@atlasauth/cli 0.11.0 → 0.12.0

package/dist/migrate/export/okta.js

@@ -0,0 +1,337 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportOkta = exportOkta;
+exports.mapOktaUser = mapOktaUser;
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+/** Profile attributes the user record carries itself; the rest are custom. */
+const BASE_PROFILE = new Set([
+    'login',
+    'email',
+    'secondEmail',
+    'firstName',
+    'lastName',
+    'displayName',
+    'nickName',
+    'mobilePhone',
+    'primaryPhone',
+    'profileUrl',
+]);
+/** Okta social IdP types → the provider name an identity record carries. */
+const SOCIAL = {
+    GOOGLE: 'google',
+    FACEBOOK: 'facebook',
+    MICROSOFT: 'microsoft',
+    APPLE: 'apple',
+    LINKEDIN: 'linkedin',
+    GITHUB: 'github',
+    GITLAB: 'gitlab',
+    AMAZON: 'amazon',
+    DISCORD: 'discord',
+    PAYPAL: 'paypal',
+    SALESFORCE: 'salesforce',
+    SPOTIFY: 'spotify',
+    XERO: 'xero',
+    YAHOO: 'yahoo',
+};
+async function exportOkta(opts) {
+    const set = new record_set_1.RecordSet();
+    const domain = opts.domain.replace(/^https?:\/\//, '').replace(/\/+$/, '');
+    if (!/^[a-z0-9.-]+$/i.test(domain))
+        throw new Error(`Not an Okta domain: ${opts.domain}`);
+    if (!opts.apiToken && !opts.accessToken)
+        throw new Error('Okta export needs an API token (OKTA_API_TOKEN) or an OAuth access token for the management API.');
+    const progress = opts.onProgress ?? (() => undefined);
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'Okta',
+        baseUrl: `https://${domain}/api/v1`,
+        headers: { authorization: opts.apiToken ? `SSWS ${opts.apiToken}` : `Bearer ${opts.accessToken}` },
+        fetchImpl: opts.fetchImpl,
+        sleep: opts.sleep,
+    });
+    const groupsAs = opts.groupsAs ?? 'roles';
+    progress('groups');
+    const groups = groupsAs === 'skip' ? [] : (await linkAll(http, '/groups?limit=200')).filter((g) => (0, record_set_1.str)(g.type) !== 'BUILT_IN');
+    const groupKey = new Map();
+    const keysUsed = new Set();
+    for (const g of groups) {
+        const id = (0, record_set_1.str)(g.id);
+        const name = (0, record_set_1.str)((0, record_set_1.isObj)(g.profile) ? g.profile.name : undefined);
+        if (!id || !name)
+            continue;
+        let key = slug(name);
+        while (keysUsed.has(key))
+            key = `${key}_${id.slice(-4).toLowerCase()}`;
+        keysUsed.add(key);
+        groupKey.set(id, key);
+        const description = (0, record_set_1.str)((0, record_set_1.isObj)(g.profile) ? g.profile.description : undefined);
+        if (groupsAs === 'organizations') {
+            set.add('organization', (0, record_set_1.compact)({ id, name, slug: key.replace(/_/g, '-'), public_metadata: description ? { description } : undefined, created_at: (0, record_set_1.str)(g.created) }));
+        }
+        else {
+            set.add('role', (0, record_set_1.compact)({ key, name, description, scope: 'app' }));
+        }
+    }
+    if (groupsAs === 'organizations') {
+        set.add('role', { key: 'member', name: 'Member', scope: 'organization' });
+    }
+    progress('users');
+    const users = await linkAll(http, '/users?limit=200');
+    const userIds = new Set();
+    for (const u of users) {
+        const user = mapOktaUser(u);
+        if (!user) {
+            set.omit('user', 'no email, phone number or login');
+            continue;
+        }
+        userIds.add(user.id);
+        set.add('user', user);
+    }
+    if (userIds.size) {
+        set.warn('Okta never exports password hashes. Turn on the okta lazy-migration preset: each password is checked against Okta on its first sign-in in Atlas, then stored as Argon2id.');
+    }
+    // Group memberships: roles on the user, or organization memberships.
+    if (groups.length) {
+        progress('group members');
+        const rolesOf = new Map();
+        for (const g of groups) {
+            const id = (0, record_set_1.str)(g.id);
+            const key = id ? groupKey.get(id) : undefined;
+            if (!id || !key)
+                continue;
+            for (const m of await linkAll(http, `/groups/${id}/users?limit=1000`)) {
+                const uid = (0, record_set_1.str)(m.id);
+                if (!uid || !userIds.has(uid))
+                    continue;
+                if (groupsAs === 'organizations')
+                    set.add('membership', { organization_id: id, user_id: uid, role: 'member' }, `${id}:${uid}`);
+                else
+                    rolesOf.set(uid, [...(rolesOf.get(uid) ?? []), key]);
+            }
+        }
+        for (const user of set.list('user')) {
+            const roles = rolesOf.get(user.id);
+            if (roles?.length)
+                user.roles = roles;
+        }
+    }
+    progress('identity providers');
+    await addIdps(set, http, userIds, domain);
+    if (opts.factors) {
+        progress('factors');
+        for (const id of userIds)
+            await addFactors(set, http, id);
+    }
+    else {
+        set.warn('Second factors were not read (pass --factors to carry SMS / voice / email factors). TOTP seeds and Okta Verify never leave Okta.');
+    }
+    progress('signing keys');
+    const server = opts.authorizationServerId ?? 'default';
+    try {
+        const { body } = await http.get(`https://${domain}/oauth2/${server}/v1/keys`);
+        for (const k of (0, record_set_1.objs)(body?.keys))
+            if ((0, record_set_1.str)(k.kid))
+                set.add('jwks', { kid: (0, record_set_1.str)(k.kid), jwk: k });
+    }
+    catch (err) {
+        if (!(err instanceof vendor_http_1.VendorApiError))
+            throw err;
+        set.warn(`The ${server} authorization server's keys could not be read; the bridge preset fetches them live.`);
+    }
+    set.manifest = {
+        origin: domain,
+        providers: [...new Set(set.list('identity').map((i) => i.provider))].sort(),
+        settings: { groups_as: groupsAs, authorization_server: server },
+    };
+    return set;
+}
+/** One Okta user → a user record (null when it has nothing to sign in with). */
+function mapOktaUser(u) {
+    const id = (0, record_set_1.str)(u.id);
+    const status = (0, record_set_1.str)(u.status);
+    if (!id || status === 'DEPROVISIONED')
+        return null;
+    const p = (0, record_set_1.isObj)(u.profile) ? u.profile : {};
+    const credentials = (0, record_set_1.isObj)(u.credentials) ? u.credentials : {};
+    // Okta reports verified addresses under credentials.emails when it has them;
+    // otherwise an ACTIVE user has proven the primary address during activation.
+    const credEmails = (0, record_set_1.objs)(credentials.emails);
+    const verifiedSet = new Set(credEmails.filter((e) => (0, record_set_1.str)(e.status) === 'VERIFIED').map((e) => (0, record_set_1.str)(e.value)?.toLowerCase()));
+    const activated = status !== 'STAGED' && status !== 'PROVISIONED';
+    const primary = (0, record_set_1.str)(p.email)?.toLowerCase();
+    const second = (0, record_set_1.str)(p.secondEmail)?.toLowerCase();
+    const emails = [
+        ...(primary ? [{ email: primary, verified: credEmails.length ? verifiedSet.has(primary) : activated, primary: true }] : []),
+        ...(second && second !== primary ? [{ email: second, verified: verifiedSet.has(second), primary: false }] : []),
+    ];
+    const phones = [...new Set([(0, record_set_1.e164)(p.mobilePhone), (0, record_set_1.e164)(p.primaryPhone)].filter((x) => !!x))].map((phone, i) => ({
+        phone,
+        verified: false,
+        primary: !emails.length && i === 0,
+    }));
+    const login = (0, record_set_1.str)(p.login);
+    const custom = Object.fromEntries(Object.entries(p).filter(([k, v]) => !BASE_PROFILE.has(k) && v !== null && v !== undefined && v !== ''));
+    const user = (0, record_set_1.compact)({
+        id,
+        emails,
+        phones,
+        // The Okta login is often the email; keep it as the username only when it is not.
+        username: login && login.toLowerCase() !== primary ? login : undefined,
+        first_name: (0, record_set_1.str)(p.firstName),
+        last_name: (0, record_set_1.str)(p.lastName),
+        name: !(0, record_set_1.str)(p.firstName) && !(0, record_set_1.str)(p.lastName) ? (0, record_set_1.str)(p.displayName) : undefined,
+        banned: status === 'SUSPENDED' ? true : undefined,
+        ban_reason: status === 'SUSPENDED' ? 'Suspended in Okta' : undefined,
+        locked: status === 'LOCKED_OUT' ? true : undefined,
+        private_metadata: (0, record_set_1.bag)({ ...custom, ...(status && status !== 'ACTIVE' ? { okta_status: status } : {}) }),
+        created_at: (0, record_set_1.str)(u.created),
+        last_sign_in_at: (0, record_set_1.str)(u.lastLogin),
+    });
+    return user.emails?.length || user.phones?.length || user.username ? user : null;
+}
+async function addIdps(set, http, userIds, domain) {
+    let idps;
+    try {
+        idps = await linkAll(http, '/idps?limit=200');
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 401)) {
+            set.warn('Identity providers were not readable with this token (okta.idps.read): social links and SAML/OIDC connections were skipped.');
+            return;
+        }
+        throw err;
+    }
+    for (const idp of idps) {
+        const id = (0, record_set_1.str)(idp.id);
+        const type = (0, record_set_1.str)(idp.type);
+        if (!id || !type || (0, record_set_1.str)(idp.status) === 'INACTIVE')
+            continue;
+        const name = (0, record_set_1.str)(idp.name) ?? type;
+        let provider;
+        let kind;
+        let connectionId;
+        if (SOCIAL[type]) {
+            provider = SOCIAL[type];
+            kind = 'oauth';
+        }
+        else if (type === 'SAML2' || type === 'OIDC') {
+            connectionId = await addEnterpriseIdp(set, http, idp, domain);
+            if (!connectionId)
+                continue;
+            provider = name;
+            kind = type === 'SAML2' ? 'saml' : 'oidc';
+        }
+        else {
+            set.warn(`Identity provider ${name} (${type}) has no Atlas counterpart and was skipped.`);
+            continue;
+        }
+        for (const link of await linkAll(http, `/idps/${id}/users?limit=200`)) {
+            const uid = (0, record_set_1.str)(link.id);
+            const external = (0, record_set_1.str)(link.externalId);
+            if (!uid || !external || !userIds.has(uid))
+                continue;
+            set.add('identity', (0, record_set_1.compact)({ user_id: uid, provider, provider_user_id: external, kind, sso_connection_id: connectionId, profile: (0, record_set_1.bag)(link.profile) }));
+        }
+    }
+}
+async function addEnterpriseIdp(set, http, idp, domain) {
+    const id = (0, record_set_1.str)(idp.id);
+    const name = (0, record_set_1.str)(idp.name) ?? id;
+    const protocol = (0, record_set_1.isObj)(idp.protocol) ? idp.protocol : {};
+    const endpoints = (0, record_set_1.isObj)(protocol.endpoints) ? protocol.endpoints : {};
+    const credentials = (0, record_set_1.isObj)(protocol.credentials) ? protocol.credentials : {};
+    // Okta routes users to an IdP by routing rules, not by a domain on the IdP:
+    // the Atlas connection's domains are set after the import.
+    const domains = [];
+    if ((0, record_set_1.str)(idp.type) === 'SAML2') {
+        const trust = (0, record_set_1.isObj)(credentials.trust) ? credentials.trust : {};
+        const kid = (0, record_set_1.str)(trust.kid);
+        let cert;
+        if (kid) {
+            try {
+                const { body } = await http.get(`/idps/credentials/keys/${kid}`);
+                const x5c = Array.isArray(body?.x5c) ? (0, record_set_1.str)(body.x5c[0]) : undefined;
+                if (x5c)
+                    cert = `-----BEGIN CERTIFICATE-----\n${x5c.match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----`;
+            }
+            catch (err) {
+                if (!(err instanceof vendor_http_1.VendorApiError))
+                    throw err;
+            }
+        }
+        const sso = (0, record_set_1.isObj)(endpoints.sso) ? endpoints.sso : {};
+        const acs = (0, record_set_1.isObj)(endpoints.acs) ? endpoints.acs : {};
+        set.add('sso_connection', (0, record_set_1.compact)({
+            id,
+            name,
+            protocol: 'saml',
+            domains,
+            enabled: (0, record_set_1.str)(idp.status) !== 'INACTIVE',
+            saml: (0, record_set_1.compact)({
+                idp_entity_id: (0, record_set_1.str)(trust.issuer),
+                idp_sso_url: (0, record_set_1.str)(sso.url),
+                idp_certificate: cert,
+                sp_entity_id: (0, record_set_1.str)(trust.audience),
+                sp_acs_url: (0, record_set_1.str)(acs.url) ?? `https://${domain}/sso/saml2/${id}`,
+            }),
+        }));
+        if (!cert)
+            set.warn(`SAML identity provider ${name}: its signing certificate could not be read; add it in Atlas.`);
+        return id;
+    }
+    const issuer = (0, record_set_1.isObj)(protocol.issuer) ? (0, record_set_1.str)(protocol.issuer.url) : undefined;
+    const client = (0, record_set_1.isObj)(credentials.client) ? credentials.client : {};
+    set.add('sso_connection', (0, record_set_1.compact)({
+        id,
+        name,
+        protocol: 'oidc',
+        domains,
+        enabled: (0, record_set_1.str)(idp.status) !== 'INACTIVE',
+        oidc: (0, record_set_1.compact)({ issuer, client_id: (0, record_set_1.str)(client.client_id), scopes: Array.isArray(protocol.scopes) ? protocol.scopes.map(String) : undefined }),
+    }));
+    set.warn(`OIDC identity provider ${name}: Okta does not return its client secret; enter it in Atlas after the import.`);
+    return id;
+}
+async function addFactors(set, http, userId) {
+    let factors;
+    try {
+        factors = (0, record_set_1.objs)((await http.get(`/users/${userId}/factors`)).body);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 404))
+            return;
+        throw err;
+    }
+    for (const f of factors) {
+        if ((0, record_set_1.str)(f.status) !== 'ACTIVE')
+            continue;
+        const type = (0, record_set_1.str)(f.factorType);
+        const profile = (0, record_set_1.isObj)(f.profile) ? f.profile : {};
+        if (type === 'sms' || type === 'call') {
+            const phone = (0, record_set_1.e164)(profile.phoneNumber);
+            if (phone)
+                set.add('mfa_factor', { user_id: userId, type: 'phone', phone, verified: true, created_at: (0, record_set_1.str)(f.created) }, `phone:${userId}:${phone}`);
+        }
+        else if (type === 'email') {
+            set.add('mfa_factor', { user_id: userId, type: 'email', verified: true, created_at: (0, record_set_1.str)(f.created) }, `email:${userId}`);
+        }
+        else if (type) {
+            set.omit('mfa_factor', `Okta does not export ${type} secrets; re-enrol in Atlas`);
+        }
+    }
+}
+/** Follow `Link: <…>; rel="next"` until the last page. */
+async function linkAll(http, path) {
+    const out = [];
+    let next = path;
+    while (next) {
+        const res = await http.get(next);
+        out.push(...(0, record_set_1.objs)(res.body));
+        next = (0, vendor_http_1.nextLink)(res.headers.get('link'));
+    }
+    return out;
+}
+function slug(name) {
+    return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '') || 'group';
+}
+//# sourceMappingURL=okta.js.map

package/dist/migrate/export/okta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"okta.js","sourceRoot":"","sources":["../../../src/migrate/export/okta.ts"],"names":[],"mappings":";;AA4EA,gCAuGC;AAGD,kCAyCC;AA9ND,6CAAyF;AACzF,+CAAqE;AA0CrE,8EAA8E;AAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,OAAO;IACP,OAAO;IACP,aAAa;IACb,WAAW;IACX,UAAU;IACV,aAAa;IACb,UAAU;IACV,aAAa;IACb,cAAc;IACd,YAAY;CACb,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,MAAM,GAA2B;IACrC,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACf,CAAC;AAEK,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IAC7J,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW,MAAM,SAAS;QACnC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE;QAClG,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;IAE1C,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;IAC/H,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAS;QAC3B,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACtB,MAAM,WAAW,GAAG,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACvK,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CACN,2KAA2K,CAC5K,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9C,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;gBAAE,SAAS;YAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBACtE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtB,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACxC,IAAI,QAAQ,KAAK,eAAe;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;;oBAC1H,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,MAAM;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACxC,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC/B,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE1C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,OAAO;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,kIAAkI,CAAC,CAAC;IAC/I,CAAC;IAED,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,IAAI,SAAS,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAqB,WAAW,MAAM,WAAW,MAAM,UAAU,CAAC,CAAC;QAClG,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,EAAE,IAAI,CAAC;YAAE,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC;YAAE,MAAM,GAAG,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,sFAAsF,CAAC,CAAC;IAChH,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG;QACb,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC3E,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE;KAChE,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,SAAgB,WAAW,CAAC,CAAM;IAChC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,MAAM,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,IAAA,iBAAI,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAC5H,MAAM,SAAS,GAAG,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,aAAa,CAAC;IAClE,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3H,GAAG,CAAC,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChH,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1H,KAAK;QACL,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3I,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM;QACN,MAAM;QACN,kFAAkF;QAClF,QAAQ,EAAE,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACtE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5E,MAAM,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACjD,UAAU,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;QACpE,MAAM,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAClD,gBAAgB,EAAE,IAAA,gBAAG,EAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACvG,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;QAC1B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;KAClC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAc,EAAE,IAAgB,EAAE,OAAoB,EAAE,MAAc;IAC3F,IAAI,IAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,6HAA6H,CAAC,CAAC;YACxI,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;YAAE,SAAS;QAC7D,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACnC,IAAI,QAAgB,CAAC;QACrB,IAAI,IAA4B,CAAC;QACjC,IAAI,YAAgC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjB,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAE,CAAC;YACzB,IAAI,GAAG,OAAO,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/C,YAAY,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC,YAAY;gBAAE,SAAS;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,qBAAqB,IAAI,KAAK,IAAI,6CAA6C,CAAC,CAAC;YAC1F,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrD,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,oBAAO,EAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,OAAO,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1K,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAc,EAAE,IAAgB,EAAE,GAAQ,EAAE,MAAc;IACxF,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,WAAW,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,IAAwB,CAAC;QAC7B,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,0BAA0B,GAAG,EAAE,CAAC,CAAC;gBACtE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACpE,IAAI,GAAG;oBAAE,IAAI,GAAG,gCAAgC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC;YACjH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC;oBAAE,MAAM,GAAG,CAAC;YAClD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,IAAI;YACJ,QAAQ,EAAE,MAAe;YACzB,OAAO;YACP,OAAO,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;YACvC,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,aAAa,EAAE,IAAA,gBAAG,EAAC,KAAK,CAAC,MAAM,CAAC;gBAChC,WAAW,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,GAAG,CAAC;gBACzB,eAAe,EAAE,IAAI;gBACrB,YAAY,EAAE,IAAA,gBAAG,EAAC,KAAK,CAAC,QAAQ,CAAC;gBACjC,UAAU,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,MAAM,cAAc,EAAE,EAAE;aAChE,CAAC;SACH,CAAC,CACH,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,+DAA+D,CAAC,CAAC;QACnH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;QACN,EAAE;QACF,IAAI;QACJ,QAAQ,EAAE,MAAe;QACzB,OAAO;QACP,OAAO,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;QACvC,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;KAC9I,CAAC,CACH,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,+EAA+E,CAAC,CAAC;IACxH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAc,EAAE,IAAgB,EAAE,MAAc;IACxE,IAAI,OAAc,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAU,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;YAAE,OAAO;QACxF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,KAAK;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;QACtJ,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;QAC3H,CAAC;aAAM,IAAI,IAAI,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,wBAAwB,IAAI,6BAA6B,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAY;IACnD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,GAAwC,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG,IAAA,sBAAQ,EAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC;AAClG,CAAC"}

package/dist/migrate/export/plugin-kit.d.ts

@@ -0,0 +1,25 @@
+import type { MigrationBundleWriter } from '@atlasauth/migrate';
+import type { CredentialSpec, ExportCursor, PluginContext } from '../framework/plugin';
+import type { RecordSet } from './record-set';
+/**
+ * Write a vendor export through the sealed-bundle writer: the manifest fields
+ * and warnings the exporter learned, what it had to leave out, then every
+ * record in canonical order. On `--resume` the vendor is read again and the
+ * records an earlier segment already holds are skipped (vendor listings are
+ * returned in a stable order).
+ */
+export declare function writeRecordSet(set: RecordSet, writer: MigrationBundleWriter, resume: {
+    cursor: ExportCursor | null;
+    checkpoint(cursor: ExportCursor): void;
+}, say: (line: string) => void): Promise<void>;
+/** A credential, or a CliError naming every way to pass it. */
+export declare function need(p: PluginContext, spec: CredentialSpec): string;
+/** A boolean flag (`--factors`). */
+export declare function flag(p: PluginContext, name: string): boolean;
+/** A local file named by a credential spec (flag or env var), as text or bytes; undefined when not given. */
+export declare function localFile(p: PluginContext, spec: CredentialSpec, as: 'text'): string | undefined;
+export declare function localFile(p: PluginContext, spec: CredentialSpec, as: 'bytes'): Buffer | undefined;
+/** A vendor host (`acme.us.auth0.com`) from a host or URL. */
+export declare function hostOf(raw: string): string;
+/** Vendor errors become CLI errors with the vendor's own words (never a stack). */
+export declare function vendorStep<T>(label: string, fn: () => Promise<T>): Promise<T>;

package/dist/migrate/export/plugin-kit.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeRecordSet = writeRecordSet;
+exports.need = need;
+exports.flag = flag;
+exports.localFile = localFile;
+exports.hostOf = hostOf;
+exports.vendorStep = vendorStep;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+/**
+ * What every vendor plugin shares: replaying an exporter's {@link RecordSet}
+ * through the framework's bundle writer, and reading the owner's local files
+ * and flags.
+ */
+/** Records between two export checkpoints. */
+const CHECKPOINT_EVERY = 1000;
+/**
+ * Write a vendor export through the sealed-bundle writer: the manifest fields
+ * and warnings the exporter learned, what it had to leave out, then every
+ * record in canonical order. On `--resume` the vendor is read again and the
+ * records an earlier segment already holds are skipped (vendor listings are
+ * returned in a stable order).
+ */
+async function writeRecordSet(set, writer, resume, say) {
+    const start = typeof resume.cursor === 'number' ? resume.cursor : 0;
+    writer.describe(set.manifest);
+    for (const w of set.warnings)
+        writer.warn(w);
+    if (!start)
+        for (const [model, o] of Object.entries(set.omitted))
+            writer.omit(model, o.reason, o.count);
+    if (start)
+        say(`  resuming after record ${start}`);
+    let i = 0;
+    for (const r of set.ordered()) {
+        i++;
+        if (i <= start)
+            continue;
+        const issues = await writer.add(r.model, r.data);
+        if (issues.length)
+            say(`  left out ${r.model} #${i}: ${issues[0].message}`);
+        if (i % CHECKPOINT_EVERY === 0)
+            resume.checkpoint(i);
+    }
+}
+/** A credential, or a CliError naming every way to pass it. */
+function need(p, spec) {
+    return p.credential({ ...spec, required: true });
+}
+/** A boolean flag (`--factors`). */
+function flag(p, name) {
+    return p.args.values[name] === true;
+}
+function localFile(p, spec, as) {
+    const path = p.credential({ ...spec, required: false });
+    if (!path)
+        return undefined;
+    try {
+        return as === 'text' ? p.ctx.readFile((0, node_path_1.resolve)(path)) : (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(path));
+    }
+    catch (err) {
+        throw new errors_1.CliError(`Could not read ${spec.label} at ${path}: ${err.message}`);
+    }
+}
+/** A vendor host (`acme.us.auth0.com`) from a host or URL. */
+function hostOf(raw) {
+    return raw.trim().replace(/^https?:\/\//, '').replace(/[/?#].*$/, '');
+}
+/** Vendor errors become CLI errors with the vendor's own words (never a stack). */
+async function vendorStep(label, fn) {
+    try {
+        return await fn();
+    }
+    catch (err) {
+        if (err instanceof errors_1.CliError)
+            throw err;
+        throw new errors_1.CliError(`${label}: ${err.message}`);
+    }
+}
+//# sourceMappingURL=plugin-kit.js.map

package/dist/migrate/export/plugin-kit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-kit.js","sourceRoot":"","sources":["../../../src/migrate/export/plugin-kit.ts"],"names":[],"mappings":";;AAuBA,wCAmBC;AAGD,oBAEC;AAGD,oBAEC;AAKD,8BAQC;AAGD,wBAEC;AAGD,gCAOC;AAhFD,qCAAuC;AACvC,yCAAoC;AAEpC,yCAAwC;AAIxC;;;;GAIG;AAEH,8CAA8C;AAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;;GAMG;AACI,KAAK,UAAU,cAAc,CAClC,GAAc,EACd,MAA6B,EAC7B,MAA+E,EAC/E,GAA2B;IAE3B,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACxG,IAAI,KAAK;QAAE,GAAG,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9B,CAAC,EAAE,CAAC;QACJ,IAAI,CAAC,IAAI,KAAK;YAAE,SAAS;QACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAa,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,gBAAgB,KAAK,CAAC;YAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,SAAgB,IAAI,CAAC,CAAgB,EAAE,IAAoB;IACzD,OAAO,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;AACpD,CAAC;AAED,oCAAoC;AACpC,SAAgB,IAAI,CAAC,CAAgB,EAAE,IAAY;IACjD,OAAQ,CAAC,CAAC,IAAI,CAAC,MAAkC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACnE,CAAC;AAKD,SAAgB,SAAS,CAAC,CAAgB,EAAE,IAAoB,EAAE,EAAoB;IACpF,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,kBAAkB,IAAI,CAAC,KAAK,OAAO,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAgB,MAAM,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,UAAU,CAAI,KAAa,EAAE,EAAoB;IACrE,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAQ;YAAE,MAAM,GAAG,CAAC;QACvC,MAAM,IAAI,iBAAQ,CAAC,GAAG,KAAK,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/migrate/export/record-set.d.ts

@@ -0,0 +1,44 @@
+import { type CanonicalModel, type CanonicalRecordData, type MigrationManifest } from '@atlasauth/migrate';
+/**
+ * What a vendor exporter gathered, grouped by canonical model. A vendor API
+ * hands data back in ITS order (users carry their identities, organizations
+ * their members); the bundle needs canonical order, so exporters collect here
+ * and the writer replays {@link RecordSet.ordered}.
+ */
+export declare class RecordSet {
+    private readonly rows;
+    private readonly seen;
+    readonly warnings: string[];
+    readonly omitted: Record<string, {
+        count: number;
+        reason: string;
+    }>;
+    /** Manifest fields the exporter learned (origin, providers, settings, rpId). */
+    manifest: Partial<Pick<MigrationManifest, 'origin' | 'sourceVersion' | 'rpId' | 'providers' | 'settings'>>;
+    /**
+     * Add a row. With `key`, a second row with the same key is dropped (a member
+     * reached through two listings, a role seen on two organizations).
+     */
+    add<M extends CanonicalModel>(model: M, data: CanonicalRecordData[M], key?: string): void;
+    warn(message: string): void;
+    omit(model: string, reason: string, count?: number): void;
+    count(model: CanonicalModel): number;
+    list<M extends CanonicalModel>(model: M): Array<CanonicalRecordData[M]>;
+    /** Every row, in the order the bundle writer requires. */
+    ordered(): Generator<{
+        model: CanonicalModel;
+        data: unknown;
+    }>;
+    counts(): Record<string, number>;
+}
+export type Obj = Record<string, unknown>;
+export declare const isObj: (v: unknown) => v is Obj;
+export declare const str: (v: unknown) => string | undefined;
+export declare const objs: (v: unknown) => Obj[];
+export declare const strs: (v: unknown) => string[];
+/** A metadata bag, only when it has keys. */
+export declare const bag: (v: unknown) => Obj | undefined;
+/** E.164 or nothing: vendors store numbers with spaces/dashes; anything else is dropped. */
+export declare function e164(raw: unknown): string | undefined;
+/** Drop undefined fields so a record carries only what the vendor had. */
+export declare function compact<T extends object>(o: T): T;

package/dist/migrate/export/record-set.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bag = exports.strs = exports.objs = exports.str = exports.isObj = exports.RecordSet = void 0;
+exports.e164 = e164;
+exports.compact = compact;
+const migrate_1 = require("@atlasauth/migrate");
+/**
+ * What a vendor exporter gathered, grouped by canonical model. A vendor API
+ * hands data back in ITS order (users carry their identities, organizations
+ * their members); the bundle needs canonical order, so exporters collect here
+ * and the writer replays {@link RecordSet.ordered}.
+ */
+class RecordSet {
+    rows = new Map();
+    seen = new Map();
+    warnings = [];
+    omitted = {};
+    /** Manifest fields the exporter learned (origin, providers, settings, rpId). */
+    manifest = {};
+    /**
+     * Add a row. With `key`, a second row with the same key is dropped (a member
+     * reached through two listings, a role seen on two organizations).
+     */
+    add(model, data, key) {
+        if (key !== undefined) {
+            const keys = this.seen.get(model) ?? new Set();
+            if (keys.has(key))
+                return;
+            keys.add(key);
+            this.seen.set(model, keys);
+        }
+        const list = this.rows.get(model) ?? [];
+        list.push(data);
+        this.rows.set(model, list);
+    }
+    warn(message) {
+        if (!this.warnings.includes(message))
+            this.warnings.push(message);
+    }
+    omit(model, reason, count = 1) {
+        const o = this.omitted[model] ?? { count: 0, reason };
+        o.count += count;
+        this.omitted[model] = o;
+    }
+    count(model) {
+        return this.rows.get(model)?.length ?? 0;
+    }
+    list(model) {
+        return (this.rows.get(model) ?? []);
+    }
+    /** Every row, in the order the bundle writer requires. */
+    *ordered() {
+        for (const model of migrate_1.CANONICAL_MODEL_ORDER) {
+            for (const data of this.rows.get(model) ?? [])
+                yield { model, data };
+        }
+    }
+    counts() {
+        const out = {};
+        for (const model of migrate_1.CANONICAL_MODEL_ORDER) {
+            const n = this.rows.get(model)?.length ?? 0;
+            if (n)
+                out[model] = n;
+        }
+        return out;
+    }
+}
+exports.RecordSet = RecordSet;
+const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+exports.isObj = isObj;
+const str = (v) => typeof v === 'string' && v.trim() ? v.trim() : typeof v === 'number' && Number.isFinite(v) ? String(v) : undefined;
+exports.str = str;
+const objs = (v) => (Array.isArray(v) ? v.filter(exports.isObj) : []);
+exports.objs = objs;
+const strs = (v) => Array.isArray(v) ? v.map((x) => (0, exports.str)(x)).filter((x) => x !== undefined) : [];
+exports.strs = strs;
+/** A metadata bag, only when it has keys. */
+const bag = (v) => ((0, exports.isObj)(v) && Object.keys(v).length > 0 ? v : undefined);
+exports.bag = bag;
+/** E.164 or nothing: vendors store numbers with spaces/dashes; anything else is dropped. */
+function e164(raw) {
+    const s = (0, exports.str)(raw);
+    if (!s)
+        return undefined;
+    const digits = s.replace(/[\s().-]/g, '');
+    const withPlus = digits.startsWith('+') ? digits : digits.startsWith('00') ? `+${digits.slice(2)}` : `+${digits}`;
+    return /^\+[1-9]\d{6,14}$/.test(withPlus) ? withPlus : undefined;
+}
+/** Drop undefined fields so a record carries only what the vendor had. */
+function compact(o) {
+    for (const k of Object.keys(o)) {
+        const v = o[k];
+        if (v === undefined || (Array.isArray(v) && v.length === 0))
+            delete o[k];
+    }
+    return o;
+}
+//# sourceMappingURL=record-set.js.map

package/dist/migrate/export/record-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-set.js","sourceRoot":"","sources":["../../../src/migrate/export/record-set.ts"],"names":[],"mappings":";;;AAoFA,oBAMC;AAED,0BAMC;AAlGD,gDAK4B;AAE5B;;;;;GAKG;AACH,MAAa,SAAS;IACH,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC5C,IAAI,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,QAAQ,GAAa,EAAE,CAAC;IACxB,OAAO,GAAsD,EAAE,CAAC;IACzE,gFAAgF;IAChF,QAAQ,GAAqG,EAAE,CAAC;IAEhH;;;OAGG;IACH,GAAG,CAA2B,KAAQ,EAAE,IAA4B,EAAE,GAAY;QAChF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,KAAa,EAAE,MAAc,EAAE,KAAK,GAAG,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACtD,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAqB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,CAA2B,KAAQ;QACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAkC,CAAC;IACvE,CAAC;IAED,0DAA0D;IAC1D,CAAC,OAAO;QACN,KAAK,MAAM,KAAK,IAAI,+BAAqB,EAAE,CAAC;YAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAED,MAAM;QACJ,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,+BAAqB,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAzDD,8BAyDC;AAKM,MAAM,KAAK,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAA3F,QAAA,KAAK,SAAsF;AACjG,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CACpD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AADxG,QAAA,GAAG,OACqG;AAC9G,MAAM,IAAI,GAAG,CAAC,CAAU,EAAS,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAAxE,QAAA,IAAI,QAAoE;AAC9E,MAAM,IAAI,GAAG,CAAC,CAAU,EAAY,EAAE,CAC3C,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,WAAG,EAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAD9E,QAAA,IAAI,QAC0E;AAC3F,6CAA6C;AACtC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAmB,EAAE,CAAC,CAAC,IAAA,aAAK,EAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAA/F,QAAA,GAAG,OAA4F;AAC5G,4FAA4F;AAC5F,SAAgB,IAAI,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;IAClH,OAAO,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AACD,0EAA0E;AAC1E,SAAgB,OAAO,CAAmB,CAAI;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAmB,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}