@atlasauth/backend 0.24.0 → 0.25.0

package/dist/migration-presets-g4/keycloak.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEYCLOAK_BRIDGE_PRESETS = void 0;
+/**
+ * Keycloak. Its browser adapter (keycloak-js) keeps the access / ID / refresh
+ * tokens in memory, and server adapters (keycloak-connect, NextAuth's Keycloak
+ * provider) keep them server-side or inside an encrypted cookie, so the token
+ * an integrator can hand the bridge is the access or ID token itself (Bearer
+ * header or the `exchangeMigrationBrowserSession` browser helper). The
+ * `KEYCLOAK_IDENTITY` cookie is signed with the realm's own HMAC secret and is
+ * never accepted.
+ *
+ * Access tokens live five minutes by default and nobody refreshes them after
+ * the switch, so a validly signed token is accepted (once) for a week past `exp`.
+ * Keycloak 16 and older serve under `/auth`: pass `base_url` as
+ * `https://sso.example.com/auth`.
+ */
+exports.KEYCLOAK_BRIDGE_PRESETS = [
+    {
+        id: 'keycloak',
+        label: 'Keycloak (access or ID token)',
+        mode: 'jwt',
+        vars: { base_url: 'Keycloak base URL (https://sso.example.com; add /auth for Keycloak 16 and older)', realm: 'Realm name' },
+        jwt: {
+            issuer: '{base_url}/realms/{realm}',
+            keysUrl: '{base_url}/realms/{realm}/protocol/openid-connect/certs',
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256', 'ES384'],
+            // sub = the Keycloak user id (what the realm export keys users by); sid = the SSO session id.
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid', mfa: 'acr:2' },
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Use the access token or the ID token (both carry sub, email, sid). Realm keys must publish a signing algorithm from the list (the default RS256 does; HS512 keys are never accepted). A step-up login raises the acr claim to 2 when you map levels of authentication to "2"; otherwise an MFA sign-in is not marked.',
+    },
+];
+//# sourceMappingURL=keycloak.js.map

package/dist/migration-presets-g4/keycloak.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak.js","sourceRoot":"","sources":["../../src/migration-presets-g4/keycloak.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;GAaG;AACU,QAAA,uBAAuB,GAAqC;IACvE;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,+BAA+B;QACtC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,kFAAkF,EAAE,KAAK,EAAE,YAAY,EAAE;QAC3H,GAAG,EAAE;YACH,MAAM,EAAE,2BAA2B;YACnC,OAAO,EAAE,yDAAyD;YAClE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,8FAA8F;YAC9F,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;YAC1H,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,uTAAuT;KAC1T;CACF,CAAC"}

package/dist/migration-presets-g4/logto.d.ts

@@ -0,0 +1,12 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * Logto. The tenant's OIDC issuer is `{endpoint}/oidc` (`https://auth.example.com/oidc`,
+ * `https://abc123.logto.app/oidc` on Logto Cloud); its signing keys are at
+ * `/oidc/jwks` and default to ES384. The token to exchange is the application's
+ * ID token (`aud` = the Logto application id) — what `@logto/*` SDKs keep in
+ * the app's own session. The SDKs store that session encrypted with the app's
+ * cookie secret (or in the server's session store), so no cookie is named here:
+ * hand the middleware a token extractor that opens the session locally, or send
+ * the ID token as a bearer token from the client.
+ */
+export declare const LOGTO_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/logto.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOGTO_BRIDGE_PRESETS = void 0;
+/**
+ * Logto. The tenant's OIDC issuer is `{endpoint}/oidc` (`https://auth.example.com/oidc`,
+ * `https://abc123.logto.app/oidc` on Logto Cloud); its signing keys are at
+ * `/oidc/jwks` and default to ES384. The token to exchange is the application's
+ * ID token (`aud` = the Logto application id) — what `@logto/*` SDKs keep in
+ * the app's own session. The SDKs store that session encrypted with the app's
+ * cookie secret (or in the server's session store), so no cookie is named here:
+ * hand the middleware a token extractor that opens the session locally, or send
+ * the ID token as a bearer token from the client.
+ */
+exports.LOGTO_BRIDGE_PRESETS = [
+    {
+        id: 'logto',
+        label: 'Logto',
+        mode: 'jwt',
+        vars: {
+            base_url: 'Your Logto endpoint (https://auth.example.com or https://abc123.logto.app)',
+            client_id: 'The id of your Logto application (the audience of its ID tokens)',
+        },
+        jwt: {
+            issuer: '{base_url}/oidc',
+            keysUrl: '{base_url}/oidc/jwks',
+            audience: ['{client_id}'],
+            algorithms: ['ES384', 'ES256', 'RS256', 'PS256', 'EdDSA'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid' },
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Exchange the ID token. Logto SDK sessions are encrypted with your cookie secret (or kept in your session store): pass the middleware a token extractor that reads the idToken from the session locally. API access tokens carry the API resource as their audience and are not accepted here.',
+    },
+];
+//# sourceMappingURL=logto.js.map

package/dist/migration-presets-g4/logto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logto.js","sourceRoot":"","sources":["../../src/migration-presets-g4/logto.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAAqC;IACpE;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,QAAQ,EAAE,4EAA4E;YACtF,SAAS,EAAE,kEAAkE;SAC9E;QACD,GAAG,EAAE;YACH,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,sBAAsB;YAC/B,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACzD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;SAC7G;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,+RAA+R;KAClS;CACF,CAAC"}

package/dist/migration-presets-g4/ory.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+export declare const ORY_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/ory.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORY_BRIDGE_PRESETS = void 0;
+/**
+ * Ory Kratos bridge presets. A Kratos session is opaque: the token (or the
+ * cookie that wraps it, sealed with `secrets.cookie`) says nothing offline. So
+ * there are two ways to recognise one:
+ *
+ *   - `ory` (session_table): the session tokens (`ory_st_…`, the
+ *     `X-Session-Token` / bearer value API-flow clients hold) imported from a
+ *     database export, looked up by sha256. Self-hosted only; Ory Network has no
+ *     database access.
+ *   - `ory_whoami` / `ory_whoami_token` (remote): Atlas asks Kratos itself,
+ *     `GET /sessions/whoami`, with the cookie (or the session token) the browser
+ *     presented. Works on self-hosted Kratos and Ory Network, needs Kratos
+ *     running (and reachable from Atlas) for the bridge window, and needs no
+ *     export. The identity id in the answer is the user id the export keyed by.
+ *
+ * Kratos answers 401 for an unknown / expired session and 403
+ * (`session_aal2_required`) when a second factor is still owed: both are
+ * refusals, so a half-authenticated session never becomes an Atlas session.
+ * The remote preset reads the session's own identity: `identity.id`,
+ * `identity.traits.email` (the common schema; others rely on the imported
+ * user's email) and the first verifiable address.
+ */
+const WHOAMI_NOTES = 'Kratos stays up for the bridge window: Atlas calls its /sessions/whoami with the presented session. Point base_url at the public URL (https://<slug>.projects.oryapis.com on Ory Network). A session that still owes a second factor (aal2) is refused.';
+const IDENTITY = {
+    subjectPath: 'identity.id',
+    emailPath: 'identity.traits.email',
+    emailVerifiedPath: 'identity.verifiable_addresses.0.verified',
+    namePath: 'identity.traits.name',
+};
+exports.ORY_BRIDGE_PRESETS = [
+    {
+        id: 'ory',
+        label: 'Ory Kratos (session tokens imported from the database)',
+        mode: 'session_table',
+        // The browser cookie is sealed with Kratos' cookie secret and cannot be hashed
+        // to a stored token: only the raw session token (ory_st_…) matches.
+        cookies: [],
+        bearer: true,
+        notes: 'Matches the session tokens (ory_st_…) from a database export: API-flow clients (native apps, SPAs holding the token) send them as a bearer token. Browser cookies are sealed with Kratos\' cookie secret, so cookie sessions use the ory_whoami preset. If your app keeps the token in a cookie of its own, pass that name as cookieNames to the middleware.',
+    },
+    {
+        id: 'ory_whoami',
+        label: 'Ory Kratos (session cookie, checked with Kratos)',
+        mode: 'remote',
+        vars: {
+            base_url: 'Kratos public URL (https://auth.example.com, or https://<project slug>.projects.oryapis.com)',
+            cookie_name: 'The session cookie name (ory_kratos_session; ory_session_<project slug> on Ory Network)',
+        },
+        remote: { url: '{base_url}/sessions/whoami', method: 'GET', headers: { cookie: '{cookie_name}={token}' }, ...IDENTITY },
+        cookies: ['ory_kratos_session', 'ory_session_*'],
+        notes: `${WHOAMI_NOTES} The cookie must reach your app: serve it on a domain your app shares (Ory Network custom domain or Kratos behind your domain).`,
+    },
+    {
+        id: 'ory_whoami_token',
+        label: 'Ory Kratos (session token, checked with Kratos)',
+        mode: 'remote',
+        vars: { base_url: 'Kratos public URL (https://auth.example.com, or https://<project slug>.projects.oryapis.com)' },
+        remote: { url: '{base_url}/sessions/whoami', method: 'GET', headers: { 'x-session-token': '{token}' }, ...IDENTITY },
+        cookies: [],
+        bearer: true,
+        notes: WHOAMI_NOTES,
+    },
+];
+//# sourceMappingURL=ory.js.map

package/dist/migration-presets-g4/ory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ory.js","sourceRoot":"","sources":["../../src/migration-presets-g4/ory.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,YAAY,GAChB,yPAAyP,CAAC;AAE5P,MAAM,QAAQ,GAAG;IACf,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,uBAAuB;IAClC,iBAAiB,EAAE,0CAA0C;IAC7D,QAAQ,EAAE,sBAAsB;CACjC,CAAC;AAEW,QAAA,kBAAkB,GAAqC;IAClE;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,wDAAwD;QAC/D,IAAI,EAAE,eAAe;QACrB,+EAA+E;QAC/E,oEAAoE;QACpE,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,8VAA8V;KACjW;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,kDAAkD;QACzD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE;YACJ,QAAQ,EAAE,8FAA8F;YACxG,WAAW,EAAE,yFAAyF;SACvG;QACD,MAAM,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,GAAG,QAAQ,EAAE;QACvH,OAAO,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAChD,KAAK,EAAE,GAAG,YAAY,iIAAiI;KACxJ;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,iDAAiD;QACxD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,EAAE,QAAQ,EAAE,8FAA8F,EAAE;QAClH,MAAM,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE;QACpH,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,YAAY;KACpB;CACF,CAAC"}

package/dist/migration-presets-g4/supertokens.d.ts

@@ -0,0 +1,13 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * SuperTokens. The session's access token is a JWT signed with the core's
+ * dynamic keys; the backend SDK serves their public half at
+ * `{api_domain}{api_base_path}/jwt/jwks.json` (the core also at
+ * `/.well-known/jwks.json`) and stamps `iss` with `{api_domain}{api_base_path}`.
+ * The `sub` is the SuperTokens user id (what the export imports as the source
+ * id), `sessionHandle` identifies the session, so every token of one old
+ * session exchanges once. The access token lives an hour and is refreshed by
+ * the SuperTokens frontend SDK, which stops running after the switch: a token
+ * up to a week past `exp` is still accepted (each exchanges once).
+ */
+export declare const SUPERTOKENS_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/supertokens.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUPERTOKENS_BRIDGE_PRESETS = void 0;
+/**
+ * SuperTokens. The session's access token is a JWT signed with the core's
+ * dynamic keys; the backend SDK serves their public half at
+ * `{api_domain}{api_base_path}/jwt/jwks.json` (the core also at
+ * `/.well-known/jwks.json`) and stamps `iss` with `{api_domain}{api_base_path}`.
+ * The `sub` is the SuperTokens user id (what the export imports as the source
+ * id), `sessionHandle` identifies the session, so every token of one old
+ * session exchanges once. The access token lives an hour and is refreshed by
+ * the SuperTokens frontend SDK, which stops running after the switch: a token
+ * up to a week past `exp` is still accepted (each exchanges once).
+ */
+exports.SUPERTOKENS_BRIDGE_PRESETS = [
+    {
+        id: 'supertokens',
+        label: 'SuperTokens',
+        mode: 'jwt',
+        vars: { base_url: 'Your SuperTokens API domain (https://api.example.com), the apiDomain of your backend config' },
+        defaults: { api_base_path: 'auth' },
+        jwt: {
+            issuer: '{base_url}/{api_base_path}',
+            keysUrl: '{base_url}/{api_base_path}/jwt/jwks.json',
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', sessionKey: 'sessionHandle' },
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: ['sAccessToken'],
+        clearCookies: ['sAccessToken', 'sRefreshToken', 'sIdRefreshToken', 'sFrontToken'],
+        bearer: true,
+        notes: 'Pass api_base_path (your apiBasePath without slashes, default auth) when you changed it. With header-based sessions send the access token as `Authorization: Bearer`. SuperTokens access tokens carry no email: the user is matched by the imported SuperTokens user id, so import users first.',
+    },
+];
+//# sourceMappingURL=supertokens.js.map

package/dist/migration-presets-g4/supertokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supertokens.js","sourceRoot":"","sources":["../../src/migration-presets-g4/supertokens.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;GAUG;AACU,QAAA,0BAA0B,GAAqC;IAC1E;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,6FAA6F,EAAE;QACjH,QAAQ,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE;QACnC,GAAG,EAAE;YACH,MAAM,EAAE,4BAA4B;YACpC,OAAO,EAAE,0CAA0C;YACnD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE;YACvD,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,cAAc,CAAC;QACzB,YAAY,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,CAAC;QACjF,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,iSAAiS;KACpS;CACF,CAAC"}

package/dist/migration-presets-g4/zitadel.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+export declare const ZITADEL_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/zitadel.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZITADEL_BRIDGE_PRESETS = void 0;
+/**
+ * ZITADEL bridge preset (ZITADEL Cloud, self-hosted, custom domains). ZITADEL
+ * signs ID tokens, and access tokens of applications set to the JWT token
+ * type, with RS256 keys it publishes at `{issuer}/oauth/v2/keys`. The `iss` is
+ * the instance URL (`https://<instance>.zitadel.cloud`, or your custom domain
+ * exactly as users reach it), `sub` the ZITADEL user id, `sid` the session id.
+ * `amr` lists `mfa` after a second factor.
+ *
+ * Opaque access tokens (ZITADEL's default for new applications) cannot be
+ * verified offline: exchange the ID token, or switch the application's access
+ * token type to JWT.
+ */
+const WEEK = 7 * 24 * 3600;
+exports.ZITADEL_BRIDGE_PRESETS = [
+    {
+        id: 'zitadel',
+        label: 'ZITADEL (ID tokens and JWT access tokens)',
+        mode: 'jwt',
+        vars: { issuer: 'Your ZITADEL URL, exactly as the iss claim has it (https://<instance>.zitadel.cloud, or your custom domain)' },
+        jwt: {
+            issuer: '{issuer}',
+            keysUrl: '{issuer}/oauth/v2/keys',
+            algorithms: ['RS256', 'RS384', 'RS512', 'ES256'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid', mfa: 'amr:mfa' },
+            // Tokens live hours and the OIDC client that refreshed them is gone after the switch.
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Send the ID token (or a JWT access token) as an Authorization: Bearer header. Browser OIDC clients (oidc-client-ts, react-oidc-context) keep tokens in browser storage, so the browser has to send one request with it before they are cleared; server sessions (Auth.js, express-session) hold the ID token you can pass to the middleware with extractToken. Application access tokens are opaque unless the application is set to the JWT token type.',
+    },
+];
+//# sourceMappingURL=zitadel.js.map

package/dist/migration-presets-g4/zitadel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadel.js","sourceRoot":"","sources":["../../src/migration-presets-g4/zitadel.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;GAWG;AAEH,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEd,QAAA,sBAAsB,GAAqC;IACtE;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,2CAA2C;QAClD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,6GAA6G,EAAE;QAC/H,GAAG,EAAE;YACH,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAChD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE;YAC5H,sFAAsF;YACtF,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,0bAA0b;KAC7b;CACF,CAAC"}

package/dist/migration-presets-g4.d.ts

@@ -0,0 +1,10 @@
+import type { MigrationBridgePreset } from './migration-presets';
+/**
+ * Bridge presets for the open-source identity providers — Keycloak, Ory
+ * (Kratos, Hydra, Ory Network), ZITADEL, Logto, SuperTokens, authentik,
+ * FusionAuth and Hanko — one module per vendor under ./migration-presets-g4/,
+ * each checked against the vendor's token documentation and a fixture token.
+ * Registered (replacing the starters) at the end of migration-presets.ts; the
+ * modules import only types from there, so there is no import cycle at runtime.
+ */
+export declare const G4_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.G4_BRIDGE_PRESETS = void 0;
+const authentik_1 = require("./migration-presets-g4/authentik");
+const fusionauth_1 = require("./migration-presets-g4/fusionauth");
+const hanko_1 = require("./migration-presets-g4/hanko");
+const keycloak_1 = require("./migration-presets-g4/keycloak");
+const logto_1 = require("./migration-presets-g4/logto");
+const ory_1 = require("./migration-presets-g4/ory");
+const supertokens_1 = require("./migration-presets-g4/supertokens");
+const zitadel_1 = require("./migration-presets-g4/zitadel");
+/**
+ * Bridge presets for the open-source identity providers — Keycloak, Ory
+ * (Kratos, Hydra, Ory Network), ZITADEL, Logto, SuperTokens, authentik,
+ * FusionAuth and Hanko — one module per vendor under ./migration-presets-g4/,
+ * each checked against the vendor's token documentation and a fixture token.
+ * Registered (replacing the starters) at the end of migration-presets.ts; the
+ * modules import only types from there, so there is no import cycle at runtime.
+ */
+exports.G4_BRIDGE_PRESETS = [
+    ...keycloak_1.KEYCLOAK_BRIDGE_PRESETS,
+    ...ory_1.ORY_BRIDGE_PRESETS,
+    ...zitadel_1.ZITADEL_BRIDGE_PRESETS,
+    ...logto_1.LOGTO_BRIDGE_PRESETS,
+    ...supertokens_1.SUPERTOKENS_BRIDGE_PRESETS,
+    ...authentik_1.AUTHENTIK_BRIDGE_PRESETS,
+    ...fusionauth_1.FUSIONAUTH_BRIDGE_PRESETS,
+    ...hanko_1.HANKO_BRIDGE_PRESETS,
+];
+//# sourceMappingURL=migration-presets-g4.js.map

package/dist/migration-presets-g4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-presets-g4.js","sourceRoot":"","sources":["../src/migration-presets-g4.ts"],"names":[],"mappings":";;;AACA,gEAA4E;AAC5E,kEAA8E;AAC9E,wDAAoE;AACpE,8DAA0E;AAC1E,wDAAoE;AACpE,oDAAgE;AAChE,oEAAgF;AAChF,4DAAwE;AAExE;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAqC;IACjE,GAAG,kCAAuB;IAC1B,GAAG,wBAAkB;IACrB,GAAG,gCAAsB;IACzB,GAAG,4BAAoB;IACvB,GAAG,wCAA0B;IAC7B,GAAG,oCAAwB;IAC3B,GAAG,sCAAyB;IAC5B,GAAG,4BAAoB;CACxB,CAAC"}

package/dist/migration-presets.d.ts

@@ -72,6 +72,12 @@ export interface MigrationBridgePreset {
         expiredGraceSeconds?: number;
         /** The vendor may sign with a shared secret (HS256) instead of keys (Supabase legacy JWT secret). */
         allowSharedSecret?: boolean;
+        /**
+         * The token is not a JWT but another signed token Atlas checks natively:
+         * `magic_did` (Magic DID tokens — signed by the user's own key, subject the
+         * `iss` DID, audience the Magic client id). Default `jwt`.
+         */
+        tokenType?: 'jwt' | 'magic_did';
     };
     /**
      * Mode `remote`: the vendor call that vouches for a token. Templates take the

package/dist/migration-presets.js

@@ -260,15 +260,19 @@ for (const preset of [
         label: 'WorkOS AuthKit',
         mode: 'jwt',
         vars: { client_id: 'WorkOS client id (client_…)' },
+        // api.workos.com, or your custom authentication domain when the environment has one.
+        defaults: { api_host: 'api.workos.com' },
         jwt: {
-            issuer: 'https://api.workos.com/user_management/{client_id}',
-            keysUrl: 'https://api.workos.com/sso/jwks/{client_id}',
+            issuer: 'https://{api_host}/user_management/{client_id}',
+            keysUrl: 'https://{api_host}/sso/jwks/{client_id}',
             algorithms: ['RS256'],
             claims: { subject: 'sub', sessionKey: 'sid' },
             expiredGraceSeconds: 7 * 24 * 3600,
         },
         cookies: ['wos-session'],
-        notes: 'The wos-session cookie is sealed with your WORKOS_COOKIE_PASSWORD: pass the middleware a token extractor that unseals it locally and returns the access token.',
+        clearCookies: ['wos-session'],
+        bearer: true,
+        notes: 'The wos-session cookie is sealed with your WORKOS_COOKIE_PASSWORD: pass the middleware workosSessionTokenExtractor({ password }) from @atlasauth/backend, which unseals it on your server and returns the access token. With a custom authentication domain set api_host to it. AuthKit access tokens are short-lived and signed RS256 by WorkOS; the issuer is https://{api_host}/user_management/{client_id}.',
     },
     {
         id: 'okta',
@@ -289,22 +293,55 @@ for (const preset of [
         cookies: [],
         bearer: true,
     },
+    {
+        id: 'ping_identity',
+        label: 'Ping Identity (PingOne)',
+        mode: 'jwt',
+        vars: { environment_id: 'Your PingOne environment id (a UUID)' },
+        defaults: { region: 'com' },
+        jwt: {
+            issuer: 'https://auth.pingone.{region}/{environment_id}/as',
+            keysUrl: 'https://auth.pingone.{region}/{environment_id}/as/jwks',
+            algorithms: ['RS256', 'ES256'],
+            claims: { ...OIDC_CLAIMS, sessionKey: 'sid' },
+        },
+        // PingOne sessions live in the SPA (tokens in storage): API calls carry them as bearer tokens.
+        cookies: [],
+        bearer: true,
+    },
+    {
+        id: 'onelogin',
+        label: 'OneLogin',
+        mode: 'jwt',
+        vars: { subdomain: 'Your OneLogin subdomain (acme in acme.onelogin.com)' },
+        jwt: {
+            issuer: 'https://{subdomain}.onelogin.com/oidc/2',
+            keysUrl: 'https://{subdomain}.onelogin.com/oidc/2/certs',
+            algorithms: ['RS256', 'PS256', 'ES256'],
+            claims: { ...OIDC_CLAIMS, sessionKey: 'jti' },
+        },
+        cookies: [],
+        bearer: true,
+    },
     {
         id: 'stytch',
         label: 'Stytch',
         mode: 'jwt',
         vars: { project_id: 'Stytch project id (project-live-…)' },
-        defaults: { api_host: 'api.stytch.com' },
+        // api.stytch.com for live projects, test.stytch.com for test ones; jwks_path `b2b/sessions` for Stytch B2B (members), `sessions` for consumer.
+        defaults: { api_host: 'api.stytch.com', jwks_path: 'sessions' },
         jwt: {
             issuer: 'stytch.com/{project_id}',
-            keysUrl: 'https://{api_host}/v1/sessions/jwks/{project_id}',
+            keysUrl: 'https://{api_host}/v1/{jwks_path}/jwks/{project_id}',
             audience: ['{project_id}'],
             algorithms: ['RS256'],
-            claims: { subject: 'sub', sessionKey: 'https://stytch.com/session' },
+            // The session id sits inside the `https://stytch.com/session` object claim (dotted path).
+            claims: { subject: 'sub', sessionKey: 'https://stytch.com/session.id' },
             expiredGraceSeconds: 7 * 24 * 3600,
         },
         cookies: ['stytch_session_jwt'],
         clearCookies: ['stytch_session_jwt', 'stytch_session'],
+        notes: 'Stytch session JWTs last about five minutes and are signed by the project (RS256). Use jwks_path=b2b/sessions for Stytch B2B and api_host=test.stytch.com for a test project. The subject is the Stytch user id (consumer) or member id (B2B).',
     },
     {
         id: 'keycloak',
@@ -400,6 +437,55 @@ for (const preset of [
         cookies: [],
         bearer: true,
     },
+    // ── propelauth ──
+    {
+        id: 'propelauth',
+        label: 'PropelAuth',
+        mode: 'jwt',
+        vars: { auth_url: 'Your PropelAuth auth URL (https://123456.propelauthtest.com or https://auth.example.com)' },
+        jwt: { issuer: '{auth_url}', keysUrl: '{auth_url}/.well-known/jwks.json', algorithms: ['RS256'], claims: { subject: 'user_id', email: 'email' }, expiredGraceSeconds: 7 * 24 * 3600 },
+        cookies: ['__pa_at'],
+        clearCookies: ['__pa_at', '__pa_rt'],
+        bearer: true,
+        notes: 'PropelAuth signs RS256 tokens (issuer = your auth URL, subject claim user_id) and publishes the verifier key as a PEM (Dashboard → Backend Integration, or PROPELAUTH_VERIFIER_KEY), not as a JWKS. Point the bridge at a JWKS URL that serves that key (jwks_url) before enabling it.',
+    },
+    // ── magic ──
+    {
+        id: 'magic',
+        label: 'Magic (magic.link)',
+        mode: 'jwt',
+        vars: { client_id: 'Your Magic client id (did:magic:…), the `aud` of your DID tokens' },
+        jwt: {
+            // Not an OIDC issuer: each DID token's `iss` is the user's own did:ethr. Kept for the settings' shape.
+            issuer: 'did:ethr',
+            tokenType: 'magic_did',
+            audience: ['{client_id}'],
+            algorithms: ['ES256K'],
+            claims: { subject: 'iss', sessionKey: 'tid' },
+            // DID tokens live 15 minutes by default; the app mints a fresh one whenever it asks Magic.
+            expiredGraceSeconds: 24 * 3600,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Magic DID tokens travel in the Authorization header (from magic.user.getIdToken()), not a cookie, and are not JWTs: pass the middleware magicDidTokenExtractor().',
+    },
+    // ── userfront ──
+    // ── corbado ──
+    {
+        id: 'corbado',
+        label: 'Corbado',
+        mode: 'jwt',
+        vars: { project_id: 'Your Corbado project id (pro-…)' },
+        jwt: {
+            issuer: 'https://{project_id}.frontendapi.corbado.io',
+            keysUrl: 'https://{project_id}.frontendapi.corbado.io/.well-known/jwks',
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', email: 'email', name: 'name' },
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: ['cbo_session_token', 'cbo_short_session'],
+        bearer: true,
+    },
     {
         id: 'better_auth',
         label: 'Better Auth',
@@ -437,4 +523,14 @@ function cookieNameMatches(pattern, name) {
     const re = new RegExp(`^${pattern.split('*').map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('.*')}$`);
     return re.test(name);
 }
+// ── vendor-track presets ────────────────────────────────────────────────────
+// Firebase, Supabase, Cognito, Azure AD B2C, Entra External ID, Nhost (replacing the starters).
+const migration_presets_g3_1 = require("./migration-presets-g3");
+for (const preset of migration_presets_g3_1.G3_BRIDGE_PRESETS)
+    registerMigrationBridgePreset(preset, { replace: true });
+// ── open-source identity providers ─────────────────────────────────────────
+// Keycloak, Ory, ZITADEL, Logto, SuperTokens, authentik, FusionAuth, Hanko.
+const migration_presets_g4_1 = require("./migration-presets-g4");
+for (const preset of migration_presets_g4_1.G4_BRIDGE_PRESETS)
+    registerMigrationBridgePreset(preset, { replace: true });
 //# sourceMappingURL=migration-presets.js.map

package/dist/migration-presets.js.map

@@ -1 +1 @@
-{"version":3,"file":"migration-presets.js","sourceRoot":"","sources":["../src/migration-presets.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAiGH,sEAMC;AAED,4DAEC;AAED,gEAEC;AAkDD,oEA0CC;AAqTD,8CAIC;AAvaD,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAElF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;AAEzD,SAAgB,6BAA6B,CAAC,MAA6B,EAAE,UAAiC,EAAE;IAC9G,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACjG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACvH,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,wCAAwC,CAAC,CAAC;IAC/H,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,8CAA8C,CAAC,CAAC;IAC3I,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,SAAgB,wBAAwB,CAAC,EAAU;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAgB,0BAA0B;IACxC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAsBD,MAAa,mBAAoB,SAAQ,KAAK;IAEjC;IADX,YACW,QAAgB,EACzB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,aAAQ,GAAR,QAAQ,CAAQ;QAIzB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AARD,kDAQC;AAED,sGAAsG;AACtG,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C,SAAS,IAAI,CAAC,QAAgB,EAAE,IAA4B;IAC1D,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAChE,+EAA+E;QAC/E,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,IAAI,IAAI,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,EAAU,EAAE,UAAkC,EAAE;IAC3F,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC;IAClF,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,2EAA2E;QAC3E,qEAAqE;QACrE,yCAAyC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC;QACjK,MAAM,WAAW,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACnH,IAAI,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,EAAE;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC3C,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,MAAM;QACrC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/E,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,EAAE;QACjC,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;QACzC,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,IAAI,CAAC;QAClD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,KAAK;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI;QACzB,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI;QAC/C,MAAM,EAAE,CAAC,CAAC,MAAM;YACd,CAAC,CAAC;gBACE,GAAG,CAAC,CAAC,MAAM;gBACX,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;gBAC7B,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E;YACH,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,WAAW,GAA0B,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAEhK,KAAK,MAAM,MAAM,IAAI;IACnB;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,mDAAmD,EAAE;QACrE,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE;QACvE,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,MAAM,EAAE,2FAA2F;YACnG,SAAS,EAAE,mDAAmD;SAC/D;QACD,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE;YACH,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,wCAAwC;YACjD,yFAAyF;YACzF,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,2EAA2E;YAC3E,8DAA8D;YAC9D,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;QACpC,+EAA+E;QAC/E,wDAAwD;QACxD,YAAY,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,SAAS,CAAC;QACzG,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,4PAA4P;KACpQ;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,YAAY,EAAE,oHAAoH,EAAE;QAC5I,GAAG,EAAE;YACH,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,8CAA8C;YACvD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;YAC7D,6GAA6G;YAC7G,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,6FAA6F;QAC7F,YAAY,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,aAAa,CAAC;QACjI,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,yNAAyN;KACjO;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,YAAY,EAAE,iCAAiC,EAAE,SAAS,EAAE,eAAe,EAAE;QACvH,GAAG,EAAE;YACH,MAAM,EAAE,2DAA2D;YACnE,OAAO,EAAE,iFAAiF;YAC1F,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE;SACpH;QACD,OAAO,EAAE,CAAC,sDAAsD,CAAC;QACjE,YAAY,EAAE,CAAC,8CAA8C,CAAC;QAC9D,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE;QAC3C,GAAG,EAAE;YACH,MAAM,EAAE,6CAA6C;YACrD,OAAO,EAAE,2FAA2F;YACpG,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;SACjH;QACD,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE;QAC3C,GAAG,EAAE;YACH,MAAM,EAAE,kDAAkD;YAC1D,OAAO,EAAE,uEAAuE;YAChF,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;SAC9F;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC;QACjC,iBAAiB,EAAE,IAAI;KACxB;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE;QACzE,GAAG,EAAE;YACH,MAAM,EAAE,2CAA2C;YACnD,OAAO,EAAE,iEAAiE;YAC1E,QAAQ,EAAE,CAAC,eAAe,CAAC;YAC3B,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE;YACvF,sGAAsG;YACtG,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;YAClC,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACxC,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,CAAC,6BAA6B,EAAE,+BAA+B,CAAC;QAC9E,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,SAAS,EAAE,6BAA6B,EAAE;QAClD,GAAG,EAAE;YACH,MAAM,EAAE,oDAAoD;YAC5D,OAAO,EAAE,6CAA6C;YACtD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,aAAa,CAAC;QACxB,KAAK,EAAE,gKAAgK;KACxK;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,qCAAqC,EAAE;QACvD,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE;QAC/D,GAAG,EAAE;YACH,yFAAyF;YACzF,MAAM,EAAE,uCAAuC;YAC/C,OAAO,EAAE,+CAA+C;YACxD,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,wEAAwE;YACxE,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;SAC9D;QACD,oGAAoG;QACpG,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE;QAC1D,QAAQ,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;QACxC,GAAG,EAAE;YACH,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,kDAAkD;YAC3D,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,4BAA4B,EAAE;YACpE,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,oBAAoB,CAAC;QAC/B,YAAY,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;KACvD;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,6CAA6C,EAAE,KAAK,EAAE,YAAY,EAAE;QACtF,GAAG,EAAE;YACH,MAAM,EAAE,2BAA2B;YACnC,OAAO,EAAE,yDAAyD;YAClE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;SAC5D;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,2CAA2C,EAAE;QAC/D,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;SAC9C;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC7C,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,8DAA8D,EAAE;QAChF,GAAG,EAAE;YACH,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,mCAAmC;YAC5C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,2EAA2E;YAC3E,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,+DAA+D;QAC/D,OAAO,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC;QACrC,YAAY,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,EAAE,yBAAyB,CAAC;QACjI,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE;QAC/C,QAAQ,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE;QACjD,GAAG,EAAE;YACH,8EAA8E;YAC9E,iFAAiF;YACjF,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,iCAAiC;YAC1C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;YAC1D,6FAA6F;YAC7F,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;QAC3B,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE;QAC/C,QAAQ,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE;QACjD,GAAG,EAAE;YACH,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,iCAAiC;YAC1C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;YAC1D,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;QAC3B,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,qDAAqD,EAAE;QACzE,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;QAChK,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;QAC1C,OAAO,EAAE,CAAC,wCAAwC,EAAE,+BAA+B,CAAC;QACpF,YAAY,EAAE;YACZ,wCAAwC;YACxC,uCAAuC;YACvC,uCAAuC;YACvC,wCAAwC;YACxC,+BAA+B;YAC/B,8BAA8B;YAC9B,8BAA8B;YAC9B,+BAA+B;SAChC;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,CAAC,+BAA+B,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,yBAAyB,CAAC;QACjI,KAAK,EAAE,yIAAyI;KACjJ;IACD,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE;IAC7H,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;IAC3H,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE;CAChH,EAAE,CAAC;IACpC,6BAA6B,CAAC,MAA+B,CAAC,CAAC;AACjE,CAAC;AAED,+EAA+E;AAC/E,SAAgB,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,KAAK,IAAI,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjH,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC"}
+{"version":3,"file":"migration-presets.js","sourceRoot":"","sources":["../src/migration-presets.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAuGH,sEAMC;AAED,4DAEC;AAED,gEAEC;AAkDD,oEA0CC;AA6YD,8CAIC;AA/fD,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAElF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;AAEzD,SAAgB,6BAA6B,CAAC,MAA6B,EAAE,UAAiC,EAAE;IAC9G,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACjG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACvH,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,wCAAwC,CAAC,CAAC;IAC/H,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,8CAA8C,CAAC,CAAC;IAC3I,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,SAAgB,wBAAwB,CAAC,EAAU;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAgB,0BAA0B;IACxC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAsBD,MAAa,mBAAoB,SAAQ,KAAK;IAEjC;IADX,YACW,QAAgB,EACzB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,aAAQ,GAAR,QAAQ,CAAQ;QAIzB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AARD,kDAQC;AAED,sGAAsG;AACtG,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C,SAAS,IAAI,CAAC,QAAgB,EAAE,IAA4B;IAC1D,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAChE,+EAA+E;QAC/E,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,IAAI,IAAI,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,EAAU,EAAE,UAAkC,EAAE;IAC3F,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC;IAClF,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,2EAA2E;QAC3E,qEAAqE;QACrE,yCAAyC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC;QACjK,MAAM,WAAW,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACnH,IAAI,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,EAAE;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC3C,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,MAAM;QACrC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/E,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,EAAE;QACjC,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;QACzC,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,IAAI,CAAC;QAClD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,KAAK;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI;QACzB,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI;QAC/C,MAAM,EAAE,CAAC,CAAC,MAAM;YACd,CAAC,CAAC;gBACE,GAAG,CAAC,CAAC,MAAM;gBACX,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;gBAC7B,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E;YACH,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,WAAW,GAA0B,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAEhK,KAAK,MAAM,MAAM,IAAI;IACnB;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,mDAAmD,EAAE;QACrE,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE;QACvE,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,MAAM,EAAE,2FAA2F;YACnG,SAAS,EAAE,mDAAmD;SAC/D;QACD,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE;YACH,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,wCAAwC;YACjD,yFAAyF;YACzF,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,2EAA2E;YAC3E,8DAA8D;YAC9D,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;QACpC,+EAA+E;QAC/E,wDAAwD;QACxD,YAAY,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,SAAS,CAAC;QACzG,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,4PAA4P;KACpQ;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,YAAY,EAAE,oHAAoH,EAAE;QAC5I,GAAG,EAAE;YACH,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,8CAA8C;YACvD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;YAC7D,6GAA6G;YAC7G,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,6FAA6F;QAC7F,YAAY,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,aAAa,CAAC;QACjI,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,yNAAyN;KACjO;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,YAAY,EAAE,iCAAiC,EAAE,SAAS,EAAE,eAAe,EAAE;QACvH,GAAG,EAAE;YACH,MAAM,EAAE,2DAA2D;YACnE,OAAO,EAAE,iFAAiF;YAC1F,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE;SACpH;QACD,OAAO,EAAE,CAAC,sDAAsD,CAAC;QACjE,YAAY,EAAE,CAAC,8CAA8C,CAAC;QAC9D,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE;QAC3C,GAAG,EAAE;YACH,MAAM,EAAE,6CAA6C;YACrD,OAAO,EAAE,2FAA2F;YACpG,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;SACjH;QACD,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE;QAC3C,GAAG,EAAE;YACH,MAAM,EAAE,kDAAkD;YAC1D,OAAO,EAAE,uEAAuE;YAChF,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;SAC9F;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC;QACjC,iBAAiB,EAAE,IAAI;KACxB;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE;QACzE,GAAG,EAAE;YACH,MAAM,EAAE,2CAA2C;YACnD,OAAO,EAAE,iEAAiE;YAC1E,QAAQ,EAAE,CAAC,eAAe,CAAC;YAC3B,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE;YACvF,sGAAsG;YACtG,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;YAClC,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACxC,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,CAAC,6BAA6B,EAAE,+BAA+B,CAAC;QAC9E,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,SAAS,EAAE,6BAA6B,EAAE;QAClD,qFAAqF;QACrF,QAAQ,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;QACxC,GAAG,EAAE;YACH,MAAM,EAAE,gDAAgD;YACxD,OAAO,EAAE,yCAAyC;YAClD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,aAAa,CAAC;QACxB,YAAY,EAAE,CAAC,aAAa,CAAC;QAC7B,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,iZAAiZ;KACzZ;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,qCAAqC,EAAE;QACvD,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE;QAC/D,GAAG,EAAE;YACH,yFAAyF;YACzF,MAAM,EAAE,uCAAuC;YAC/C,OAAO,EAAE,+CAA+C;YACxD,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,wEAAwE;YACxE,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;SAC9D;QACD,oGAAoG;QACpG,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,cAAc,EAAE,sCAAsC,EAAE;QAChE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3B,GAAG,EAAE;YACH,MAAM,EAAE,mDAAmD;YAC3D,OAAO,EAAE,wDAAwD;YACjE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;SAC9C;QACD,+FAA+F;QAC/F,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,SAAS,EAAE,qDAAqD,EAAE;QAC1E,GAAG,EAAE;YACH,MAAM,EAAE,yCAAyC;YACjD,OAAO,EAAE,+CAA+C;YACxD,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;SAC9C;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE;QAC1D,+IAA+I;QAC/I,QAAQ,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE;QAC/D,GAAG,EAAE;YACH,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,qDAAqD;YAC9D,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,0FAA0F;YAC1F,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,+BAA+B,EAAE;YACvE,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,oBAAoB,CAAC;QAC/B,YAAY,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;QACtD,KAAK,EACH,gPAAgP;KACnP;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,6CAA6C,EAAE,KAAK,EAAE,YAAY,EAAE;QACtF,GAAG,EAAE;YACH,MAAM,EAAE,2BAA2B;YACnC,OAAO,EAAE,yDAAyD;YAClE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;SAC5D;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,2CAA2C,EAAE;QAC/D,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;SAC9C;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC7C,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,8DAA8D,EAAE;QAChF,GAAG,EAAE;YACH,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,mCAAmC;YAC5C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,2EAA2E;YAC3E,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,+DAA+D;QAC/D,OAAO,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC;QACrC,YAAY,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,EAAE,yBAAyB,CAAC;QACjI,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE;QAC/C,QAAQ,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE;QACjD,GAAG,EAAE;YACH,8EAA8E;YAC9E,iFAAiF;YACjF,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,iCAAiC;YAC1C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;YAC1D,6FAA6F;YAC7F,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;QAC3B,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE;QAC/C,QAAQ,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE;QACjD,GAAG,EAAE;YACH,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,iCAAiC;YAC1C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;YAC1D,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;QAC3B,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,qDAAqD,EAAE;QACzE,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;QAChK,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD,mBAAmB;IACnB;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,0FAA0F,EAAE;QAC9G,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE;QACrL,OAAO,EAAE,CAAC,SAAS,CAAC;QACpB,YAAY,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QACpC,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,wRAAwR;KAC3R;IACD,cAAc;IACd;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,SAAS,EAAE,kEAAkE,EAAE;QACvF,GAAG,EAAE;YACH,uGAAuG;YACvG,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,WAAW;YACtB,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,QAAQ,CAAC;YACtB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,2FAA2F;YAC3F,mBAAmB,EAAE,EAAE,GAAG,IAAI;SAC/B;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,mKAAmK;KAC3K;IACD,kBAAkB;IAClB,gBAAgB;IAChB;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,iCAAiC,EAAE;QACvD,GAAG,EAAE;YACH,MAAM,EAAE,6CAA6C;YACrD,OAAO,EAAE,8DAA8D;YACvE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;YACxD,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;QACnD,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;QAC1C,OAAO,EAAE,CAAC,wCAAwC,EAAE,+BAA+B,CAAC;QACpF,YAAY,EAAE;YACZ,wCAAwC;YACxC,uCAAuC;YACvC,uCAAuC;YACvC,wCAAwC;YACxC,+BAA+B;YAC/B,8BAA8B;YAC9B,8BAA8B;YAC9B,+BAA+B;SAChC;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,CAAC,+BAA+B,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,yBAAyB,CAAC;QACjI,KAAK,EAAE,yIAAyI;KACjJ;IACD,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE;IAC7H,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;IAC3H,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE;CAChH,EAAE,CAAC;IACpC,6BAA6B,CAAC,MAA+B,CAAC,CAAC;AACjE,CAAC;AAED,+EAA+E;AAC/E,SAAgB,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,KAAK,IAAI,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjH,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,+EAA+E;AAC/E,gGAAgG;AAChG,iEAA2D;AAC3D,KAAK,MAAM,MAAM,IAAI,wCAAiB;IAAE,6BAA6B,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACjG,8EAA8E;AAC9E,4EAA4E;AAC5E,iEAA2D;AAC3D,KAAK,MAAM,MAAM,IAAI,wCAAiB;IAAE,6BAA6B,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/dist/request-auth.d.ts

@@ -0,0 +1,32 @@
+import { type ProtectCondition } from '@atlasauth/authz';
+import type { AtlasBackend, SessionClaims } from './verify';
+/**
+ * Framework-neutral request authentication, shared by the Koa, Hapi and GraphQL
+ * adapters: read the `__session` cookie or `Authorization: Bearer` header
+ * (the header wins), verify locally against the JWKS and return the auth state.
+ * It never throws: a missing or bad token is the signed-out state, whose
+ * `has()` is `false` and `protect()` throws.
+ */
+export interface RequestAuth {
+    userId: string | null;
+    sessionId: string | null;
+    orgId: string | null;
+    orgRole: string | null;
+    claims: SessionClaims | null;
+    isSignedIn: boolean;
+    /** The impersonator (RFC 8693 `act`) or null. */
+    actor: {
+        sub: string;
+    } | null;
+    has(condition?: ProtectCondition): boolean;
+    /** Assert a condition; returns the claims or throws `ForbiddenError`. */
+    protect(condition?: ProtectCondition): SessionClaims;
+}
+export declare function signedOutAuth(): RequestAuth;
+export declare function signedInAuth(claims: SessionClaims): RequestAuth;
+type HeaderValue = string | string[] | undefined;
+/** The raw session token a request carries (bearer header first, then the `__session` cookie), or null. */
+export declare function sessionTokenFromHeaders(headers: Record<string, HeaderValue>): string | null;
+/** Verify a request's headers into a {@link RequestAuth}. Never throws. */
+export declare function authenticateHeaders(backend: AtlasBackend, headers: Record<string, HeaderValue>): Promise<RequestAuth>;
+export {};