@atlasauth/cli 0.11.0 → 0.12.0

package/dist/migrate/export/clerk.js

@@ -0,0 +1,486 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportClerk = exportClerk;
+exports.clerkPasswordHash = clerkPasswordHash;
+exports.roleKey = roleKey;
+exports.permissionKey = permissionKey;
+const node_crypto_1 = require("node:crypto");
+const csv_1 = require("../../import/csv");
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+const PAGE = 500;
+async function exportClerk(opts) {
+    const set = new record_set_1.RecordSet();
+    if (!opts.secretKey && !opts.csv)
+        throw new Error('Clerk export needs the secret key (CLERK_SECRET_KEY) or the dashboard CSV export.');
+    const csvRows = opts.csv ? (0, csv_1.parseCsv)(opts.csv) : [];
+    const csvById = new Map(csvRows.filter((r) => (0, record_set_1.str)(r.id)).map((r) => [r.id, r]));
+    if (!opts.secretKey) {
+        // CSV only: users, passwords and TOTP — no orgs, social accounts or metadata.
+        set.warn('Exported from the dashboard CSV only: organizations, social accounts and metadata need the Backend API (pass the secret key).');
+        for (const row of csvRows)
+            addCsvUser(set, row);
+        finishManifest(set, null);
+        return set;
+    }
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'Clerk',
+        baseUrl: opts.apiUrl ?? 'https://api.clerk.com',
+        headers: { authorization: `Bearer ${opts.secretKey}` },
+        fetchImpl: opts.fetchImpl,
+        sleep: opts.sleep,
+    });
+    const progress = opts.onProgress ?? (() => undefined);
+    // Organizations first: memberships and invitations point at them.
+    progress('organizations');
+    const orgs = await listAll(http, '/v1/organizations?include_members_count=false');
+    for (const o of orgs) {
+        const id = (0, record_set_1.str)(o.id);
+        const name = (0, record_set_1.str)(o.name);
+        if (!id || !name)
+            continue;
+        const domains = await optionalList(http, `/v1/organizations/${id}/domains`);
+        set.add('organization', (0, record_set_1.compact)({
+            id,
+            name,
+            slug: (0, record_set_1.str)(o.slug),
+            image_url: (0, record_set_1.str)(o.image_url),
+            domains: domains.filter((d) => (0, record_set_1.isObj)(d.verification) && d.verification.status === 'verified').map((d) => (0, record_set_1.str)(d.name)).filter((d) => !!d),
+            max_members: typeof o.max_allowed_memberships === 'number' && o.max_allowed_memberships > 0 ? o.max_allowed_memberships : undefined,
+            public_metadata: (0, record_set_1.bag)(o.public_metadata),
+            private_metadata: (0, record_set_1.bag)(o.private_metadata),
+            created_at: typeof o.created_at === 'number' ? o.created_at : undefined,
+        }));
+    }
+    progress('roles');
+    for (const r of await optionalList(http, '/v1/organization_roles')) {
+        const key = (0, record_set_1.str)(r.key);
+        if (!key)
+            continue;
+        set.add('role', (0, record_set_1.compact)({
+            key: roleKey(key),
+            name: (0, record_set_1.str)(r.name),
+            description: (0, record_set_1.str)(r.description),
+            scope: 'organization',
+            permissions: (0, record_set_1.objs)(r.permissions).map((p) => (0, record_set_1.str)(p.key)).filter((p) => !!p).map(permissionKey),
+        }), key);
+    }
+    progress('users');
+    const users = await listAll(http, '/v1/users?order_by=%2Bcreated_at');
+    const apiIds = new Set();
+    for (const u of users) {
+        const id = (0, record_set_1.str)(u.id);
+        if (!id)
+            continue;
+        apiIds.add(id);
+        addApiUser(set, u, csvById.get(id));
+    }
+    // A CSV row the API no longer lists (deleted since the export) is skipped.
+    const stale = csvRows.filter((r) => (0, record_set_1.str)(r.id) && !apiIds.has(r.id)).length;
+    if (stale)
+        set.omit('user', 'in the CSV export but no longer in Clerk (deleted since)', stale);
+    if (!opts.csv && users.some((u) => u.password_enabled === true)) {
+        set.warn('No password digests: Clerk only exports them in the dashboard CSV (Users → Export). Pass it with --clerk-csv, or enable lazy migration so passwords move on first sign-in.');
+    }
+    progress('memberships');
+    for (const o of orgs) {
+        const orgId = (0, record_set_1.str)(o.id);
+        if (!orgId)
+            continue;
+        for (const m of await listAll(http, `/v1/organizations/${orgId}/memberships`)) {
+            const userId = (0, record_set_1.str)((0, record_set_1.isObj)(m.public_user_data) ? m.public_user_data.user_id : undefined);
+            const role = (0, record_set_1.str)(m.role);
+            if (!userId || !role || !apiIds.has(userId))
+                continue;
+            set.add('membership', (0, record_set_1.compact)({ id: (0, record_set_1.str)(m.id), organization_id: orgId, user_id: userId, role: roleKey(role), created_at: num(m.created_at) }), `${orgId}:${userId}`);
+        }
+    }
+    progress('invitations');
+    for (const o of orgs) {
+        const orgId = (0, record_set_1.str)(o.id);
+        if (!orgId)
+            continue;
+        for (const inv of await listAll(http, `/v1/organizations/${orgId}/invitations?status=pending`)) {
+            const id = (0, record_set_1.str)(inv.id);
+            const email = (0, record_set_1.str)(inv.email_address);
+            if (!id || !email)
+                continue;
+            set.add('invitation', (0, record_set_1.compact)({ id, organization_id: orgId, email, role: (0, record_set_1.str)(inv.role) ? roleKey((0, record_set_1.str)(inv.role)) : undefined, status: 'pending', expires_at: num(inv.expires_at), created_at: num(inv.created_at) }));
+        }
+    }
+    for (const inv of await optionalList(http, '/v1/invitations?status=pending')) {
+        const id = (0, record_set_1.str)(inv.id);
+        const email = (0, record_set_1.str)(inv.email_address);
+        if (id && email)
+            set.add('invitation', (0, record_set_1.compact)({ id, email, status: 'pending', expires_at: num(inv.expires_at), created_at: num(inv.created_at) }));
+    }
+    if (!opts.skipApiKeys) {
+        progress('api keys');
+        await addApiKeys(set, http, apiIds, new Set(orgs.map((o) => (0, record_set_1.str)(o.id)).filter((x) => !!x)));
+    }
+    progress('enterprise connections');
+    await addSsoConnections(set, http);
+    progress('signing keys');
+    const jwks = await optionalGet(http, '/v1/jwks');
+    for (const k of (0, record_set_1.objs)(jwks?.keys)) {
+        const kid = (0, record_set_1.str)(k.kid);
+        if (kid)
+            set.add('jwks', { kid, jwk: k });
+    }
+    finishManifest(set, opts.apiUrl ?? 'https://api.clerk.com');
+    return set;
+}
+function finishManifest(set, origin) {
+    const providers = new Set(set.list('identity').map((i) => i.provider));
+    set.manifest = { ...set.manifest, origin, providers: [...providers].sort() };
+    set.warn('Clerk does not export passkeys or backup codes: those users register a passkey / new codes after the move.');
+}
+// ── users ───────────────────────────────────────────────────────────────────
+function addApiUser(set, u, csv) {
+    const id = (0, record_set_1.str)(u.id);
+    const emails = (0, record_set_1.objs)(u.email_addresses)
+        .filter((e) => (0, record_set_1.str)(e.email_address))
+        .map((e) => ({
+        email: (0, record_set_1.str)(e.email_address).toLowerCase(),
+        verified: (0, record_set_1.isObj)(e.verification) && e.verification.status === 'verified',
+        primary: e.id === u.primary_email_address_id,
+    }));
+    const phones = (0, record_set_1.objs)(u.phone_numbers)
+        .map((p) => ({ phone: (0, record_set_1.e164)(p.phone_number), verified: (0, record_set_1.isObj)(p.verification) && p.verification.status === 'verified', primary: p.id === u.primary_phone_number_id }))
+        .filter((p) => !!p.phone);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails,
+        phones,
+        username: (0, record_set_1.str)(u.username),
+        first_name: (0, record_set_1.str)(u.first_name),
+        last_name: (0, record_set_1.str)(u.last_name),
+        image_url: u.has_image === false ? undefined : (0, record_set_1.str)(u.image_url),
+        banned: u.banned === true ? true : undefined,
+        locked: u.locked === true ? true : undefined,
+        public_metadata: (0, record_set_1.bag)(u.public_metadata),
+        private_metadata: (0, record_set_1.bag)(u.private_metadata),
+        unsafe_metadata: (0, record_set_1.bag)(u.unsafe_metadata),
+        created_at: num(u.created_at),
+        last_sign_in_at: num(u.last_sign_in_at),
+    });
+    if (csv)
+        attachCsvPassword(set, user, csv);
+    else if (u.password_enabled === true)
+        set.omit('password', 'password digests are only in the dashboard CSV export');
+    if (!user.emails?.length && !user.phones?.length && !user.username) {
+        // A web3-wallet-only user: Clerk's wallet sign-in has no Atlas identifier to carry.
+        set.omit('user', 'no email, phone or username (wallet-only users)');
+        return;
+    }
+    set.add('user', user);
+    for (const ext of (0, record_set_1.objs)(u.external_accounts)) {
+        const provider = (0, record_set_1.str)(ext.provider);
+        const sub = (0, record_set_1.str)(ext.provider_user_id) ?? (0, record_set_1.str)(ext.external_id);
+        if (!provider || !sub)
+            continue;
+        set.add('identity', (0, record_set_1.compact)({
+            id: (0, record_set_1.str)(ext.id),
+            user_id: id,
+            provider,
+            provider_user_id: sub,
+            kind: 'oauth',
+            email: (0, record_set_1.str)(ext.email_address),
+            email_verified: (0, record_set_1.isObj)(ext.verification) ? ext.verification.status === 'verified' : undefined,
+            scopes: (0, record_set_1.str)(ext.approved_scopes)?.split(/\s+/),
+            profile: (0, record_set_1.bag)((0, record_set_1.compact)({ first_name: (0, record_set_1.str)(ext.first_name), last_name: (0, record_set_1.str)(ext.last_name), image_url: (0, record_set_1.str)(ext.image_url), username: (0, record_set_1.str)(ext.username) })),
+        }));
+    }
+    for (const ent of [...(0, record_set_1.objs)(u.enterprise_accounts), ...(0, record_set_1.objs)(u.saml_accounts)]) {
+        const conn = (0, record_set_1.isObj)(ent.enterprise_connection) ? ent.enterprise_connection : (0, record_set_1.isObj)(ent.saml_connection) ? ent.saml_connection : undefined;
+        const sub = (0, record_set_1.str)(ent.provider_user_id);
+        if (!sub || ent.active === false)
+            continue;
+        set.add('identity', (0, record_set_1.compact)({
+            id: (0, record_set_1.str)(ent.id),
+            user_id: id,
+            provider: (0, record_set_1.str)(ent.provider) ?? 'saml',
+            provider_user_id: sub,
+            kind: (0, record_set_1.str)(ent.protocol) === 'oauth' || (0, record_set_1.str)(ent.provider)?.startsWith('oidc') ? 'oidc' : 'saml',
+            sso_connection_id: (0, record_set_1.str)(conn?.id),
+            email: (0, record_set_1.str)(ent.email_address),
+        }), `ent:${(0, record_set_1.str)(ent.id) ?? sub}`);
+    }
+    const totp = csv ? (0, record_set_1.str)(csv.totp_secret) : undefined;
+    if (totp)
+        set.add('mfa_factor', { user_id: id, type: 'totp', secret_base32: totp.replace(/\s+/g, '').toUpperCase(), digits: 6, period: 30, algorithm: 'SHA1', verified: true });
+    else if (u.totp_enabled === true)
+        set.omit('mfa_factor', 'TOTP secrets are only in the dashboard CSV export');
+    if (u.backup_code_enabled === true)
+        set.omit('mfa_factor', 'Clerk does not export backup codes');
+    if ((0, record_set_1.objs)(u.passkeys).length)
+        set.omit('passkey', 'Clerk does not export passkey public keys', (0, record_set_1.objs)(u.passkeys).length);
+}
+/** A user from the CSV alone (no API access). */
+function addCsvUser(set, r) {
+    const id = (0, record_set_1.str)(r.id);
+    if (!id)
+        return;
+    const verified = split(r.verified_email_addresses);
+    const unverified = split(r.unverified_email_addresses);
+    const primary = (0, record_set_1.str)(r.primary_email_address)?.toLowerCase();
+    const emails = [...new Set([...(primary ? [primary] : []), ...verified, ...unverified].map((e) => e.toLowerCase()))].map((email) => ({
+        email,
+        verified: verified.map((e) => e.toLowerCase()).includes(email),
+        primary: email === primary,
+    }));
+    const vPhones = split(r.verified_phone_numbers);
+    const phones = [...new Set([(0, record_set_1.str)(r.primary_phone_number), ...vPhones, ...split(r.unverified_phone_numbers)].filter((p) => !!p))]
+        .map((p) => ({ phone: (0, record_set_1.e164)(p), verified: vPhones.includes(p), primary: p === (0, record_set_1.str)(r.primary_phone_number) }))
+        .filter((p) => !!p.phone);
+    const user = (0, record_set_1.compact)({ id, emails, phones, username: (0, record_set_1.str)(r.username), first_name: (0, record_set_1.str)(r.first_name), last_name: (0, record_set_1.str)(r.last_name) });
+    attachCsvPassword(set, user, r);
+    if (!user.emails?.length && !user.phones?.length && !user.username) {
+        set.omit('user', 'no email, phone or username');
+        return;
+    }
+    set.add('user', user);
+    const totp = (0, record_set_1.str)(r.totp_secret);
+    if (totp)
+        set.add('mfa_factor', { user_id: id, type: 'totp', secret_base32: totp.replace(/\s+/g, '').toUpperCase(), digits: 6, period: 30, algorithm: 'SHA1', verified: true });
+}
+function attachCsvPassword(set, user, r) {
+    const digest = (0, record_set_1.str)(r.password_digest);
+    if (!digest)
+        return;
+    const mapped = clerkPasswordHash((0, record_set_1.str)(r.password_hasher) ?? 'bcrypt', digest);
+    if ('reason' in mapped) {
+        set.omit('password', mapped.reason);
+        return;
+    }
+    user.password = mapped;
+}
+const split = (v) => (v ?? '').split(/[|,;]/).map((s) => s.trim()).filter(Boolean);
+/**
+ * A Clerk `password_digest` + `password_hasher` → the bundle's password hash
+ * (an Atlas hash-registry algorithm with its parameters). Formats per Clerk's
+ * `createUser` reference. Returns a reason when the digest cannot move: those
+ * users sign in through lazy migration (Clerk's verify_password) instead.
+ */
+function clerkPasswordHash(hasher, digest) {
+    const h = hasher.trim().toLowerCase();
+    const parts = digest.split('$');
+    const int = (v) => (v && /^\d+$/.test(v) ? Number(v) : NaN);
+    const isHex = (v) => v.length % 2 === 0 && /^[0-9a-f]+$/i.test(v);
+    switch (h) {
+        case 'bcrypt':
+            return { algorithm: 'bcrypt', hash: digest };
+        case 'bcrypt_sha256_django':
+            return { algorithm: 'bcrypt_sha256_django', hash: digest };
+        case 'argon2i':
+        case 'argon2id':
+            return { algorithm: 'argon2', hash: digest };
+        case 'phpass':
+        case 'md5_phpass':
+            return { algorithm: 'phpass', hash: digest };
+        case 'ldap_ssha':
+            return { algorithm: 'ldap_ssha', hash: digest };
+        case 'md5':
+        case 'sha256':
+            return /^[0-9a-f]+$/i.test(digest) ? { algorithm: h, hash: digest.toLowerCase(), params: { encoding: 'hex' } } : { reason: `${h} digest is not hex` };
+        case 'md5_salted':
+        case 'sha256_salted':
+            // Clerk does not document whether the salt is prepended or appended; a
+            // guess that is wrong would lock the user out, so these verify lazily.
+            return { reason: `${h}: Clerk does not document the salt position; these users move through lazy migration` };
+        case 'pbkdf2_sha256_django':
+            return { algorithm: 'pbkdf2_django', hash: digest };
+        case 'pbkdf2_sha256': {
+            // pbkdf2_sha256$<iterations>$<base64 salt>$<base64 hash>
+            const [, it, salt, hash] = parts;
+            if (parts.length !== 4 || !Number.isFinite(int(it)) || !salt || !hash)
+                return { reason: 'malformed pbkdf2_sha256 digest' };
+            return { algorithm: 'pbkdf2', hash, salt, params: { digest: 'sha256', iterations: int(it), encoding: 'base64', salt_encoding: 'base64' } };
+        }
+        case 'pbkdf2_sha1': {
+            // pbkdf2_sha1$<iterations>$<salt>$<hex hash>[$<key length>]; the salt is
+            // hex when it parses as hex, raw bytes otherwise.
+            const [, it, salt, hash, keylen] = parts;
+            if ((parts.length !== 4 && parts.length !== 5) || !Number.isFinite(int(it)) || !salt || !hash || !isHex(hash))
+                return { reason: 'malformed pbkdf2_sha1 digest' };
+            const params = { digest: 'sha1', iterations: int(it), encoding: 'hex', salt_encoding: isHex(salt) ? 'hex' : 'utf8' };
+            if (keylen && Number.isFinite(int(keylen)))
+                params.key_length = int(keylen);
+            return { algorithm: 'pbkdf2', hash, salt, params };
+        }
+        case 'pbkdf2_sha512':
+        case 'pbkdf2_sha512_hex': {
+            const [, it, salt, hash] = parts;
+            if (parts.length !== 4 || !Number.isFinite(int(it)) || !salt || !hash || !isHex(hash))
+                return { reason: `malformed ${h} digest` };
+            return { algorithm: 'pbkdf2', hash, salt, params: { digest: 'sha512', iterations: int(it), encoding: 'hex', salt_encoding: h === 'pbkdf2_sha512_hex' ? 'hex' : 'utf8' } };
+        }
+        case 'scrypt_firebase': {
+            // <hash>$<salt>$<signer key>$<salt separator>$<rounds>$<memory cost>
+            const [hash, salt, signerKey, saltSeparator, rounds, mem] = parts;
+            if (parts.length !== 6 || !hash || !signerKey)
+                return { reason: 'malformed scrypt_firebase digest' };
+            return {
+                algorithm: 'scrypt_firebase',
+                hash,
+                salt: salt ?? '',
+                params: { signer_key: signerKey, salt_separator: saltSeparator ?? '', rounds: int(rounds), mem_cost: int(mem) },
+            };
+        }
+        case 'scrypt_werkzeug': {
+            // Werkzeug writes `scrypt:N:r:p$salt$<hex>`; Clerk documents the layout with
+            // a leading `$` and a base64 hash. Normalise to Werkzeug's own form.
+            const m = /^\$?(scrypt:\d+:\d+:\d+)\$([^$]+)\$([^$]+)$/.exec(digest);
+            if (!m)
+                return { reason: 'malformed scrypt_werkzeug digest' };
+            const hex = isHex(m[3]) ? m[3].toLowerCase() : Buffer.from(m[3], 'base64').toString('hex');
+            return hex ? { algorithm: 'scrypt_werkzeug', hash: `${m[1]}$${m[2]}$${hex}` } : { reason: 'malformed scrypt_werkzeug digest' };
+        }
+        case 'sha512_symfony': {
+            // sha512_symfony$<iterations>$<salt>$<base64 hash>
+            const [, it, salt, hash] = parts;
+            if (parts.length !== 4 || !Number.isFinite(int(it)) || salt === undefined || !hash)
+                return { reason: 'malformed sha512_symfony digest' };
+            return { algorithm: 'sha512_symfony', hash, salt, params: { iterations: int(it), encoding: 'base64' } };
+        }
+        case 'bcrypt_peppered':
+            return { reason: 'bcrypt_peppered: the pepper never leaves Clerk; these users move through lazy migration' };
+        case 'awscognito':
+            return { reason: 'awscognito: the password still lives in Amazon Cognito; these users move through lazy migration' };
+        default:
+            return { reason: `password hasher "${hasher}" is not supported; these users move through lazy migration` };
+    }
+}
+// ── organizations, keys, connections ────────────────────────────────────────
+/** Clerk role keys carry an `org:` prefix; the bundle uses the bare key. */
+function roleKey(key) {
+    return key.replace(/^org:/, '');
+}
+/** `org:invoices:read` → `invoices:read`; system permissions keep their `sys_` key. */
+function permissionKey(key) {
+    return key.replace(/^org:/, '');
+}
+async function addApiKeys(set, http, users, orgs) {
+    let keys;
+    try {
+        keys = await listAll(http, '/v1/api_keys', 100);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && (err.status === 404 || err.status === 403))
+            return;
+        throw err;
+    }
+    for (const k of keys) {
+        const id = (0, record_set_1.str)(k.id);
+        const subject = (0, record_set_1.str)(k.subject);
+        if (!id || !subject || k.revoked === true)
+            continue;
+        // Clerk returns the secret on request: Atlas stores only its sha256, so
+        // the key keeps working after the move.
+        const secret = await optionalGet(http, `/v1/api_keys/${id}/secret`);
+        const value = (0, record_set_1.str)(secret?.secret);
+        if (!value) {
+            set.omit('api_key', 'secret not retrievable; reissue');
+            continue;
+        }
+        set.add('api_key', (0, record_set_1.compact)({
+            id,
+            user_id: users.has(subject) ? subject : undefined,
+            organization_id: orgs.has(subject) ? subject : undefined,
+            name: (0, record_set_1.str)(k.name),
+            hash: (0, node_crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex'),
+            hash_algorithm: 'sha256',
+            start: value.slice(0, 8),
+            scopes: (0, record_set_1.strs)(k.scopes),
+            expires_at: num(k.expiration),
+            last_used_at: num(k.last_used_at),
+            created_at: num(k.created_at),
+        }));
+    }
+}
+async function addSsoConnections(set, http) {
+    let conns = await optionalList(http, '/v1/enterprise_connections');
+    if (!conns.length)
+        conns = await optionalList(http, '/v1/saml_connections');
+    for (const c of conns) {
+        const id = (0, record_set_1.str)(c.id);
+        if (!id)
+            continue;
+        const saml = (0, record_set_1.isObj)(c.saml_connection) ? c.saml_connection : c;
+        const oidc = (0, record_set_1.isObj)(c.oauth_config) ? c.oauth_config : (0, record_set_1.isObj)(c.oidc_connection) ? c.oidc_connection : undefined;
+        const protocol = oidc && !(0, record_set_1.str)(saml.idp_sso_url) ? 'oidc' : 'saml';
+        const domains = [...(0, record_set_1.strs)(c.domains), ...((0, record_set_1.str)(c.domain) ? [(0, record_set_1.str)(c.domain)] : [])];
+        const mapping = (0, record_set_1.isObj)(saml.attribute_mapping) ? saml.attribute_mapping : undefined;
+        set.add('sso_connection', (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(c.name),
+            organization_id: (0, record_set_1.str)(c.organization_id),
+            protocol: protocol,
+            domains: [...new Set(domains)],
+            enabled: c.active !== false,
+            saml: protocol === 'saml'
+                ? (0, record_set_1.compact)({
+                    idp_entity_id: (0, record_set_1.str)(saml.idp_entity_id),
+                    idp_sso_url: (0, record_set_1.str)(saml.idp_sso_url),
+                    idp_certificate: (0, record_set_1.str)(saml.idp_certificate),
+                    idp_metadata_url: (0, record_set_1.str)(saml.idp_metadata_url),
+                    idp_metadata_xml: (0, record_set_1.str)(saml.idp_metadata),
+                    sp_entity_id: (0, record_set_1.str)(saml.sp_entity_id),
+                    sp_acs_url: (0, record_set_1.str)(saml.acs_url),
+                    attribute_mapping: mapping
+                        ? Object.fromEntries(Object.entries(mapping).filter(([, v]) => typeof v === 'string' && v))
+                        : undefined,
+                })
+                : undefined,
+            oidc: protocol === 'oidc' && oidc
+                ? (0, record_set_1.compact)({ discovery_url: (0, record_set_1.str)(oidc.discovery_url), issuer: (0, record_set_1.str)(oidc.issuer), client_id: (0, record_set_1.str)(oidc.client_id), scopes: (0, record_set_1.str)(oidc.scopes)?.split(/\s+/) })
+                : undefined,
+        }));
+        if (protocol === 'oidc')
+            set.warn(`Enterprise OIDC connection ${(0, record_set_1.str)(c.name) ?? id}: Clerk does not return its client secret; enter it in Atlas after the import.`);
+    }
+}
+// ── paging ──────────────────────────────────────────────────────────────────
+const num = (v) => (typeof v === 'number' && Number.isFinite(v) && v > 0 ? v : undefined);
+/** Clerk lists answer either a bare array or `{ data, total_count }`. */
+function rowsOf(body) {
+    if (Array.isArray(body))
+        return body.filter(record_set_1.isObj);
+    if ((0, record_set_1.isObj)(body) && Array.isArray(body.data))
+        return body.data.filter(record_set_1.isObj);
+    return [];
+}
+async function listAll(http, path, limit = PAGE) {
+    const out = [];
+    const sep = path.includes('?') ? '&' : '?';
+    for (let offset = 0;; offset += limit) {
+        const { body } = await http.get(`${path}${sep}limit=${limit}&offset=${offset}`);
+        const rows = rowsOf(body);
+        out.push(...rows);
+        const total = (0, record_set_1.isObj)(body) && typeof body.total_count === 'number' ? body.total_count : undefined;
+        if (rows.length < limit || (total !== undefined && out.length >= total))
+            return out;
+    }
+}
+/** A list that may not exist on this instance's plan or API version: empty instead of an error. */
+async function optionalList(http, path) {
+    try {
+        return await listAll(http, path);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 402, 403, 404, 410, 422].includes(err.status))
+            return [];
+        throw err;
+    }
+}
+async function optionalGet(http, path) {
+    try {
+        return (await http.get(path)).body;
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 402, 403, 404, 410, 422].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+//# sourceMappingURL=clerk.js.map

package/dist/migrate/export/clerk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clerk.js","sourceRoot":"","sources":["../../../src/migrate/export/clerk.ts"],"names":[],"mappings":";;AAwCA,kCAgIC;AAyID,8CAiFC;AAKD,0BAEC;AAGD,sCAEC;AA9YD,6CAAyC;AAEzC,0CAA4C;AAC5C,6CAA+F;AAC/F,+CAA2D;AAkC3D,MAAM,IAAI,GAAG,GAAG,CAAC;AAEV,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvI,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,cAAQ,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,8EAA8E;QAC9E,GAAG,CAAC,IAAI,CAAC,+HAA+H,CAAC,CAAC;QAC1I,KAAK,MAAM,GAAG,IAAI,OAAO;YAAE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,uBAAuB;QAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE,EAAE;QACtD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEtD,kEAAkE;IAClE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAS;QAC3B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,qBAAqB,EAAE,UAAU,CAAC,CAAC;QAC5E,GAAG,CAAC,GAAG,CACL,cAAc,EACd,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,IAAI;YACJ,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;YACjB,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrJ,WAAW,EAAE,OAAO,CAAC,CAAC,uBAAuB,KAAK,QAAQ,IAAI,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS;YACnI,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC;YACvC,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC;YACzC,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SACxE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,MAAM,YAAY,CAAC,IAAI,EAAE,wBAAwB,CAAC,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAA,oBAAO,EAAC;YACN,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;YACjB,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;YACjB,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;YAC/B,KAAK,EAAE,cAAuB;YAC9B,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;SAC3G,CAAC,EACF,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,kCAAkC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,2EAA2E;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,0DAA0D,EAAE,KAAK,CAAC,CAAC;IAC/F,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CACN,4KAA4K,CAC7K,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,qBAAqB,KAAK,cAAc,CAAC,EAAE,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvF,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,SAAS;YACtD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC;QACvK,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,GAAG,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,qBAAqB,KAAK,6BAA6B,CAAC,EAAE,CAAC;YAC/F,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACrC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK;gBAAE,SAAS;YAC5B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAkB,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACjO,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,YAAY,CAAC,IAAI,EAAE,gCAAgC,CAAC,EAAE,CAAC;QAC7E,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACrC,IAAI,EAAE,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAkB,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/J,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrB,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACnC,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEnC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAmB,IAAI,EAAE,UAAU,CAAC,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,uBAAuB,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAAc,EAAE,MAAqB;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC7E,GAAG,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;AACzH,CAAC;AAED,+EAA+E;AAE/E,SAAS,UAAU,CAAC,GAAc,EAAE,CAAM,EAAE,GAAuC;IACjF,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAE,CAAC;IACtB,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,eAAe,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,KAAK,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,aAAa,CAAE,CAAC,WAAW,EAAE;QAC1C,QAAQ,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,UAAU;QACvE,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,wBAAwB;KAC7C,CAAC,CAAC,CAAC;IACN,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,aAAa,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC;SACnK,MAAM,CAAC,CAAC,CAAC,EAA+D,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzF,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM;QACN,MAAM;QACN,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;QACzB,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC3B,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC5C,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC;QACvC,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC;QACzC,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC;QACvC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,GAAG;QAAE,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;SACtC,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,uDAAuD,CAAC,CAAC;IACpH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnE,oFAAoF;QACpF,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEtB,KAAK,MAAM,GAAG,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG;YAAE,SAAS;QAChC,GAAG,CAAC,GAAG,CACL,UAAU,EACV,IAAA,oBAAO,EAAiB;YACtB,EAAE,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC;YACf,OAAO,EAAE,EAAE;YACX,QAAQ;YACR,gBAAgB,EAAE,GAAG;YACrB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,aAAa,CAAC;YAC7B,cAAc,EAAE,IAAA,kBAAK,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS;YAC5F,MAAM,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC;YAC9C,OAAO,EAAE,IAAA,gBAAG,EAAC,IAAA,oBAAO,EAAC,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;SACtJ,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QACzI,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;YAAE,SAAS;QAC3C,GAAG,CAAC,GAAG,CACL,UAAU,EACV,IAAA,oBAAO,EAAiB;YACtB,EAAE,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC;YACf,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM;YACrC,gBAAgB,EAAE,GAAG;YACrB,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC9F,iBAAiB,EAAE,IAAA,gBAAG,EAAC,IAAI,EAAE,EAAE,CAAC;YAChC,KAAK,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,aAAa,CAAC;SAC9B,CAAC,EACF,OAAO,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,CAC5B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,IAAI,IAAI;QAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;SAC3K,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,mDAAmD,CAAC,CAAC;IAC9G,IAAI,CAAC,CAAC,mBAAmB,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IACjG,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,2CAA2C,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;AACzH,CAAC;AAED,iDAAiD;AACjD,SAAS,UAAU,CAAC,GAAc,EAAE,CAAyB;IAC3D,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnI,KAAK;QACL,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9D,OAAO,EAAE,KAAK,KAAK,OAAO;KAC3B,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACzI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,IAAA,gBAAG,EAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;SAC3G,MAAM,CAAC,CAAC,CAAC,EAA+D,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzF,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChJ,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAChC,IAAI,IAAI;QAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAClL,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAc,EAAE,IAAgB,EAAE,CAAyB;IACpF,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,IAAI,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7E,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;AACzB,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAY,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAEjH;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC/C,KAAK,sBAAsB;YACzB,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7D,KAAK,SAAS,CAAC;QACf,KAAK,UAAU;YACb,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC/C,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY;YACf,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC/C,KAAK,WAAW;YACd,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClD,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACxJ,KAAK,YAAY,CAAC;QAClB,KAAK,eAAe;YAClB,uEAAuE;YACvE,uEAAuE;YACvE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,sFAAsF,EAAE,CAAC;QAChH,KAAK,sBAAsB;YACzB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACtD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,yDAAyD;YACzD,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;YAC3H,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC7I,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,yEAAyE;YACzE,kDAAkD;YAClD,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;YACjK,MAAM,MAAM,GAAoC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACtJ,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAAE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACrD,CAAC;QACD,KAAK,eAAe,CAAC;QACrB,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC;YAClI,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,KAAK,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5K,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,qEAAqE;YACrE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;YAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YACrG,OAAO;gBACL,SAAS,EAAE,iBAAiB;gBAC5B,IAAI;gBACJ,IAAI,EAAE,IAAI,IAAI,EAAE;gBAChB,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;aAChH,CAAC;QACJ,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,6EAA6E;YAC7E,qEAAqE;YACrE,MAAM,CAAC,GAAG,6CAA6C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrE,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9F,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QACjI,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,mDAAmD;YACnD,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;YACzI,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC1G,CAAC;QACD,KAAK,iBAAiB;YACpB,OAAO,EAAE,MAAM,EAAE,yFAAyF,EAAE,CAAC;QAC/G,KAAK,YAAY;YACf,OAAO,EAAE,MAAM,EAAE,iGAAiG,EAAE,CAAC;QACvH;YACE,OAAO,EAAE,MAAM,EAAE,oBAAoB,MAAM,6DAA6D,EAAE,CAAC;IAC/G,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,4EAA4E;AAC5E,SAAgB,OAAO,CAAC,GAAW;IACjC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,uFAAuF;AACvF,SAAgB,aAAa,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAc,EAAE,IAAgB,EAAE,KAAkB,EAAE,IAAiB;IAC/F,IAAI,IAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;YAAE,OAAO;QACxF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;YAAE,SAAS;QACpD,wEAAwE;QACxE,wCAAwC;QACxC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAsB,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CACL,SAAS,EACT,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACjD,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACxD,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC9D,cAAc,EAAE,QAAiB;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACxB,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,MAAM,CAAC;YACtB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAC7B,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;YACjC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;SAC9B,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAc,EAAE,IAAgB;IAC/D,IAAI,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/G,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAClE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;YACjB,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC;YACvC,QAAQ,EAAE,QAA2B;YACrC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,KAAK;YAC3B,IAAI,EACF,QAAQ,KAAK,MAAM;gBACjB,CAAC,CAAC,IAAA,oBAAO,EAAC;oBACN,aAAa,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,aAAa,CAAC;oBACtC,WAAW,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,WAAW,CAAC;oBAClC,eAAe,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,eAAe,CAAC;oBAC1C,gBAAgB,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,gBAAgB,CAAC;oBAC5C,gBAAgB,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,YAAY,CAAC;oBACxC,YAAY,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,YAAY,CAAC;oBACpC,UAAU,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,OAAO,CAAC;oBAC7B,iBAAiB,EAAE,OAAO;wBACxB,CAAC,CAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAA4B;wBACvH,CAAC,CAAC,SAAS;iBACd,CAAC;gBACJ,CAAC,CAAC,SAAS;YACf,IAAI,EACF,QAAQ,KAAK,MAAM,IAAI,IAAI;gBACzB,CAAC,CAAC,IAAA,oBAAO,EAAC,EAAE,aAAa,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvJ,CAAC,CAAC,SAAS;SAChB,CAAC,CACH,CAAC;QACF,IAAI,QAAQ,KAAK,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,8BAA8B,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,gFAAgF,CAAC,CAAC;IACrK,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAEvH,yEAAyE;AACzE,SAAS,MAAM,CAAC,IAAa;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAK,CAAC,CAAC;IACnD,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAK,CAAC,CAAC;IAC5E,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAY,EAAE,KAAK,GAAG,IAAI;IACjE,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3C,KAAK,IAAI,MAAM,GAAG,CAAC,GAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,GAAG,IAAI,GAAG,GAAG,SAAS,KAAK,WAAW,MAAM,EAAE,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;IACtF,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,YAAY,CAAC,IAAgB,EAAE,IAAY;IACxD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACpG,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAI,IAAgB,EAAE,IAAY;IAC1D,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACtG,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/migrate/export/descope.d.ts

@@ -0,0 +1,35 @@
+import type { UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export descope` — a Descope project onto the canonical
+ * bundle models, read with a management key on this machine.
+ *
+ *   - users (login ids, verified email / phone, names, custom attributes,
+ *     project roles, tenant memberships with their roles); test users skipped;
+ *   - tenants → organizations (self-provisioning domains included), roles and
+ *     permissions, and each tenant's SSO configuration (SAML or OIDC);
+ *   - password hashes: Descope does not return them by API. Its support team
+ *     can export them (Descope stores Argon2id); pass that file with
+ *     --descope-hashes-file. Otherwise turn on the `descope` lazy-migration preset: Atlas
+ *     checks each password against Descope's password sign-in on first use.
+ *
+ * Descope does not export TOTP seeds, passkeys or access-key secrets; those
+ * are re-enrolled / reissued. Sessions are Descope JWTs, bridged by the
+ * `descope` bridge preset (project JWKS).
+ */
+export interface DescopeExportOptions {
+    projectId: string;
+    managementKey: string;
+    /** API base, for regional or custom-domain projects (default https://api.descope.com). */
+    baseUrl?: string;
+    /** The password-hash export from Descope support (CSV or NDJSON). */
+    hashesText?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+export declare function exportDescope(opts: DescopeExportOptions): Promise<RecordSet>;
+/** One Descope user (search result) → a user record. */
+export declare function mapDescopeUser(u: Obj): UserRecord | null;
+/** Descope role names are free text: `Tenant Admin` → `tenant_admin`. */
+export declare function roleKey(name: string): string;