@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/export/ory.js

@@ -0,0 +1,555 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oryPasswordHash = oryPasswordHash;
+exports.exportOryTables = exportOryTables;
+exports.oryIdentityFromApi = oryIdentityFromApi;
+exports.nextPageToken = nextPageToken;
+exports.exportOryApi = exportOryApi;
+const tables_1 = require("./frameworks/tables");
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+/** Kratos' TOTP parameters (pquerna/otp defaults; not configurable). */
+const TOTP = { digits: 6, period: 30, algorithm: 'SHA1' };
+const NO_PASSKEY_RP = 'Passkeys were left out: pass the relying-party id they were registered for (--set ory-rp-id=<…rp.id from kratos.yml>, e.g. example.com).';
+const NO_IDENTIFIER = 'Identity with no email address, phone number or username';
+// ── password hashes ─────────────────────────────────────────────────────────
+const B64 = '[A-Za-z0-9+/]*={0,2}';
+const PF_DIGEST = new RegExp(`^\\$(md5|sha1|sha256|sha512)\\$pf=${B64}\\$${B64}\\$${B64}$`);
+const HMAC = new RegExp(`^\\$hmac-(md5|sha1|sha224|sha256|sha384|sha512)\\$${B64}\\$${B64}$`);
+/**
+ * A Kratos `hashed_password` as a bundle password; null when Atlas cannot
+ * verify the format (`$hmac-md4$`, unknown schemes), whose users then move by
+ * lazy migration. Formats: hash/hash_comparator.go.
+ */
+function oryPasswordHash(raw) {
+    const d = (0, tables_1.text)(raw);
+    if (!d)
+        return null;
+    if (/^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/.test(d))
+        return { algorithm: 'bcrypt', hash: d };
+    if (/^\$argon2(id|i|d)\$/.test(d))
+        return { algorithm: 'argon2', hash: d };
+    // {SSHA}, {SSHA256}, {SSHA512}, {SHA…}: self-describing LDAP digests.
+    if (/^\{(SSHA|SSHA256|SSHA512|SHA|SHA256|SHA512)\}[A-Za-z0-9+/=]+$/i.test(d))
+        return { algorithm: 'auto', hash: d };
+    // The two Kratos-only formats the registry recognises by themselves.
+    if (PF_DIGEST.test(d) || HMAC.test(d))
+        return { algorithm: 'auto', hash: d };
+    // $pbkdf2-sha256$i=100000,l=32$<salt>$<hash>: unpadded standard base64 (not passlib ab64).
+    let m = /^\$pbkdf2-(sha1|sha256|sha384|sha512)\$i=(\d+),l=(\d+)\$([^$]+)\$([^$]+)$/.exec(d);
+    if (m) {
+        return { algorithm: 'pbkdf2', hash: m[5], salt: m[4], params: { digest: m[1], iterations: Number(m[2]), key_length: Number(m[3]), encoding: 'base64', salt_encoding: 'base64' } };
+    }
+    // $scrypt$ln=<N>,r=<r>,p=<p>$<salt>$<hash>: Kratos writes N itself in `ln`.
+    m = /^\$scrypt\$ln=(\d+),r=(\d+),p=(\d+)\$([^$]+)\$([^$]+)$/.exec(d);
+    if (m)
+        return { algorithm: 'scrypt', hash: m[5], salt: m[4], params: { n: Number(m[1]), r: Number(m[2]), p: Number(m[3]), encoding: 'base64', salt_encoding: 'base64' } };
+    // $firescrypt$ln=<mem_cost>,r=<rounds>,p=1$<salt>$<hash>$<salt separator>$<signer key>.
+    m = /^\$firescrypt\$ln=(\d+),r=(\d+),p=(\d+)\$([^$]+)\$([^$]+)\$([^$]*)\$([^$]+)$/.exec(d);
+    if (m) {
+        if (m[3] !== '1')
+            return null;
+        return { algorithm: 'scrypt_firebase', hash: m[5], salt: m[4], params: { rounds: Number(m[2]), mem_cost: Number(m[1]), salt_separator: m[6], signer_key: m[7] } };
+    }
+    // $md5$<base64 digest> (the salted/templated forms are $md5$pf=…, handled above).
+    m = /^\$md5\$([A-Za-z0-9+/]+={0,2})$/.exec(d);
+    if (m)
+        return { algorithm: 'md5', hash: m[1], params: { encoding: 'base64' } };
+    // $md5-crypt$, $sha256-crypt$, $sha512-crypt$: the crypt(3) strings under Kratos' prefix.
+    m = /^\$(md5|sha256|sha512)-crypt\$(.+)$/.exec(d);
+    if (m)
+        return { algorithm: 'auto', hash: `$${{ md5: '1', sha256: '5', sha512: '6' }[m[1]]}$${m[2]}` };
+    if (/^\$(1|5|6)\$/.test(d))
+        return { algorithm: 'auto', hash: d };
+    return null;
+}
+const EMAIL_KEYS = ['email', 'email_address', 'emailaddress', 'mail', 'e-mail'];
+const USERNAME_KEYS = ['username', 'user_name', 'login', 'handle', 'nickname'];
+const PHONE_KEYS = ['phone', 'phone_number', 'phonenumber', 'mobile', 'tel'];
+const IMAGE_KEYS = ['picture', 'avatar', 'avatar_url', 'image', 'photo'];
+const FIRST_KEYS = ['first_name', 'firstname', 'given_name', 'givenname'];
+const LAST_KEYS = ['last_name', 'lastname', 'family_name', 'familyname', 'surname'];
+/** A top-level trait by any of its usual names (case-insensitive); returns the real key too. */
+function trait(traits, keys) {
+    for (const k of Object.keys(traits))
+        if (keys.includes(k.toLowerCase()))
+            return { key: k, value: traits[k] };
+    return undefined;
+}
+/** Group a Go-style `{Time, Valid}` or plain nullable timestamp: the time when it is set. */
+function nullTime(v) {
+    if ((0, record_set_1.isObj)(v))
+        return v.Valid === true ? (0, record_set_1.str)(v.Time) : undefined;
+    const s = (0, record_set_1.str)(v);
+    return s && !s.startsWith('0001-') ? s : undefined;
+}
+/** 16 bytes (base64) as an AAGUID UUID; undefined for the all-zero AAGUID or anything else. */
+function aaguid(v) {
+    const s = (0, record_set_1.str)(v);
+    if (!s)
+        return undefined;
+    if (/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(s))
+        return /^[0-]+$/.test(s) ? undefined : s.toLowerCase();
+    const bytes = Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+    if (bytes.length !== 16 || bytes.every((b) => b === 0))
+        return undefined;
+    const hex = bytes.toString('hex');
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+/** A `totp_url` (`otpauth://totp/Issuer:account?secret=…`) as a factor. */
+function totpFactor(url) {
+    const raw = (0, record_set_1.str)(url);
+    if (!raw)
+        return null;
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    const secret = u.searchParams.get('secret')?.replace(/\s|=+$/g, '').toUpperCase();
+    if (u.protocol !== 'otpauth:' || !secret || !/^[A-Z2-7]+$/.test(secret))
+        return null;
+    const alg = (u.searchParams.get('algorithm') ?? 'SHA1').toUpperCase();
+    const digits = Number(u.searchParams.get('digits') ?? TOTP.digits);
+    const period = Number(u.searchParams.get('period') ?? TOTP.period);
+    return {
+        type: 'totp',
+        secret_base32: secret,
+        digits: Number.isInteger(digits) && digits >= 6 && digits <= 8 ? digits : TOTP.digits,
+        period: Number.isInteger(period) && period > 0 ? period : TOTP.period,
+        algorithm: alg === 'SHA256' || alg === 'SHA512' ? alg : 'SHA1',
+        verified: true,
+    };
+}
+/** WebAuthn / passkey credential configs (`{ credentials: [{ id, public_key, authenticator, … }] }`). */
+function passkeys(userId, config, rpId, set) {
+    let mfaOnly = 0;
+    for (const c of (0, record_set_1.objs)(config.credentials)) {
+        const credentialId = (0, tables_1.base64url)(c.id);
+        const publicKey = (0, tables_1.base64url)(c.public_key);
+        if (!credentialId || !publicKey) {
+            set.omit('passkey', 'WebAuthn credential without an id or public key');
+            continue;
+        }
+        const auth = (0, record_set_1.isObj)(c.authenticator) ? c.authenticator : {};
+        const flags = (0, record_set_1.isObj)(c.flags) ? c.flags : {};
+        const count = Number(auth.sign_count);
+        // go-webauthn nests the backup flags; older Kratos kept them beside the credential.
+        const backup = flags.backup_state ?? c.backup_state;
+        // `is_passwordless: false` is a security key registered as a second factor only.
+        if (c.is_passwordless === false)
+            mfaOnly++;
+        set.add('passkey', (0, record_set_1.compact)({
+            id: credentialId,
+            user_id: userId,
+            credential_id: credentialId,
+            public_key: publicKey,
+            sign_count: Number.isFinite(count) && count > 0 ? count : undefined,
+            rp_id: rpId,
+            transports: (0, record_set_1.strs)(c.transport ?? c.transports),
+            aaguid: aaguid(auth.aaguid),
+            backed_up: backup === undefined ? undefined : (0, tables_1.bool)(backup),
+            name: (0, record_set_1.str)(c.display_name),
+            created_at: (0, tables_1.time)(c.added_at),
+        }), credentialId);
+    }
+    return { mfaOnly };
+}
+/** The recovery codes still unused (`used_at` null / invalid); plaintext, as Kratos keeps them. */
+function recoveryCodes(config) {
+    return (0, record_set_1.objs)(config.recovery_codes)
+        .filter((c) => nullTime(c.used_at) === undefined)
+        .map((c) => (0, record_set_1.str)(c.code))
+        .filter((c) => c !== undefined);
+}
+function mapIdentities(list, o) {
+    const set = new record_set_1.RecordSet();
+    const providers = new Set();
+    const exported = new Set();
+    let withPassword = 0;
+    let withTotp = 0;
+    let withRecovery = 0;
+    let withWebauthn = 0;
+    let unsupportedHash = 0;
+    let missingHash = 0;
+    let migrationHook = 0;
+    let credentialsWithoutRp = 0;
+    let mfaOnly = 0;
+    let inOrganization = 0;
+    let codeOnly = 0;
+    for (const i of list) {
+        // ── identifiers ──
+        const emails = [];
+        const seenEmail = new Set();
+        const addEmail = (raw, verified) => {
+            const email = (0, record_set_1.str)(raw)?.toLowerCase();
+            if (!email || !email.includes('@') || seenEmail.has(email))
+                return;
+            seenEmail.add(email);
+            emails.push({ email, verified, primary: emails.length === 0 });
+        };
+        for (const a of i.addresses)
+            if (a.via === 'email')
+                addEmail(a.value, a.verified);
+        const consumed = new Set();
+        const tEmail = trait(i.traits, EMAIL_KEYS);
+        if (tEmail) {
+            consumed.add(tEmail.key);
+            addEmail(tEmail.value, false);
+        }
+        const phones = [];
+        const addPhone = (raw, verified) => {
+            const phone = (0, record_set_1.e164)(raw);
+            if (phone && !phones.some((p) => p.phone === phone))
+                phones.push({ phone, verified, primary: phones.length === 0 });
+        };
+        for (const a of i.addresses)
+            if (a.via === 'sms' || a.via === 'phone')
+                addPhone(a.value, a.verified);
+        const tPhone = trait(i.traits, PHONE_KEYS);
+        if (tPhone) {
+            consumed.add(tPhone.key);
+            addPhone(tPhone.value, false);
+        }
+        const tUser = trait(i.traits, USERNAME_KEYS);
+        if (tUser)
+            consumed.add(tUser.key);
+        const password = i.credentials.get('password');
+        // A password identifier that is neither of the above is the sign-in name.
+        const username = (0, record_set_1.str)(tUser?.value) ?? (emails.length || phones.length ? undefined : password?.identifiers[0]);
+        if (!emails.length && !phones.length && !username) {
+            set.omit('user', NO_IDENTIFIER);
+            continue;
+        }
+        // ── profile ──
+        const tName = trait(i.traits, ['name', 'full_name', 'fullname', 'display_name', 'displayname']);
+        let first = (0, record_set_1.str)(trait(i.traits, FIRST_KEYS)?.value);
+        let last = (0, record_set_1.str)(trait(i.traits, LAST_KEYS)?.value);
+        const nameValue = tName?.value;
+        let full;
+        if ((0, record_set_1.isObj)(nameValue)) {
+            first ??= (0, record_set_1.str)(trait(nameValue, ['first', 'first_name', 'given', 'given_name'])?.value);
+            last ??= (0, record_set_1.str)(trait(nameValue, ['last', 'last_name', 'family', 'family_name', 'surname'])?.value);
+            full = (0, record_set_1.str)(trait(nameValue, ['full', 'full_name', 'display'])?.value);
+        }
+        else {
+            full = (0, record_set_1.str)(nameValue);
+        }
+        if (tName)
+            consumed.add(tName.key);
+        for (const k of Object.keys(i.traits))
+            if ([...FIRST_KEYS, ...LAST_KEYS].includes(k.toLowerCase()))
+                consumed.add(k);
+        const tImage = trait(i.traits, IMAGE_KEYS);
+        if (tImage)
+            consumed.add(tImage.key);
+        const image = (0, record_set_1.str)(tImage?.value);
+        const rest = {};
+        for (const [k, v] of Object.entries(i.traits))
+            if (!consumed.has(k))
+                rest[k] = v;
+        // ── password ──
+        let pw;
+        if (password) {
+            withPassword++;
+            const hashed = (0, record_set_1.str)(password.config?.hashed_password);
+            if (hashed) {
+                const mapped = oryPasswordHash(hashed);
+                if (mapped)
+                    pw = mapped;
+                else
+                    unsupportedHash++;
+            }
+            else if (password.config?.use_password_migration_hook === true)
+                migrationHook++;
+            else if (o.source === 'database')
+                missingHash++;
+        }
+        const meta = (0, record_set_1.bag)(i.adminMetadata);
+        const private_metadata = i.schemaId && i.schemaId !== 'default' ? { ...(meta ?? {}), ory_schema_id: i.schemaId } : meta;
+        set.add('user', (0, record_set_1.compact)({
+            id: i.id,
+            emails,
+            phones,
+            username,
+            first_name: first,
+            last_name: last,
+            name: full,
+            image_url: image,
+            password: pw,
+            banned: i.state === 'inactive' ? true : undefined,
+            ban_reason: i.state === 'inactive' ? 'Deactivated in Ory' : undefined,
+            public_metadata: (0, record_set_1.bag)(i.publicMetadata),
+            private_metadata,
+            unsafe_metadata: (0, record_set_1.bag)(rest) ? { ory_traits: rest } : undefined,
+            created_at: (0, tables_1.time)(i.createdAt),
+        }), i.id);
+        exported.add(i.id);
+        if (i.organizationId)
+            inOrganization++;
+        // ── social links ──
+        const oidc = i.credentials.get('oidc');
+        if (oidc) {
+            const links = (0, record_set_1.objs)(oidc.config?.providers).map((p) => ({ provider: (0, record_set_1.str)(p.provider), subject: (0, record_set_1.str)(p.subject) }));
+            // The Admin API without config: identifiers are `<provider>:<subject>`.
+            if (!links.length) {
+                for (const id of oidc.identifiers) {
+                    const at = id.indexOf(':');
+                    if (at > 0)
+                        links.push({ provider: id.slice(0, at), subject: id.slice(at + 1) });
+                }
+            }
+            for (const l of links) {
+                if (!l.provider || !l.subject)
+                    continue;
+                providers.add(l.provider);
+                set.add('identity', (0, record_set_1.compact)({ user_id: i.id, provider: l.provider, provider_user_id: l.subject, email: emails[0]?.email }), `${l.provider}\u0000${l.subject}`);
+            }
+        }
+        // ── second factors ──
+        const totp = i.credentials.get('totp');
+        if (totp) {
+            withTotp++;
+            const factor = totpFactor(totp.config?.totp_url);
+            if (factor)
+                set.add('mfa_factor', { ...factor, user_id: i.id });
+        }
+        const lookup = i.credentials.get('lookup_secret');
+        if (lookup) {
+            withRecovery++;
+            const codes = recoveryCodes(lookup.config ?? {});
+            if (codes.length)
+                set.add('mfa_factor', { user_id: i.id, type: 'backup_codes', backup_codes: codes, verified: true });
+        }
+        if (i.credentials.has('code') && i.credentials.size === 1)
+            codeOnly++;
+        // ── passkeys and security keys (type `webauthn` before Kratos 1.2, `passkey` after) ──
+        for (const type of ['webauthn', 'passkey']) {
+            const c = i.credentials.get(type);
+            if (!c)
+                continue;
+            withWebauthn++;
+            if (!c.config)
+                continue; // the Admin API: counted, not exportable
+            if (!o.rpId) {
+                credentialsWithoutRp += (0, record_set_1.objs)(c.config.credentials).length;
+                continue;
+            }
+            mfaOnly += passkeys(i.id, c.config, o.rpId, set).mfaOnly;
+        }
+    }
+    // ── sessions (the database only) ──
+    let inactive = 0;
+    for (const s of o.sessions ?? []) {
+        if (!exported.has(s.identityId))
+            continue;
+        if (!s.active || !s.expiresAt || s.expiresAt <= o.now || !s.token) {
+            inactive++;
+            continue;
+        }
+        set.add('session', (0, record_set_1.compact)({
+            id: s.id,
+            user_id: s.identityId,
+            token_hash: (0, tables_1.sha256Hex)(s.token),
+            expires_at: s.expiresAt,
+            mfa_verified: s.aal === 'aal2' ? true : undefined,
+            created_at: (0, tables_1.time)(s.authenticatedAt),
+        }), s.id);
+    }
+    if (inactive)
+        set.omit('session', 'Session already expired, signed out or without a token', inactive);
+    // ── what moved, what did not ──
+    if (o.source === 'api') {
+        if (withPassword) {
+            set.warn(`${withPassword} identit${withPassword === 1 ? 'y has' : 'ies have'} a password: the Admin API never returns password hashes, so they move by lazy migration (preset ory) on each user's first Atlas sign-in — or export from the database instead.`);
+        }
+        if (withTotp || withRecovery)
+            set.warn(`${withTotp} TOTP and ${withRecovery} recovery-code credential(s): the Admin API never returns them, so those users enrol an authenticator again in Atlas (a database dump carries the seeds).`);
+        if (withWebauthn) {
+            set.omit('passkey', 'The Ory Admin API never returns WebAuthn / passkey credentials (export from the database)', withWebauthn);
+            set.warn(`${withWebauthn} identit${withWebauthn === 1 ? 'y has' : 'ies have'} a passkey or security key: the Admin API does not return them, so users register one again (a database dump carries them).`);
+        }
+        set.warn('Session tokens are not exported (the Admin API has none): the bridge asks Ory to vouch for the session instead (preset ory_whoami / ory_whoami_token).');
+    }
+    else {
+        if (unsupportedHash)
+            set.warn(`${unsupportedHash} password hash(es) are in a format Atlas cannot verify (for example $hmac-md4$): those users move by lazy migration (preset ory) or reset their password.`);
+        if (missingHash)
+            set.warn(`${missingHash} identit${missingHash === 1 ? 'y has' : 'ies have'} a password credential without a stored hash: they move by lazy migration (preset ory).`);
+    }
+    if (migrationHook)
+        set.warn(`${migrationHook} identit${migrationHook === 1 ? 'y has' : 'ies have'} a password still held by your password-migration webhook (use_password_migration_hook): Atlas never saw a hash, so these move by lazy migration (preset ory).`);
+    if (credentialsWithoutRp) {
+        set.omit('passkey', 'No relying-party id given (--set ory-rp-id)', credentialsWithoutRp);
+        set.warn(NO_PASSKEY_RP);
+    }
+    if (mfaOnly) {
+        set.warn(`${mfaOnly} WebAuthn credential(s) were security keys used only as a second factor. They move as passkeys bound to the same relying-party id; Atlas can also accept them as a first factor.`);
+    }
+    if (inOrganization)
+        set.warn(`${inOrganization} identit${inOrganization === 1 ? 'y belongs' : 'ies belong'} to Ory Network organizations (enterprise SSO): organizations are not exported; their SSO connections are recreated in Atlas by hand.`);
+    if (codeOnly)
+        set.warn(`${codeOnly} identit${codeOnly === 1 ? 'y signs' : 'ies sign'} in only with an emailed or texted code: they work in Atlas through its one-time-code strategy with no further step.`);
+    set.manifest = (0, record_set_1.compact)({ origin: o.origin, rpId: o.rpId, providers: [...providers].sort(), settings: { totp: { ...TOTP } } });
+    return set;
+}
+// ── a database dump ─────────────────────────────────────────────────────────
+/** Credential type names Kratos stores in `identity_credential_types.name`. */
+function typeOfConfig(config) {
+    if (!config)
+        return undefined;
+    if ('hashed_password' in config)
+        return 'password';
+    if ('totp_url' in config)
+        return 'totp';
+    if ('recovery_codes' in config)
+        return 'lookup_secret';
+    if ('providers' in config)
+        return 'oidc';
+    if ('credentials' in config)
+        return 'webauthn';
+    return undefined;
+}
+function exportOryTables(tables, opts = {}) {
+    const nidOf = (r) => (0, tables_1.text)((0, tables_1.col)(r, 'nid'));
+    const identities = tables.rows('identities');
+    const nids = new Set(identities.map(nidOf).filter((n) => !!n));
+    if (!opts.networkId && nids.size > 1) {
+        throw new Error(`The dump holds several Ory projects (nid ${[...nids].join(', ')}): name one with --set ory-nid=<id>.`);
+    }
+    const mine = (rows) => (opts.networkId ? rows.filter((r) => nidOf(r) === opts.networkId) : rows);
+    const typeNames = new Map();
+    for (const t of tables.rows('identity_credential_types')) {
+        const id = (0, tables_1.text)((0, tables_1.col)(t, 'id'));
+        const name = (0, tables_1.text)((0, tables_1.col)(t, 'name'));
+        if (id && name)
+            typeNames.set(id, name);
+    }
+    const identifiers = new Map();
+    for (const r of mine(tables.rows('identity_credential_identifiers'))) {
+        const cid = (0, tables_1.text)((0, tables_1.col)(r, 'identity_credential_id'));
+        const identifier = (0, tables_1.text)((0, tables_1.col)(r, 'identifier'));
+        if (cid && identifier)
+            identifiers.set(cid, [...(identifiers.get(cid) ?? []), identifier.toLowerCase()]);
+    }
+    const byIdentity = new Map();
+    for (const r of mine(identities)) {
+        const id = (0, tables_1.text)((0, tables_1.col)(r, 'id'));
+        if (!id)
+            continue;
+        byIdentity.set(id, {
+            id,
+            schemaId: (0, tables_1.text)((0, tables_1.col)(r, 'schema_id')),
+            state: (0, tables_1.text)((0, tables_1.col)(r, 'state')),
+            traits: (0, tables_1.json)((0, tables_1.col)(r, 'traits')) ?? {},
+            addresses: [],
+            publicMetadata: (0, tables_1.json)((0, tables_1.col)(r, 'metadata_public')),
+            adminMetadata: (0, tables_1.json)((0, tables_1.col)(r, 'metadata_admin')),
+            createdAt: (0, tables_1.col)(r, 'created_at'),
+            organizationId: (0, tables_1.text)((0, tables_1.col)(r, 'organization_id')),
+            credentials: new Map(),
+        });
+    }
+    for (const r of mine(tables.rows('identity_verifiable_addresses'))) {
+        const identity = byIdentity.get((0, tables_1.text)((0, tables_1.col)(r, 'identity_id')) ?? '');
+        const value = (0, tables_1.text)((0, tables_1.col)(r, 'value'));
+        if (!identity || !value)
+            continue;
+        identity.addresses.push({ value, via: ((0, tables_1.text)((0, tables_1.col)(r, 'via')) ?? 'email').toLowerCase(), verified: (0, tables_1.bool)((0, tables_1.col)(r, 'verified')) || (0, tables_1.text)((0, tables_1.col)(r, 'status')) === 'completed' });
+    }
+    for (const r of mine(tables.rows('identity_credentials'))) {
+        const identity = byIdentity.get((0, tables_1.text)((0, tables_1.col)(r, 'identity_id')) ?? '');
+        if (!identity)
+            continue;
+        const config = (0, tables_1.json)((0, tables_1.col)(r, 'config'));
+        const type = typeNames.get((0, tables_1.text)((0, tables_1.col)(r, 'identity_credential_type_id')) ?? '') ?? (0, tables_1.text)((0, tables_1.col)(r, 'type', 'type_name')) ?? typeOfConfig(config);
+        if (!type)
+            continue;
+        identity.credentials.set(type, { identifiers: identifiers.get((0, tables_1.text)((0, tables_1.col)(r, 'id')) ?? '') ?? [], config });
+    }
+    const sessions = [];
+    for (const r of mine(tables.rows('sessions'))) {
+        const id = (0, tables_1.text)((0, tables_1.col)(r, 'id'));
+        const identityId = (0, tables_1.text)((0, tables_1.col)(r, 'identity_id'));
+        if (!id || !identityId)
+            continue;
+        sessions.push({
+            id,
+            identityId,
+            token: (0, tables_1.text)((0, tables_1.col)(r, 'token')),
+            active: (0, tables_1.bool)((0, tables_1.col)(r, 'active')),
+            expiresAt: (0, tables_1.timeMs)((0, tables_1.col)(r, 'expires_at')),
+            authenticatedAt: (0, tables_1.col)(r, 'authenticated_at'),
+            aal: (0, tables_1.text)((0, tables_1.col)(r, 'aal', 'authenticator_assurance_level')),
+        });
+    }
+    return mapIdentities([...byIdentity.values()], { source: 'database', rpId: opts.rpId, sessions, now: opts.now ?? Date.now(), origin: 'Ory Kratos database dump' });
+}
+// ── the Admin API ───────────────────────────────────────────────────────────
+/** The Admin API's identity JSON as an {@link OryIdentity}. */
+function oryIdentityFromApi(raw) {
+    const id = (0, record_set_1.str)(raw.id);
+    if (!id)
+        return null;
+    const credentials = new Map();
+    if ((0, record_set_1.isObj)(raw.credentials)) {
+        for (const [type, c] of Object.entries(raw.credentials)) {
+            if ((0, record_set_1.isObj)(c))
+                credentials.set(type, { identifiers: (0, record_set_1.strs)(c.identifiers).map((s) => s.toLowerCase()), config: (0, record_set_1.isObj)(c.config) ? c.config : undefined });
+        }
+    }
+    return {
+        id,
+        schemaId: (0, record_set_1.str)(raw.schema_id),
+        state: (0, record_set_1.str)(raw.state),
+        traits: (0, record_set_1.isObj)(raw.traits) ? raw.traits : {},
+        addresses: (0, record_set_1.objs)(raw.verifiable_addresses).flatMap((a) => {
+            const value = (0, record_set_1.str)(a.value);
+            return value ? [{ value, via: ((0, record_set_1.str)(a.via) ?? 'email').toLowerCase(), verified: a.verified === true }] : [];
+        }),
+        publicMetadata: (0, record_set_1.isObj)(raw.metadata_public) ? raw.metadata_public : undefined,
+        adminMetadata: (0, record_set_1.isObj)(raw.metadata_admin) ? raw.metadata_admin : undefined,
+        createdAt: raw.created_at,
+        organizationId: (0, record_set_1.str)(raw.organization_id),
+        credentials,
+    };
+}
+/** The `page_token` of a Link header's `rel="next"` URL (Kratos pages with tokens). */
+function nextPageToken(link) {
+    const next = (0, vendor_http_1.nextLink)(link);
+    if (!next)
+        return null;
+    try {
+        return new URL(next, 'https://kratos.invalid').searchParams.get('page_token');
+    }
+    catch {
+        return null;
+    }
+}
+async function exportOryApi(o) {
+    const progress = o.onProgress ?? (() => undefined);
+    const base = /^https?:\/\//.test(o.adminUrl.trim()) ? o.adminUrl.trim().replace(/\/+$/, '') : `https://${o.adminUrl.trim().replace(/\/+$/, '')}`;
+    const http = new vendor_http_1.VendorHttp({ vendor: 'Ory', baseUrl: base, headers: o.apiKey ? { authorization: `Bearer ${o.apiKey}` } : {}, fetchImpl: o.fetchImpl, sleep: o.sleep });
+    const size = o.pageSize ?? 250;
+    const list = [];
+    const seenTokens = new Set();
+    let path = `/admin/identities?page_size=${size}&include_credential=oidc`;
+    for (;;) {
+        progress(`identities (${list.length} so far)`);
+        const res = await http.get(path);
+        for (const raw of (0, record_set_1.objs)(res.body)) {
+            const i = oryIdentityFromApi(raw);
+            if (i)
+                list.push(i);
+        }
+        const token = nextPageToken(res.headers.get('link'));
+        if (!token || seenTokens.has(token))
+            break;
+        seenTokens.add(token);
+        path = `/admin/identities?page_size=${size}&include_credential=oidc&page_token=${encodeURIComponent(token)}`;
+    }
+    return mapIdentities(list, { source: 'api', rpId: o.rpId, now: Date.now(), origin: `Ory Admin API ${base.replace(/^https?:\/\//, '')}` });
+}
+//# sourceMappingURL=ory.js.map

package/dist/migrate/export/ory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ory.js","sourceRoot":"","sources":["../../../src/migrate/export/ory.ts"],"names":[],"mappings":";;AAsEA,0CAgCC;AAuXD,0CAoEC;AAKD,gDAwBC;AAGD,sCAQC;AAED,oCAqBC;AA/lBD,gDAA6G;AAC7G,6CAA+F;AAC/F,+CAAqD;AAiDrD,wEAAwE;AACxE,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAe,EAAE,CAAC;AAEnE,MAAM,aAAa,GACjB,0IAA0I,CAAC;AAC7I,MAAM,aAAa,GAAG,0DAA0D,CAAC;AAEjF,+EAA+E;AAE/E,MAAM,GAAG,GAAG,sBAAsB,CAAC;AACnC,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,qCAAqC,GAAG,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC;AAC5F,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,qDAAqD,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC;AAE9F;;;;GAIG;AACH,SAAgB,eAAe,CAAC,GAAY;IAC1C,MAAM,CAAC,GAAG,IAAA,aAAI,EAAC,GAAG,CAAC,CAAC;IACpB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5F,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC3E,sEAAsE;IACtE,IAAI,gEAAgE,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACpH,qEAAqE;IACrE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAE7E,2FAA2F;IAC3F,IAAI,CAAC,GAAG,2EAA2E,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,EAAE,CAAC;QACN,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC;IACvL,CAAC;IACD,4EAA4E;IAC5E,CAAC,GAAG,wDAAwD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC;IAC5K,wFAAwF;IACxF,CAAC,GAAG,8EAA8E,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,EAAE,CAAC;QACN,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC;IACxK,CAAC;IACD,kFAAkF;IAClF,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;IAChF,0FAA0F;IAC1F,CAAC,GAAG,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrI,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAyCD,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAChF,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC/E,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC7E,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACzE,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AAC1E,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AAEpF,gGAAgG;AAChG,SAAS,KAAK,CAAC,MAAW,EAAE,IAAc;IACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7G,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6FAA6F;AAC7F,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,+FAA+F;AAC/F,SAAS,MAAM,CAAC,CAAU;IACxB,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClF,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,aAAa,EAAE,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;QACrF,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;QACrE,SAAS,EAAE,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;QAC9D,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,SAAS,QAAQ,CAAC,MAAc,EAAE,MAAW,EAAE,IAAY,EAAE,GAAc;IACzE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAA,kBAAS,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAA,kBAAS,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,iDAAiD,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,oFAAoF;QACpF,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC;QACpD,iFAAiF;QACjF,IAAI,CAAC,CAAC,eAAe,KAAK,KAAK;YAAE,OAAO,EAAE,CAAC;QAC3C,GAAG,CAAC,GAAG,CACL,SAAS,EACT,IAAA,oBAAO,EAAgB;YACrB,EAAE,EAAE,YAAY;YAChB,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACnE,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC;YAC7C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAC3B,SAAS,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,aAAI,EAAC,MAAM,CAAC;YAC1D,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;YACzB,UAAU,EAAE,IAAA,aAAI,EAAC,CAAC,CAAC,QAAQ,CAAC;SAC7B,CAAC,EACF,YAAY,CACb,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,mGAAmG;AACnG,SAAS,aAAa,CAAC,MAAW;IAChC,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,cAAc,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,IAAmB,EAAE,CAAa;IACvD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,oBAAoB;QACpB,MAAM,MAAM,GAAkE,EAAE,CAAC;QACjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,QAAiB,EAAE,EAAE;YACnD,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO;YACnE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS;YAAE,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;gBAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,MAAM,GAAkE,EAAE,CAAC;QACjF,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,QAAiB,EAAE,EAAE;YACnD,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,CAAC;YACxB,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QACtH,CAAC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS;YAAE,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;gBAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC7C,IAAI,KAAK;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9G,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QAED,gBAAgB;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;QAChG,IAAI,KAAK,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,IAAI,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,KAAK,EAAE,KAAK,CAAC;QAC/B,IAAI,IAAwB,CAAC;QAC7B,IAAI,IAAA,kBAAK,EAAC,SAAS,CAAC,EAAE,CAAC;YACrB,KAAK,KAAK,IAAA,gBAAG,EAAC,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACvF,IAAI,KAAK,IAAA,gBAAG,EAAC,KAAK,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACjG,IAAI,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,IAAA,gBAAG,EAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,KAAK;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,MAAM;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,GAAQ,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAEjF,iBAAiB;QACjB,IAAI,EAA4B,CAAC;QACjC,IAAI,QAAQ,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YACrD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;gBACvC,IAAI,MAAM;oBAAE,EAAE,GAAG,MAAM,CAAC;;oBACnB,eAAe,EAAE,CAAC;YACzB,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,2BAA2B,KAAK,IAAI;gBAAE,aAAa,EAAE,CAAC;iBAC7E,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;gBAAE,WAAW,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,gBAAgB,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxH,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAA,oBAAO,EAAa;YAClB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM;YACN,MAAM;YACN,QAAQ;YACR,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACjD,UAAU,EAAE,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;YACrE,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC;YACtC,gBAAgB;YAChB,eAAe,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,UAAU,EAAE,IAAA,aAAI,EAAC,CAAC,CAAC,SAAS,CAAC;SAC9B,CAAC,EACF,CAAC,CAAC,EAAE,CACL,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,cAAc;YAAE,cAAc,EAAE,CAAC;QAEvC,qBAAqB;QACrB,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAChH,wEAAwE;YACxE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBAClC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAC3B,IAAI,EAAE,GAAG,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnF,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO;oBAAE,SAAS;gBACxC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAC1B,GAAG,CAAC,GAAG,CACL,UAAU,EACV,IAAA,oBAAO,EAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EACtH,GAAG,CAAC,CAAC,QAAQ,SAAS,CAAC,CAAC,OAAO,EAAE,CAClC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,EAAE,CAAC;YACT,QAAQ,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACjD,IAAI,MAAM;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACX,YAAY,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,MAAM;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;YAAE,QAAQ,EAAE,CAAC;QAEtE,wFAAwF;QACxF,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,YAAY,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,CAAC,MAAM;gBAAE,SAAS,CAAC,yCAAyC;YAClE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACZ,oBAAoB,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YAClE,QAAQ,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CACL,SAAS,EACT,IAAA,oBAAO,EAAC;YACN,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,UAAU;YACrB,UAAU,EAAE,IAAA,kBAAS,EAAC,CAAC,CAAC,KAAK,CAAC;YAC9B,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,YAAY,EAAE,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACjD,UAAU,EAAE,IAAA,aAAI,EAAC,CAAC,CAAC,eAAe,CAAC;SACpC,CAAC,EACF,CAAC,CAAC,EAAE,CACL,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,wDAAwD,EAAE,QAAQ,CAAC,CAAC;IAEtG,iCAAiC;IACjC,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACvB,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,iLAAiL,CAAC,CAAC;QACjQ,CAAC;QACD,IAAI,QAAQ,IAAI,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,aAAa,YAAY,2JAA2J,CAAC,CAAC;QACxO,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,2FAA2F,EAAE,YAAY,CAAC,CAAC;YAC/H,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,6HAA6H,CAAC,CAAC;QAC7M,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,wJAAwJ,CAAC,CAAC;IACrK,CAAC;SAAM,CAAC;QACN,IAAI,eAAe;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,eAAe,2JAA2J,CAAC,CAAC;QAC7M,IAAI,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,WAAW,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,yFAAyF,CAAC,CAAC;IACxL,CAAC;IACD,IAAI,aAAa;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,WAAW,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,gKAAgK,CAAC,CAAC;IACnQ,IAAI,oBAAoB,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,6CAA6C,EAAE,oBAAoB,CAAC,CAAC;QACzF,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,kLAAkL,CAAC,CAAC;IACzM,CAAC;IACD,IAAI,cAAc;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,cAAc,WAAW,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,uIAAuI,CAAC,CAAC;IACnP,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,WAAW,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,sHAAsH,CAAC,CAAC;IAE5M,GAAG,CAAC,QAAQ,GAAG,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9H,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAE/E,+EAA+E;AAC/E,SAAS,YAAY,CAAC,MAAuB;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,iBAAiB,IAAI,MAAM;QAAE,OAAO,UAAU,CAAC;IACnD,IAAI,UAAU,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,gBAAgB,IAAI,MAAM;QAAE,OAAO,eAAe,CAAC;IACvD,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,aAAa,IAAI,MAAM;QAAE,OAAO,UAAU,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc,EAAE,OAAyB,EAAE;IACzE,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAE,EAAE,CAAC,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,GAAG,CAAoC,IAAS,EAAO,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE9I,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACzD,MAAM,EAAE,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,IAAI,IAAI;YAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;QAC9C,IAAI,GAAG,IAAI,UAAU;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;YACjB,EAAE;YACF,QAAQ,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACnC,KAAK,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC5B,MAAM,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE;YACpC,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAC/C,aAAa,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC7C,SAAS,EAAE,IAAA,YAAG,EAAC,CAAC,EAAE,YAAY,CAAC;YAC/B,cAAc,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAC/C,WAAW,EAAE,IAAI,GAAG,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK;YAAE,SAAS;QAClC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC;IACxK,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,MAAM,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3I,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU;YAAE,SAAS;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE;YACF,UAAU;YACV,KAAK,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC5B,MAAM,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9B,SAAS,EAAE,IAAA,eAAM,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YACvC,eAAe,EAAE,IAAA,YAAG,EAAC,CAAC,EAAE,kBAAkB,CAAC;YAC3C,GAAG,EAAE,IAAA,aAAI,EAAC,IAAA,YAAG,EAAC,CAAC,EAAE,KAAK,EAAE,+BAA+B,CAAC,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,aAAa,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;AACrK,CAAC;AAED,+EAA+E;AAE/E,+DAA+D;AAC/D,SAAgB,kBAAkB,CAAC,GAAQ;IACzC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IACrD,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACxD,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACxJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,SAAS,CAAC;QAC5B,KAAK,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,KAAK,CAAC;QACrB,MAAM,EAAE,IAAA,kBAAK,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAC3C,SAAS,EAAE,IAAA,iBAAI,EAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACtD,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,CAAC,CAAC;QACF,cAAc,EAAE,IAAA,kBAAK,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QAC5E,aAAa,EAAE,IAAA,kBAAK,EAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACzE,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,cAAc,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,eAAe,CAAC;QACxC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAgB,aAAa,CAAC,IAAmB;IAC/C,MAAM,IAAI,GAAG,IAAA,sBAAQ,EAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,CAAgB;IACjD,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACjJ,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACxK,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;IAC/B,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,IAAI,GAAG,+BAA+B,IAAI,0BAA0B,CAAC;IACzE,SAAS,CAAC;QACR,QAAQ,CAAC,eAAe,IAAI,CAAC,MAAM,UAAU,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM;QAC3C,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,GAAG,+BAA+B,IAAI,uCAAuC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/G,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,iBAAiB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5I,CAAC"}

package/dist/migrate/export/password-detect.d.ts

@@ -0,0 +1,29 @@
+import { type PasswordHash } from '@atlasauth/migrate';
+/**
+ * Recognise a password hash by its shape, on the owner's machine, so an
+ * exporter writes `{ algorithm, hash }` Atlas can verify — or leaves the
+ * password out and says why (lazy migration covers those users). Mirrors the
+ * self-describing formats of Atlas's verifier registry; the server checks again
+ * on import.
+ */
+export type DetectedHash = {
+    ok: true;
+    password: PasswordHash;
+    weak: boolean;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Identify a self-describing hash. `{CLEARTEXT}` (and a plaintext value when
+ * `plaintext` is allowed) is hashed here with PBKDF2 before it is written, so
+ * no password is ever stored in the clear (Atlas re-hashes it to Argon2id on
+ * the first sign-in).
+ */
+export declare function detectPasswordHash(raw: string | undefined, options?: {
+    plaintext?: boolean;
+}): DetectedHash;
+/** PBKDF2-SHA256 rounds for a plaintext password hashed on export (re-hashed to Argon2id on first sign-in). */
+export declare const PLAINTEXT_PBKDF2_ITERATIONS = 10000;
+/** Whether Atlas's registry has a verifier id (or `auto`). */
+export declare function isKnownAlgorithm(id: string): boolean;