@atlasauth/backend 0.23.0 → 0.25.0

package/dist/migration-bridge.js

@@ -0,0 +1,354 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrationExchangePath = migrationExchangePath;
+exports.migrationBapiExchangePath = migrationBapiExchangePath;
+exports.exchangeMigrationSession = exchangeMigrationSession;
+exports.parseCookieHeader = parseCookieHeader;
+exports.readPocketBaseCookieToken = readPocketBaseCookieToken;
+exports.readSupabaseAccessToken = readSupabaseAccessToken;
+exports.readSupabaseRefreshToken = readSupabaseRefreshToken;
+exports.bridgeCookieConfig = bridgeCookieConfig;
+exports.createMigrationBridge = createMigrationBridge;
+const migration_presets_1 = require("./migration-presets");
+/**
+ * Moving to Atlas from ANY auth vendor without signing anyone out — the
+ * vendor-neutral zero-logout bridge (Better Auth's `betterAuthBridge` is now an
+ * alias of this with `source: 'better_auth'`).
+ *
+ * During the migration window a returning user still carries the old vendor's
+ * session cookie (or bearer token). The bridge reads it, exchanges it ONCE with
+ * Atlas (`POST /v1/migrations/{source}/exchange` with the secret key, or the
+ * Frontend API twin `POST /v1/client/migrations/{source}/exchange`), sets the
+ * Atlas session as your own first-party cookies and clears the old ones. Atlas
+ * verifies the old token (a JWT against the vendor's keys, or an opaque token
+ * against the sessions you imported) and runs the normal sign-in path on it —
+ * MFA policy included.
+ *
+ * Framework-neutral: {@link createMigrationBridge} returns a decision with the
+ * cookies to set and clear; the Next.js middleware and the Express / Fastify /
+ * Hono adapters render it (`migrationBridge({ source })`).
+ */
+/** Default Backend API origin. */
+const DEFAULT_BAPI_URL = 'https://api.atlasauth.net';
+/** The Frontend API exchange path for a source. */
+function migrationExchangePath(source) {
+    return `/v1/client/migrations/${encodeURIComponent(source)}/exchange`;
+}
+/** The Backend API (secret-key) exchange path for a source. */
+function migrationBapiExchangePath(source) {
+    return `/v1/migrations/${encodeURIComponent(source)}/exchange`;
+}
+const KNOWN_REFUSALS = ['closed', 'invalid', 'signature_invalid', 'expired', 'reused', 'user_unavailable', 'user_unknown', 'rate_limited'];
+/**
+ * Exchange an old vendor session for an Atlas session, server to server
+ * (`delivery: "body"`). Never throws: a transport failure is
+ * `{ kind: 'refused', outcome: 'unavailable' }`, so the caller keeps the old
+ * cookie and tries again on a later request.
+ */
+async function exchangeMigrationSession(options) {
+    const doFetch = options.fetchImpl ?? fetch;
+    const viaSecretKey = Boolean(options.secretKey);
+    const url = viaSecretKey
+        ? `${(options.bapiBaseUrl ?? DEFAULT_BAPI_URL).replace(/\/+$/, '')}${migrationBapiExchangePath(options.source)}`
+        : new URL(migrationExchangePath(options.source), options.fapiOrigin).toString();
+    const headers = { 'content-type': 'application/json' };
+    if (viaSecretKey) {
+        headers.authorization = `Bearer ${options.secretKey}`;
+        if (options.clientIp)
+            headers['x-atlas-client-ip'] = options.clientIp;
+        if (options.userAgent)
+            headers['x-atlas-client-user-agent'] = options.userAgent;
+    }
+    else {
+        headers['x-publishable-key'] = options.publishableKey;
+        if (options.userAgent)
+            headers['user-agent'] = options.userAgent;
+    }
+    let res;
+    try {
+        res = await doFetch(url, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+                token: options.token,
+                ...(viaSecretKey ? {} : { delivery: 'body' }),
+                ...(options.remember === false ? { remember: false } : {}),
+            }),
+        });
+    }
+    catch {
+        return { kind: 'refused', outcome: 'unavailable', status: 0 };
+    }
+    const data = (await res.json().catch(() => null));
+    if (res.ok && data?.object === 'session_tokens' && data.jwt && data.refresh_token) {
+        return { kind: 'session', jwt: data.jwt, refreshToken: data.refresh_token, sessionId: data.session_id ?? '', userId: data.user_id ?? '', expiresIn: data.expires_in ?? 0 };
+    }
+    if (res.ok && data?.object === 'sign_in_attempt' && data.id && (data.status === 'needs_second_factor' || data.status === 'needs_mfa_enrollment')) {
+        return { kind: 'needs_mfa', attemptId: data.id, status: data.status };
+    }
+    if (res.status === 429)
+        return { kind: 'refused', outcome: 'rate_limited', status: 429 };
+    const outcome = data?.errors?.[0]?.meta?.bridge_outcome;
+    if (outcome && KNOWN_REFUSALS.includes(outcome))
+        return { kind: 'refused', outcome: outcome, status: res.status };
+    // Anything else (a 5xx, a guard refusal, an unparsable body) is not a verdict on the old session: keep it.
+    return { kind: 'refused', outcome: 'unavailable', status: res.status };
+}
+/** Refusals that say the old session will never exchange: its cookies are cleared. */
+const FINAL = ['invalid', 'signature_invalid', 'expired', 'reused', 'user_unavailable', 'user_unknown'];
+function header(headers, name) {
+    if (typeof headers.get === 'function')
+        return headers.get(name) ?? undefined;
+    const record = headers;
+    const value = record[name] ?? record[name.toLowerCase()];
+    return Array.isArray(value) ? value.join('; ') : value;
+}
+/** Parse a Cookie header into name → raw value (first occurrence wins). */
+function parseCookieHeader(cookieHeader) {
+    const out = {};
+    if (!cookieHeader)
+        return out;
+    for (const part of cookieHeader.split(';')) {
+        const i = part.indexOf('=');
+        if (i <= 0)
+            continue;
+        const name = part.slice(0, i).trim();
+        if (name && !(name in out))
+            out[name] = part.slice(i + 1).trim();
+    }
+    return out;
+}
+/** The unverified `iss` of a compact JWT (routing only; Atlas verifies). */
+function peekIss(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        const json = JSON.parse(decodeBase64Url(parts[1]));
+        return typeof json.iss === 'string' ? json.iss : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function decodeBase64Url(s) {
+    const b64 = s.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(s.length / 4) * 4, '=');
+    const bin = atob(b64);
+    const bytes = Uint8Array.from(bin, (c) => c.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+}
+/** The token in the PocketBase JS SDK's `authStore.exportToCookie()` cookie (`pb_auth`: JSON `{ token, record }`). */
+function readPocketBaseCookieToken(raw) {
+    if (!raw)
+        return undefined;
+    try {
+        const v = JSON.parse(raw.startsWith('%7B') || raw.startsWith('%7b') ? decodeURIComponent(raw) : raw);
+        return typeof v?.token === 'string' && v.token ? v.token : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Supabase SSR cookie: `sb-<ref>-auth-token` (or chunks `.0`, `.1`, … joined in
+ * order), the value JSON or `base64-` + base64url(JSON), holding `access_token`.
+ */
+function readSupabaseAccessToken(cookies, baseName) {
+    return readSupabaseCookieField(cookies, baseName, 'access_token');
+}
+/**
+ * The refresh token in the same cookie (`refresh_token`, or the second entry
+ * of the older auth-helpers array): what the `supabase_refresh_token`
+ * session-table preset looks up among the sessions a dump of
+ * auth.refresh_tokens imported.
+ */
+function readSupabaseRefreshToken(cookies, baseName) {
+    return readSupabaseCookieField(cookies, baseName, 'refresh_token');
+}
+function readSupabaseCookieField(cookies, baseName, field) {
+    let raw = cookies[baseName];
+    if (raw === undefined) {
+        const chunks = [];
+        for (let i = 0; cookies[`${baseName}.${i}`] !== undefined; i++)
+            chunks.push(cookies[`${baseName}.${i}`]);
+        if (!chunks.length)
+            return undefined;
+        raw = chunks.join('');
+    }
+    try {
+        let text = decodeURIComponent(raw);
+        if (text.startsWith('base64-'))
+            text = decodeBase64Url(text.slice('base64-'.length));
+        const parsed = JSON.parse(text);
+        const token = Array.isArray(parsed) ? parsed[field === 'access_token' ? 0 : 1] : parsed?.[field];
+        return typeof token === 'string' && token ? token : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Resolve the cookie names / format / bearer flag the bridge uses for its source. */
+function bridgeCookieConfig(options) {
+    const presetId = options.preset ?? ((0, migration_presets_1.getMigrationBridgePreset)(options.source) ? options.source : undefined);
+    let cookies = [];
+    let clear = [];
+    let format = 'raw';
+    let bearer = false;
+    let sharesAtlasCookie = false;
+    let issuer = null;
+    if (presetId) {
+        try {
+            const r = (0, migration_presets_1.resolveMigrationBridgePreset)(presetId, options.presetVars ?? {});
+            cookies = r.cookies;
+            clear = r.clearCookies;
+            format = r.tokenFormat;
+            bearer = r.bearer;
+            sharesAtlasCookie = r.sharesAtlasCookie;
+            issuer = r.issuer;
+        }
+        catch {
+            // A preset whose cookie names need variables the app did not pass: only explicit names work.
+            const p = (0, migration_presets_1.getMigrationBridgePreset)(presetId);
+            cookies = (p?.cookies ?? []).filter((c) => !c.includes('{'));
+            clear = (p?.clearCookies ?? p?.cookies ?? []).filter((c) => !c.includes('{'));
+            format = p?.tokenFormat ?? 'raw';
+            bearer = p?.bearer === true;
+            sharesAtlasCookie = p?.sharesAtlasCookie === true;
+        }
+    }
+    if (options.cookieNames)
+        cookies = options.cookieNames;
+    if (options.clearCookieNames)
+        clear = options.clearCookieNames;
+    else if (options.cookieNames)
+        clear = options.cookieNames;
+    return {
+        cookies,
+        clear,
+        format: options.tokenFormat ?? format,
+        bearer: options.bearer ?? bearer,
+        sharesAtlasCookie: sharesAtlasCookie || cookies.includes('__session'),
+        issuer,
+    };
+}
+/**
+ * The bridge as a function of a request's headers. Call it from middleware
+ * before your normal auth check; it does nothing (no network) for a request
+ * without an old session, or with an Atlas session already present.
+ */
+function createMigrationBridge(options) {
+    const secure = options.secure !== false;
+    const config = bridgeCookieConfig(options);
+    const clearOld = (present) => {
+        const names = new Set();
+        for (const pattern of config.clear) {
+            if (!pattern.includes('*')) {
+                names.add(pattern);
+                continue;
+            }
+            for (const name of Object.keys(present))
+                if ((0, migration_presets_1.cookieNameMatches)(pattern, name))
+                    names.add(name);
+        }
+        return [...names].map((name) => ({
+            name,
+            value: '',
+            options: {
+                path: '/',
+                maxAge: 0,
+                ...(options.oldCookieDomain ? { domain: options.oldCookieDomain } : {}),
+                ...(name.startsWith('__Secure-') || name.startsWith('__Host-') ? { secure: true } : {}),
+            },
+        }));
+    };
+    const readToken = async (request, cookies) => {
+        if (options.extractToken) {
+            const t = await options.extractToken({ cookies, headers: request.headers });
+            return t ? { token: t, fromAtlasCookie: false } : undefined;
+        }
+        for (const pattern of config.cookies) {
+            const names = pattern.includes('*') ? Object.keys(cookies).filter((n) => (0, migration_presets_1.cookieNameMatches)(pattern, n)).sort() : [pattern];
+            for (const name of names) {
+                const token = config.format === 'supabase' ? readSupabaseAccessToken(cookies, name) : config.format === 'supabase_refresh' ? readSupabaseRefreshToken(cookies, name) : config.format === 'pocketbase' ? readPocketBaseCookieToken(cookies[name]) : cookies[name];
+                if (token)
+                    return { token, fromAtlasCookie: name === '__session' };
+            }
+        }
+        if (config.bearer) {
+            const auth = header(request.headers, 'authorization');
+            const m = auth ? /^Bearer\s+(.+)$/i.exec(auth.trim()) : null;
+            if (m && config.issuer && peekIss(m[1]) === config.issuer)
+                return { token: m[1], fromAtlasCookie: false };
+        }
+        return undefined;
+    };
+    return async function bridge(request) {
+        const cookies = parseCookieHeader(header(request.headers, 'cookie'));
+        const found = await readToken(request, cookies);
+        if (!found)
+            return { action: 'none' };
+        // Already on Atlas: an Atlas refresh cookie means the switch happened.
+        if (cookies.__atlas_rt)
+            return { action: 'none' };
+        // `__session` is Atlas's own cookie name, and a few vendors (Clerk, Firebase
+        // Hosting, nextjs-auth0) use it too. A token read from it is the vendor's
+        // only when it carries the vendor's issuer (which needs the preset's
+        // variables); otherwise an Atlas session (a JWT with another issuer) means
+        // the user is already on Atlas.
+        if (found.fromAtlasCookie) {
+            if (!config.issuer || peekIss(found.token) !== config.issuer)
+                return { action: 'none' };
+        }
+        else if (cookies.__session) {
+            const iss = peekIss(cookies.__session);
+            const atlasSession = !config.sharesAtlasCookie || (iss !== undefined && iss !== config.issuer);
+            if (atlasSession)
+                return { action: 'none' };
+        }
+        const result = await exchangeMigrationSession({
+            source: options.source,
+            fapiOrigin: options.fapiOrigin,
+            publishableKey: options.publishableKey,
+            token: found.token,
+            fetchImpl: options.fetchImpl,
+            userAgent: header(request.headers, 'user-agent'),
+            secretKey: options.secretKey,
+            bapiBaseUrl: options.bapiBaseUrl,
+            clientIp: request.ip ?? clientIpFrom(request.headers),
+        });
+        if (result.kind === 'session') {
+            const old = clearOld(cookies).filter((c) => c.name !== '__session');
+            return {
+                action: 'signed_in',
+                session: result,
+                cookies: [
+                    { name: '__session', value: result.jwt, options: { path: '/', sameSite: 'lax', secure } },
+                    { name: '__atlas_rt', value: result.refreshToken, options: { path: '/', httpOnly: true, sameSite: 'lax', secure } },
+                    ...old,
+                ],
+            };
+        }
+        if (result.kind === 'needs_mfa') {
+            return {
+                action: 'needs_mfa',
+                attemptId: result.attemptId,
+                status: result.status,
+                cookies: clearOld(cookies),
+                continuationUrl: (url) => {
+                    const next = new URL(url);
+                    next.searchParams.set('__atlas_attempt', result.attemptId);
+                    next.searchParams.set('__atlas_status', result.status);
+                    return next.toString();
+                },
+            };
+        }
+        return { action: 'refused', outcome: result.outcome, cookies: FINAL.includes(result.outcome) ? clearOld(cookies) : [] };
+    };
+}
+/** The client IP a proxy in front of your server recorded (first X-Forwarded-For hop, or X-Real-IP). */
+function clientIpFrom(headers) {
+    const xff = header(headers, 'x-forwarded-for');
+    const first = xff?.split(',')[0]?.trim();
+    return first || header(headers, 'x-real-ip')?.trim() || undefined;
+}
+//# sourceMappingURL=migration-bridge.js.map

package/dist/migration-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-bridge.js","sourceRoot":"","sources":["../src/migration-bridge.ts"],"names":[],"mappings":";;AA0BA,sDAEC;AAGD,8DAEC;AAmDD,4DAmDC;AAsED,8CAUC;AAsBD,8DAQC;AAMD,0DAEC;AAQD,4DAEC;AAsBD,gDAsCC;AAOD,sDAwGC;AAjbD,2DAAkI;AAElI;;;;;;;;;;;;;;;;;GAiBG;AAEH,kCAAkC;AAClC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAErD,mDAAmD;AACnD,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO,yBAAyB,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;AACxE,CAAC;AAED,+DAA+D;AAC/D,SAAgB,yBAAyB,CAAC,MAAc;IACtD,OAAO,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;AACjE,CAAC;AA2CD,MAAM,cAAc,GAA6B,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAErK;;;;;GAKG;AACI,KAAK,UAAU,wBAAwB,CAAC,OAAwC;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,YAAY;QACtB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QAChH,CAAC,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClF,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,aAAa,GAAG,UAAU,OAAO,CAAC,SAAS,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACtE,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACnE,CAAC;IACD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAC7C,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAUxC,CAAC;IACT,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;IAC7K,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,iBAAiB,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,qBAAqB,IAAI,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,EAAE,CAAC;QACjJ,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC;IACxD,IAAI,OAAO,IAAK,cAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAiC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC1J,2GAA2G;IAC3G,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzE,CAAC;AA2DD,sFAAsF;AACtF,MAAM,KAAK,GAA6B,CAAC,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAElI,SAAS,MAAM,CAAC,OAAkB,EAAE,IAAY;IAC9C,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU;QAAE,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC9I,MAAM,MAAM,GAAG,OAAwD,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,2EAA2E;AAC3E,SAAgB,iBAAiB,CAAC,YAAuC;IACvE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAsB,CAAC;QACzE,OAAO,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,sHAAsH;AACtH,SAAgB,yBAAyB,CAAC,GAAuB;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAwB,CAAC;QAC5H,OAAO,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,OAA+B,EAAE,QAAgB;IACvF,OAAO,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,OAA+B,EAAE,QAAgB;IACxF,OAAO,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,uBAAuB,CAAC,OAA+B,EAAE,QAAgB,EAAE,KAAuC;IACzH,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACrC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,MAAyC,EAAE,CAAC,KAAK,CAAC,CAAC;QACrI,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAgB,kBAAkB,CAAC,OAAyI;IAC1K,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,IAAA,4CAAwB,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3G,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,GAAgB,KAAK,CAAC;IAChC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAA,gDAA4B,EAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAC3E,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;YACpB,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC;YACvB,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;YACvB,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YAClB,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;YACxC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;YAC7F,MAAM,CAAC,GAAG,IAAA,4CAAwB,EAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,KAAK,GAAG,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9E,MAAM,GAAG,CAAC,EAAE,WAAW,IAAI,KAAK,CAAC;YACjC,MAAM,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;YAC5B,iBAAiB,GAAG,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACvD,IAAI,OAAO,CAAC,gBAAgB;QAAE,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;SAC1D,IAAI,OAAO,CAAC,WAAW;QAAE,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAC1D,OAAO;QACL,OAAO;QACP,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;QACrC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM;QAChC,iBAAiB,EAAE,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrE,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAG,CAAC,OAA+B,EAAkB,EAAE;QACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,IAAI,IAAA,qCAAiB,EAAC,OAAO,EAAE,IAAI,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/B,IAAI;YACJ,KAAK,EAAE,EAAE;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,CAAC;gBACT,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF;SACF,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,OAA+B,EAAE,OAA+B,EAAoE,EAAE;QAC7J,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAiB,EAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3H,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACjQ,IAAI,KAAK;oBAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YACrE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9G,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,KAAK,UAAU,MAAM,CAAC,OAA+B;QAC1D,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,uEAAuE;QACvE,IAAI,OAAO,CAAC,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAClD,6EAA6E;QAC7E,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,gCAAgC;QAChC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1F,CAAC;aAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/F,IAAI,YAAY;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;YAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC;YAChD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;YACpE,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACzF,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACnH,GAAG,GAAG;iBACP;aACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAC1B,eAAe,EAAE,CAAC,GAAW,EAAE,EAAE;oBAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzB,CAAC;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1H,CAAC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,YAAY,CAAC,OAAkB;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACpE,CAAC"}

package/dist/migration-presets-g3.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationBridgePreset } from './migration-presets';
+export declare const G3_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g3.js

@@ -0,0 +1,254 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.G3_BRIDGE_PRESETS = void 0;
+/**
+ * Bridge presets for Firebase / Identity Platform, Supabase, Amazon Cognito,
+ * Azure AD B2C, Entra External ID, Appwrite, PocketBase and Nhost, checked against each vendor's
+ * token documentation. Registered (replacing the starters) at the end of
+ * migration-presets.ts; only a type is imported from there, so there is no
+ * import cycle at runtime.
+ *
+ * A vendor whose browser SDK keeps the session in localStorage / IndexedDB
+ * (Firebase, Amplify, MSAL, Supabase SPA, Nhost) has no cookie for a server
+ * middleware to read: the browser helpers in `@atlasauth/js`
+ * (`exchangeMigrationBrowserSession` with the vendor readers) pick the token up
+ * there and call the Frontend API exchange.
+ */
+/** Short-lived vendor tokens nobody refreshes after the switch: accept them (once) for a week past `exp`. */
+const WEEK = 7 * 24 * 3600;
+exports.G3_BRIDGE_PRESETS = [
+    {
+        id: 'firebase',
+        label: 'Firebase Authentication / Identity Platform (ID tokens)',
+        mode: 'jwt',
+        vars: { project_id: 'Firebase / Google Cloud project id' },
+        jwt: {
+            issuer: 'https://securetoken.google.com/{project_id}',
+            keysUrl: 'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com',
+            audience: ['{project_id}'],
+            algorithms: ['RS256'],
+            // `sub` and `user_id` both carry the uid. Firebase ID tokens have no jti:
+            // the whole token is spent in the single-use ledger.
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name' },
+            // ID tokens live an hour and the Firebase SDK refreshes them; after the switch nothing does.
+            expiredGraceSeconds: WEEK,
+        },
+        // Firebase keeps sessions in IndexedDB; `__session` is the cookie apps behind
+        // Firebase Hosting conventionally copy the ID token into.
+        cookies: ['__session'],
+        sharesAtlasCookie: true,
+        bearer: true,
+        notes: 'Identity Platform tenants sign with the same issuer (the tenant is the firebase.tenant claim); export each tenant into its own organization. Browser sessions (IndexedDB) are exchanged with readFirebaseBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'firebase_session_cookie',
+        label: 'Firebase session cookies (Admin SDK createSessionCookie)',
+        mode: 'jwt',
+        vars: { project_id: 'Firebase / Google Cloud project id' },
+        defaults: { cookie_name: 'session' },
+        jwt: {
+            issuer: 'https://session.firebase.google.com/{project_id}',
+            keysUrl: 'https://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys',
+            keysFormat: 'x509',
+            audience: ['{project_id}'],
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name' },
+        },
+        cookies: ['{cookie_name}', '__session'],
+        sharesAtlasCookie: true,
+        notes: 'Session cookies live up to two weeks and verify against the x509 key map; set cookie_name when your app named it something else.',
+    },
+    {
+        id: 'supabase',
+        label: 'Supabase Auth (hosted)',
+        mode: 'jwt',
+        vars: { project_ref: 'Project ref (the subdomain of <ref>.supabase.co)' },
+        jwt: {
+            issuer: 'https://{project_ref}.supabase.co/auth/v1',
+            keysUrl: 'https://{project_ref}.supabase.co/auth/v1/.well-known/jwks.json',
+            audience: ['authenticated'],
+            // ES256/RS256 with the new signing keys; HS256 with the legacy JWT secret (stored in the bridge settings).
+            algorithms: ['ES256', 'RS256', 'HS256'],
+            // `amr` is a list of { method, timestamp } objects and `aal` a level, so
+            // the second factor is not mapped: Atlas applies its own MFA policy.
+            claims: { subject: 'sub', email: 'email', sessionKey: 'session_id' },
+            expiredGraceSeconds: WEEK,
+            allowSharedSecret: true,
+        },
+        cookies: ['sb-{project_ref}-auth-token'],
+        tokenFormat: 'supabase',
+        clearCookies: ['sb-{project_ref}-auth-token', 'sb-{project_ref}-auth-token.*', 'sb-{project_ref}-auth-token-code-verifier'],
+        bearer: true,
+        notes: 'Anonymous users (is_anonymous) are refused like any user the import did not create.',
+    },
+    {
+        id: 'supabase_refresh_token',
+        label: 'Supabase Auth (refresh tokens from a dump)',
+        mode: 'session_table',
+        vars: { project_ref: 'Project ref (the subdomain of <ref>.supabase.co)' },
+        // The export keys each live auth.refresh_tokens row by sha256(token): the
+        // refresh token in the SSR cookie finds it however long the user was away
+        // (the supabase JWT preset covers access tokens up to a week past expiry).
+        cookies: ['sb-{project_ref}-auth-token'],
+        tokenFormat: 'supabase_refresh',
+        clearCookies: ['sb-{project_ref}-auth-token', 'sb-{project_ref}-auth-token.*', 'sb-{project_ref}-auth-token-code-verifier'],
+        notes: 'Needs a dump of auth.refresh_tokens taken close to cutover. Refresh tokens Supabase issued after the dump are not known: keep the supabase preset for those, or re-import.',
+    },
+    {
+        id: 'supabase_self_hosted',
+        label: 'Supabase Auth (self-hosted or custom domain)',
+        mode: 'jwt',
+        vars: { auth_url: 'The Auth URL (https://db.example.com/auth/v1)', cookie_name: 'The SSR cookie name (sb-<first label of the host>-auth-token)' },
+        jwt: {
+            issuer: '{auth_url}',
+            keysUrl: '{auth_url}/.well-known/jwks.json',
+            audience: ['authenticated'],
+            algorithms: ['ES256', 'RS256', 'HS256'],
+            claims: { subject: 'sub', email: 'email', sessionKey: 'session_id' },
+            expiredGraceSeconds: WEEK,
+            allowSharedSecret: true,
+        },
+        cookies: ['{cookie_name}'],
+        tokenFormat: 'supabase',
+        clearCookies: ['{cookie_name}', '{cookie_name}.*'],
+        bearer: true,
+    },
+    {
+        id: 'cognito',
+        label: 'Amazon Cognito (ID tokens)',
+        mode: 'jwt',
+        vars: { region: 'AWS region (us-east-1)', user_pool_id: 'User pool id (us-east-1_AbCdEf)', client_id: 'App client id' },
+        jwt: {
+            issuer: 'https://cognito-idp.{region}.amazonaws.com/{user_pool_id}',
+            keysUrl: 'https://cognito-idp.{region}.amazonaws.com/{user_pool_id}/.well-known/jwks.json',
+            // ID tokens carry aud = the app client id (access tokens carry client_id and no aud).
+            audience: ['{client_id}'],
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'origin_jti' },
+            // ID tokens live an hour by default; Amplify refreshed them.
+            expiredGraceSeconds: WEEK,
+        },
+        // @aws-amplify/adapter-nextjs keeps the tokens in cookies named like Amplify's localStorage keys.
+        cookies: ['CognitoIdentityServiceProvider.{client_id}.*.idToken'],
+        clearCookies: ['CognitoIdentityServiceProvider.{client_id}.*'],
+        bearer: true,
+        notes: 'Users are matched on sub (the export keys users by sub). SPA sessions in localStorage are exchanged with readAmplifyBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'azure_ad_b2c',
+        label: 'Azure AD B2C (ID tokens)',
+        mode: 'jwt',
+        vars: {
+            tenant: 'Tenant name (contoso for contoso.b2clogin.com)',
+            tenant_id: 'Directory (tenant) id GUID',
+            policy: 'The user flow / custom policy that issued the tokens (B2C_1_signupsignin)',
+            client_id: 'Application (client) id',
+        },
+        jwt: {
+            issuer: 'https://{tenant}.b2clogin.com/{tenant_id}/v2.0/',
+            keysUrl: 'https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/{policy}/discovery/v2.0/keys',
+            audience: ['{client_id}'],
+            algorithms: ['RS256'],
+            // B2C's sub is the user's object id by default, which the Graph export uses as the user id.
+            claims: { subject: 'sub', name: 'name' },
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Keys are published per policy: run one bridge per user flow that issued tokens. MSAL keeps tokens in browser storage (encrypted from msal-browser v4): exchange v2/v3 caches with readMsalBrowserSession from @atlasauth/js; v4 apps rely on lazy migration.',
+    },
+    {
+        id: 'entra_external_id',
+        label: 'Microsoft Entra External ID (ID tokens)',
+        mode: 'jwt',
+        vars: {
+            tenant: 'Tenant subdomain (contoso for contoso.ciamlogin.com)',
+            tenant_id: 'Directory (tenant) id GUID',
+            client_id: 'Application (client) id',
+        },
+        jwt: {
+            issuer: 'https://{tenant_id}.ciamlogin.com/{tenant_id}/v2.0',
+            keysUrl: 'https://{tenant}.ciamlogin.com/{tenant_id}/discovery/v2.0/keys',
+            audience: ['{client_id}'],
+            algorithms: ['RS256'],
+            // `sub` differs per application; `oid` is the directory object id the Graph export keys users by.
+            claims: { subject: 'oid', email: 'email', name: 'name', sessionKey: 'uti' },
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'MSAL keeps tokens in browser storage (encrypted from msal-browser v4): exchange v2/v3 caches with readMsalBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'appwrite',
+        label: 'Appwrite (session cookie, checked with Appwrite)',
+        mode: 'remote',
+        vars: { endpoint_url: 'API endpoint including /v1 (https://cloud.appwrite.io/v1, or your own)', project_id: 'Project id' },
+        // Appwrite keeps only a hash of each session secret, so sessions cannot be
+        // exported or verified offline: Atlas asks Appwrite who the session is. The
+        // cookie value (base64 of {id, secret}) is what X-Appwrite-Session takes.
+        remote: {
+            url: '{endpoint_url}/account',
+            method: 'GET',
+            headers: { 'x-appwrite-project': '{project_id}', 'x-appwrite-session': '{token}' },
+            subjectPath: '$id',
+            emailPath: 'email',
+            emailVerifiedPath: 'emailVerification',
+            namePath: 'name',
+        },
+        // a_session_<project id, lowercased> and its _legacy twin.
+        cookies: ['a_session_*'],
+        notes: 'The browser must send the Appwrite cookie to your app, so this works when Appwrite is on a subdomain of your app (custom domain) or your app does SSR with the session secret in its own cookie (pass its name as cookieNames). Client-only apps keep the session in localStorage (cookieFallback): exchange it with readAppwriteBrowserSession from @atlasauth/js. Keep the Appwrite project running for the bridge window.',
+    },
+    {
+        id: 'pocketbase',
+        label: 'PocketBase (auth token, checked with PocketBase)',
+        mode: 'remote',
+        vars: { url: 'PocketBase URL (https://pb.example.com)' },
+        defaults: { collection: 'users' },
+        // Tokens are signed with a per-user tokenKey plus a per-collection secret, so
+        // nothing outside PocketBase can verify one: auth-refresh vouches for it.
+        remote: {
+            url: '{url}/api/collections/{collection}/auth-refresh',
+            method: 'POST',
+            headers: { authorization: '{token}' },
+            subjectPath: 'record.id',
+            emailPath: 'record.email',
+            emailVerifiedPath: 'record.verified',
+            namePath: 'record.name',
+        },
+        // pb_auth is the cookie the JS SDK's authStore.exportToCookie() writes (JSON with the token).
+        cookies: ['pb_auth'],
+        tokenFormat: 'pocketbase',
+        notes: 'Client-only apps keep the token in localStorage (pocketbase_auth): exchange it with readPocketBaseBrowserSession from @atlasauth/js. Keep PocketBase running for the bridge window.',
+    },
+    {
+        id: 'nhost',
+        label: 'Nhost (refresh tokens)',
+        mode: 'session_table',
+        // The export stores sha256(refresh token) — exactly what auth.refresh_tokens keeps.
+        cookies: ['nhostRefreshToken'],
+        clearCookies: ['nhostRefreshToken', 'nhostRefreshTokenExpiresAt', 'nhostSession'],
+        notes: 'SPA sessions keep the refresh token in localStorage (nhostRefreshToken): exchange them with readNhostBrowserSession from @atlasauth/js.',
+    },
+    {
+        id: 'nhost_jwt',
+        label: 'Nhost (access tokens)',
+        mode: 'jwt',
+        vars: { auth_url: 'The Auth URL (https://<subdomain>.auth.<region>.nhost.run/v1)' },
+        // Legacy Hasura Auth signs with iss "hasura-auth"; current versions use the server URL.
+        defaults: { issuer: 'hasura-auth' },
+        jwt: {
+            issuer: '{issuer}',
+            keysUrl: '{auth_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'HS256', 'HS512'],
+            claims: { subject: 'sub', sessionKey: 'jti' },
+            expiredGraceSeconds: WEEK,
+            // Most projects sign with the shared HASURA_GRAPHQL_JWT_SECRET key.
+            allowSharedSecret: true,
+        },
+        cookies: [],
+        bearer: true,
+    },
+];
+//# sourceMappingURL=migration-presets-g3.js.map

package/dist/migration-presets-g3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-presets-g3.js","sourceRoot":"","sources":["../src/migration-presets-g3.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;GAYG;AAEH,6GAA6G;AAC7G,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEd,QAAA,iBAAiB,GAAqC;IACjE;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,yDAAyD;QAChE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE;QAC1D,GAAG,EAAE;YACH,MAAM,EAAE,6CAA6C;YACrD,OAAO,EAAE,2FAA2F;YACpG,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,0EAA0E;YAC1E,qDAAqD;YACrD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;YACzF,6FAA6F;YAC7F,mBAAmB,EAAE,IAAI;SAC1B;QACD,8EAA8E;QAC9E,0DAA0D;QAC1D,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,6OAA6O;KAChP;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,0DAA0D;QACjE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE;QAC1D,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;QACpC,GAAG,EAAE;YACH,MAAM,EAAE,kDAAkD;YAC1D,OAAO,EAAE,uEAAuE;YAChF,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;SAC1F;QACD,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;QACvC,iBAAiB,EAAE,IAAI;QACvB,KAAK,EAAE,kIAAkI;KAC1I;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,wBAAwB;QAC/B,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE;QACzE,GAAG,EAAE;YACH,MAAM,EAAE,2CAA2C;YACnD,OAAO,EAAE,iEAAiE;YAC1E,QAAQ,EAAE,CAAC,eAAe,CAAC;YAC3B,2GAA2G;YAC3G,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE;YACpE,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACxC,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,CAAC,6BAA6B,EAAE,+BAA+B,EAAE,2CAA2C,CAAC;QAC3H,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,qFAAqF;KAC7F;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,4CAA4C;QACnD,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACxC,WAAW,EAAE,kBAAkB;QAC/B,YAAY,EAAE,CAAC,6BAA6B,EAAE,+BAA+B,EAAE,2CAA2C,CAAC;QAC3H,KAAK,EAAE,4KAA4K;KACpL;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EAAE,8CAA8C;QACrD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,+CAA+C,EAAE,WAAW,EAAE,+DAA+D,EAAE;QACjJ,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,QAAQ,EAAE,CAAC,eAAe,CAAC;YAC3B,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE;YACpE,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAClD,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,YAAY,EAAE,iCAAiC,EAAE,SAAS,EAAE,eAAe,EAAE;QACvH,GAAG,EAAE;YACH,MAAM,EAAE,2DAA2D;YACnE,OAAO,EAAE,iFAAiF;YAC1F,sFAAsF;YACtF,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE;YACnH,6DAA6D;YAC7D,mBAAmB,EAAE,IAAI;SAC1B;QACD,kGAAkG;QAClG,OAAO,EAAE,CAAC,sDAAsD,CAAC;QACjE,YAAY,EAAE,CAAC,8CAA8C,CAAC;QAC9D,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,wJAAwJ;KAChK;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,MAAM,EAAE,gDAAgD;YACxD,SAAS,EAAE,4BAA4B;YACvC,MAAM,EAAE,2EAA2E;YACnF,SAAS,EAAE,yBAAyB;SACrC;QACD,GAAG,EAAE;YACH,MAAM,EAAE,iDAAiD;YACzD,OAAO,EAAE,qFAAqF;YAC9F,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,4FAA4F;YAC5F,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;YACxC,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,8PAA8P;KACjQ;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,yCAAyC;QAChD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,MAAM,EAAE,sDAAsD;YAC9D,SAAS,EAAE,4BAA4B;YACvC,SAAS,EAAE,yBAAyB;SACrC;QACD,GAAG,EAAE;YACH,MAAM,EAAE,oDAAoD;YAC5D,OAAO,EAAE,gEAAgE;YACzE,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,kGAAkG;YAClG,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;YAC3E,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,8IAA8I;KACtJ;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,kDAAkD;QACzD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,EAAE,YAAY,EAAE,wEAAwE,EAAE,UAAU,EAAE,YAAY,EAAE;QAC1H,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,EAAE;YACN,GAAG,EAAE,wBAAwB;YAC7B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,oBAAoB,EAAE,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE;YAClF,WAAW,EAAE,KAAK;YAClB,SAAS,EAAE,OAAO;YAClB,iBAAiB,EAAE,mBAAmB;YACtC,QAAQ,EAAE,MAAM;SACjB;QACD,2DAA2D;QAC3D,OAAO,EAAE,CAAC,aAAa,CAAC;QACxB,KAAK,EACH,8ZAA8Z;KACja;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,kDAAkD;QACzD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,EAAE,GAAG,EAAE,yCAAyC,EAAE;QACxD,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;QACjC,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,EAAE;YACN,GAAG,EAAE,iDAAiD;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE;YACrC,WAAW,EAAE,WAAW;YACxB,SAAS,EAAE,cAAc;YACzB,iBAAiB,EAAE,iBAAiB;YACpC,QAAQ,EAAE,aAAa;SACxB;QACD,8FAA8F;QAC9F,OAAO,EAAE,CAAC,SAAS,CAAC;QACpB,WAAW,EAAE,YAAY;QACzB,KAAK,EAAE,qLAAqL;KAC7L;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,wBAAwB;QAC/B,IAAI,EAAE,eAAe;QACrB,oFAAoF;QACpF,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,YAAY,EAAE,CAAC,mBAAmB,EAAE,4BAA4B,EAAE,cAAc,CAAC;QACjF,KAAK,EAAE,yIAAyI;KACjJ;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,+DAA+D,EAAE;QACnF,wFAAwF;QACxF,QAAQ,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;QACnC,GAAG,EAAE;YACH,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,mBAAmB,EAAE,IAAI;YACzB,oEAAoE;YACpE,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;CACF,CAAC"}