAmC,EAAE,YAAY,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC;QAC/P,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAClC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,qCAAqC,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;QAC3H,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,QAAQ,IAAI,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,0CAA0C,CAAC;YACnK,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI;gBAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,iCAAiC,IAAI,mGAAmG,IAAI,IAAI,CAAC,CAAC;QAC5L,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GAAG,IAAA,iBAAI,EAAC,EAAE,CAAC,2CAA2C,CAAC,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACxE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,6CAA6C,CAAC,EAAE,CAAC;gBAC9D,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrB,MAAM,IAAI,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC1D,IAAI,CAAC,EAAE;oBAAE,SAAS;gBAClB,MAAM,QAAQ,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,yBAAS,EAAC,IAAI,CAAC,CAAC;gBACpE,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,QAAQ,EAAE,CAAC;oBACb,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;oBACxJ,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;oBAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC1B,IAAI,IAAI;wBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBACtD,IAAI,EAAE,KAAK,QAAQ;wBAAE,IAAI,CAAC,IAAI,IAAI,qDAAqD,EAAE,+BAA+B,EAAE,IAAI,QAAQ,GAAG,CAAC;gBAC5I,CAAC;qBAAM,CAAC;oBACN,MAAM,WAAW,GAAG,IAAA,qBAAK,EAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;oBACxE,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;oBACxC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;oBACjC,MAAM,GAAG,GAAyB;wBAChC,YAAY,EAAE,WAAW;wBACzB,YAAY,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;wBAChC,QAAQ,EAAE,MAAM;wBAChB,SAAS,EAAE,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,YAAY,EAAE,GAAG,EAAE,YAAY,CAAC;wBAC7E,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,CAAC;wBAC7E,OAAO,EAAE,IAAI;wBACb,aAAa,EAAE,IAAI;wBACnB,aAAa,EAAE,IAAI;qBACpB,CAAC;oBACF,IAAI,MAAM,EAAE,CAAC;wBACX,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;wBACpB,GAAG,CAAC,aAAa,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC;oBACvF,CAAC;oBACD,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;wBAAE,GAAG,CAAC,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBACrD,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;oBACtC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC;oBAC9B,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,uCAAuC,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,YAAY,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD,KAAK,sDAAsD,EAAE,+BAA+B,EAAE,IAAI,WAAW,GAAG,EAAE,0BAA0B,WAAW,EAAE,CAAC,CAAC;gBACrW,CAAC;gBACD,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;oBAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI,aAAa,EAAE,8BAA8B,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,qJAAqJ,CAAC,CAAC;gBACrR,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,gBAAgB,CAAC;oBAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI,mBAAmB,EAAE,iFAAiF,CAAC,CAAC;YAC7M,CAAC;QACH,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC;QACxE,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,QAAQ,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,IAAA,8BAAc,EAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,oBAAoB,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,yCAAyC,EAAE,gCAAgC,CAAC,CAAC;QAC1O,IAAI,GAAG,CAAC,kCAAkC,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,kCAAkC,EAAE,8DAA8D,CAAC,CAAC;QAC5K,IAAI,EAAE,CAAC,2BAA2B,CAAC,KAAK,KAAK;YAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,2BAA2B,EAAE,2FAA2F,CAAC,CAAC;QACpM,KAAK,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,qBAAqB,CAAC,EAAE,CAAC;YACpH,IAAI,GAAG,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,qIAAqI,CAAC,CAAC;QACnL,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAC;QACnD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC/B,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,6BAA6B,EAAE,sCAAsC,EAAE,uBAAuB,CAAC,CAAC;QAC5H,CAAC;aAAM,IAAI,GAAG,KAAK,mBAAmB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5D,IAAI,GAAG;gBAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,6BAA6B,EAAE,wFAAwF,EAAE,uBAAuB,CAAC,CAAC;QACvL,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,IAAI,GAAG,CAAC,IAAA,gBAAG,EAAC,EAAE,CAAC,wCAAwC,CAAC,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjJ,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,iCAAiC,EAAE,GAAG,GAAG,gEAAgE,EAAE,eAAe,CAAC,CAAC;gBACnJ,SAAS;YACX,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACjC,KAAK,EAAE,CAAC;QACV,CAAC;QACD,IAAI,KAAK;YAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,wCAAwC,EAAE,GAAG,KAAK,sCAAsC,EAAE,eAAe,CAAC,CAAC;QACzN,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9F,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,CAAC,CAAC,QAAQ,CAAC,eAAe,GAAG,OAAO,CAAC;YACrC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,IAAA,iBAAI,EAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,mCAAmC,EAAE,8DAA8D,CAAC,CAAC;IAC9M,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC,EAAE,CAAC;QACN,IAAI,GAAG,CAAC,6BAA6B,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,6BAA6B,EAAE,oHAAoH,CAAC,CAAC;QACpN,KAAK,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,mBAAmB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;QACjL,IAAI,GAAG,CAAC,mBAAmB,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,4GAA4G,CAAC,CAAC;QACxL,IAAI,IAAA,iBAAI,EAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,yIAAyI,CAAC,CAAC;QACzP,IAAI,IAAA,gBAAG,EAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,yBAAyB,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,uFAAuF,CAAC,CAAC;QACnO,IAAI,IAAA,gBAAG,EAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,gIAAgI,CAAC,CAAC;QACrN,IAAI,IAAI,CAAC,uCAAuC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,uCAAuC,EAAE,gEAAgE,CAAC,CAAC;QAChM,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,kBAAkB,CAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,mHAAmH,CAAC,CAAC;IAC5N,CAAC;IAED,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO;QAAE,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAEvE,cAAc;IACd,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,KAAK,GAAG,CAAC,MAAuC,EAAE,IAAY,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9J,IAAI,IAAA,gBAAG,EAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAAE,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,yBAAyB,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,uKAAuK,EAAE,2BAA2B,CAAC,CAAC;QACnU,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC;YAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,6EAA6E,CAAC,CAAC;QAC1L,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAAE,CAAC,mBAAmB,EAAE,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAU,EAAE,CAAC;YACvL,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,IAAI,aAAa,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oEAAoE,CAAC,CAAC;QACtJ,CAAC;QACD,IAAI,IAAA,gBAAG,EAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,KAAK,KAAK;YAAE,KAAK,CAAC,QAAQ,EAAE,yBAAyB,EAAE,kFAAkF,CAAC,CAAC;aAC5K,IAAI,EAAE,CAAC,yBAAyB,CAAC,KAAK,SAAS;YAAE,KAAK,CAAC,SAAS,EAAE,yBAAyB,EAAE,mIAAmI,CAAC,CAAC;QACvO,IAAI,IAAA,iBAAI,EAAC,EAAE,CAAC,0CAA0C,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,KAAK,CAAC,QAAQ,EAAE,0CAA0C,EAAE,oJAAoJ,CAAC,CAAC;QACjS,IAAI,EAAE,CAAC,0CAA0C,CAAC,KAAK,IAAI;YAAE,KAAK,CAAC,QAAQ,EAAE,0CAA0C,EAAE,0GAA0G,CAAC,CAAC;QACrO,IAAI,EAAE,CAAC,sBAAsB,CAAC,KAAK,IAAI;YAAE,KAAK,CAAC,QAAQ,EAAE,sBAAsB,EAAE,yCAAyC,CAAC,CAAC;IAC9H,CAAC;IAED,sBAAsB;IACtB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,qBAAqB,CAAC;QAC1E,MAAM,GAAG,GAAyB,EAAE,IAAI,EAAE,CAAC;QAC3C,IAAI,SAAS,CAAC,MAAM;YAAE,GAAG,CAAC,aAAa,GAAG,SAAS,CAAC;QACpD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClG,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,cAAc,GAAG,MAAM,CAAC;QAC/C,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;QAC5C,GAAG,CAAC,0BAA0B,GAAG,MAAM,CAAC;QACxC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,GAAG,CAAC,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAE,CAAC;QACrD,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;QACpD,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,WAAW,EAAE,EAAE,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,IAAI,oCAAoC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,KAAK,SAAS,CAAC,MAAM,mBAAmB,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;QACxP,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;QACjC,IAAI,MAAM,KAAK,iBAAiB;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,KAAK,6BAA6B,EAAE,iGAAiG,CAAC,CAAC;QAC7M,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,KAAK,UAAU;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,KAAK,eAAe,EAAE,+EAA+E,CAAC,CAAC;QACnL,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,KAAK,WAAW,EAAE,YAAY,IAAA,iBAAI,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oFAAoF,EAAE,kBAAkB,CAAC,CAAC;QACpO,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,uBAAuB,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,KAAK,cAAc,EAAE,+EAA+E,CAAC,CAAC;IACjN,CAAC;IACD,IAAI,OAAO;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,OAAO,+HAA+H,CAAC,CAAC;IAE1M,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,gBAAG,EAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,kDAAkD,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7G,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;IACvG,MAAM,IAAI,GAA2B,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAC7D,IAAI,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;QAC3B,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE;QACtC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvG,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,SAAS,YAAY,CAAC,CAAgB,EAAE,EAAU,EAAE,MAAW;IAC7D,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,UAAU,CAAC,IAAI,IAAA,kBAAK,EAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAClH,MAAM,KAAK,GAAG,MAAM,IAAI,IAAA,kBAAK,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC;YAAE,SAAS;QAC1B,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACjH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,mBAAmB,EAAE,WAAW,IAAI,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,KAAK,CAAC,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7L,CAAC;aAAM,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAK,GAAG,CAAC,UAAkB,CAAC,EAAE,CAAC;YAChG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iEAAiE,CAAC,CAAC;QAC/G,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,0DAA0D,IAAI,2DAA2D,CAAC,CAAC;QAC3O,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/migrate/export/ory.d.ts

@@ -1,81 +0,0 @@
-import type { PasswordHash } from '@atlasauth/migrate';
-import { type Tables } from './frameworks/tables';
-import { RecordSet, type Obj } from './record-set';
-/**
- * `atlas migrate export ory` — Ory Kratos (self-hosted, or Ory Network) onto
- * the canonical bundle models. Two ways in, both on the owner's machine:
- *
- *   - a DATABASE DUMP of Kratos (`<table>.json|ndjson|csv` per table, see
- *     frameworks/tables.ts): `identities`, `identity_credentials` (+ `_types`,
- *     `_identifiers`), `identity_verifiable_addresses` and `sessions`. The
- *     complete path: password hashes (every format Kratos verifies), TOTP
- *     seeds, unused recovery codes, WebAuthn / passkey credentials, social
- *     links and live session tokens. Ory Network projects cannot be dumped.
- *   - the ADMIN API (`GET /admin/identities`, paged with the `Link` header's
- *     page_token) with the admin URL of a self-hosted Kratos or an Ory Network
- *     project's API key. It never returns password hashes, TOTP seeds, recovery
- *     codes, WebAuthn credentials or session tokens: those users sign in once
- *     against Kratos through the `ory` lazy preset (passwords) and re-enrol
- *     their second factor; the session bridge asks Kratos to vouch for the
- *     session (remote mode).
- *
- * The Kratos identity id is the user id: it is the `identity.id` of every
- * session (`/sessions/whoami`) and the `sub` Hydra issues by default.
- *
- * Schemas: github.com/ory/kratos `persistence/sql/migrations` (tables),
- * `identity/credentials_*.go` (credential configs), `hash/hash_comparator.go`
- * (password formats); Admin API: `identity.Identity` JSON.
- */
-export interface OryTablesOptions {
-    /** The WebAuthn relying-party id (`selfservice.methods.passkey.config.rp.id` / `webauthn…rp.id`); passkeys need it. */
-    rpId?: string;
-    /** A multi-project database (Ory Network style): the `nid` to export. */
-    networkId?: string;
-    /** Export sessions that are active and unexpired at this time (default now). */
-    now?: number;
-}
-export interface OryApiOptions {
-    /** Kratos admin URL (`http://kratos:4434`) or `https://<slug>.projects.oryapis.com`. */
-    adminUrl: string;
-    /** Ory Network project API key (`ory_pat_…`), sent as `Authorization: Bearer`. */
-    apiKey?: string;
-    rpId?: string;
-    pageSize?: number;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-/**
- * A Kratos `hashed_password` as a bundle password; null when Atlas cannot
- * verify the format (`$hmac-md4$`, unknown schemes), whose users then move by
- * lazy migration. Formats: hash/hash_comparator.go.
- */
-export declare function oryPasswordHash(raw: unknown): PasswordHash | null;
-interface OryCredential {
-    identifiers: string[];
-    config?: Obj;
-}
-/** An identity as both readers present it (the Admin API's JSON, assembled from the tables). */
-interface OryIdentity {
-    id: string;
-    schemaId?: string;
-    state?: string;
-    traits: Obj;
-    addresses: Array<{
-        value: string;
-        via: string;
-        verified: boolean;
-    }>;
-    publicMetadata?: Obj;
-    adminMetadata?: Obj;
-    createdAt?: unknown;
-    organizationId?: string;
-    credentials: Map<string, OryCredential>;
-}
-export declare function exportOryTables(tables: Tables, opts?: OryTablesOptions): RecordSet;
-/** The Admin API's identity JSON as an {@link OryIdentity}. */
-export declare function oryIdentityFromApi(raw: Obj): OryIdentity | null;
-/** The `page_token` of a Link header's `rel="next"` URL (Kratos pages with tokens). */
-export declare function nextPageToken(link: string | null): string | null;
-export declare function exportOryApi(o: OryApiOptions): Promise<RecordSet>;
-export {};