Leaving 1Password for Apple Passwords and Notes

cd "$HOME/Downloads"
python3 1password-to-apple-v3.py "$HOME/Downloads/YourExport.1pux"

Reading 1Password export...
No secrets will be printed.

1Password -> Apple Migration
=======================================================

Available vaults with ACTIVE items:

 1. Personal                         125
 2. Work                              87
    Migrated                         399   [EXCLUDED]

Select ONE vault (or q to quit):

=======================================================
Vault: Personal
=======================================================

Active items:          125
Logins:                [count]
  CSV eligible:        [count]
  Missing URL:         [count]
  OTP detected:        [count]
  Multiple URLs:       [count]
  Login notes:         [count]
Secure Notes:          [count]
Documents:             [count]
Other/manual review:   [count]

Prepare migration output for 'Personal'? [y/N]

1Password-Migration/
└── Personal/
    ├── Apple-Passwords.csv       # only if eligible logins exist
    ├── Review.html
    ├── Migration-Summary.txt
    ├── Passkey-Workflow.html
    └── Documents/               # when Secure Notes or Documents are present

Vault: Personal
Logins missing URL: [count]
Multiple URL logins: [count]
Secure Notes: [count]
Documents: [count]
Other/manual review: [count]

Logins excluded because they have no URL:
  - Local Router

Logins with multiple URLs:
  - Example Shop: 2 URLs

Logins with OTP data detected:
  - Example Shop
OTP secrets were NOT printed in this report.

Items requiring manual review:
  - Corporate Card [Credit Card]

APPLE NOTES
  [count] note(s) can be created in:
  1Password Migration - Personal

Create these notes automatically in Apple Notes? [y/N]

Migration preparation complete.
=======================================================

Output:
  ~/Downloads/1Password-Migration/Personal

APPLE PASSWORDS
  [count] login(s) written to:
  ~/Downloads/1Password-Migration/Personal/Apple-Passwords.csv

  *** NOT IMPORTED ***
  You control the import manually in Passwords.app.

REVIEW
  ~/Downloads/1Password-Migration/Personal/Review.html
  ~/Downloads/1Password-Migration/Personal/Migration-Summary.txt

PASSKEY WORKFLOW
  [count] candidate(s) across ALL vaults/states
  ~/Downloads/1Password-Migration/Personal/Passkey-Workflow.html

1Password was NOT modified.
Apple Passwords was NOT modified.

~/Downloads/1Password-Migration/Personal/Documents/
├── Recovery Kit/
│   └── recovery.pdf
├── Travel Records/
│   ├── passport-scan.pdf
│   └── itinerary.pdf
└── Empty Document/

EXTRACTED ATTACHMENTS
  Recovery Kit: 1 extracted
  Travel Records: 2 extracted
  Empty Document: 0 extracted
    WARNING: 1 attachment(s) could not be located.

Migrated from 1Password.

Extracted attachments: 2
Attachments were extracted locally but not auto-attached because
Notes attachment automation is disabled after the duplicate-attachment test.

#!/usr/bin/env python3

"""
1Password -> Apple Migration Helper

IMPORTANT:
    - Reads a 1Password .1pux export.
    - Processes ONE vault at a time.
    - ACTIVE items only.
    - Refuses to process a vault named "Migrated".
    - Generates an Apple Passwords CSV.
    - DOES NOT import anything into Apple Passwords.
    - Can create Apple Notes for Secure Notes / Documents after confirmation.
    - DOES NOT modify 1Password.
    - Generates a passkey-upgrade HTML workflow with clickable site URLs.
    - DOES NOT use the network itself; URLs open only when you click them.

Tested/designed for 1Password 8 1PUX exports on macOS.
"""

import csv
import html
import json
import os
import re
import shutil
import subprocess
import sys
import tempfile
import zipfile

from pathlib import Path
from urllib.parse import urlparse


# ---------------------------------------------------------------------------
# Configuration
# ---------------------------------------------------------------------------

MIGRATED_VAULT_NAME = "Migrated"

# Categories observed / documented in 1PUX.
CATEGORY_LOGIN = "001"
CATEGORY_SECURE_NOTE = "003"
CATEGORY_PASSWORD = "005"
CATEGORY_DOCUMENT = "006"

CATEGORY_NAMES = {
    "001": "Login",
    "002": "Credit Card",
    "003": "Secure Note",
    "004": "Identity",
    "005": "Password",
    "006": "Document",
    "100": "Bank Account",
    "101": "Database",
    "102": "Driver License",
    "103": "Email Account",
    "104": "Membership",
    "105": "Outdoor License",
    "106": "Passport",
    "107": "Rewards Program",
    "108": "Social Security Number",
    "109": "Router",
    "110": "Server",
    "111": "Wireless Router",
}


# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------

def die(message):
    print(f"\nERROR: {message}\n", file=sys.stderr)
    sys.exit(1)


def safe_name(value):
    """Return a filesystem-safe name."""
    value = str(value or "Untitled")
    value = value.replace("/", "-").replace(":", "-")
    value = re.sub(r"[\x00-\x1f]", "", value)
    value = value.strip()

    if not value:
        value = "Untitled"

    return value[:150]


def yes_no(prompt, default=False):
    suffix = " [Y/n] " if default else " [y/N] "

    try:
        answer = input(prompt + suffix).strip().lower()
    except (EOFError, KeyboardInterrupt):
        print()
        return False

    if not answer:
        return default

    return answer in ("y", "yes")


def chmod_private(path, directory=False):
    try:
        os.chmod(path, 0o700 if directory else 0o600)
    except OSError:
        pass


def category_name(uuid):
    return CATEGORY_NAMES.get(uuid, f"Other ({uuid})")


def load_export(path):
    try:
        with zipfile.ZipFile(path) as archive:
            if "export.data" not in archive.namelist():
                die("This archive does not contain export.data.")

            return json.loads(archive.read("export.data"))

    except zipfile.BadZipFile:
        die("The selected file is not a valid 1PUX/ZIP archive.")
    except json.JSONDecodeError:
        die("export.data does not contain valid JSON.")


def active_items(vault):
    return [
        item for item in vault.get("items", [])
        if item.get("state") == "active"
    ]


def item_title(item):
    return (
        item.get("overview", {}).get("title")
        or "Untitled"
    )


# ---------------------------------------------------------------------------
# Vault selection
# ---------------------------------------------------------------------------

def collect_vaults(data):
    result = []

    for account in data.get("accounts", []):
        account_name = (
            account.get("attrs", {}).get("accountName")
            or "(unknown account)"
        )

        for vault in account.get("vaults", []):
            items = active_items(vault)

            if not items:
                continue

            result.append({
                "account": account_name,
                "vault": vault,
                "name": vault.get("attrs", {}).get("name", "Untitled"),
                "count": len(items),
            })

    return result


def choose_vault(vaults):
    selectable = []

    print()
    print("1Password -> Apple Migration")
    print("=" * 55)
    print()
    print("Available vaults with ACTIVE items:")
    print()

    for vault_info in vaults:

        if vault_info["name"].casefold() == MIGRATED_VAULT_NAME.casefold():
            print(
                f"    {vault_info['name']:<30}"
                f"{vault_info['count']:>5}   [EXCLUDED]"
            )
            continue

        selectable.append(vault_info)

        print(
            f"{len(selectable):2}. "
            f"{vault_info['name']:<30}"
            f"{vault_info['count']:>5}"
        )

    if not selectable:
        die("No selectable vaults contain active items.")

    print()

    try:
        selection = input("Select ONE vault (or q to quit): ").strip()
    except (EOFError, KeyboardInterrupt):
        print()
        sys.exit(0)

    if selection.lower() in ("q", "quit", "exit"):
        sys.exit(0)

    try:
        index = int(selection)
    except ValueError:
        die("Invalid selection.")

    if index < 1 or index > len(selectable):
        die("Invalid selection.")

    chosen = selectable[index - 1]

    if chosen["name"].casefold() == MIGRATED_VAULT_NAME.casefold():
        die("The Migrated vault cannot be processed.")

    return chosen


# ---------------------------------------------------------------------------
# Login parsing
# ---------------------------------------------------------------------------

def extract_login(item):
    overview = item.get("overview", {})
    details = item.get("details", {})

    username = ""
    password = ""

    extra_login_fields = []

    for field in details.get("loginFields", []):

        designation = field.get("designation")

        if designation == "username":
            username = str(field.get("value", "") or "")

        elif designation == "password":
            password = str(field.get("value", "") or "")

        else:
            extra_login_fields.append(field)

    urls = overview.get("urls", []) or []

    primary_url = ""

    if urls:
        primary = next(
            (u for u in urls if u.get("primary")),
            urls[0]
        )

        primary_url = str(primary.get("url", "") or "")

    notes = str(details.get("notesPlain", "") or "")

    otp = ""
    for section in details.get("sections", []) or []:
        for field in section.get("fields", []) or []:
            value = field.get("value")
            if isinstance(value, dict) and value.get("totp"):
                otp = str(value["totp"])
                break
        if otp:
            break

    return {
        "title": item_title(item),
        "username": username,
        "password": password,
        "url": primary_url,
        "urls": urls,
        "notes": notes,
        "otp": otp,
        "extra_login_fields": extra_login_fields,
    }


# ---------------------------------------------------------------------------
# OTP / custom field analysis
# ---------------------------------------------------------------------------

def walk_values(value, path=""):
    """
    Recursively walk arbitrary 1PUX structures.

    Returns tuples:
        (path, value)
    """

    if isinstance(value, dict):
        for key, child in value.items():
            child_path = f"{path}.{key}" if path else str(key)
            yield from walk_values(child, child_path)

    elif isinstance(value, list):
        for index, child in enumerate(value):
            child_path = f"{path}[{index}]"
            yield from walk_values(child, child_path)

    else:
        yield path, value


def analyze_item_fields(item):
    """
    Conservative analysis.

    We identify likely OTP material without printing the secret.
    We also count structured/custom fields so they can be reviewed.
    """

    details = item.get("details", {})

    otp_found = False
    custom_count = 0

    for section in details.get("sections", []) or []:
        for field in section.get("fields", []) or []:

            custom_count += 1

            title = str(
                field.get("title")
                or field.get("t")
                or ""
            ).lower()

            field_blob = json.dumps(
                field,
                ensure_ascii=False
            ).lower()

            if (
                "otp" in title
                or "one-time" in title
                or "one time" in title
                or "totp" in title
                or "otpauth://" in field_blob
            ):
                otp_found = True

    # Some exports may expose OTP data elsewhere.
    for path, value in walk_values(details):

        if isinstance(value, str):

            lower_value = value.lower()
            lower_path = path.lower()

            if (
                lower_value.startswith("otpauth://")
                or "totp" in lower_path
                or "otp" in lower_path
            ):
                otp_found = True

    return {
        "otp": otp_found,
        "custom_fields": custom_count,
    }


# ---------------------------------------------------------------------------
# Document handling
# ---------------------------------------------------------------------------

def document_attachments(item):
    attachments = []

    details = item.get("details", {})

    for section in details.get("sections", []) or []:

        for field in section.get("fields", []) or []:

            value = field.get("value")

            if not isinstance(value, dict):
                continue

            file_info = value.get("file")

            if not isinstance(file_info, dict):
                continue

            attachments.append(file_info)

    return attachments


def find_attachment_member(archive, document_id, file_info):
    """
    Locate the actual attachment within the 1PUX.

    1PUX implementations can vary slightly in how the internal
    attachment path is represented, so we use metadata first and
    conservative filename/document-id matching second.
    """

    candidates = []

    for key in ("contentPath", "path"):
        value = file_info.get(key)

        if value:
            candidates.append(str(value).lstrip("/"))

    names = archive.namelist()

    for candidate in candidates:
        if candidate in names:
            return candidate

    # Search using document ID.
    if document_id:
        matches = [
            name for name in names
            if document_id in name
            and not name.endswith("/")
        ]

        if len(matches) == 1:
            return matches[0]

        # Prefer paths under files/.
        file_matches = [
            name for name in matches
            if name.startswith("files/")
        ]

        if len(file_matches) == 1:
            return file_matches[0]

    return None


def extract_document(export_path, item, output_directory):
    title = safe_name(item_title(item))

    destination = output_directory / title
    destination.mkdir(parents=True, exist_ok=True)
    chmod_private(destination, directory=True)

    attachments = document_attachments(item)

    extracted = []
    failed = []

    with zipfile.ZipFile(export_path) as archive:

        for number, info in enumerate(attachments, 1):

            filename = (
                info.get("fileName")
                or info.get("name")
                or f"Attachment-{number}"
            )

            filename = safe_name(filename)

            document_id = str(
                info.get("documentId")
                or info.get("documentID")
                or ""
            )

            member = find_attachment_member(
                archive,
                document_id,
                info
            )

            if not member:
                failed.append(filename)
                continue

            target = destination / filename

            # Avoid accidental overwrite.
            if target.exists():
                stem = target.stem
                suffix = target.suffix
                counter = 2

                while target.exists():
                    target = destination / (
                        f"{stem}-{counter}{suffix}"
                    )
                    counter += 1

            with archive.open(member) as source:
                with target.open("wb") as dest:
                    shutil.copyfileobj(source, dest)

            chmod_private(target)
            extracted.append(target)

    return extracted, failed


# ---------------------------------------------------------------------------
# Secure note parsing
# ---------------------------------------------------------------------------

def field_display_name(field, number):
    return (
        field.get("title")
        or field.get("t")
        or f"Field {number}"
    )


def printable_field_value(value):
    """
    Convert non-file structured values to text.

    This is used ONLY in Apple Notes output, never Terminal output.
    """

    if value is None:
        return ""

    if isinstance(value, str):
        return value

    if isinstance(value, bool):
        return "Yes" if value else "No"

    if isinstance(value, (int, float)):
        return str(value)

    if isinstance(value, dict):

        # Common 1PUX wrapped value types.
        for key in (
            "string",
            "concealed",
            "email",
            "phone",
            "url",
            "date",
            "monthYear",
        ):
            if key in value:
                return str(value[key])

        if "file" in value:
            info = value["file"]

            if isinstance(info, dict):
                return (
                    info.get("fileName")
                    or info.get("name")
                    or "[Attachment]"
                )

            return "[Attachment]"

        # Unknown structure: preserve it rather than silently lose it.
        return json.dumps(
            value,
            ensure_ascii=False,
            indent=2
        )

    if isinstance(value, list):
        return "\n".join(
            printable_field_value(v)
            for v in value
        )

    return str(value)


def secure_note_body(item):
    details = item.get("details", {})

    parts = []

    notes_plain = str(
        details.get("notesPlain", "") or ""
    ).strip()

    if notes_plain:
        parts.append(notes_plain)

    for section in details.get("sections", []) or []:

        fields = section.get("fields", []) or []

        if not fields:
            continue

        section_title = (
            section.get("title")
            or ""
        ).strip()

        section_lines = []

        for number, field in enumerate(fields, 1):

            value = field.get("value")

            # Files are handled separately.
            if (
                isinstance(value, dict)
                and "file" in value
            ):
                continue

            display_value = printable_field_value(value)

            if not display_value:
                continue

            label = field_display_name(field, number)

            section_lines.append(
                f"{label}: {display_value}"
            )

        if section_lines:

            if section_title:
                parts.append(
                    f"{section_title}\n"
                    + "\n".join(section_lines)
                )
            else:
                parts.append(
                    "\n".join(section_lines)
                )

    return "\n\n".join(parts).strip()


# ---------------------------------------------------------------------------
# Apple Notes
# ---------------------------------------------------------------------------

def applescript_escape(value):
    return (
        str(value)
        .replace("\\", "\\\\")
        .replace('"', '\\"')
    )


def note_html(text):
    """
    Notes' AppleScript interface accepts HTML for the body.
    """

    escaped = html.escape(text)

    paragraphs = escaped.split("\n")

    return "<br>".join(paragraphs)


def create_note(folder_name, title, body):
    """
    Create a note in Notes.app.

    Returns True on success.
    """

    folder_name = applescript_escape(folder_name)
    title = applescript_escape(title)
    body = applescript_escape(note_html(body))

    script = f'''
tell application "Notes"
    set targetAccount to first account

    if not (exists folder "{folder_name}" of targetAccount) then
        make new folder at targetAccount with properties {{name:"{folder_name}"}}
    end if

    set targetFolder to folder "{folder_name}" of targetAccount

    make new note at targetFolder with properties {{name:"{title}", body:"{body}"}}
end tell
'''

    result = subprocess.run(
        ["/usr/bin/osascript", "-e", script],
        capture_output=True,
        text=True
    )

    if result.returncode != 0:
        return False, result.stderr.strip()

    return True, ""


def create_document_note(folder_name, title, attachment_paths):
    """
    Create an Apple Note and attach extracted files.

    This is intentionally done through Notes/Finder AppleScript,
    not by modifying Notes' database.
    """

    folder_name_e = applescript_escape(folder_name)
    title_e = applescript_escape(title)

    body_text = (
        "Migrated from 1Password.\n\n"
        f"Original item: {title}\n"
        f"Attachments: {len(attachment_paths)}"
    )

    body_e = applescript_escape(note_html(body_text))

    # First create note and capture its ID.
    script = f'''
tell application "Notes"
    set targetAccount to first account

    if not (exists folder "{folder_name_e}" of targetAccount) then
        make new folder at targetAccount with properties {{name:"{folder_name_e}"}}
    end if

    set targetFolder to folder "{folder_name_e}" of targetAccount

    set newNote to make new note at targetFolder with properties {{name:"{title_e}", body:"{body_e}"}}

    return id of newNote
end tell
'''

    result = subprocess.run(
        ["/usr/bin/osascript", "-e", script],
        capture_output=True,
        text=True
    )

    if result.returncode != 0:
        return False, result.stderr.strip()

    note_id = result.stdout.strip()

    # Attach each file.
    for attachment in attachment_paths:

        path_e = applescript_escape(
            str(attachment.resolve())
        )

        note_id_e = applescript_escape(note_id)

        attach_script = f'''
tell application "Notes"
    set targetNote to note id "{note_id_e}"

    tell targetNote
        make new attachment with data POSIX file "{path_e}"
    end tell
end tell
'''

        attach_result = subprocess.run(
            ["/usr/bin/osascript", "-e", attach_script],
            capture_output=True,
            text=True
        )

        if attach_result.returncode != 0:
            return (
                False,
                "Note created, but an attachment failed: "
                + attach_result.stderr.strip()
            )

    return True, ""


# ---------------------------------------------------------------------------
# Passkey upgrade workflow
# ---------------------------------------------------------------------------

def passkey_upgrade_candidate(item):
    """Watchtower candidate only; does not prove a stored passkey exists."""
    overview = item.get("overview", {}) or {}
    exclusions = overview.get("watchtowerExclusions", {}) or {}
    return "passkeyAvailable" in exclusions


def item_primary_url(item):
    overview = item.get("overview", {}) or {}
    urls = overview.get("urls", []) or []
    if urls:
        primary = next((u for u in urls if u.get("primary")), urls[0])
        return str(primary.get("url", "") or "")
    return str(overview.get("url", "") or "")


def collect_passkey_candidates(data):
    # Deliberately scans ALL vaults/states, including Migrated and archived,
    # so this can be used as the final passkey-upgrade audit.
    rows = []
    for account in data.get("accounts", []):
        for vault in account.get("vaults", []):
            vault_name = vault.get("attrs", {}).get("name", "(unnamed)")
            for item in vault.get("items", []):
                if item.get("categoryUuid") != CATEGORY_LOGIN:
                    continue
                if not passkey_upgrade_candidate(item):
                    continue
                rows.append({
                    "vault": vault_name,
                    "state": item.get("state", "?"),
                    "title": item_title(item),
                    "url": item_primary_url(item),
                })
    return rows


def write_passkey_report(path, candidates):
    rows = []
    for i, entry in enumerate(candidates):
        url = entry["url"]
        link = (f'<a href="{html.escape(url, quote=True)}" target="_blank" '
                f'rel="noopener noreferrer">Open site</a>') if url else '<span class="missing">No URL in export</span>'
        rows.append(
            '<tr>'
            f'<td><input type="checkbox" id="pk-{i}" data-save></td>'
            f'<td>{html.escape(entry["title"])}</td>'
            f'<td>{html.escape(entry["vault"])}</td>'
            f'<td>{html.escape(str(entry["state"]))}</td>'
            f'<td>{link}</td>'
            '</tr>'
        )

    document = """<!doctype html>
<html><head><meta charset="utf-8"><title>1Password Passkey Upgrade Workflow</title>
<style>
body {font-family:-apple-system,BlinkMacSystemFont,sans-serif;max-width:1100px;margin:40px auto;padding:0 24px;line-height:1.45}
h1{margin-bottom:4px}.notice{padding:16px;background:#f3f3f3;border-radius:10px;margin:20px 0}.steps{padding:16px 20px;border:1px solid #ddd;border-radius:10px}
table{border-collapse:collapse;width:100%;margin-top:22px}th,td{text-align:left;border-bottom:1px solid #ddd;padding:10px;vertical-align:top}th{font-weight:600}.missing{opacity:.65}.small{font-size:.9em;opacity:.75}
</style></head><body>
<h1>Passkey Upgrade Workflow</h1>
<p>__COUNT__ passkey-upgrade candidate(s) found across the entire 1PUX export.</p>
<div class="notice"><strong>Important:</strong> This report uses 1Password's <code>passkeyAvailable</code> Watchtower metadata. It means the site is a candidate for a passkey upgrade; it does <strong>not</strong> prove that a passkey is currently stored in 1Password. No passwords, usernames, OTP secrets, or passkey credentials are included here.</div>
<div class="steps"><strong>Workflow for each site</strong><ol>
<li>Open the site using the link below.</li><li>Let Apple Passwords fill the migrated login.</li><li>Open the site's security/passkey settings.</li><li>Create a new passkey and save it in Apple Passwords.</li><li>Confirm the new passkey works.</li><li>Revoke the old 1Password passkey manually if one exists.</li><li>Check the item off below.</li>
</ol></div>
<p class="small">Checkbox state is saved only in this browser on this Mac via localStorage.</p>
<table><thead><tr><th>Done</th><th>Item</th><th>1Password Vault</th><th>State</th><th>Website</th></tr></thead><tbody>__ROWS__</tbody></table>
<script>for(const box of document.querySelectorAll('[data-save]')){const k='onepassword-passkey-'+box.id;box.checked=localStorage.getItem(k)==='1';box.addEventListener('change',()=>localStorage.setItem(k,box.checked?'1':'0'));}</script>
</body></html>"""
    document = document.replace("__COUNT__", str(len(candidates))).replace("__ROWS__", "".join(rows))
    path.write_text(document, encoding="utf-8")
    chmod_private(path)


# ---------------------------------------------------------------------------
# CSV
# ---------------------------------------------------------------------------

def write_password_csv(path, login_rows):
    fieldnames = [
        "Title",
        "URL",
        "Username",
        "Password",
        "Notes",
        "OTP",
    ]

    with path.open(
        "w",
        newline="",
        encoding="utf-8"
    ) as handle:

        writer = csv.DictWriter(
            handle,
            fieldnames=fieldnames
        )

        writer.writeheader()

        for login in login_rows:

            writer.writerow({
                "Title": login["title"],
                "URL": login["url"],
                "Username": login["username"],
                "Password": login["password"],
                "Notes": login["notes"],
                "OTP": login["otp"],
            })

    chmod_private(path)


# ---------------------------------------------------------------------------
# HTML review report
# ---------------------------------------------------------------------------

def write_review_report(
    path,
    vault_name,
    login_analysis,
    secure_notes,
    documents,
    other_items
):
    rows = []

    for entry in login_analysis:

        flags = []

        if len(entry["login"]["urls"]) > 1:
            flags.append(
                f'{len(entry["login"]["urls"])} URLs'
            )

        if entry["login"]["otp"]:
            flags.append("OTP")

        if entry["login"]["notes"]:
            flags.append("Notes")

        if entry["analysis"]["custom_fields"]:
            flags.append(
                f'{entry["analysis"]["custom_fields"]} structured field(s)'
            )

        if not entry["login"]["url"]:
            flags.append("NO URL")

        flag_text = ", ".join(flags) if flags else "Standard login"

        rows.append(
            "<tr>"
            f"<td>{html.escape(entry['login']['title'])}</td>"
            "<td>Login</td>"
            f"<td>{html.escape(flag_text)}</td>"
            "</tr>"
        )

    for item in secure_notes:
        rows.append(
            "<tr>"
            f"<td>{html.escape(item_title(item))}</td>"
            "<td>Secure Note</td>"
            "<td>Apple Notes</td>"
            "</tr>"
        )

    for item in documents:
        count = len(document_attachments(item))

        rows.append(
            "<tr>"
            f"<td>{html.escape(item_title(item))}</td>"
            "<td>Document</td>"
            f"<td>{count} attachment(s)</td>"
            "</tr>"
        )

    for item in other_items:
        uuid = item.get("categoryUuid")

        rows.append(
            "<tr>"
            f"<td>{html.escape(item_title(item))}</td>"
            f"<td>{html.escape(category_name(uuid))}</td>"
            "<td>Manual review</td>"
            "</tr>"
        )

    document = f"""<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>1Password Migration Review - {html.escape(vault_name)}</title>
<style>
body {{
    font-family: -apple-system, BlinkMacSystemFont, sans-serif;
    max-width: 1000px;
    margin: 40px auto;
    padding: 0 24px;
    line-height: 1.45;
}}
h1 {{ margin-bottom: 4px; }}
.warning {{
    padding: 14px;
    background: #f3f3f3;
    border-radius: 10px;
    margin: 20px 0;
}}
table {{
    border-collapse: collapse;
    width: 100%;
}}
th, td {{
    text-align: left;
    border-bottom: 1px solid #ddd;
    padding: 10px;
}}
th {{ font-weight: 600; }}
</style>
</head>
<body>

<h1>1Password Migration Review</h1>
<p>Vault: <strong>{html.escape(vault_name)}</strong></p>

<div class="warning">
This report intentionally does not display passwords, OTP secrets,
or usernames. Apple Passwords import remains a manual step.
</div>

<table>
<thead>
<tr>
<th>Item</th>
<th>Type</th>
<th>Migration status / review</th>
</tr>
</thead>
<tbody>
{''.join(rows)}
</tbody>
</table>

</body>
</html>
"""

    path.write_text(document, encoding="utf-8")
    chmod_private(path)


# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------

def main():
    if sys.platform != "darwin":
        die("This utility is intended for macOS.")

    if len(sys.argv) != 2:
        print(
            f"Usage:\n"
            f"  {Path(sys.argv[0]).name} /path/to/export.1pux"
        )
        sys.exit(1)

    export_path = Path(
        os.path.expanduser(sys.argv[1])
    ).resolve()

    if not export_path.exists():
        die(f"Export not found: {export_path}")

    print()
    print("Reading 1Password export...")
    print("No secrets will be printed.")

    data = load_export(export_path)

    vaults = collect_vaults(data)
    chosen = choose_vault(vaults)

    vault = chosen["vault"]
    vault_name = chosen["name"]

    items = active_items(vault)

    logins = []
    secure_notes = []
    documents = []
    other_items = []

    for item in items:

        category = item.get("categoryUuid")

        if category == CATEGORY_LOGIN:
            login = extract_login(item)
            analysis = analyze_item_fields(item)

            logins.append({
                "item": item,
                "login": login,
                "analysis": analysis,
            })

        elif category == CATEGORY_SECURE_NOTE:
            secure_notes.append(item)

        elif category == CATEGORY_DOCUMENT:
            documents.append(item)

        else:
            other_items.append(item)

    eligible_logins = [
        entry["login"]
        for entry in logins
        if entry["login"]["url"]
    ]

    no_url_logins = [
        entry
        for entry in logins
        if not entry["login"]["url"]
    ]

    otp_count = sum(
        1 for entry in logins
        if entry["login"]["otp"]
    )

    multiple_url_count = sum(
        1 for entry in logins
        if len(entry["login"]["urls"]) > 1
    )

    note_login_count = sum(
        1 for entry in logins
        if bool(entry["login"]["notes"])
    )

    print()
    print("=" * 55)
    print(f"Vault: {vault_name}")
    print("=" * 55)
    print()
    print(f"Active items:          {len(items)}")
    print(f"Logins:                {len(logins)}")
    print(f"  CSV eligible:        {len(eligible_logins)}")
    print(f"  Missing URL:         {len(no_url_logins)}")
    print(f"  OTP detected:        {otp_count}")
    print(f"  Multiple URLs:       {multiple_url_count}")
    print(f"  Login notes:         {note_login_count}")
    print(f"Secure Notes:          {len(secure_notes)}")
    print(f"Documents:             {len(documents)}")
    print(f"Other/manual review:   {len(other_items)}")
    print()

    if other_items:
        print("Manual-review item types:")

        counts = {}

        for item in other_items:
            uuid = item.get("categoryUuid")
            name = category_name(uuid)
            counts[name] = counts.get(name, 0) + 1

        for name, count in sorted(counts.items()):
            print(f"  {name}: {count}")

        print()

    if not yes_no(
        f"Prepare migration output for '{vault_name}'?"
    ):
        print("No changes made.")
        return

    base = Path.home() / "Downloads" / "1Password-Migration"
    base.mkdir(exist_ok=True)
    chmod_private(base, directory=True)

    output = base / safe_name(vault_name)

    if output.exists():
        die(
            f"Output directory already exists:\n{output}\n\n"
            "Remove/rename it first. The script will not overwrite "
            "previous migration output."
        )

    output.mkdir()
    chmod_private(output, directory=True)

    # Password CSV ----------------------------------------------------------

    csv_path = output / "Apple-Passwords.csv"

    if eligible_logins:
        write_password_csv(
            csv_path,
            eligible_logins
        )

    # Documents -------------------------------------------------------------

    document_results = []

    documents_directory = output / "Documents"

    attachment_items = secure_notes + documents

    if attachment_items:
        documents_directory.mkdir()
        chmod_private(
            documents_directory,
            directory=True
        )

        for item in attachment_items:

            extracted, failed = extract_document(
                export_path,
                item,
                documents_directory
            )

            document_results.append({
                "item": item,
                "extracted": extracted,
                "failed": failed,
            })

    # Review report ---------------------------------------------------------

    report_path = output / "Review.html"

    write_review_report(
        report_path,
        vault_name,
        logins,
        secure_notes,
        documents,
        other_items
    )

    # Final passkey-upgrade audit: all vaults, including Migrated/archived.
    passkey_candidates = collect_passkey_candidates(data)
    passkey_report_path = output / "Passkey-Workflow.html"
    write_passkey_report(passkey_report_path, passkey_candidates)

    # Summary ---------------------------------------------------------------

    summary_path = output / "Migration-Summary.txt"

    summary_lines = [
        "1Password -> Apple Migration",
        "=" * 50,
        "",
        f"Vault: {vault_name}",
        "",
        f"Active items: {len(items)}",
        f"Logins: {len(logins)}",
        f"CSV eligible: {len(eligible_logins)}",
        f"Logins missing URL: {len(no_url_logins)}",
        f"OTP detected: {otp_count}",
        f"Multiple URL logins: {multiple_url_count}",
        f"Login notes: {note_login_count}",
        f"Secure Notes: {len(secure_notes)}",
        f"Documents: {len(documents)}",
        f"Other/manual review: {len(other_items)}",
        f"Passkey-upgrade candidates (all vaults): {len(passkey_candidates)}",
        "",
        "IMPORTANT:",
        "Apple Passwords has NOT been modified.",
        "Import Apple-Passwords.csv manually using Passwords.app.",
        "",
    ]

    if no_url_logins:
        summary_lines.append("Logins excluded because they have no URL:")

        for entry in no_url_logins:
            summary_lines.append(
                f"  - {entry['login']['title']}"
            )

        summary_lines.append("")

    if multiple_url_count:
        summary_lines.append("Logins with multiple URLs:")

        for entry in logins:
            if len(entry["login"]["urls"]) > 1:
                summary_lines.append(
                    f"  - {entry['login']['title']}: "
                    f"{len(entry['login']['urls'])} URLs"
                )

        summary_lines.append("")

    if otp_count:
        summary_lines.append("Logins with OTP data detected:")

        for entry in logins:
            if entry["login"]["otp"]:
                summary_lines.append(
                    f"  - {entry['login']['title']}"
                )

        summary_lines.append(
            "OTP secrets were NOT printed in this report."
        )
        summary_lines.append("")

    if other_items:
        summary_lines.append("Items requiring manual review:")

        for item in other_items:
            summary_lines.append(
                f"  - {item_title(item)} "
                f"[{category_name(item.get('categoryUuid'))}]"
            )

        summary_lines.append("")

    summary_path.write_text(
        "\n".join(summary_lines),
        encoding="utf-8"
    )

    chmod_private(summary_path)

    # Results ---------------------------------------------------------------

    print()
    print("Migration preparation complete.")
    print("=" * 55)
    print()
    print("Output:")
    print(f"  {output}")
    print()

    if eligible_logins:
        print("APPLE PASSWORDS")
        print(f"  {len(eligible_logins)} login(s) written to:")
        print(f"  {csv_path}")
        print()
        print("  *** NOT IMPORTED ***")
        print("  You control the import manually in Passwords.app.")
        print()

    if document_results:
        print("EXTRACTED ATTACHMENTS")

        for result in document_results:
            title = item_title(result["item"])

            print(
                f"  {title}: "
                f"{len(result['extracted'])} extracted"
            )

            if result["failed"]:
                print(
                    f"    WARNING: "
                    f"{len(result['failed'])} attachment(s) "
                    f"could not be located."
                )

        print()

    # Apple Notes -----------------------------------------------------------

    note_candidates = len(secure_notes) + len(
        [
            r for r in document_results
            if r["extracted"] and r["item"].get("categoryUuid") == CATEGORY_DOCUMENT
        ]
    )

    if note_candidates:

        folder_name = f"1Password Migration - {vault_name}"

        print("APPLE NOTES")
        print(
            f"  {note_candidates} note(s) can be created in:"
        )
        print(f"  {folder_name}")
        print()

        if yes_no(
            "Create these notes automatically in Apple Notes?"
        ):

            created = 0
            failures = []

            # Secure Notes
            for item in secure_notes:

                title = item_title(item)
                body = secure_note_body(item)

                if not body:
                    body = (
                        "Migrated from 1Password.\n\n"
                        "The original Secure Note contained no "
                        "plain-text note body."
                    )

                ok, error = create_note(
                    folder_name,
                    title,
                    body
                )

                if ok:
                    created += 1
                else:
                    failures.append((title, error))

            # Documents
            for result in document_results:

                if not result["extracted"]:
                    continue
                if result["item"].get("categoryUuid") != CATEGORY_DOCUMENT:
                    continue

                title = item_title(result["item"])

                body = (
                    "Migrated from 1Password.\n\n"
                    f"Extracted attachments: {len(result['extracted'])}\n"
                    "Attachments were extracted locally but not auto-attached "
                    "because Notes attachment automation is disabled after the "
                    "duplicate-attachment test."
                )
                ok, error = create_note(
                    folder_name,
                    title,
                    body
                )

                if ok:
                    created += 1
                else:
                    failures.append((title, error))

            print()
            print(
                f"Apple Notes created: {created}"
            )

            if failures:
                print(
                    f"Apple Notes failures: {len(failures)}"
                )

                for title, error in failures:
                    print(f"  - {title}: {error}")

            print()
            print(
                "Verify the created notes before moving "
                "anything in 1Password."
            )

        else:
            print()
            print("Apple Notes were not modified.")

    print()
    print("REVIEW")
    print(f"  {report_path}")
    print(f"  {summary_path}")
    print()
    print("PASSKEY WORKFLOW")
    print(f"  {len(passkey_candidates)} candidate(s) across ALL vaults/states")
    print(f"  {passkey_report_path}")
    print("  Use it for the final create-in-Apple / revoke-in-1Password pass.")
    print()
    print("SECURITY")
    print(
        "  Apple-Passwords.csv and extracted documents may "
        "contain sensitive plaintext data."
    )
    print(
        "  Delete the migration output after you have "
        "verified the migration."
    )
    print()
    print("1Password was NOT modified.")
    print("Apple Passwords was NOT modified.")
    print()


if __name__ == "__main__":
    main()