@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/export/okta.d.ts

@@ -0,0 +1,43 @@
+import type { UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export okta` — Okta Workforce Identity Cloud and Okta
+ * Customer Identity Solution orgs onto the canonical bundle models.
+ *
+ * Read with an API token (`SSWS …`) or an OAuth access token with the
+ * okta.users.read / okta.groups.read / okta.idps.read scopes, on this machine.
+ *
+ *   - users (every status but DEPROVISIONED) with their profile; custom
+ *     profile attributes land in private metadata;
+ *   - groups, as app roles (default) or as organizations;
+ *   - identity providers: social IdPs become identities on their linked
+ *     users, SAML 2.0 / OIDC IdPs become enterprise connections (with the
+ *     signing certificate);
+ *   - with --factors: SMS / voice / email second factors (no secret is
+ *     needed for those). TOTP seeds, Okta Verify and WebAuthn credentials
+ *     never leave Okta — those users re-enrol.
+ *
+ * Okta NEVER exports password hashes, by API or support. Passwords move with
+ * the `okta` lazy-migration preset: Atlas checks a password against Okta
+ * (Authn API or the password grant) on the user's first sign-in.
+ */
+export interface OktaExportOptions {
+    /** `acme.okta.com` (or a custom domain serving the API). */
+    domain: string;
+    /** An Okta API token. */
+    apiToken?: string;
+    /** An OAuth 2.0 access token for the Okta management API, instead of an API token. */
+    accessToken?: string;
+    /** How groups move: as Atlas app roles (default) or as organizations. */
+    groupsAs?: 'roles' | 'organizations' | 'skip';
+    /** Read each user's factors (one call per user). */
+    factors?: boolean;
+    /** The authorization server whose signing keys go in the bundle (default `default`). */
+    authorizationServerId?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+export declare function exportOkta(opts: OktaExportOptions): Promise<RecordSet>;
+/** One Okta user → a user record (null when it has nothing to sign in with). */
+export declare function mapOktaUser(u: Obj): UserRecord | null;

package/dist/migrate/export/okta.js

@@ -0,0 +1,337 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportOkta = exportOkta;
+exports.mapOktaUser = mapOktaUser;
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+/** Profile attributes the user record carries itself; the rest are custom. */
+const BASE_PROFILE = new Set([
+    'login',
+    'email',
+    'secondEmail',
+    'firstName',
+    'lastName',
+    'displayName',
+    'nickName',
+    'mobilePhone',
+    'primaryPhone',
+    'profileUrl',
+]);
+/** Okta social IdP types → the provider name an identity record carries. */
+const SOCIAL = {
+    GOOGLE: 'google',
+    FACEBOOK: 'facebook',
+    MICROSOFT: 'microsoft',
+    APPLE: 'apple',
+    LINKEDIN: 'linkedin',
+    GITHUB: 'github',
+    GITLAB: 'gitlab',
+    AMAZON: 'amazon',
+    DISCORD: 'discord',
+    PAYPAL: 'paypal',
+    SALESFORCE: 'salesforce',
+    SPOTIFY: 'spotify',
+    XERO: 'xero',
+    YAHOO: 'yahoo',
+};
+async function exportOkta(opts) {
+    const set = new record_set_1.RecordSet();
+    const domain = opts.domain.replace(/^https?:\/\//, '').replace(/\/+$/, '');
+    if (!/^[a-z0-9.-]+$/i.test(domain))
+        throw new Error(`Not an Okta domain: ${opts.domain}`);
+    if (!opts.apiToken && !opts.accessToken)
+        throw new Error('Okta export needs an API token (OKTA_API_TOKEN) or an OAuth access token for the management API.');
+    const progress = opts.onProgress ?? (() => undefined);
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'Okta',
+        baseUrl: `https://${domain}/api/v1`,
+        headers: { authorization: opts.apiToken ? `SSWS ${opts.apiToken}` : `Bearer ${opts.accessToken}` },
+        fetchImpl: opts.fetchImpl,
+        sleep: opts.sleep,
+    });
+    const groupsAs = opts.groupsAs ?? 'roles';
+    progress('groups');
+    const groups = groupsAs === 'skip' ? [] : (await linkAll(http, '/groups?limit=200')).filter((g) => (0, record_set_1.str)(g.type) !== 'BUILT_IN');
+    const groupKey = new Map();
+    const keysUsed = new Set();
+    for (const g of groups) {
+        const id = (0, record_set_1.str)(g.id);
+        const name = (0, record_set_1.str)((0, record_set_1.isObj)(g.profile) ? g.profile.name : undefined);
+        if (!id || !name)
+            continue;
+        let key = slug(name);
+        while (keysUsed.has(key))
+            key = `${key}_${id.slice(-4).toLowerCase()}`;
+        keysUsed.add(key);
+        groupKey.set(id, key);
+        const description = (0, record_set_1.str)((0, record_set_1.isObj)(g.profile) ? g.profile.description : undefined);
+        if (groupsAs === 'organizations') {
+            set.add('organization', (0, record_set_1.compact)({ id, name, slug: key.replace(/_/g, '-'), public_metadata: description ? { description } : undefined, created_at: (0, record_set_1.str)(g.created) }));
+        }
+        else {
+            set.add('role', (0, record_set_1.compact)({ key, name, description, scope: 'app' }));
+        }
+    }
+    if (groupsAs === 'organizations') {
+        set.add('role', { key: 'member', name: 'Member', scope: 'organization' });
+    }
+    progress('users');
+    const users = await linkAll(http, '/users?limit=200');
+    const userIds = new Set();
+    for (const u of users) {
+        const user = mapOktaUser(u);
+        if (!user) {
+            set.omit('user', 'no email, phone number or login');
+            continue;
+        }
+        userIds.add(user.id);
+        set.add('user', user);
+    }
+    if (userIds.size) {
+        set.warn('Okta never exports password hashes. Turn on the okta lazy-migration preset: each password is checked against Okta on its first sign-in in Atlas, then stored as Argon2id.');
+    }
+    // Group memberships: roles on the user, or organization memberships.
+    if (groups.length) {
+        progress('group members');
+        const rolesOf = new Map();
+        for (const g of groups) {
+            const id = (0, record_set_1.str)(g.id);
+            const key = id ? groupKey.get(id) : undefined;
+            if (!id || !key)
+                continue;
+            for (const m of await linkAll(http, `/groups/${id}/users?limit=1000`)) {
+                const uid = (0, record_set_1.str)(m.id);
+                if (!uid || !userIds.has(uid))
+                    continue;
+                if (groupsAs === 'organizations')
+                    set.add('membership', { organization_id: id, user_id: uid, role: 'member' }, `${id}:${uid}`);
+                else
+                    rolesOf.set(uid, [...(rolesOf.get(uid) ?? []), key]);
+            }
+        }
+        for (const user of set.list('user')) {
+            const roles = rolesOf.get(user.id);
+            if (roles?.length)
+                user.roles = roles;
+        }
+    }
+    progress('identity providers');
+    await addIdps(set, http, userIds, domain);
+    if (opts.factors) {
+        progress('factors');
+        for (const id of userIds)
+            await addFactors(set, http, id);
+    }
+    else {
+        set.warn('Second factors were not read (pass --factors to carry SMS / voice / email factors). TOTP seeds and Okta Verify never leave Okta.');
+    }
+    progress('signing keys');
+    const server = opts.authorizationServerId ?? 'default';
+    try {
+        const { body } = await http.get(`https://${domain}/oauth2/${server}/v1/keys`);
+        for (const k of (0, record_set_1.objs)(body?.keys))
+            if ((0, record_set_1.str)(k.kid))
+                set.add('jwks', { kid: (0, record_set_1.str)(k.kid), jwk: k });
+    }
+    catch (err) {
+        if (!(err instanceof vendor_http_1.VendorApiError))
+            throw err;
+        set.warn(`The ${server} authorization server's keys could not be read; the bridge preset fetches them live.`);
+    }
+    set.manifest = {
+        origin: domain,
+        providers: [...new Set(set.list('identity').map((i) => i.provider))].sort(),
+        settings: { groups_as: groupsAs, authorization_server: server },
+    };
+    return set;
+}
+/** One Okta user → a user record (null when it has nothing to sign in with). */
+function mapOktaUser(u) {
+    const id = (0, record_set_1.str)(u.id);
+    const status = (0, record_set_1.str)(u.status);
+    if (!id || status === 'DEPROVISIONED')
+        return null;
+    const p = (0, record_set_1.isObj)(u.profile) ? u.profile : {};
+    const credentials = (0, record_set_1.isObj)(u.credentials) ? u.credentials : {};
+    // Okta reports verified addresses under credentials.emails when it has them;
+    // otherwise an ACTIVE user has proven the primary address during activation.
+    const credEmails = (0, record_set_1.objs)(credentials.emails);
+    const verifiedSet = new Set(credEmails.filter((e) => (0, record_set_1.str)(e.status) === 'VERIFIED').map((e) => (0, record_set_1.str)(e.value)?.toLowerCase()));
+    const activated = status !== 'STAGED' && status !== 'PROVISIONED';
+    const primary = (0, record_set_1.str)(p.email)?.toLowerCase();
+    const second = (0, record_set_1.str)(p.secondEmail)?.toLowerCase();
+    const emails = [
+        ...(primary ? [{ email: primary, verified: credEmails.length ? verifiedSet.has(primary) : activated, primary: true }] : []),
+        ...(second && second !== primary ? [{ email: second, verified: verifiedSet.has(second), primary: false }] : []),
+    ];
+    const phones = [...new Set([(0, record_set_1.e164)(p.mobilePhone), (0, record_set_1.e164)(p.primaryPhone)].filter((x) => !!x))].map((phone, i) => ({
+        phone,
+        verified: false,
+        primary: !emails.length && i === 0,
+    }));
+    const login = (0, record_set_1.str)(p.login);
+    const custom = Object.fromEntries(Object.entries(p).filter(([k, v]) => !BASE_PROFILE.has(k) && v !== null && v !== undefined && v !== ''));
+    const user = (0, record_set_1.compact)({
+        id,
+        emails,
+        phones,
+        // The Okta login is often the email; keep it as the username only when it is not.
+        username: login && login.toLowerCase() !== primary ? login : undefined,
+        first_name: (0, record_set_1.str)(p.firstName),
+        last_name: (0, record_set_1.str)(p.lastName),
+        name: !(0, record_set_1.str)(p.firstName) && !(0, record_set_1.str)(p.lastName) ? (0, record_set_1.str)(p.displayName) : undefined,
+        banned: status === 'SUSPENDED' ? true : undefined,
+        ban_reason: status === 'SUSPENDED' ? 'Suspended in Okta' : undefined,
+        locked: status === 'LOCKED_OUT' ? true : undefined,
+        private_metadata: (0, record_set_1.bag)({ ...custom, ...(status && status !== 'ACTIVE' ? { okta_status: status } : {}) }),
+        created_at: (0, record_set_1.str)(u.created),
+        last_sign_in_at: (0, record_set_1.str)(u.lastLogin),
+    });
+    return user.emails?.length || user.phones?.length || user.username ? user : null;
+}
+async function addIdps(set, http, userIds, domain) {
+    let idps;
+    try {
+        idps = await linkAll(http, '/idps?limit=200');
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 401)) {
+            set.warn('Identity providers were not readable with this token (okta.idps.read): social links and SAML/OIDC connections were skipped.');
+            return;
+        }
+        throw err;
+    }
+    for (const idp of idps) {
+        const id = (0, record_set_1.str)(idp.id);
+        const type = (0, record_set_1.str)(idp.type);
+        if (!id || !type || (0, record_set_1.str)(idp.status) === 'INACTIVE')
+            continue;
+        const name = (0, record_set_1.str)(idp.name) ?? type;
+        let provider;
+        let kind;
+        let connectionId;
+        if (SOCIAL[type]) {
+            provider = SOCIAL[type];
+            kind = 'oauth';
+        }
+        else if (type === 'SAML2' || type === 'OIDC') {
+            connectionId = await addEnterpriseIdp(set, http, idp, domain);
+            if (!connectionId)
+                continue;
+            provider = name;
+            kind = type === 'SAML2' ? 'saml' : 'oidc';
+        }
+        else {
+            set.warn(`Identity provider ${name} (${type}) has no Atlas counterpart and was skipped.`);
+            continue;
+        }
+        for (const link of await linkAll(http, `/idps/${id}/users?limit=200`)) {
+            const uid = (0, record_set_1.str)(link.id);
+            const external = (0, record_set_1.str)(link.externalId);
+            if (!uid || !external || !userIds.has(uid))
+                continue;
+            set.add('identity', (0, record_set_1.compact)({ user_id: uid, provider, provider_user_id: external, kind, sso_connection_id: connectionId, profile: (0, record_set_1.bag)(link.profile) }));
+        }
+    }
+}
+async function addEnterpriseIdp(set, http, idp, domain) {
+    const id = (0, record_set_1.str)(idp.id);
+    const name = (0, record_set_1.str)(idp.name) ?? id;
+    const protocol = (0, record_set_1.isObj)(idp.protocol) ? idp.protocol : {};
+    const endpoints = (0, record_set_1.isObj)(protocol.endpoints) ? protocol.endpoints : {};
+    const credentials = (0, record_set_1.isObj)(protocol.credentials) ? protocol.credentials : {};
+    // Okta routes users to an IdP by routing rules, not by a domain on the IdP:
+    // the Atlas connection's domains are set after the import.
+    const domains = [];
+    if ((0, record_set_1.str)(idp.type) === 'SAML2') {
+        const trust = (0, record_set_1.isObj)(credentials.trust) ? credentials.trust : {};
+        const kid = (0, record_set_1.str)(trust.kid);
+        let cert;
+        if (kid) {
+            try {
+                const { body } = await http.get(`/idps/credentials/keys/${kid}`);
+                const x5c = Array.isArray(body?.x5c) ? (0, record_set_1.str)(body.x5c[0]) : undefined;
+                if (x5c)
+                    cert = `-----BEGIN CERTIFICATE-----\n${x5c.match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----`;
+            }
+            catch (err) {
+                if (!(err instanceof vendor_http_1.VendorApiError))
+                    throw err;
+            }
+        }
+        const sso = (0, record_set_1.isObj)(endpoints.sso) ? endpoints.sso : {};
+        const acs = (0, record_set_1.isObj)(endpoints.acs) ? endpoints.acs : {};
+        set.add('sso_connection', (0, record_set_1.compact)({
+            id,
+            name,
+            protocol: 'saml',
+            domains,
+            enabled: (0, record_set_1.str)(idp.status) !== 'INACTIVE',
+            saml: (0, record_set_1.compact)({
+                idp_entity_id: (0, record_set_1.str)(trust.issuer),
+                idp_sso_url: (0, record_set_1.str)(sso.url),
+                idp_certificate: cert,
+                sp_entity_id: (0, record_set_1.str)(trust.audience),
+                sp_acs_url: (0, record_set_1.str)(acs.url) ?? `https://${domain}/sso/saml2/${id}`,
+            }),
+        }));
+        if (!cert)
+            set.warn(`SAML identity provider ${name}: its signing certificate could not be read; add it in Atlas.`);
+        return id;
+    }
+    const issuer = (0, record_set_1.isObj)(protocol.issuer) ? (0, record_set_1.str)(protocol.issuer.url) : undefined;
+    const client = (0, record_set_1.isObj)(credentials.client) ? credentials.client : {};
+    set.add('sso_connection', (0, record_set_1.compact)({
+        id,
+        name,
+        protocol: 'oidc',
+        domains,
+        enabled: (0, record_set_1.str)(idp.status) !== 'INACTIVE',
+        oidc: (0, record_set_1.compact)({ issuer, client_id: (0, record_set_1.str)(client.client_id), scopes: Array.isArray(protocol.scopes) ? protocol.scopes.map(String) : undefined }),
+    }));
+    set.warn(`OIDC identity provider ${name}: Okta does not return its client secret; enter it in Atlas after the import.`);
+    return id;
+}
+async function addFactors(set, http, userId) {
+    let factors;
+    try {
+        factors = (0, record_set_1.objs)((await http.get(`/users/${userId}/factors`)).body);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 404))
+            return;
+        throw err;
+    }
+    for (const f of factors) {
+        if ((0, record_set_1.str)(f.status) !== 'ACTIVE')
+            continue;
+        const type = (0, record_set_1.str)(f.factorType);
+        const profile = (0, record_set_1.isObj)(f.profile) ? f.profile : {};
+        if (type === 'sms' || type === 'call') {
+            const phone = (0, record_set_1.e164)(profile.phoneNumber);
+            if (phone)
+                set.add('mfa_factor', { user_id: userId, type: 'phone', phone, verified: true, created_at: (0, record_set_1.str)(f.created) }, `phone:${userId}:${phone}`);
+        }
+        else if (type === 'email') {
+            set.add('mfa_factor', { user_id: userId, type: 'email', verified: true, created_at: (0, record_set_1.str)(f.created) }, `email:${userId}`);
+        }
+        else if (type) {
+            set.omit('mfa_factor', `Okta does not export ${type} secrets; re-enrol in Atlas`);
+        }
+    }
+}
+/** Follow `Link: <…>; rel="next"` until the last page. */
+async function linkAll(http, path) {
+    const out = [];
+    let next = path;
+    while (next) {
+        const res = await http.get(next);
+        out.push(...(0, record_set_1.objs)(res.body));
+        next = (0, vendor_http_1.nextLink)(res.headers.get('link'));
+    }
+    return out;
+}
+function slug(name) {
+    return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '') || 'group';
+}
+//# sourceMappingURL=okta.js.map

package/dist/migrate/export/okta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"okta.js","sourceRoot":"","sources":["../../../src/migrate/export/okta.ts"],"names":[],"mappings":";;AA4EA,gCAuGC;AAGD,kCAyCC;AA9ND,6CAAyF;AACzF,+CAAqE;AA0CrE,8EAA8E;AAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,OAAO;IACP,OAAO;IACP,aAAa;IACb,WAAW;IACX,UAAU;IACV,aAAa;IACb,UAAU;IACV,aAAa;IACb,cAAc;IACd,YAAY;CACb,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,MAAM,GAA2B;IACrC,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACf,CAAC;AAEK,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IAC7J,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW,MAAM,SAAS;QACnC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE;QAClG,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;IAE1C,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;IAC/H,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAS;QAC3B,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACtB,MAAM,WAAW,GAAG,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACvK,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CACN,2KAA2K,CAC5K,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9C,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;gBAAE,SAAS;YAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBACtE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtB,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACxC,IAAI,QAAQ,KAAK,eAAe;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;;oBAC1H,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,MAAM;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACxC,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC/B,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE1C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,OAAO;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,kIAAkI,CAAC,CAAC;IAC/I,CAAC;IAED,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,IAAI,SAAS,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAqB,WAAW,MAAM,WAAW,MAAM,UAAU,CAAC,CAAC;QAClG,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,EAAE,IAAI,CAAC;YAAE,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC;YAAE,MAAM,GAAG,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,sFAAsF,CAAC,CAAC;IAChH,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG;QACb,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC3E,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE;KAChE,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,SAAgB,WAAW,CAAC,CAAM;IAChC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,MAAM,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,IAAA,iBAAI,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAC5H,MAAM,SAAS,GAAG,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,aAAa,CAAC;IAClE,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3H,GAAG,CAAC,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChH,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1H,KAAK;QACL,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3I,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM;QACN,MAAM;QACN,kFAAkF;QAClF,QAAQ,EAAE,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACtE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5E,MAAM,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACjD,UAAU,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;QACpE,MAAM,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAClD,gBAAgB,EAAE,IAAA,gBAAG,EAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACvG,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;QAC1B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;KAClC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAc,EAAE,IAAgB,EAAE,OAAoB,EAAE,MAAc;IAC3F,IAAI,IAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,6HAA6H,CAAC,CAAC;YACxI,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;YAAE,SAAS;QAC7D,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACnC,IAAI,QAAgB,CAAC;QACrB,IAAI,IAA4B,CAAC;QACjC,IAAI,YAAgC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjB,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAE,CAAC;YACzB,IAAI,GAAG,OAAO,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/C,YAAY,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC,YAAY;gBAAE,SAAS;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,qBAAqB,IAAI,KAAK,IAAI,6CAA6C,CAAC,CAAC;YAC1F,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrD,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,oBAAO,EAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,OAAO,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1K,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAc,EAAE,IAAgB,EAAE,GAAQ,EAAE,MAAc;IACxF,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,WAAW,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,IAAwB,CAAC;QAC7B,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,0BAA0B,GAAG,EAAE,CAAC,CAAC;gBACtE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACpE,IAAI,GAAG;oBAAE,IAAI,GAAG,gCAAgC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC;YACjH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC;oBAAE,MAAM,GAAG,CAAC;YAClD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,IAAI;YACJ,QAAQ,EAAE,MAAe;YACzB,OAAO;YACP,OAAO,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;YACvC,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,aAAa,EAAE,IAAA,gBAAG,EAAC,KAAK,CAAC,MAAM,CAAC;gBAChC,WAAW,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,GAAG,CAAC;gBACzB,eAAe,EAAE,IAAI;gBACrB,YAAY,EAAE,IAAA,gBAAG,EAAC,KAAK,CAAC,QAAQ,CAAC;gBACjC,UAAU,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,MAAM,cAAc,EAAE,EAAE;aAChE,CAAC;SACH,CAAC,CACH,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,+DAA+D,CAAC,CAAC;QACnH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;QACN,EAAE;QACF,IAAI;QACJ,QAAQ,EAAE,MAAe;QACzB,OAAO;QACP,OAAO,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;QACvC,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;KAC9I,CAAC,CACH,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,+EAA+E,CAAC,CAAC;IACxH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAc,EAAE,IAAgB,EAAE,MAAc;IACxE,IAAI,OAAc,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAU,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;YAAE,OAAO;QACxF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,KAAK;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;QACtJ,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;QAC3H,CAAC;aAAM,IAAI,IAAI,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,wBAAwB,IAAI,6BAA6B,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAY;IACnD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,GAAwC,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG,IAAA,sBAAQ,EAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC;AAClG,CAAC"}

package/dist/migrate/export/onelogin.d.ts

@@ -0,0 +1,22 @@
+import { RecordSet } from './record-set';
+/**
+ * `atlas migrate onelogin export` — a OneLogin account through API v2 with API
+ * credentials (client id + secret, on this machine): users (login, email,
+ * name, phone, status, custom attributes, last login) and roles (as app roles,
+ * with their members).
+ *
+ * OneLogin never returns password hashes or MFA secrets: passwords move by lazy
+ * migration (the `onelogin` preset), second factors are enrolled again.
+ */
+export interface OneLoginExportOptions {
+    subdomain: string;
+    clientId: string;
+    clientSecret: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** `acme`, `acme.onelogin.com` or a URL → `acme`. */
+export declare function oneLoginSubdomain(raw: string): string;
+export declare function oneLoginToken(o: Pick<OneLoginExportOptions, 'subdomain' | 'clientId' | 'clientSecret' | 'fetchImpl'>): Promise<string>;
+export declare function exportOneLogin(o: OneLoginExportOptions): Promise<RecordSet>;

package/dist/migrate/export/onelogin.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oneLoginSubdomain = oneLoginSubdomain;
+exports.oneLoginToken = oneLoginToken;
+exports.exportOneLogin = exportOneLogin;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+/** `acme`, `acme.onelogin.com` or a URL → `acme`. */
+function oneLoginSubdomain(raw) {
+    const s = raw.trim().replace(/^https?:\/\//, '').replace(/[/?#].*$/, '').replace(/\.onelogin\.com$/i, '');
+    if (!/^[a-z0-9][a-z0-9-]{0,62}$/i.test(s))
+        throw new Error(`"${raw}" is not a OneLogin subdomain.`);
+    return s.toLowerCase();
+}
+/** OneLogin user `status` codes. */
+const STATUS = { suspended: 2, locked: 3 };
+async function oneLoginToken(o) {
+    const f = o.fetchImpl ?? fetch;
+    const res = await f(`https://${oneLoginSubdomain(o.subdomain)}.onelogin.com/auth/oauth2/v2/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', authorization: `client_id:${o.clientId}, client_secret:${o.clientSecret}` },
+        body: JSON.stringify({ grant_type: 'client_credentials' }),
+    });
+    const body = (await res.json().catch(() => null));
+    const token = (0, record_set_1.str)(body?.access_token);
+    if (res.status !== 200 || !token)
+        throw new Error(`OneLogin refused the API credentials (${res.status}).`);
+    return token;
+}
+async function pages(http, path) {
+    const out = [];
+    let cursor = null;
+    do {
+        const sep = path.includes('?') ? '&' : '?';
+        const res = await http.get(cursor ? `${path}${sep}cursor=${encodeURIComponent(cursor)}` : path);
+        out.push(...(0, record_set_1.objs)(res.body));
+        cursor = res.headers.get('after-cursor') || null;
+    } while (cursor);
+    return out;
+}
+async function exportOneLogin(o) {
+    const set = new record_set_1.RecordSet();
+    const say = o.onProgress ?? (() => undefined);
+    const sub = oneLoginSubdomain(o.subdomain);
+    set.manifest = { origin: `OneLogin account ${sub}.onelogin.com` };
+    const token = await oneLoginToken(o);
+    const http = new vendor_http_1.VendorHttp({ vendor: 'OneLogin', baseUrl: `https://${sub}.onelogin.com`, headers: { authorization: `Bearer ${token}` }, fetchImpl: o.fetchImpl, sleep: o.sleep });
+    say('roles');
+    const roleKey = new Map();
+    try {
+        for (const r of await pages(http, '/api/2/roles?limit=100')) {
+            const id = (0, record_set_1.str)(r.id);
+            const name = (0, record_set_1.str)(r.name);
+            if (!id || !name)
+                continue;
+            const key = (0, translate_kit_1.keyOf)(name);
+            roleKey.set(id, key);
+            set.add('role', { key, name, scope: 'app' }, key);
+        }
+    }
+    catch (err) {
+        if (!(err instanceof vendor_http_1.VendorApiError && [401, 403, 404].includes(err.status)))
+            throw err;
+        set.warn('Roles could not be read (the API credential lacks the Read roles scope): users are imported without roles.');
+    }
+    say('users');
+    const users = await pages(http, '/api/2/users?limit=100');
+    let unactivated = 0;
+    for (const u of users) {
+        const id = (0, record_set_1.str)(u.id);
+        if (!id)
+            continue;
+        const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+        const emails = email?.includes('@') ? [{ email, verified: false, primary: true }] : [];
+        const phone = (0, record_set_1.e164)(u.phone);
+        const phones = phone ? [{ phone, verified: false, primary: true }] : [];
+        const status = Number(u.status);
+        const roles = (Array.isArray(u.role_ids) ? u.role_ids.map(String) : []).map((r) => roleKey.get(r)).filter((r) => !!r);
+        const record = (0, record_set_1.compact)({
+            id,
+            emails,
+            phones,
+            username: (0, record_set_1.str)(u.username),
+            first_name: (0, record_set_1.str)(u.firstname),
+            last_name: (0, record_set_1.str)(u.lastname),
+            created_at: (0, record_set_1.str)(u.created_at),
+            last_sign_in_at: (0, record_set_1.str)(u.last_login),
+            roles: [...new Set(roles)],
+            private_metadata: {
+                onelogin: (0, record_set_1.compact)({
+                    status,
+                    external_id: (0, record_set_1.str)(u.external_id),
+                    directory_id: (0, record_set_1.str)(u.directory_id),
+                    group_id: (0, record_set_1.str)(u.group_id),
+                    title: (0, record_set_1.str)(u.title),
+                    department: (0, record_set_1.str)(u.department),
+                    company: (0, record_set_1.str)(u.company),
+                    custom_attributes: (0, record_set_1.bag)(u.custom_attributes),
+                }),
+            },
+        });
+        if (status === STATUS.suspended) {
+            record.banned = true;
+            record.ban_reason = 'Suspended in OneLogin';
+        }
+        else if (status === STATUS.locked)
+            record.locked = true;
+        if (status === 0)
+            unactivated++;
+        if (!record.emails?.length && !record.phones?.length && !record.username) {
+            set.omit('user', 'no email, phone or username', 1);
+            continue;
+        }
+        set.add('user', record, id);
+    }
+    set.omit('password', 'OneLogin never exports password hashes', users.length);
+    set.warn('Addresses are imported unverified (OneLogin does not say which were confirmed). Passwords move by lazy migration (preset onelogin); users enrol their second factor again.');
+    if (unactivated)
+        set.warn(`${unactivated} user(s) never activated their OneLogin account (no password to migrate).`);
+    return set;
+}
+//# sourceMappingURL=onelogin.js.map

package/dist/migrate/export/onelogin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onelogin.js","sourceRoot":"","sources":["../../../src/migrate/export/onelogin.ts"],"names":[],"mappings":";;AAyBA,8CAIC;AAKD,sCAWC;AAcD,wCA2EC;AArID,6CAAkF;AAClF,mDAAwC;AACxC,+CAA2D;AAqB3D,qDAAqD;AACrD,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,GAAG,gCAAgC,CAAC,CAAC;IACpG,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,oCAAoC;AACpC,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAW,CAAC;AAE7C,KAAK,UAAU,aAAa,CAAC,CAAuF;IACzH,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,oCAAoC,EAAE;QACjG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,QAAQ,mBAAmB,CAAC,CAAC,YAAY,EAAE,EAAE;QAC1H,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAe,CAAC;IAChE,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC3G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAgB,EAAE,IAAY;IACjD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,GAAG,CAAC;QACF,MAAM,GAAG,GAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnD,MAAM,GAAG,GAAwC,MAAM,IAAI,CAAC,GAAG,CAAU,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9I,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,GAAG,CAAC;AACb,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,CAAwB;IAC3D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3C,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,oBAAoB,GAAG,eAAe,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,GAAG,eAAe,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAEnL,GAAG,CAAC,OAAO,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,EAAE,CAAC;YAC5D,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;gBAAE,SAAS;YAC3B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;IACzH,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAC1D,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAmB,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,QAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClJ,MAAM,MAAM,GAAe,IAAA,oBAAO,EAAC;YACjC,EAAE;YACF,MAAM;YACN,MAAM;YACN,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YACzB,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;YAC5B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YAC1B,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;YAC7B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;YAClC,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1B,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,IAAA,oBAAO,EAAC;oBAChB,MAAM;oBACN,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;oBAC/B,YAAY,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;oBACjC,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;oBACzB,KAAK,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC;oBACnB,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;oBAC7B,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;oBACvB,iBAAiB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC;iBAC5C,CAAC;aACH;SACY,CAAC,CAAC;QACjB,IAAI,MAAM,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,UAAU,GAAG,uBAAuB,CAAC;QAC9C,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1D,IAAI,MAAM,KAAK,CAAC;YAAE,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,wCAAwC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7E,GAAG,CAAC,IAAI,CAAC,4KAA4K,CAAC,CAAC;IACvL,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,2EAA2E,CAAC,CAAC;IACrH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/ory-config.d.ts

@@ -0,0 +1,58 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate ory config` — Ory Kratos and Hydra settings → Atlas config.
+ *
+ * Three readers, one translation:
+ *   - a Kratos config file (`kratos.yml`, or the JSON `ory get identity-config
+ *     --format json` prints), every report line carrying file:line for YAML;
+ *   - an Ory Network project (`ory get project <id> --format json`: the Kratos
+ *     config under `services.identity.config`, Hydra's under
+ *     `services.oauth2.config`);
+ *   - a Hydra config (`hydra.yml`) and the live Hydra Admin API, whose OAuth 2.0
+ *     clients become Atlas OAuth clients (Hydra keeps only hashed client
+ *     secrets: every secret is reissued).
+ * The identity schemas (`identity.schemas`: inline `base64://`, local `file://`,
+ * or the public `GET /schemas` of a running Kratos) say which traits are the
+ * email, username, phone and name and which are custom.
+ */
+/** One config file: its parsed value, with the source line of any dotted path. */
+export interface OryConfigFile {
+    value: Obj;
+    file: string;
+    line(path: string): number | undefined;
+}
+export interface OryIdentitySchema {
+    id: string;
+    schema: Obj;
+}
+export interface OryConfigSnapshot {
+    origin: string;
+    /** Kratos configuration (kratos.yml / `services.identity.config`). */
+    kratos?: OryConfigFile;
+    /** Hydra configuration (hydra.yml / `services.oauth2.config`). */
+    hydra?: OryConfigFile;
+    schemas: OryIdentitySchema[];
+    /** Hydra OAuth 2.0 clients (`GET /admin/clients`). */
+    clients: Obj[];
+    /** Kratos' public URL (the bridge and the lazy preset call it). */
+    publicUrl?: string;
+}
+/** A config file's text: JSON when it starts with `{`, otherwise YAML. */
+export declare function parseOryConfig(text: string, file: string): OryConfigFile;
+/** An `ory get project --format json` document split into its Kratos and Hydra configs; null when it is not one. */
+export declare function splitOryProject(file: OryConfigFile): {
+    kratos: OryConfigFile;
+    hydra?: OryConfigFile;
+    slug?: string;
+} | null;
+/** Identity schemas a Kratos config names that can be read without the network: `base64://` and `file://` (through `readFile`). */
+export declare function resolveOrySchemas(kratos: OryConfigFile | undefined, readFile: (path: string) => string, warn?: (m: string) => void): OryIdentitySchema[];
+/** Kratos' public `GET /schemas`: `[{ id, schema }]`. */
+export declare function fetchOrySchemas(http: VendorHttp): Promise<OryIdentitySchema[]>;
+/** Hydra's `GET /admin/clients`, following the Link header's page_token. */
+export declare function fetchOryClients(http: VendorHttp, pageSize?: number): Promise<Obj[]>;
+/** Go durations (`24h`, `720h`, `1h30m`) → ms. */
+export declare function goDurationMs(v: unknown): number | undefined;
+export declare function translateOryConfig(snap: OryConfigSnapshot): TranslationResult;