@atlasauth/cli 0.11.0 → 0.13.0

package/dist/migrate/export/kinde.js

@@ -0,0 +1,333 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decryptKindeExport = decryptKindeExport;
+exports.exportKinde = exportKinde;
+exports.mapKindeUser = mapKindeUser;
+exports.kindePasswordHash = kindePasswordHash;
+exports.m2mToken = m2mToken;
+const node_crypto_1 = require("node:crypto");
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+const zip_1 = require("./zip");
+/** AES-256-CTR, the scheme of Kinde's `.dat` export (`openssl aes-256-ctr -d -nosalt -K <key> -iv <iv>`). */
+function decryptKindeExport(data, keyHex, ivHex) {
+    const key = Buffer.from(keyHex.trim(), 'hex');
+    const iv = Buffer.from(ivHex.trim(), 'hex');
+    if (key.length !== 32)
+        throw new Error('The Kinde export Key must be 64 hex characters (AES-256).');
+    if (iv.length !== 16)
+        throw new Error('The Kinde export Initialization Vector must be 32 hex characters.');
+    const d = (0, node_crypto_1.createDecipheriv)('aes-256-ctr', key, iv);
+    return Buffer.concat([d.update(data), d.final()]);
+}
+async function exportKinde(opts) {
+    const set = new record_set_1.RecordSet();
+    const progress = opts.onProgress ?? (() => undefined);
+    // ── the data export (users + passwords) ──
+    let usersText = opts.usersNdjson;
+    let orgsText = opts.organizationsNdjson;
+    if (opts.encryptedExport || opts.zip) {
+        const zip = opts.zip ?? decryptKindeExport(opts.encryptedExport.data, opts.encryptedExport.key, opts.encryptedExport.iv);
+        if (zip.readUInt32LE(0) !== 0x04034b50)
+            throw new Error('The decrypted Kinde export is not a zip: check the Key and IV.');
+        const files = (0, zip_1.readZip)(zip);
+        usersText ??= (0, zip_1.zipFile)(files, 'users.ndjson')?.toString('utf8');
+        orgsText ??= (0, zip_1.zipFile)(files, 'organizations.ndjson')?.toString('utf8');
+        if (usersText === undefined)
+            throw new Error('The Kinde export has no users.ndjson.');
+    }
+    const exported = usersText !== undefined ? ndjson(usersText) : [];
+    const online = Boolean(opts.domain && opts.clientId && opts.clientSecret);
+    if (!online && usersText === undefined) {
+        throw new Error('Kinde export needs the data export file (with its Key and IV) and/or a machine-to-machine application (domain, client id, secret).');
+    }
+    const base = opts.domain ? `https://${opts.domain.replace(/^https?:\/\//, '').replace(/\/+$/, '')}` : '';
+    let token;
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'Kinde',
+        baseUrl: `${base}/api/v1`,
+        headers: async () => ({ authorization: `Bearer ${(token ??= await m2mToken(base, opts))}` }),
+        fetchImpl: opts.fetchImpl,
+        sleep: opts.sleep,
+    });
+    // ── organizations ──
+    progress('organizations');
+    const orgCodes = new Set();
+    let defaultOrg;
+    const orgRows = online ? await tokenAll(http, '/organizations?page_size=500', 'organizations') : orgsText ? ndjson(orgsText) : [];
+    for (const o of orgRows) {
+        const code = (0, record_set_1.str)(o.code) ?? (0, record_set_1.str)(o.organization_code);
+        const name = (0, record_set_1.str)(o.name);
+        if (!code || !name)
+            continue;
+        // The API flags it; the export file does not, so it is known there by Kinde's default name.
+        if (o.is_default === true || (o.is_default === undefined && name === 'Default Organization'))
+            defaultOrg = code;
+        if (code === defaultOrg && !opts.includeDefaultOrganization)
+            continue;
+        orgCodes.add(code);
+        set.add('organization', (0, record_set_1.compact)({ id: code, name, slug: (0, record_set_1.str)(o.handle), created_at: (0, record_set_1.str)(o.created_on) }));
+    }
+    if (defaultOrg && !opts.includeDefaultOrganization) {
+        set.warn(`Kinde's default organization (${defaultOrg}) holds every user and was not exported as an organization (pass --kinde-include-default-org to keep it).`);
+    }
+    // ── roles ──
+    const roleById = new Map();
+    if (online) {
+        progress('roles');
+        for (const r of await tokenAll(http, '/roles?page_size=500', 'roles')) {
+            const id = (0, record_set_1.str)(r.id);
+            const key = (0, record_set_1.str)(r.key);
+            if (!id || !key)
+                continue;
+            roleById.set(id, key);
+            const permissions = (await tokenAll(http, `/roles/${id}/permissions?page_size=500`, 'permissions')).map((p) => (0, record_set_1.str)(p.key)).filter((p) => !!p);
+            set.add('role', (0, record_set_1.compact)({ key, name: (0, record_set_1.str)(r.name), description: (0, record_set_1.str)(r.description), scope: 'organization', permissions }), key);
+        }
+    }
+    // ── users: the export (with passwords) first, the API fills the rest ──
+    progress('users');
+    const users = new Map();
+    for (const u of exported)
+        if ((0, record_set_1.str)(u.id))
+            users.set(u.id, u);
+    if (online) {
+        for (const u of await tokenAll(http, '/users?page_size=500&expand=organizations,identities', 'users')) {
+            const id = (0, record_set_1.str)(u.id);
+            if (!id)
+                continue;
+            users.set(id, { ...u, ...(users.get(id) ?? {}) });
+        }
+    }
+    let withPassword = 0;
+    for (const u of users.values()) {
+        const user = mapKindeUser(u, set);
+        if (!user) {
+            set.omit('user', 'no email, phone number or username');
+            continue;
+        }
+        if (user.password)
+            withPassword++;
+        set.add('user', user);
+        // Without API access, memberships come from the export's organization codes.
+        if (!online) {
+            for (const code of (0, record_set_1.strs)(u.organizations)) {
+                if (orgCodes.has(code))
+                    set.add('membership', { organization_id: code, user_id: user.id, role: 'member' }, `${code}:${user.id}`);
+            }
+        }
+    }
+    if (exported.length === 0) {
+        set.warn('No data export given: password hashes come only from Kinde\'s data export ("All data"). Without them users set a new password (Kinde has no API to verify one).');
+    }
+    else if (withPassword === 0) {
+        set.warn('The data export has no passwords: request "All data" (not "All data except passwords") to carry them.');
+    }
+    // ── memberships with roles ──
+    if (online) {
+        progress('organization members');
+        const userIds = new Set(set.list('user').map((u) => u.id));
+        for (const code of orgCodes) {
+            for (const m of await tokenAll(http, `/organizations/${code}/users?page_size=500`, 'organization_users')) {
+                const uid = (0, record_set_1.str)(m.id);
+                if (!uid || !userIds.has(uid))
+                    continue;
+                const role = (0, record_set_1.strs)(m.roles)[0] ?? 'member';
+                set.add('membership', (0, record_set_1.compact)({ organization_id: code, user_id: uid, role, created_at: (0, record_set_1.str)(m.joined_on) }), `${code}:${uid}`);
+                if ((0, record_set_1.strs)(m.roles).length > 1)
+                    set.warn('Some organization members hold several Kinde roles; Atlas seats each member with one role (the first).');
+            }
+        }
+        progress('connections');
+        await addConnections(set, http);
+    }
+    set.warn('Kinde does not export second-factor secrets or passkeys: those users re-enrol in Atlas.');
+    set.manifest = { origin: base || null, providers: [...new Set(set.list('identity').map((i) => i.provider))].sort() };
+    return set;
+}
+/** One Kinde user (export row and/or API row) → a user record. */
+function mapKindeUser(u, set) {
+    const id = (0, record_set_1.str)(u.id);
+    if (!id)
+        return null;
+    const identities = (0, record_set_1.objs)(u.identities);
+    const email = ((0, record_set_1.str)(u.email) ?? (0, record_set_1.str)(u.preferred_email))?.toLowerCase();
+    const emailIdentity = identities.find((i) => (0, record_set_1.str)(i.type) === 'email' && (0, record_set_1.str)(i.identity)?.toLowerCase() === email);
+    const phone = (0, record_set_1.e164)(u.phone) ?? (0, record_set_1.e164)(identities.find((i) => (0, record_set_1.str)(i.type) === 'phone')?.identity);
+    const username = (0, record_set_1.str)(u.username) ?? (0, record_set_1.str)(identities.find((i) => (0, record_set_1.str)(i.type) === 'username')?.identity);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails: email
+            ? [{ email, verified: u.email_verified === true || emailIdentity?.is_confirmed === true || (u.email_verified === undefined && identities.some((i) => (0, record_set_1.str)(i.type)?.startsWith('oauth2:'))), primary: true }]
+            : [],
+        phones: phone ? [{ phone, verified: false, primary: !email }] : [],
+        username,
+        first_name: (0, record_set_1.str)(u.first_name),
+        last_name: (0, record_set_1.str)(u.last_name),
+        image_url: (0, record_set_1.str)(u.picture),
+        banned: u.is_suspended === true ? true : undefined,
+        private_metadata: (0, record_set_1.bag)((0, record_set_1.compact)({ kinde_external_id: (0, record_set_1.str)(u.external_id) ?? (0, record_set_1.str)(u.provided_id) })),
+        created_at: (0, record_set_1.str)(u.created_on),
+        last_sign_in_at: (0, record_set_1.str)(u.last_signed_in),
+    });
+    if ((0, record_set_1.isObj)(u.password)) {
+        const mapped = kindePasswordHash(u.password);
+        if ('reason' in mapped)
+            set?.omit('password', mapped.reason);
+        else
+            user.password = mapped;
+    }
+    const social = identities.filter((i) => (0, record_set_1.str)(i.type)?.startsWith('oauth2:'));
+    if (social.length)
+        set?.omit('identity', "Kinde does not export social accounts' provider user ids: they relink by verified email on first social sign-in", social.length);
+    return user.emails?.length || user.phones?.length || user.username ? user : null;
+}
+/**
+ * Kinde's exported `password` object → the bundle's password hash. Kinde
+ * stores bcrypt; users imported into Kinde keep the algorithm they came with
+ * (crypt, md5, sha256, wordpress, pbkdf2, firebase-scrypt, aspnet-identity-v2).
+ */
+function kindePasswordHash(p) {
+    const hash = (0, record_set_1.str)(p.hashed_password);
+    if (!hash)
+        return { reason: 'empty Kinde password hash' };
+    const algorithm = ((0, record_set_1.str)(p.hashing_algorithm) ?? '').toLowerCase().replace(/_/g, '-');
+    const config = (0, record_set_1.isObj)(p.hashing_config) ? p.hashing_config : {};
+    const salt = (0, record_set_1.str)(config.salt);
+    const position = ((0, record_set_1.str)(config.salt_position) ?? (0, record_set_1.str)(config.salt_location) ?? (0, record_set_1.str)(config.position) ?? 'suffix').toLowerCase();
+    switch (algorithm) {
+        case '':
+        case 'bcrypt':
+            return { algorithm: 'bcrypt', hash };
+        case 'crypt':
+        case 'wordpress':
+        case 'phpass':
+            // Self-describing ($1$, $5$, $6$, $2y$, $P$): the registry recognises them.
+            return { algorithm: 'auto', hash };
+        case 'md5':
+        case 'sha256':
+            if (!salt)
+                return { algorithm, hash, params: { encoding: /^[0-9a-f]+$/i.test(hash) ? 'hex' : 'base64' } };
+            return {
+                algorithm: `${algorithm}_salted`,
+                hash,
+                salt,
+                params: { encoding: /^[0-9a-f]+$/i.test(hash) ? 'hex' : 'base64', salt_position: position === 'prefix' ? 'prefix' : 'suffix' },
+            };
+        case 'pbkdf2': {
+            if (hash.includes('$'))
+                return { algorithm: 'auto', hash };
+            const iterations = Number(config.iterations ?? config.rounds);
+            if (!salt || !Number.isInteger(iterations))
+                return { reason: 'Kinde pbkdf2 hash without salt or iterations' };
+            return {
+                algorithm: 'pbkdf2',
+                hash,
+                salt,
+                params: { digest: (0, record_set_1.str)(config.digest)?.toLowerCase() ?? 'sha256', iterations, ...((0, record_set_1.str)(config.salt_encoding) ? { salt_encoding: (0, record_set_1.str)(config.salt_encoding) } : {}) },
+            };
+        }
+        case 'firebase-scrypt': {
+            const signer = (0, record_set_1.str)(config.signer_key) ?? (0, record_set_1.str)(config.base64_signer_key);
+            if (!signer)
+                return { reason: 'Kinde firebase-scrypt hash without the project signer key' };
+            return {
+                algorithm: 'scrypt_firebase',
+                hash,
+                salt: salt ?? '',
+                params: {
+                    signer_key: signer,
+                    salt_separator: (0, record_set_1.str)(config.salt_separator) ?? (0, record_set_1.str)(config.base64_salt_separator) ?? 'Bw==',
+                    rounds: Number(config.rounds ?? 8),
+                    mem_cost: Number(config.mem_cost ?? config.memory_cost ?? 14),
+                },
+            };
+        }
+        case 'aspnet-identity-v2':
+        case 'aspnet-identity-v3':
+            return { algorithm: 'aspnet_identity', hash };
+        default:
+            return { reason: `Kinde password algorithm "${algorithm}" is not supported` };
+    }
+}
+async function addConnections(set, http) {
+    let conns;
+    try {
+        conns = await tokenAll(http, '/connections?page_size=500', 'connections');
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 404))
+            return;
+        throw err;
+    }
+    for (const c of conns) {
+        const id = (0, record_set_1.str)(c.id);
+        const strategy = (0, record_set_1.str)(c.strategy) ?? '';
+        if (!id || !/^(saml|wsfed|oidc|oauth2:(azure_ad|microsoft_entra|okta|google_workspace))/.test(strategy))
+            continue;
+        let detail = c;
+        try {
+            const { body } = await http.get(`/connections/${id}`);
+            detail = (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.connection) ? body.connection : (0, record_set_1.isObj)(body) ? body : c;
+        }
+        catch (err) {
+            if (!(err instanceof vendor_http_1.VendorApiError))
+                throw err;
+        }
+        const o = (0, record_set_1.isObj)(detail.options) ? detail.options : {};
+        const domains = (0, record_set_1.strs)(o.home_realm_domains);
+        const name = (0, record_set_1.str)(c.display_name) ?? (0, record_set_1.str)(c.name);
+        if (strategy.startsWith('saml')) {
+            set.add('sso_connection', (0, record_set_1.compact)({
+                id,
+                name,
+                protocol: 'saml',
+                domains,
+                saml: (0, record_set_1.compact)({
+                    idp_entity_id: (0, record_set_1.str)(o.saml_entity_id),
+                    idp_metadata_url: (0, record_set_1.str)(o.saml_idp_metadata_url),
+                    idp_sso_url: (0, record_set_1.str)(o.saml_sign_in_url) ?? (0, record_set_1.str)(o.saml_sso_url),
+                    idp_certificate: (0, record_set_1.str)(o.saml_signing_certificate) ?? (0, record_set_1.str)(o.saml_certificate),
+                    sp_acs_url: (0, record_set_1.str)(o.saml_acs_url),
+                }),
+            }));
+        }
+        else {
+            set.add('sso_connection', (0, record_set_1.compact)({ id, name, protocol: 'oidc', domains, oidc: (0, record_set_1.compact)({ issuer: (0, record_set_1.str)(o.issuer) ?? (0, record_set_1.str)(o.entra_id_domain), client_id: (0, record_set_1.str)(o.client_id) }) }));
+            set.warn(`Enterprise connection ${name ?? id}: Kinde does not return its client secret; enter it in Atlas after the import.`);
+        }
+    }
+}
+async function m2mToken(base, opts) {
+    const res = await (opts.fetchImpl ?? fetch)(`${base}/oauth2/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+        body: new URLSearchParams({ grant_type: 'client_credentials', client_id: opts.clientId, client_secret: opts.clientSecret, audience: `${base}/api` }).toString(),
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok || !body.access_token)
+        throw new vendor_http_1.VendorApiError('Kinde', res.status, '/oauth2/token', body.error_description ?? 'could not get a Management API token');
+    return body.access_token;
+}
+/** Kinde's `next_token` paging. */
+async function tokenAll(http, path, key) {
+    const out = [];
+    let next;
+    do {
+        const { body } = await http.get(`${path}${next ? `&next_token=${encodeURIComponent(next)}` : ''}`);
+        const rows = (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
+        out.push(...rows);
+        next = (0, record_set_1.isObj)(body) ? (0, record_set_1.str)(body.next_token) : undefined;
+        if (rows.length === 0)
+            break;
+    } while (next);
+    return out;
+}
+function ndjson(text) {
+    return text
+        .split(/\r?\n/)
+        .filter((l) => l.trim())
+        .map((l) => JSON.parse(l))
+        .filter(record_set_1.isObj);
+}
+//# sourceMappingURL=kinde.js.map

package/dist/migrate/export/kinde.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kinde.js","sourceRoot":"","sources":["../../../src/migrate/export/kinde.ts"],"names":[],"mappings":";;AA8CA,gDAOC;AAED,kCAqHC;AAGD,oCA+BC;AAOD,8CAyDC;AAmDD,4BASC;AA1UD,6CAA+C;AAE/C,6CAA+F;AAC/F,+CAA2D;AAC3D,+BAAyC;AAyCzC,6GAA6G;AAC7G,SAAgB,kBAAkB,CAAC,IAAY,EAAE,MAAc,EAAE,KAAa;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACpG,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC3G,MAAM,CAAC,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEtD,4CAA4C;IAC5C,IAAI,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC;IACjC,IAAI,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACxC,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,eAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,eAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAgB,CAAC,EAAE,CAAC,CAAC;QAC5H,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAC1H,MAAM,KAAK,GAAG,IAAA,aAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,SAAS,KAAK,IAAA,aAAO,EAAC,KAAK,EAAE,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,QAAQ,KAAK,IAAA,aAAO,EAAC,KAAK,EAAE,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,oIAAoI,CAAC,CAAC;IACxJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzG,IAAI,KAAyB,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,GAAG,IAAI,SAAS;QACzB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,KAAK,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QAC5F,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,sBAAsB;IACtB,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,UAA8B,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,8BAA8B,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClI,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,SAAS;QAC7B,4FAA4F;QAC5F,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,KAAK,sBAAsB,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;QAChH,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,0BAA0B;YAAE,SAAS;QACtE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC,iCAAiC,UAAU,2GAA2G,CAAC,CAAC;IACnK,CAAC;IAED,cAAc;IACd,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;gBAAE,SAAS;YAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACtB,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,4BAA4B,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3J,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,cAAuB,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1I,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAe,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,sDAAsD,EAAE,OAAO,CAAC,EAAE,CAAC;YACtG,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,YAAY,EAAE,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtB,6EAA6E;QAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,iKAAiK,CAAC,CAAC;IAC9K,CAAC;SAAM,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,uGAAuG,CAAC,CAAC;IACpH,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,kBAAkB,IAAI,sBAAsB,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBACzG,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtB,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACxC,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;gBAC1C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC9H,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,wGAAwG,CAAC,CAAC;YACnJ,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,aAAa,CAAC,CAAC;QACxB,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;IACpG,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,SAAgB,YAAY,CAAC,CAAM,EAAE,GAAe;IAClD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,UAAU,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACtE,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAA,iBAAI,EAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAA,gBAAG,EAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtG,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM,EAAE,KAAK;YACX,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,aAAa,EAAE,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3M,CAAC,CAAC,EAAE;QACN,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAClE,QAAQ;QACR,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC3B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAClD,gBAAgB,EAAE,IAAA,gBAAG,EAAC,IAAA,oBAAO,EAAC,EAAE,iBAAiB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/F,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,QAAQ,IAAI,MAAM;YAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;;YACxD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM;QAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,iHAAiH,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3K,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,CAAM;IACtC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,CAAC,IAAA,gBAAG,EAAC,MAAM,CAAC,aAAa,CAAC,IAAI,IAAA,gBAAG,EAAC,MAAM,CAAC,aAAa,CAAC,IAAI,IAAA,gBAAG,EAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5H,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,EAAE,CAAC;QACR,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvC,KAAK,OAAO,CAAC;QACb,KAAK,WAAW,CAAC;QACjB,KAAK,QAAQ;YACX,4EAA4E;YAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrC,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACX,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1G,OAAO;gBACL,SAAS,EAAE,GAAG,SAAS,SAAS;gBAChC,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;aAC/H,CAAC;QACJ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;YAC9G,OAAO;gBACL,SAAS,EAAE,QAAQ;gBACnB,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,IAAA,gBAAG,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,aAAa,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACnK,CAAC;QACJ,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,CAAC,UAAU,CAAC,IAAI,IAAA,gBAAG,EAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;YAC5F,OAAO;gBACL,SAAS,EAAE,iBAAiB;gBAC5B,IAAI;gBACJ,IAAI,EAAE,IAAI,IAAI,EAAE;gBAChB,MAAM,EAAE;oBACN,UAAU,EAAE,MAAM;oBAClB,cAAc,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,cAAc,CAAC,IAAI,IAAA,gBAAG,EAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,MAAM;oBACzF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;oBAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;iBAC9D;aACF,CAAC;QACJ,CAAC;QACD,KAAK,oBAAoB,CAAC;QAC1B,KAAK,oBAAoB;YACvB,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;QAChD;YACE,OAAO,EAAE,MAAM,EAAE,6BAA6B,SAAS,oBAAoB,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAc,EAAE,IAAgB;IAC5D,IAAI,KAAY,CAAC;IACjB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,4BAA4B,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;YAAE,OAAO;QACxF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,EAAE,IAAI,CAAC,4EAA4E,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QAClH,IAAI,MAAM,GAAQ,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC;gBAAE,MAAM,GAAG,CAAC;QAClD,CAAC;QACD,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;gBACN,EAAE;gBACF,IAAI;gBACJ,QAAQ,EAAE,MAAe;gBACzB,OAAO;gBACP,IAAI,EAAE,IAAA,oBAAO,EAAC;oBACZ,aAAa,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC;oBACpC,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,qBAAqB,CAAC;oBAC9C,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;oBAC3D,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC;oBAC3E,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;iBAChC,CAAC;aACH,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAe,EAAE,OAAO,EAAE,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAC3J,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,yBAAyB,IAAI,IAAI,EAAE,gFAAgF,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAwB;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,eAAe,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,CAAC,QAAS,EAAE,aAAa,EAAE,IAAI,CAAC,YAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAClK,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0D,CAAC;IAC3G,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,4BAAc,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,iBAAiB,IAAI,sCAAsC,CAAC,CAAC;IACpK,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC;AAED,mCAAmC;AACnC,KAAK,UAAU,QAAQ,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IACjE,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,IAAwB,CAAC;IAC7B,GAAG,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAClB,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;IAC/B,CAAC,QAAQ,IAAI,EAAE;IACf,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI;SACR,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;SACpC,MAAM,CAAC,kBAAK,CAAC,CAAC;AACnB,CAAC"}

package/dist/migrate/export/ldap.d.ts

@@ -0,0 +1,53 @@
+import { RecordSet } from './record-set';
+/**
+ * `atlas migrate ldap export` — a directory's users and groups from an LDIF
+ * export (RFC 2849), as the directory's own tools write it:
+ *
+ *   OpenLDAP      slapcat -n 1 > dir.ldif   (or ldapsearch -LLL … '*' '+')
+ *   389 DS        dsctl <instance> db2ldif userroot
+ *   PingDirectory export-ldif --backendID userRoot --ldifFile dir.ldif
+ *   Oracle / Sun  export-ldif / db2ldif
+ *   Active Dir.   ldifde -f dir.ldif -d "dc=corp,dc=example" -p subtree
+ *
+ * Users keep their password when `userPassword` holds a hash Atlas verifies
+ * (`{SSHA*}`, `{PBKDF2-*}`, `{CRYPT}$6$…`, bcrypt, …). Active Directory never
+ * exports one (unicodePwd is write-only), and pass-through schemes (`{SASL}`)
+ * or DES `{CRYPT}` cannot be checked: those users move with lazy migration
+ * (the `ldap` preset binds to the directory on their first sign-in).
+ *
+ * Groups (groupOfNames, groupOfUniqueNames, posixGroup, AD group) become app
+ * roles, or organizations with members (`--set ldap-groups=organizations`).
+ */
+export interface LdifEntry {
+    dn: string;
+    /** Lower-cased attribute name (options such as `;binary` dropped) → values. Binary values are base64 strings. */
+    attrs: Map<string, string[]>;
+    /** The line the entry starts on (1-based), for messages. */
+    line: number;
+}
+/**
+ * Parse LDIF content records. Change records other than `add` are skipped;
+ * comments and folded lines are handled; a malformed line is reported, not fatal.
+ */
+export declare function parseLdif(text: string): {
+    entries: LdifEntry[];
+    problems: string[];
+};
+export interface LdapExportOptions {
+    /** `roles` (default) or `organizations`. */
+    groups?: 'roles' | 'organizations' | 'none';
+    /** The attribute used as the user id (default: entryUUID, nsUniqueId, objectGUID, ibm-entryUUID, orclGUID, then the DN). */
+    idAttribute?: string;
+    /** Directory addresses are set by administrators: mark them verified (default false). */
+    trustEmails?: boolean;
+    /** Where the LDIF came from (shown in the dashboard). */
+    origin?: string;
+}
+/** Canonical DN for matching member values (case and spacing around `,`/`=` vary). */
+export declare function normalizeDn(dn: string): string;
+/** AD objectGUID (base64 of the little-endian GUID) → the textual GUID. */
+export declare function guidFromBase64(b64: string): string | undefined;
+/** LDAP GeneralizedTime (`20240102030405Z`, `20240102030405.0Z`, `…+0100`) → ISO-8601. */
+export declare function generalizedTime(v: string | undefined): string | undefined;
+/** Map a parsed LDIF onto canonical records. */
+export declare function mapLdif(entries: LdifEntry[], options?: LdapExportOptions): RecordSet;