@atlasauth/cli 0.10.0 → 0.12.0

package/dist/migrate/export/clerk-config.d.ts

@@ -0,0 +1,26 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+/**
+ * `atlas migrate clerk config` — a Clerk instance's settings → Atlas config.
+ *
+ * Read from Clerk's PUBLIC environment document (`GET https://<frontend
+ * api>/v1/environment`, what clerk-js loads with the publishable key) and,
+ * with the secret key, the Backend API's JWT templates, redirect URLs,
+ * organization roles and permissions. Atlas mirrors Clerk's model, so most
+ * settings map 1:1.
+ */
+export interface ClerkConfigSnapshot {
+    frontendApi: string;
+    environment: Obj;
+    jwtTemplates?: Obj[];
+    redirectUrls?: Obj[];
+    roles?: Obj[];
+    permissions?: Obj[];
+}
+export declare function fetchClerkConfig(opts: {
+    publishableKey: string;
+    secretKey?: string;
+    fetchImpl?: typeof fetch;
+    apiUrl?: string;
+}): Promise<ClerkConfigSnapshot>;
+export declare function translateClerkConfig(snap: ClerkConfigSnapshot): TranslationResult;

package/dist/migrate/export/clerk-config.js

@@ -0,0 +1,227 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchClerkConfig = fetchClerkConfig;
+exports.translateClerkConfig = translateClerkConfig;
+const backend_1 = require("@atlasauth/backend");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function fetchClerkConfig(opts) {
+    const frontendApi = (0, backend_1.clerkFrontendApiFromPublishableKey)(opts.publishableKey);
+    if (!frontendApi)
+        throw new Error('That is not a Clerk publishable key (pk_test_… / pk_live_…).');
+    const fapi = new vendor_http_1.VendorHttp({ vendor: 'Clerk', baseUrl: `https://${frontendApi}`, fetchImpl: opts.fetchImpl });
+    const { body: environment } = await fapi.get('/v1/environment');
+    const snap = { frontendApi, environment: (0, record_set_1.isObj)(environment) ? environment : {} };
+    if (opts.secretKey) {
+        const bapi = new vendor_http_1.VendorHttp({ vendor: 'Clerk', baseUrl: opts.apiUrl ?? 'https://api.clerk.com', headers: { authorization: `Bearer ${opts.secretKey}` }, fetchImpl: opts.fetchImpl });
+        const list = async (path) => {
+            try {
+                const { body } = await bapi.get(path);
+                return Array.isArray(body) ? (0, record_set_1.objs)(body) : (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body.data) : [];
+            }
+            catch (err) {
+                if (err instanceof vendor_http_1.VendorApiError && [403, 404, 422].includes(err.status))
+                    return [];
+                throw err;
+            }
+        };
+        snap.jwtTemplates = await list('/v1/jwt_templates');
+        snap.redirectUrls = await list('/v1/redirect_urls');
+        snap.roles = await list('/v1/organization_roles?limit=500');
+        snap.permissions = await list('/v1/organization_permissions?limit=500');
+    }
+    return snap;
+}
+const AREA_ATTR = 'user & authentication';
+function translateClerkConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const env = snap.environment;
+    const us = (0, record_set_1.isObj)(env.user_settings) ? env.user_settings : {};
+    const attrs = (0, record_set_1.isObj)(us.attributes) ? us.attributes : {};
+    const attr = (name) => ((0, record_set_1.isObj)(attrs[name]) ? attrs[name] : {});
+    const on = (name) => attr(name).enabled === true;
+    // ── identifiers and first factors ──
+    const email = attr('email_address');
+    if (on('email_address')) {
+        const first = (0, record_set_1.strs)(email.first_factors);
+        b.set('strategies.emailCode', first.includes('email_code'));
+        b.set('strategies.emailLink', first.includes('email_link'));
+        b.add('mapped', AREA_ATTR, 'attributes.email_address.first_factors', `Email sign-in: ${first.join(', ') || 'identifier only'}.`, 'auth_config.strategies.emailCode / emailLink');
+        const verifyAtSignUp = email.verify_at_sign_up === true || (0, record_set_1.strs)(email.verifications).length > 0;
+        b.set('requireEmailVerification', verifyAtSignUp);
+        b.add('mapped', AREA_ATTR, 'attributes.email_address.verify_at_sign_up', verifyAtSignUp ? 'Email addresses are verified at sign-up.' : 'Email addresses are not verified at sign-up.', 'auth_config.requireEmailVerification');
+    }
+    if (on('phone_number')) {
+        b.set('strategies.phoneCode', (0, record_set_1.strs)(attr('phone_number').first_factors).includes('phone_code'));
+        b.add('mapped', AREA_ATTR, 'attributes.phone_number', 'SMS code sign-in.', 'auth_config.strategies.phoneCode');
+    }
+    if (on('username')) {
+        b.set('strategies.username', true);
+        const u = (0, record_set_1.isObj)(us.username_settings) ? us.username_settings : {};
+        if (typeof u.min_length === 'number')
+            b.set('accountUx.username.minLength', u.min_length);
+        if (typeof u.max_length === 'number')
+            b.set('accountUx.username.maxLength', u.max_length);
+        b.add('mapped', AREA_ATTR, 'attributes.username', 'Usernames, with the same length limits.', 'auth_config.strategies.username');
+    }
+    const password = on('password');
+    b.set('strategies.password', password);
+    if (password)
+        b.add('mapped', AREA_ATTR, 'attributes.password', 'Password sign-in. Imported Clerk users keep their bcrypt digest and are re-hashed to Argon2id on first sign-in.', 'auth_config.strategies.password');
+    if (on('passkey')) {
+        b.set('strategies.passkey', true);
+        b.add('differs', AREA_ATTR, 'attributes.passkey', 'Passkey sign-in is on, but Clerk does not export passkeys: users register a new one in Atlas.', 'auth_config.strategies.passkey');
+    }
+    if (on('web3_wallet'))
+        b.add('differs', AREA_ATTR, 'attributes.web3_wallet', 'Atlas signs wallets in with Sign-In with Ethereum (strategies.siwe); wallet-only Clerk users are not exported (no email to carry).', 'auth_config.strategies.siwe');
+    for (const name of ['first_name', 'last_name']) {
+        if (attr(name).required === true)
+            b.add('manual', AREA_ATTR, `attributes.${name}.required`, 'Make the name a required identity trait in Atlas (identityTraits) if sign-up must collect it.', 'auth_config.identityTraits');
+    }
+    // ── second factors ──
+    const totp = on('authenticator_app');
+    const sms2fa = attr('phone_number').used_for_second_factor === true;
+    const backup = on('backup_code');
+    b.set('mfa.factors.totp', totp);
+    if (totp)
+        b.add('mapped', 'multi-factor', 'attributes.authenticator_app', 'Authenticator apps. TOTP secrets move only from the dashboard CSV export.', 'auth_config.mfa.factors.totp');
+    if (sms2fa)
+        b.add('differs', 'multi-factor', 'attributes.phone_number.used_for_second_factor', 'SMS second factor: Atlas offers SMS as a first factor and recommends TOTP or passkeys for the second.', 'auth_config.mfa');
+    if (backup)
+        b.add('mapped', 'multi-factor', 'attributes.backup_code', 'Backup codes. Clerk does not export them: users generate new ones.', 'auth_config.mfa.backupCodes');
+    const signIn = (0, record_set_1.isObj)(us.sign_in) ? us.sign_in : {};
+    if ((0, record_set_1.isObj)(signIn.second_factor) && signIn.second_factor.required === true) {
+        b.set('mfaPolicy', 'required');
+        b.add('mapped', 'multi-factor', 'sign_in.second_factor.required', 'Every user must use a second factor.', 'auth_config.mfaPolicy');
+    }
+    // ── sign-up mode ──
+    const signUp = (0, record_set_1.isObj)(us.sign_up) ? us.sign_up : {};
+    const mode = (0, record_set_1.str)(signUp.mode) ?? 'public';
+    if (mode === 'restricted' || mode === 'waitlist') {
+        b.set('signUpMode', 'restricted');
+        b.add(mode === 'waitlist' ? 'differs' : 'mapped', 'restrictions', 'sign_up.mode', mode === 'waitlist' ? 'Clerk waitlist: Atlas restricts sign-up to invitations and the allowlist; collect waitlist sign-ups yourself.' : 'Sign-up by invitation / allowlist only.', 'auth_config.signUpMode');
+    }
+    else {
+        b.set('signUpMode', 'public');
+        b.add('mapped', 'restrictions', 'sign_up.mode', 'Public sign-up.', 'auth_config.signUpMode');
+    }
+    // ── password policy ──
+    const pw = (0, record_set_1.isObj)(us.password_settings) ? us.password_settings : {};
+    if (typeof pw.min_length === 'number') {
+        b.set('passwordPolicy.minLength', Math.max(8, pw.min_length));
+        b.add(pw.min_length < 8 ? 'differs' : 'mapped', 'password', 'password_settings.min_length', pw.min_length < 8 ? `Clerk allows ${pw.min_length}; Atlas requires at least 8 (existing passwords still sign in).` : `${pw.min_length}.`, 'auth_config.passwordPolicy.minLength');
+    }
+    if (typeof pw.max_length === 'number' && pw.max_length > 0) {
+        b.set('passwordPolicy.maxLength', Math.min(256, pw.max_length));
+        b.add('mapped', 'password', 'password_settings.max_length', `${Math.min(256, pw.max_length)}.`, 'auth_config.passwordPolicy.maxLength');
+    }
+    if (pw.disable_hibp !== undefined) {
+        b.set('passwordPolicy.checkBreaches', pw.disable_hibp !== true);
+        b.add('mapped', 'password', 'password_settings.disable_hibp', pw.disable_hibp === true ? 'Breached-password check off.' : 'Breached passwords are refused.', 'auth_config.passwordPolicy.checkBreaches');
+    }
+    for (const k of ['require_special_char', 'require_numbers', 'require_uppercase', 'require_lowercase']) {
+        if (pw[k] === true)
+            b.add('differs', 'password', `password_settings.${k}`, 'Atlas follows NIST 800-63B (length and breach checks, no composition rules); this rule is dropped.', 'auth_config.passwordPolicy');
+    }
+    // ── social providers ──
+    const social = (0, record_set_1.isObj)(us.social) ? us.social : {};
+    for (const [strategy, cfg] of Object.entries(social)) {
+        if (!(0, record_set_1.isObj)(cfg) || cfg.enabled !== true)
+            continue;
+        const key = (0, translate_kit_1.socialKey)(strategy);
+        if (key) {
+            b.socialProvider({ atlasKey: key, vendorName: strategy, area: 'SSO connections', setting: `social.${strategy}`, allowSignUp: cfg.authenticatable !== false });
+            if (cfg.authenticatable === false)
+                b.add('differs', 'SSO connections', `social.${strategy}.authenticatable`, 'Connect-only in Clerk; in Atlas it can sign in too (turn allow_sign_in off to match).', `oauth_providers ${key}`);
+        }
+        else if (strategy.startsWith('oauth_custom_')) {
+            b.add('manual', 'SSO connections', `social.${strategy}`, `Custom OAuth provider "${(0, record_set_1.str)(cfg.name) ?? strategy}": recreate it in Atlas as a custom OAuth/OIDC provider with its endpoints.`, 'custom_oauth_providers');
+        }
+        else {
+            b.add('manual', 'SSO connections', `social.${strategy}`, `"${(0, record_set_1.str)(cfg.name) ?? strategy}" is not a built-in Atlas provider; add it as a custom OAuth provider.`, 'custom_oauth_providers');
+        }
+    }
+    if ((0, record_set_1.isObj)(us.enterprise_sso) && us.enterprise_sso.enabled === true) {
+        b.add('mapped', 'SSO connections', 'enterprise_sso', 'Enterprise connections (SAML / OIDC) move with the data export as Atlas SSO connections. Give each IdP Atlas\'s new ACS URL and entity id.', 'sso_connections');
+    }
+    // ── sessions ──
+    const authConfig = (0, record_set_1.isObj)(env.auth_config) ? env.auth_config : {};
+    if (authConfig.single_session_mode !== undefined) {
+        b.set('session.multiSession', authConfig.single_session_mode !== true);
+        b.add('mapped', 'sessions', 'auth_config.single_session_mode', authConfig.single_session_mode === true ? 'One signed-in account per browser.' : 'Multi-session (account switching).', 'auth_config.session.multiSession');
+    }
+    b.add('manual', 'sessions', 'session lifetime / inactivity timeout', "Clerk's session lifetime is not in its public settings: copy it from Clerk's dashboard (Sessions) into auth_config.session.absoluteMs / idleMs.", 'auth_config.session');
+    // ── organizations ──
+    const orgs = (0, record_set_1.isObj)(env.organization_settings) ? env.organization_settings : {};
+    if (orgs.enabled === true) {
+        if (typeof orgs.max_allowed_memberships === 'number' && orgs.max_allowed_memberships > 0) {
+            b.set('organizations.defaultMaxAllowedMemberships', orgs.max_allowed_memberships);
+            b.add('mapped', 'organizations', 'organization_settings.max_allowed_memberships', `${orgs.max_allowed_memberships} members per organization.`, 'auth_config.organizations.defaultMaxAllowedMemberships');
+        }
+        const actions = (0, record_set_1.isObj)(orgs.actions) ? orgs.actions : {};
+        if (actions.admin_delete !== undefined) {
+            b.set('organizations.allowDeletionFromApp', actions.admin_delete === true);
+            b.add('mapped', 'organizations', 'organization_settings.actions.admin_delete', actions.admin_delete === true ? 'Admins can delete their organization.' : 'Admins cannot delete organizations.', 'auth_config.organizations.allowDeletionFromApp');
+        }
+        const domains = (0, record_set_1.isObj)(orgs.domains) ? orgs.domains : {};
+        if (domains.enabled === true)
+            b.add('mapped', 'organizations', 'organization_settings.domains', `Verified domains (${(0, record_set_1.strs)(domains.enrollment_modes).join(', ') || 'manual'}) move with each organization.`, 'organizations.domains');
+        const creator = (0, record_set_1.str)((0, record_set_1.isObj)(orgs.creator_role) ? orgs.creator_role.key : orgs.creator_role);
+        if (creator) {
+            b.set('organizations.creatorRole', creator.startsWith('org:') ? creator : `org:${creator}`);
+            b.add('mapped', 'organizations', 'organization_settings.creator_role', `Creators are seated as ${creator}.`, 'auth_config.organizations.creatorRole');
+        }
+    }
+    // ── roles, permissions, JWT templates, redirect URLs (Backend API) ──
+    for (const p of snap.permissions ?? []) {
+        const key = (0, record_set_1.str)(p.key);
+        if (!key || /^org:sys_/.test(key))
+            continue;
+        b.push('permissions', { key: key.replace(/^org:/, ''), name: (0, record_set_1.str)(p.name) ?? key, description: (0, record_set_1.str)(p.description) ?? '' });
+    }
+    if (snap.permissions?.length)
+        b.add('mapped', 'organizations', 'organization_permissions', `${b.collections.permissions.length} custom permission(s); Clerk's system permissions are built into Atlas.`, 'permissions');
+    for (const r of snap.roles ?? []) {
+        const key = (0, record_set_1.str)(r.key);
+        if (!key)
+            continue;
+        const atlasKey = key.startsWith('org:') ? key : `org:${(0, translate_kit_1.keyOf)(key)}`;
+        b.roles[key] = atlasKey;
+        b.push('roles', {
+            key: atlasKey,
+            name: (0, record_set_1.str)(r.name) ?? key,
+            description: (0, record_set_1.str)(r.description) ?? '',
+            permissions: (0, record_set_1.objs)(r.permissions).map((p) => (0, record_set_1.str)(p.key)).filter((p) => !!p).map((p) => p.replace(/^org:/, '')),
+        });
+    }
+    if (snap.roles?.length)
+        b.add('mapped', 'organizations', 'organization_roles', `${snap.roles.length} role(s), same keys.`, 'roles');
+    for (const t of snap.jwtTemplates ?? []) {
+        const name = (0, record_set_1.str)(t.name);
+        if (!name)
+            continue;
+        b.push('jwt_templates', { name, claims: ((0, record_set_1.isObj)(t.claims) ? t.claims : {}), lifetime: typeof t.lifetime === 'number' ? t.lifetime : 60, ...(typeof t.allowed_clock_skew === 'number' ? { allowed_clock_skew: t.allowed_clock_skew } : {}) });
+        b.add(t.custom_signing_key === true ? 'differs' : 'mapped', 'JWT templates', `jwt_templates.${name}`, t.custom_signing_key === true ? 'Template kept; Atlas signs it with the instance key (the custom signing key is not copied).' : 'Same shortcodes ({{user.id}}, {{org.role}} …).', `jwt_templates ${name}`);
+    }
+    for (const r of snap.redirectUrls ?? []) {
+        const url = (0, record_set_1.str)(r.url);
+        if (url)
+            b.push('redirect_urls', { url });
+    }
+    if (snap.redirectUrls?.length)
+        b.add('mapped', 'paths', 'redirect_urls', 'Native / OAuth redirect URLs.', 'redirect_urls');
+    const display = (0, record_set_1.isObj)(env.display_config) ? env.display_config : {};
+    for (const [setting, atlas] of [
+        ['sign_in_url', 'NEXT_PUBLIC_ATLAS_SIGN_IN_URL'],
+        ['sign_up_url', 'NEXT_PUBLIC_ATLAS_SIGN_UP_URL'],
+    ]) {
+        const v = (0, record_set_1.str)(display[setting]);
+        if (v)
+            b.add('differs', 'paths', `display_config.${setting}`, `Clerk hosts ${v}; Atlas uses its own hosted pages or your routes (set ${atlas}).`, atlas);
+    }
+    return b.result(`Clerk instance ${snap.frontendApi}`, {
+        bridge: { preset: 'clerk', vars: { frontend_api: snap.frontendApi } },
+    });
+}
+//# sourceMappingURL=clerk-config.js.map

package/dist/migrate/export/clerk-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clerk-config.js","sourceRoot":"","sources":["../../../src/migrate/export/clerk-config.ts"],"names":[],"mappings":";;AAyBA,4CAuBC;AAID,oDA+KC;AAjOD,gDAAwE;AACxE,6CAAgE;AAChE,mDAAkE;AAClE,+CAA2D;AAoBpD,KAAK,UAAU,gBAAgB,CAAC,IAA+F;IACpI,MAAM,WAAW,GAAG,IAAA,4CAAkC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5E,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/G,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,iBAAiB,CAAC,CAAC;IACrE,MAAM,IAAI,GAAwB,EAAE,WAAW,EAAE,WAAW,EAAE,IAAA,kBAAK,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,uBAAuB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACrL,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAkB,EAAE;YAClD,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;gBAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,OAAO,EAAE,CAAC;gBACrF,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC5D,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAE1C,SAAgB,oBAAoB,CAAC,IAAyB;IAC5D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAO,EAAE,CAAC,CAAC,IAAA,kBAAK,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,IAAI,CAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;IAEzD,sCAAsC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5D,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5D,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,wCAAwC,EAAE,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,GAAG,EAAE,8CAA8C,CAAC,CAAC;QACjL,MAAM,cAAc,GAAG,KAAK,CAAC,iBAAiB,KAAK,IAAI,IAAI,IAAA,iBAAI,EAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAChG,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,4CAA4C,EAAE,cAAc,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,8CAA8C,EAAE,sCAAsC,CAAC,CAAC;IACjO,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;QACvB,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAA,iBAAI,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,kCAAkC,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QACnB,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QAC1F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,yCAAyC,EAAE,iCAAiC,CAAC,CAAC;IAClI,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,QAAQ;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,iHAAiH,EAAE,iCAAiC,CAAC,CAAC;IACtN,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QAClB,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,oBAAoB,EAAE,+FAA+F,EAAE,gCAAgC,CAAC,CAAC;IACvL,CAAC;IACD,IAAI,EAAE,CAAC,aAAa,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,wBAAwB,EAAE,oIAAoI,EAAE,6BAA6B,CAAC,CAAC;IAClP,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,IAAI,WAAW,EAAE,+FAA+F,EAAE,4BAA4B,CAAC,CAAC;IAC7N,CAAC;IAED,uBAAuB;IACvB,MAAM,IAAI,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,sBAAsB,KAAK,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,8BAA8B,EAAE,2EAA2E,EAAE,8BAA8B,CAAC,CAAC;IACvL,IAAI,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,gDAAgD,EAAE,uGAAuG,EAAE,iBAAiB,CAAC,CAAC;IAC3N,IAAI,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,wBAAwB,EAAE,oEAAoE,EAAE,6BAA6B,CAAC,CAAC;IAC3K,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,IAAA,kBAAK,EAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1E,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,gCAAgC,EAAE,sCAAsC,EAAE,uBAAuB,CAAC,CAAC;IACrI,CAAC;IAED,qBAAqB;IACrB,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,+GAA+G,CAAC,CAAC,CAAC,yCAAyC,EAAE,wBAAwB,CAAC,CAAC;IACjS,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IAC/F,CAAC;IAED,wBAAwB;IACxB,MAAM,EAAE,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACtC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,8BAA8B,EAAE,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,UAAU,iEAAiE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,UAAU,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAChR,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QAC3D,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,8BAA8B,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAC1I,CAAC;IACD,IAAI,EAAE,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,EAAE,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC;QAChE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,gCAAgC,EAAE,EAAE,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,iCAAiC,EAAE,0CAA0C,CAAC,CAAC;IAC3M,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACtG,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE,EAAE,oGAAoG,EAAE,4BAA4B,CAAC,CAAC;IACjN,CAAC;IAED,yBAAyB;IACzB,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACR,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,UAAU,QAAQ,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC,CAAC;YAC9J,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,UAAU,QAAQ,kBAAkB,EAAE,uFAAuF,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;QAClO,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,UAAU,QAAQ,EAAE,EAAE,0BAA0B,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,6EAA6E,EAAE,wBAAwB,CAAC,CAAC;QACvN,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,UAAU,QAAQ,EAAE,EAAE,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,wEAAwE,EAAE,wBAAwB,CAAC,CAAC;QAC5L,CAAC;IACH,CAAC;IACD,IAAI,IAAA,kBAAK,EAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACnE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,4IAA4I,EAAE,iBAAiB,CAAC,CAAC;IACxN,CAAC;IAED,iBAAiB;IACjB,MAAM,UAAU,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,UAAU,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC;QACvE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,iCAAiC,EAAE,UAAU,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,oCAAoC,EAAE,kCAAkC,CAAC,CAAC;IAC5N,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,uCAAuC,EAAE,iJAAiJ,EAAE,qBAAqB,CAAC,CAAC;IAE/O,sBAAsB;IACtB,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,OAAO,IAAI,CAAC,uBAAuB,KAAK,QAAQ,IAAI,IAAI,CAAC,uBAAuB,GAAG,CAAC,EAAE,CAAC;YACzF,CAAC,CAAC,GAAG,CAAC,4CAA4C,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAClF,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,+CAA+C,EAAE,GAAG,IAAI,CAAC,uBAAuB,4BAA4B,EAAE,wDAAwD,CAAC,CAAC;QAC3M,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,oCAAoC,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC;YAC3E,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,4CAA4C,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,qCAAqC,EAAE,gDAAgD,CAAC,CAAC;QACpP,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,+BAA+B,EAAE,qBAAqB,IAAA,iBAAI,EAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,gCAAgC,EAAE,uBAAuB,CAAC,CAAC;QACrO,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1F,IAAI,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;YAC5F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,oCAAoC,EAAE,0BAA0B,OAAO,GAAG,EAAE,uCAAuC,CAAC,CAAC;QACxJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAU,CAAC,CAAC;IACpI,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,WAAY,CAAC,MAAM,yEAAyE,EAAE,aAAa,CAAC,CAAC;IACzN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAA,qBAAK,EAAC,GAAG,CAAC,EAAE,CAAC;QACpE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE;YACd,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG;YACxB,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;YACrC,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;SACnH,CAAC,CAAC;IACb,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,sBAAsB,EAAE,OAAO,CAAC,CAAC;IACpI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAU,CAAC,CAAC;QAC5P,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,6FAA6F,CAAC,CAAC,CAAC,gDAAgD,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACnT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG;YAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,+BAA+B,EAAE,eAAe,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,aAAa,EAAE,+BAA+B,CAAC;QAChD,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACxC,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,kBAAkB,OAAO,EAAE,EAAE,eAAe,CAAC,yDAAyD,KAAK,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3J,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,WAAW,EAAE,EAAE;QACpD,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE;KACtE,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/clerk.d.ts

@@ -0,0 +1,46 @@
+import type { PasswordHash } from '@atlasauth/migrate';
+import { RecordSet } from './record-set';
+/**
+ * `atlas migrate export clerk` — everything Clerk lets an instance owner take
+ * out, mapped onto the canonical bundle models.
+ *
+ * Two sources, merged by Clerk user id:
+ *   - the Backend API (secret key, on this machine only): users with their
+ *     emails, phones, social and enterprise accounts and all three metadata
+ *     bags; organizations, domains, memberships, roles and permissions,
+ *     pending invitations, enterprise (SAML/OIDC) connections, API keys and
+ *     the instance's public signing keys;
+ *   - the dashboard CSV export (Users → Export), the ONLY place Clerk hands
+ *     out password digests (`password_digest` + `password_hasher`) and TOTP
+ *     secrets (`totp_secret`). The API never returns either.
+ *
+ * Clerk cannot export passkeys (only their names) or backup codes: those
+ * users enrol again. Sessions are not exported — Clerk session tokens are
+ * JWTs, bridged by the `clerk` bridge preset (JWKS) instead.
+ */
+export interface ClerkExportOptions {
+    secretKey?: string;
+    /** Defaults to https://api.clerk.com. */
+    apiUrl?: string;
+    /** The dashboard CSV export text, when the owner downloaded one. */
+    csv?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    /** Skip API-key secrets (they are read one call per key). */
+    skipApiKeys?: boolean;
+    onProgress?: (message: string) => void;
+}
+export declare function exportClerk(opts: ClerkExportOptions): Promise<RecordSet>;
+/**
+ * A Clerk `password_digest` + `password_hasher` → the bundle's password hash
+ * (an Atlas hash-registry algorithm with its parameters). Formats per Clerk's
+ * `createUser` reference. Returns a reason when the digest cannot move: those
+ * users sign in through lazy migration (Clerk's verify_password) instead.
+ */
+export declare function clerkPasswordHash(hasher: string, digest: string): PasswordHash | {
+    reason: string;
+};
+/** Clerk role keys carry an `org:` prefix; the bundle uses the bare key. */
+export declare function roleKey(key: string): string;
+/** `org:invoices:read` → `invoices:read`; system permissions keep their `sys_` key. */
+export declare function permissionKey(key: string): string;