@atlasauth/backend 0.23.0 → 0.25.0

package/dist/client/messaging.d.ts

@@ -18,9 +18,9 @@ import { type RequestFn } from './request';
  * stored secret) stays. So a from-address change need not re-enter the API key.
  */
 /** Email transports accepted by `PUT /v1/messaging_providers/email`. */
-export type EmailTransport = 'resend' | 'ses' | 'smtp' | 'brevo' | 'mailgun';
+export type EmailTransport = 'resend' | 'ses' | 'smtp' | 'brevo' | 'mailgun' | 'webhook';
 /** SMS transports accepted by `PUT /v1/messaging_providers/sms`. */
-export type SmsTransport = 'twilio' | 'vonage' | 'messagebird' | 'plivo' | 'telnyx' | 'sinch' | 'infobip' | 'clicksend' | 'bandwidth' | 'aws_sns';
+export type SmsTransport = 'twilio' | 'vonage' | 'messagebird' | 'plivo' | 'telnyx' | 'sinch' | 'infobip' | 'clicksend' | 'bandwidth' | 'aws_sns' | 'webhook';
 export type MessagingTransport = EmailTransport | SmsTransport;
 /** Sender number or ID for an SMS provider. `from_address` on the request takes precedence. */
 interface SmsFrom {
@@ -150,6 +150,15 @@ export interface AwsSnsConfig extends SmsFrom {
     /** STS session token, only for temporary credentials. Write-only: never returned. */
     session_token?: string;
 }
+/** Your own delivery endpoint: Atlas POSTs each message, Standard Webhooks signed. */
+export interface WebhookConfig {
+    /** Your HTTPS endpoint (port 443). Required on first setup. */
+    url: string;
+    /** Signing secret (`whsec_…` base64 or any string). Required on first setup. Write-only: never returned. */
+    signing_secret: string;
+    /** Email only. `rendered` (default) sends the final subject/text/html; `raw` sends the template name and variables. */
+    payload?: 'rendered' | 'raw';
+}
 /** The `config` shape for each transport, keyed by transport. */
 export interface MessagingTransportConfigs {
     resend: ResendConfig;
@@ -167,6 +176,7 @@ export interface MessagingTransportConfigs {
     clicksend: ClicksendConfig;
     bandwidth: BandwidthConfig;
     aws_sns: AwsSnsConfig;
+    webhook: WebhookConfig;
 }
 /** The write-only (secret) keys of each transport — never present in a response. */
 export interface MessagingSecretKeys {
@@ -185,6 +195,7 @@ export interface MessagingSecretKeys {
     clicksend: 'api_key';
     bandwidth: 'password';
     aws_sns: 'secret_access_key' | 'session_token';
+    webhook: 'signing_secret';
 }
 interface ProviderBodyBase<T extends MessagingTransport> {
     transport: T;
@@ -413,7 +424,7 @@ export type EnableDevelopmentEmailBody = {
     provider_id: string;
     from_address?: string;
 } | {
-    transport: 'resend' | 'ses' | 'smtp' | 'brevo' | 'mailgun';
+    transport: 'resend' | 'ses' | 'smtp' | 'brevo' | 'mailgun' | 'webhook';
     config?: Record<string, string>;
     from_address?: string;
 };

package/dist/client/messaging.js.map

@@ -1 +1 @@
-{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAoeA,8CA6GC;AAjlBD,uCAAgD;AAoehD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,oFAAoF;QACpF,OAAO,CACL,OAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,OAAO,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,gBAAgB,EAAE;YAChB,4EAA4E;YAC5E,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,iDAAiD;YACjD,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,4FAA4F;QAC5F,YAAY,EAAE;YACZ,uDAAuD;YACvD,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,IAA4B;gBACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD;;;;eAIG;YACH,MAAM,CAAC,UAA+B,EAAE;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,uCAAuC;oBAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;SACF;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAifA,8CA6GC;AA9lBD,uCAAgD;AAifhD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,oFAAoF;QACpF,OAAO,CACL,OAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,OAAO,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,gBAAgB,EAAE;YAChB,4EAA4E;YAC5E,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,iDAAiD;YACjD,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,4FAA4F;QAC5F,YAAY,EAAE;YACZ,uDAAuD;YACvD,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,IAA4B;gBACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD;;;;eAIG;YACH,MAAM,CAAC,UAA+B,EAAE;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,uCAAuC;oBAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;SACF;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/mfa-factors.d.ts

@@ -0,0 +1,120 @@
+import { type RequestFn } from './request';
+/** An existing second factor to import with a user (`atlas.users.create({ mfa })`). */
+export interface ImportedMfa {
+    /** An authenticator-app secret. SHA1, SHA256 or SHA512; 6 or 8 digits; 30 or 60 second step. */
+    totp?: {
+        secret_base32: string;
+        algorithm?: 'SHA1' | 'SHA256' | 'SHA512';
+        digits?: 6 | 8;
+        period?: 30 | 60;
+        verified_at?: number | string;
+    };
+    /** A counter-based (HOTP) token. Give `totp` or `hotp`, not both. */
+    hotp?: {
+        secret_base32: string;
+        algorithm?: 'SHA1' | 'SHA256' | 'SHA512';
+        digits?: 6 | 8;
+        /** The next counter the token will produce. Default 0. */
+        counter?: number;
+        verified_at?: number | string;
+    };
+    /** Plaintext recovery codes; they are hashed on import. */
+    backup_codes?: string[];
+}
+export type SmartCardMappingKind = 'san_email' | 'san_upn' | 'subject_cn' | 'serial' | 'fingerprint';
+export interface Yubikey {
+    object: 'yubikey';
+    id: string;
+    public_id: string;
+    label: string | null;
+    user_id: string | null;
+    has_private_id: boolean;
+    last_counter: number | null;
+    created_at: number;
+}
+export interface SmartCardMapping {
+    object: 'smartcard_mapping';
+    id: string;
+    user_id: string;
+    kind: SmartCardMappingKind;
+    value: string;
+    label: string | null;
+    last_used_at: number | null;
+    created_at: number;
+}
+type SecretSet<T extends string> = {
+    object: T;
+    set: true;
+};
+type SecretDeleted<T extends string> = {
+    object: T;
+    deleted: true;
+};
+/**
+ * The additional authentication factors: the write-only BYOK secrets (Yubico cloud, Duo, the
+ * smart card proxy), the self-held Yubico OTP key registry, smart card certificate mappings and
+ * the admin reset for security questions. Turn the factors on in the auth config (`mfa.factors`,
+ * `mfa.hotp`, `mfa.yubikey`, `mfa.duo`, `mfa.smartCard`, `mfa.securityQuestions`).
+ */
+export declare function mfaFactorsResource(request: RequestFn): {
+    /** Store the Yubico cloud API secret key (base64). Write-only. */
+    setYubicoSecret(secret: string): Promise<SecretSet<"yubico_secret">>;
+    removeYubicoSecret(): Promise<SecretDeleted<"yubico_secret">>;
+    /** Store the Duo client secret. Write-only. */
+    setDuoSecret(secret: string): Promise<SecretSet<"duo_secret">>;
+    removeDuoSecret(): Promise<SecretDeleted<"duo_secret">>;
+    /** Ask Duo whether the configured integration key, stored secret and API host are accepted. */
+    duoHealthCheck(): Promise<{
+        object: "duo_health_check";
+        ok: boolean;
+        message: string;
+    }>;
+    /** Store the shared secret your TLS proxy sends so Atlas trusts its certificate headers. Write-only. */
+    setSmartCardSecret(secret: string): Promise<SecretSet<"smart_card_secret">>;
+    removeSmartCardSecret(): Promise<SecretDeleted<"smart_card_secret">>;
+    yubikeys: {
+        /** Registered self-held YubiKeys. The AES keys are never returned. */
+        list(): Promise<{
+            object: "list";
+            data: Yubikey[];
+        }>;
+        /** Register a YubiKey's AES key for self-held Yubico OTP. `userId` assigns it; otherwise the first user to enrol it claims it. */
+        register(body: {
+            publicId: string;
+            aesKey: string;
+            privateId?: string;
+            label?: string;
+            userId?: string;
+        }): Promise<Yubikey>;
+        remove(id: string): Promise<{
+            object: "yubikey";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    smartCardMappings: {
+        list(userId: string): Promise<{
+            object: "list";
+            data: SmartCardMapping[];
+        }>;
+        /** Pre-register the certificate attribute that signs a user in. A `serial` needs the certificate's `issuer` DN. */
+        add(userId: string, body: {
+            kind: SmartCardMappingKind;
+            value: string;
+            issuer?: string;
+            label?: string;
+        }): Promise<SmartCardMapping>;
+        remove(userId: string, mappingId: string): Promise<{
+            object: "smartcard_mapping";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    /** Clear a user's security-question answers (and any lockout). */
+    resetSecurityQuestions(userId: string): Promise<{
+        object: "security_questions";
+        user_id: string;
+        deleted: boolean;
+    }>;
+};
+export {};

package/dist/client/mfa-factors.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mfaFactorsResource = mfaFactorsResource;
+const request_1 = require("./request");
+/**
+ * The additional authentication factors: the write-only BYOK secrets (Yubico cloud, Duo, the
+ * smart card proxy), the self-held Yubico OTP key registry, smart card certificate mappings and
+ * the admin reset for security questions. Turn the factors on in the auth config (`mfa.factors`,
+ * `mfa.hotp`, `mfa.yubikey`, `mfa.duo`, `mfa.smartCard`, `mfa.securityQuestions`).
+ */
+function mfaFactorsResource(request) {
+    return {
+        /** Store the Yubico cloud API secret key (base64). Write-only. */
+        setYubicoSecret(secret) {
+            return request({ method: 'PUT', path: '/v1/instance/yubico_secret', body: { secret } });
+        },
+        removeYubicoSecret() {
+            return request({ method: 'DELETE', path: '/v1/instance/yubico_secret' });
+        },
+        /** Store the Duo client secret. Write-only. */
+        setDuoSecret(secret) {
+            return request({ method: 'PUT', path: '/v1/instance/duo_secret', body: { secret } });
+        },
+        removeDuoSecret() {
+            return request({ method: 'DELETE', path: '/v1/instance/duo_secret' });
+        },
+        /** Ask Duo whether the configured integration key, stored secret and API host are accepted. */
+        duoHealthCheck() {
+            return request({ method: 'POST', path: '/v1/instance/duo_health_check' });
+        },
+        /** Store the shared secret your TLS proxy sends so Atlas trusts its certificate headers. Write-only. */
+        setSmartCardSecret(secret) {
+            return request({ method: 'PUT', path: '/v1/instance/smart_card_secret', body: { secret } });
+        },
+        removeSmartCardSecret() {
+            return request({ method: 'DELETE', path: '/v1/instance/smart_card_secret' });
+        },
+        yubikeys: {
+            /** Registered self-held YubiKeys. The AES keys are never returned. */
+            list() {
+                return request({ method: 'GET', path: '/v1/yubikeys' });
+            },
+            /** Register a YubiKey's AES key for self-held Yubico OTP. `userId` assigns it; otherwise the first user to enrol it claims it. */
+            register(body) {
+                return request({
+                    method: 'POST',
+                    path: '/v1/yubikeys',
+                    body: { public_id: body.publicId, aes_key: body.aesKey, private_id: body.privateId, label: body.label, user_id: body.userId },
+                });
+            },
+            remove(id) {
+                return request({ method: 'DELETE', path: `/v1/yubikeys/${(0, request_1.enc)(id)}` });
+            },
+        },
+        smartCardMappings: {
+            list(userId) {
+                return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(userId)}/smartcard_mappings` });
+            },
+            /** Pre-register the certificate attribute that signs a user in. A `serial` needs the certificate's `issuer` DN. */
+            add(userId, body) {
+                return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(userId)}/smartcard_mappings`, body });
+            },
+            remove(userId, mappingId) {
+                return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(userId)}/smartcard_mappings/${(0, request_1.enc)(mappingId)}` });
+            },
+        },
+        /** Clear a user's security-question answers (and any lockout). */
+        resetSecurityQuestions(userId) {
+            return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(userId)}/security_questions` });
+        },
+    };
+}
+//# sourceMappingURL=mfa-factors.js.map

package/dist/client/mfa-factors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-factors.js","sourceRoot":"","sources":["../../src/client/mfa-factors.ts"],"names":[],"mappings":";;AA0DA,gDAgEC;AA1HD,uCAAgD;AAoDhD;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,kEAAkE;QAClE,eAAe,CAAC,MAAc;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,kBAAkB;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,+CAA+C;QAC/C,YAAY,CAAC,MAAc;YACzB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,eAAe;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,+FAA+F;QAC/F,cAAc;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,wGAAwG;QACxG,kBAAkB,CAAC,MAAc;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,qBAAqB;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,QAAQ,EAAE;YACR,sEAAsE;YACtE,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,kIAAkI;YAClI,QAAQ,CAAC,IAA+F;gBACtG,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;iBAC9H,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACxE,CAAC;SACF;QAED,iBAAiB,EAAE;YACjB,IAAI,CAAC,MAAc;gBACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,mHAAmH;YACnH,GAAG,CAAC,MAAc,EAAE,IAAoF;gBACtG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,CAAC,MAAc,EAAE,SAAiB;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,uBAAuB,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9G,CAAC;SACF;QAED,kEAAkE;QAClE,sBAAsB,CAAC,MAAc;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/migrations.d.ts

@@ -0,0 +1,286 @@
+import { type BetterAuthImportActionItem } from './better-auth-imports';
+import { type RequestFn } from './request';
+import type { CursorPage, CursorParams } from './types';
+/**
+ * Migrate to Atlas from any source: the vendor-neutral surface every vendor
+ * plugs into (`{source}`: `auth0`, `clerk`, `cognito`, `firebase`, …,
+ * `better_auth`, `custom`).
+ *
+ *   imports  `/v1/migrations/{source}/imports` — a sealed migration bundle
+ *            (`@atlasauth/migrate`, or `atlas migrate export <vendor>`):
+ *            `getPublicKey()`, `upload()` (create + parts + finalize), read the
+ *            `report`, `apply()`; applying again after a failure resumes.
+ *   bridge   `/v1/migrations/{source}/bridge` — the zero-logout bridge settings
+ *            (a vendor JWT preset, or imported sessions).
+ *   sources  `/v1/migrations/sources` — what each source supports.
+ */
+export type MigrationSourceId = 'better_auth' | 'auth0' | 'clerk' | 'cognito' | 'firebase' | 'supabase' | 'workos' | 'authjs' | 'okta' | 'stytch' | 'keycloak' | 'fusionauth' | 'kinde' | 'descope' | 'lucia' | 'ory' | 'frontegg' | 'propelauth' | 'magic' | 'userfront' | 'corbado' | 'custom';
+export type MigrationImportStatus = 'uploading' | 'analyzing' | 'ready' | 'invalid' | 'queued' | 'applying' | 'completed' | 'failed';
+export interface MigrationImportKey {
+    object: 'migration_import_key';
+    kid: string;
+    /** base64url raw X25519 public key. One key serves every source. */
+    public_key: string;
+    alg: 'X25519-HKDF-SHA256-A256GCM';
+    status: 'active' | 'retired';
+    fingerprint: string;
+    /** `kid:public_key`, the form the exporters take. */
+    compact: string;
+    created_at: number;
+    retired_at: number | null;
+}
+/** Options of a non-Better-Auth import (a `better_auth` import takes {@link BetterAuthImportOptions}). */
+export interface MigrationImportOptions {
+    models?: Array<'organization' | 'role' | 'user' | 'identity' | 'mfa_factor' | 'passkey' | 'membership' | 'invitation' | 'api_key' | 'sso_connection' | 'jwks' | 'session'>;
+    on_email_conflict?: 'skip' | 'link';
+    create_app_roles?: boolean;
+    import_oauth_tokens?: boolean;
+    passkeys_on_rp_mismatch?: 'skip' | 'import';
+    import_sessions?: boolean;
+    import_jwks?: boolean;
+    jwks_cutover_days?: number;
+    /** Source provider name → Atlas provider key. */
+    provider_map?: Record<string, string>;
+    /** Hash parameters that live outside the export, per algorithm id (Firebase signer key …). */
+    password_hash_params?: Record<string, Record<string, string | number | boolean>>;
+    retain_bundle?: boolean;
+    [option: string]: unknown;
+}
+interface MigrationReportCommon {
+    skipped: Array<{
+        model: string;
+        row_id: string | null;
+        reason_code: string;
+        reason: string;
+    }>;
+    skipped_total: number;
+    skipped_by_code: Record<string, number>;
+    conflicts: Array<{
+        model: string;
+        row_id: string | null;
+        code: string;
+        message: string;
+        resolution: 'merge' | 'skip';
+        existing_id: string | null;
+    }>;
+    conflicts_total: number;
+    action_items: BetterAuthImportActionItem[];
+    warnings: string[];
+    notes: Record<string, unknown>;
+}
+export interface MigrationImportReport extends MigrationReportCommon {
+    models: Array<{
+        model: string;
+        label: string;
+        found: number;
+        will_create: number;
+        will_update: number;
+        will_skip: number;
+    }>;
+    /** Users per password-hash algorithm. */
+    password_algorithms?: Record<string, number>;
+}
+export interface MigrationImportResult extends MigrationReportCommon {
+    models: Array<{
+        model: string;
+        label: string;
+        found: number;
+        created: number;
+        updated: number;
+        unchanged: number;
+        skipped: number;
+        failed: number;
+    }>;
+    completed_at: number | null;
+}
+export interface MigrationImport {
+    object: 'migration_import';
+    id: string;
+    source: MigrationSourceId;
+    format: 'atlas-migration-bundle' | 'atlas-better-auth-bundle';
+    status: MigrationImportStatus;
+    key_id: string | null;
+    parts: number;
+    bytes: number;
+    bundle_sha256: string | null;
+    bundle_purged: boolean;
+    options: Record<string, unknown>;
+    manifest: {
+        exported_at: string;
+        exporter: {
+            name: string;
+            version: string;
+        };
+        origin: string | null;
+        source_version: string | null;
+        models: string[];
+        providers: string[];
+        rp_id: string | null;
+        warnings: string[];
+    } | null;
+    total: number;
+    progress: {
+        total: number;
+        processed: number;
+        succeeded: number;
+        failed: number;
+        percent: number;
+    } | null;
+    report: MigrationImportReport | null;
+    result: MigrationImportResult | null;
+    error: {
+        code: string;
+        message: string;
+    } | null;
+    created_at: number;
+    updated_at: number;
+    analyzed_at: number | null;
+    apply_started_at: number | null;
+    completed_at: number | null;
+}
+export interface MigrationClaimMap {
+    subject?: string;
+    email?: string;
+    email_verified?: string;
+    name?: string;
+    session_key?: string;
+    mfa?: string;
+}
+/** PUT body of the bridge settings; every field optional, merged onto the stored ones. */
+export interface MigrationBridgeSettingsUpdate {
+    enabled?: boolean;
+    ends_at?: string | number | null;
+    mode?: 'jwt' | 'session_table' | 'remote';
+    preset?: string | null;
+    preset_vars?: Record<string, string>;
+    issuer?: string | null;
+    jwks_url?: string | null;
+    audience?: string[] | null;
+    algorithms?: string[] | null;
+    claim_map?: MigrationClaimMap;
+    expired_grace_seconds?: number;
+    cookie_names?: string[];
+    create_users?: boolean;
+    /** Write-only HS256 secret; omit to keep, null to clear. */
+    shared_secret?: string | null;
+}
+export interface MigrationBridgeSettings {
+    object: 'migration_bridge';
+    source: MigrationSourceId;
+    enabled: boolean;
+    ends_at: number | null;
+    mode: 'jwt' | 'session_table' | 'remote';
+    preset: string | null;
+    preset_vars: Record<string, string>;
+    issuer: string | null;
+    jwks_url: string | null;
+    audience: string[] | null;
+    algorithms: string[];
+    claim_map: Record<string, string>;
+    expired_grace_seconds: number;
+    cookie_names: string[];
+    create_users: boolean;
+    has_shared_secret: boolean;
+    exchange_path: string;
+    stats: {
+        exchanged: number;
+        from_import: number;
+        from_jwt: number;
+    };
+    created_at: number | null;
+    updated_at: number | null;
+}
+export interface MigrationSourceView {
+    object: 'migration_source';
+    source: MigrationSourceId;
+    label: string;
+    models: string[];
+    passwords: 'export' | 'ticket' | 'lazy' | 'none';
+    export_via: Array<'api' | 'file' | 'database' | 'support_ticket'>;
+    bridge: {
+        mode: 'jwt' | 'session_table' | 'remote' | 'none';
+        preset: string | null;
+        vars: Record<string, string>;
+        cookies: string[];
+    };
+    lazy_migration: {
+        preset: string;
+        config: Record<string, {
+            label: string;
+            required: boolean;
+        }>;
+        secret: {
+            label: string;
+            required: boolean;
+        } | null;
+    } | null;
+    password_algorithms: string[];
+    limits: string | null;
+}
+export declare function migrationsResource(request: RequestFn): {
+    /** Every migration source and what it supports. */
+    sources(): Promise<CursorPage<MigrationSourceView>>;
+    /** The import surface of one source: `migrations.imports('auth0').upload(text)`. */
+    imports: (source: MigrationSourceId | string) => {
+        /** The import public key (created on first read; shared by every source). */
+        getPublicKey(): Promise<MigrationImportKey>;
+        /** Replace the import key; bundles sealed to the old one no longer finalize. */
+        rotatePublicKey(): Promise<MigrationImportKey>;
+        create(body?: {
+            options?: MigrationImportOptions;
+        }, idempotencyKey?: string): Promise<MigrationImport>;
+        list(params?: CursorParams): Promise<CursorPage<MigrationImport>>;
+        get(id: string): Promise<MigrationImport>;
+        /** Upload part `part` (1-based) of the sealed bundle text. */
+        uploadPart(id: string, part: number, data: string): Promise<{
+            object: "migration_import_part";
+            import_id: string;
+            part: number;
+            bytes: number;
+            sha256: string;
+        }>;
+        /** Close the upload; Atlas checks the key and the format, then runs the dry run. */
+        finalize(id: string): Promise<MigrationImport>;
+        dryRun(id: string, body?: {
+            options?: MigrationImportOptions;
+        }): Promise<MigrationImport>;
+        /** Import (or resume). Pass confirm_conflicts when the dry run reported conflicts. */
+        apply(id: string, body?: {
+            confirm_conflicts?: boolean;
+        }): Promise<MigrationImport>;
+        delete(id: string): Promise<{
+            object: "migration_import";
+            id: string;
+            deleted: true;
+        }>;
+        /**
+         * Create an import (or continue `importId`), upload the sealed bundle text
+         * in parts from `resumeFrom` (1-based) and finalize it.
+         */
+        upload(bundleText: string, opts?: {
+            options?: MigrationImportOptions;
+            partBytes?: number;
+            importId?: string;
+            resumeFrom?: number;
+            onPart?: (n: number, of: number) => void;
+        }): Promise<MigrationImport>;
+        /** Poll until the import leaves analyzing / queued / applying. */
+        waitFor(id: string, opts?: {
+            intervalMs?: number;
+            timeoutMs?: number;
+            onProgress?: (imp: MigrationImport) => void;
+            sleep?: (ms: number) => Promise<void>;
+        }): Promise<MigrationImport>;
+    };
+    /** The zero-logout bridge settings of one source. */
+    bridge: (source: MigrationSourceId | string) => {
+        get(): Promise<MigrationBridgeSettings>;
+        update(body: MigrationBridgeSettingsUpdate): Promise<MigrationBridgeSettings>;
+        delete(): Promise<{
+            object: "migration_bridge";
+            source: string;
+            deleted: true;
+        }>;
+    };
+};
+export {};

package/dist/client/migrations.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrationsResource = migrationsResource;
+const better_auth_imports_1 = require("./better-auth-imports");
+const request_1 = require("./request");
+const TERMINAL = ['ready', 'invalid', 'completed', 'failed'];
+function migrationsResource(request) {
+    const importsFor = (source) => {
+        const base = `/v1/migrations/${(0, request_1.enc)(source)}/imports`;
+        const self = {
+            /** The import public key (created on first read; shared by every source). */
+            getPublicKey() {
+                return request({ method: 'GET', path: `${base}/public_key` });
+            },
+            /** Replace the import key; bundles sealed to the old one no longer finalize. */
+            rotatePublicKey() {
+                return request({ method: 'POST', path: `${base}/public_key/rotate` });
+            },
+            create(body = {}, idempotencyKey) {
+                return request({ method: 'POST', path: base, body, idempotencyKey });
+            },
+            list(params = {}) {
+                return request({ method: 'GET', path: base, query: { ...params } });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `${base}/${(0, request_1.enc)(id)}` });
+            },
+            /** Upload part `part` (1-based) of the sealed bundle text. */
+            uploadPart(id, part, data) {
+                return request({ method: 'PUT', path: `${base}/${(0, request_1.enc)(id)}/parts/${part}`, body: { data } });
+            },
+            /** Close the upload; Atlas checks the key and the format, then runs the dry run. */
+            finalize(id) {
+                return request({ method: 'POST', path: `${base}/${(0, request_1.enc)(id)}/finalize` });
+            },
+            dryRun(id, body = {}) {
+                return request({ method: 'POST', path: `${base}/${(0, request_1.enc)(id)}/dry_run`, body });
+            },
+            /** Import (or resume). Pass confirm_conflicts when the dry run reported conflicts. */
+            apply(id, body = {}) {
+                return request({ method: 'POST', path: `${base}/${(0, request_1.enc)(id)}/apply`, body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `${base}/${(0, request_1.enc)(id)}` });
+            },
+            /**
+             * Create an import (or continue `importId`), upload the sealed bundle text
+             * in parts from `resumeFrom` (1-based) and finalize it.
+             */
+            async upload(bundleText, opts = {}) {
+                const parts = (0, better_auth_imports_1.splitBundleParts)(bundleText, opts.partBytes);
+                if (parts.length === 0)
+                    throw new Error('The bundle is empty.');
+                const id = opts.importId ?? (await self.create(opts.options ? { options: opts.options } : {})).id;
+                for (let i = Math.max(0, (opts.resumeFrom ?? 1) - 1); i < parts.length; i++) {
+                    await self.uploadPart(id, i + 1, parts[i]);
+                    opts.onPart?.(i + 1, parts.length);
+                }
+                return self.finalize(id);
+            },
+            /** Poll until the import leaves analyzing / queued / applying. */
+            async waitFor(id, opts = {}) {
+                const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+                const deadline = Date.now() + (opts.timeoutMs ?? 6 * 3600_000);
+                for (;;) {
+                    const imp = await self.get(id);
+                    opts.onProgress?.(imp);
+                    if (TERMINAL.includes(imp.status) || imp.status === 'uploading')
+                        return imp;
+                    if (Date.now() > deadline)
+                        throw new Error(`Timed out waiting for migration import ${id} (status ${imp.status}).`);
+                    await sleep(opts.intervalMs ?? 2000);
+                }
+            },
+        };
+        return self;
+    };
+    const bridgeFor = (source) => {
+        const path = `/v1/migrations/${(0, request_1.enc)(source)}/bridge`;
+        return {
+            get() {
+                return request({ method: 'GET', path });
+            },
+            update(body) {
+                return request({ method: 'PUT', path, body });
+            },
+            delete() {
+                return request({ method: 'DELETE', path });
+            },
+        };
+    };
+    return {
+        /** Every migration source and what it supports. */
+        sources() {
+            return request({ method: 'GET', path: '/v1/migrations/sources' });
+        },
+        /** The import surface of one source: `migrations.imports('auth0').upload(text)`. */
+        imports: importsFor,
+        /** The zero-logout bridge settings of one source. */
+        bridge: bridgeFor,
+    };
+}
+//# sourceMappingURL=migrations.js.map

package/dist/client/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/client/migrations.ts"],"names":[],"mappings":";;AAsMA,gDAkGC;AAxSD,+DAA0F;AAC1F,uCAAgD;AAmMhD,MAAM,QAAQ,GAAqC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAE/F,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,MAAM,UAAU,GAAG,CAAC,MAAkC,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,kBAAkB,IAAA,aAAG,EAAC,MAAM,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG;YACX,6EAA6E;YAC7E,YAAY;gBACV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,gFAAgF;YAChF,eAAe;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,oBAAoB,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,CAAC,OAA6C,EAAE,EAAE,cAAuB;gBAC7E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,SAAuB,EAAE;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,8DAA8D;YAC9D,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,IAAY;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,oFAAoF;YACpF,QAAQ,CAAC,EAAU;gBACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,OAA6C,EAAE;gBAChE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,sFAAsF;YACtF,KAAK,CAAC,EAAU,EAAE,OAAwC,EAAE;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,CAAC;YACD;;;eAGG;YACH,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,OAAmJ,EAAE;gBAErJ,MAAM,KAAK,GAAG,IAAA,sCAAgB,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAChE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC5E,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;oBAC5C,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;YACD,kEAAkE;YAClE,KAAK,CAAC,OAAO,CACX,EAAU,EACV,OAAwI,EAAE;gBAE1I,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAC/D,SAAS,CAAC;oBACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC/B,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;oBACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;wBAAE,OAAO,GAAG,CAAC;oBAC5E,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;wBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,EAAE,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;oBACnH,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;SACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAkC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,kBAAkB,IAAA,aAAG,EAAC,MAAM,CAAC,SAAS,CAAC;QACpD,OAAO;YACL,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,CAAC,IAAmC;gBACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,mDAAmD;QACnD,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,oFAAoF;QACpF,OAAO,EAAE,UAAU;QACnB,qDAAqD;QACrD,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC"}