@atlasauth/cli 0.11.0 → 0.13.0

package/dist/migrate/export/nhost-config.js

@@ -0,0 +1,360 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readToml = readToml;
+exports.translateNhostConfig = translateNhostConfig;
+const source_lines_1 = require("./source-lines");
+const translate_kit_1 = require("./translate-kit");
+/**
+ * Flatten a TOML document to dotted keys → value with its line:
+ * `auth.method.emailPassword.passwordMinLength` → { value: 9, line: 42 }.
+ * Array-of-tables entries are indexed (`auth.session.accessToken.customClaims.0.key`).
+ * Enough TOML for nhost.toml; not a general parser (no dates, no dotted keys
+ * with quotes inside headers).
+ */
+function readToml(text) {
+    const out = new Map();
+    const counters = new Map();
+    const lines = text.split(/\r?\n/);
+    let prefix = '';
+    for (let i = 0; i < lines.length; i++) {
+        const lineNo = i + 1;
+        let raw = stripComment(lines[i]).trim();
+        if (!raw)
+            continue;
+        const aot = /^\[\[\s*([^\]]+?)\s*\]\]$/.exec(raw);
+        if (aot) {
+            const base = aot[1].trim();
+            const n = counters.get(base) ?? 0;
+            counters.set(base, n + 1);
+            prefix = `${base}.${n}`;
+            out.set(prefix, { value: {}, line: lineNo });
+            continue;
+        }
+        const table = /^\[\s*([^\]]+?)\s*\]$/.exec(raw);
+        if (table) {
+            prefix = table[1].trim();
+            out.set(prefix, { value: {}, line: lineNo });
+            continue;
+        }
+        const eq = raw.indexOf('=');
+        if (eq < 0)
+            continue;
+        const key = unquoteKey(raw.slice(0, eq).trim());
+        let rhs = raw.slice(eq + 1).trim();
+        // Multi-line arrays / inline tables: read on until the brackets balance.
+        while (!balanced(rhs) && i + 1 < lines.length) {
+            i++;
+            rhs += ` ${stripComment(lines[i]).trim()}`;
+        }
+        raw = rhs;
+        let value;
+        try {
+            value = new ValueParser(raw).parse();
+        }
+        catch {
+            value = raw;
+        }
+        const path = prefix ? `${prefix}.${key}` : key;
+        out.set(path, { value, line: lineNo });
+        flattenInto(out, path, value, lineNo);
+    }
+    return out;
+}
+function flattenInto(out, path, value, line) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        for (const [k, v] of Object.entries(value)) {
+            out.set(`${path}.${k}`, { value: v, line });
+            flattenInto(out, `${path}.${k}`, v, line);
+        }
+    }
+}
+function unquoteKey(k) {
+    return k.replace(/^["'](.*)["']$/, '$1');
+}
+function stripComment(line) {
+    let quote = null;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (quote) {
+            if (c === '\\' && quote === '"')
+                i++;
+            else if (c === quote)
+                quote = null;
+        }
+        else if (c === '"' || c === "'")
+            quote = c;
+        else if (c === '#')
+            return line.slice(0, i);
+    }
+    return line;
+}
+function balanced(s) {
+    let depth = 0;
+    let quote = null;
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        if (quote) {
+            if (c === '\\' && quote === '"')
+                i++;
+            else if (c === quote)
+                quote = null;
+        }
+        else if (c === '"' || c === "'")
+            quote = c;
+        else if (c === '[' || c === '{')
+            depth++;
+        else if (c === ']' || c === '}')
+            depth--;
+    }
+    return depth <= 0;
+}
+class ValueParser {
+    s;
+    i = 0;
+    constructor(s) {
+        this.s = s;
+    }
+    parse() {
+        const v = this.value();
+        this.ws();
+        if (this.i < this.s.length)
+            throw new Error('trailing');
+        return v;
+    }
+    ws() {
+        while (this.i < this.s.length && /[\s,]/.test(this.s[this.i]))
+            this.i++;
+    }
+    value() {
+        this.ws();
+        const c = this.s[this.i];
+        if (c === '"' || c === "'")
+            return this.string(c);
+        if (c === '[') {
+            this.i++;
+            const arr = [];
+            for (;;) {
+                this.ws();
+                if (this.s[this.i] === ']') {
+                    this.i++;
+                    return arr;
+                }
+                if (this.i >= this.s.length)
+                    throw new Error('unterminated array');
+                arr.push(this.value());
+            }
+        }
+        if (c === '{') {
+            this.i++;
+            const obj = {};
+            for (;;) {
+                this.ws();
+                if (this.s[this.i] === '}') {
+                    this.i++;
+                    return obj;
+                }
+                const m = /^("[^"]*"|'[^']*'|[A-Za-z0-9_-]+)\s*=/.exec(this.s.slice(this.i));
+                if (!m)
+                    throw new Error('bad inline table');
+                this.i += m[0].length;
+                obj[unquoteKey(m[1])] = this.value();
+            }
+        }
+        const m = /^(true|false|[+-]?[0-9][0-9_]*(?:\.[0-9_]+)?(?:[eE][+-]?\d+)?)/.exec(this.s.slice(this.i));
+        if (!m)
+            throw new Error('bad value');
+        this.i += m[0].length;
+        if (m[1] === 'true')
+            return true;
+        if (m[1] === 'false')
+            return false;
+        return Number(m[1].replace(/_/g, ''));
+    }
+    string(q) {
+        this.i++;
+        let out = '';
+        while (this.i < this.s.length) {
+            const c = this.s[this.i++];
+            if (c === q)
+                return out;
+            if (c === '\\' && q === '"') {
+                const e = this.s[this.i++];
+                out += e === 'n' ? '\n' : e === 't' ? '\t' : e === 'r' ? '\r' : e;
+            }
+            else
+                out += c;
+        }
+        throw new Error('unterminated string');
+    }
+}
+// ── the translator ──────────────────────────────────────────────────────────
+const SECRET_REF = /^\{\{\s*secrets\.([A-Za-z0-9_]+)\s*\}\}$/;
+function translateNhostConfig(file, opts = {}) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const toml = readToml(file.text);
+    const get = (k) => toml.get(`auth.${k}`);
+    const val = (k) => get(k)?.value;
+    const put = (status, k, note, atlas) => {
+        const at = get(k);
+        (0, source_lines_1.addAt)(b, at ? file.path : undefined, at?.line, status, 'auth', `auth.${k}`, note, atlas);
+    };
+    if (![...toml.keys()].some((k) => k === 'auth' || k.startsWith('auth.'))) {
+        b.add('manual', 'auth', '[auth]', `${file.path} has no [auth] section: nothing to translate.`);
+    }
+    // ── sign-up ──
+    if (val('signUp.enabled') === false || val('signUp.disableNewUsers') === true) {
+        b.set('signUpMode', 'restricted');
+        put('mapped', val('signUp.enabled') === false ? 'signUp.enabled' : 'signUp.disableNewUsers', 'Self sign-up is closed (invitations and the allowlist still work).', 'auth_config.signUpMode');
+    }
+    if (val('signUp.disableAutoSignup') === true)
+        put('differs', 'signUp.disableAutoSignup', 'Nhost does not create accounts on passwordless sign-in; Atlas signs up unknown users from the same flow unless sign-up is restricted.', 'auth_config.signUpMode');
+    if (typeof val('signUp.turnstile.secretKey') === 'string')
+        put('differs', 'signUp.turnstile.secretKey', 'Turnstile on sign-up: Atlas has its own bot protection (captcha); the Turnstile secret is not copied.', 'auth_config.captcha');
+    // ── methods ──
+    const emailPassword = get('method.emailPassword');
+    if (emailPassword) {
+        b.set('strategies.password', true);
+        put('mapped', 'method.emailPassword', 'Email + password sign-in. Imported bcrypt hashes verify as they are and are upgraded to Argon2id.', 'auth_config.strategies.password');
+    }
+    const min = val('method.emailPassword.passwordMinLength');
+    if (typeof min === 'number') {
+        b.set('passwordPolicy.minLength', Math.max(8, min));
+        put(min < 8 ? 'differs' : 'mapped', 'method.emailPassword.passwordMinLength', min < 8 ? `Nhost allows ${min}; Atlas requires at least 8 (existing passwords still sign in).` : `${min} characters minimum.`, 'auth_config.passwordPolicy.minLength');
+    }
+    if (val('method.emailPassword.hibpEnabled') === true) {
+        b.set('passwordPolicy.checkBreaches', true);
+        put('mapped', 'method.emailPassword.hibpEnabled', 'Breached passwords (Have I Been Pwned) are rejected.', 'auth_config.passwordPolicy.checkBreaches');
+    }
+    const verify = val('method.emailPassword.emailVerificationRequired');
+    if (typeof verify === 'boolean') {
+        b.set('requireEmailVerification', verify);
+        put('mapped', 'method.emailPassword.emailVerificationRequired', verify ? 'Email addresses must be verified before sign-in.' : 'Unverified email addresses may sign in.', 'auth_config.requireEmailVerification');
+    }
+    const flags = [
+        ['method.anonymous.enabled', 'strategies.anonymous', 'Anonymous users.'],
+        ['method.emailPasswordless.enabled', 'strategies.emailLink', 'Magic links.'],
+        ['method.otp.email.enabled', 'strategies.emailCode', 'One-time email codes.'],
+        ['method.smsPasswordless.enabled', 'strategies.phoneCode', 'SMS codes (sent through your Atlas SMS settings).'],
+        ['method.webauthn.enabled', 'strategies.passkey', 'Security keys / passkeys. Existing keys move with the export when the relying-party id stays the same.'],
+    ];
+    for (const [k, atlas, note] of flags) {
+        if (val(k) === true) {
+            b.set(atlas, true);
+            put('mapped', k, note, `auth_config.${atlas}`);
+        }
+    }
+    const rpId = val('method.webauthn.relyingParty.id');
+    if (typeof rpId === 'string' && rpId)
+        put('mapped', 'method.webauthn.relyingParty.id', `Relying party "${rpId}": keep sign-in on this domain (or a parent) so imported passkeys keep working.`, 'auth_config.passkeyPolicy');
+    // ── OAuth ──
+    for (const [k, entry] of toml) {
+        const m = /^auth\.method\.oauth\.([A-Za-z0-9]+)\.enabled$/.exec(k);
+        if (!m || entry.value !== true)
+            continue;
+        const name = m[1];
+        const atlas = (0, translate_kit_1.socialKey)(name) ?? (name === 'azuread' || name === 'entraid' ? 'microsoft' : null);
+        const clientId = val(`method.oauth.${name}.clientId`);
+        const cid = typeof clientId === 'string' && clientId && !SECRET_REF.test(clientId) ? clientId : undefined;
+        if (atlas) {
+            b.socialProvider({ atlasKey: atlas, vendorName: name, area: 'auth oauth', setting: `auth.method.oauth.${name}`, clientId: cid });
+            const last = b.report[b.report.length - 1];
+            last.file = file.path;
+            last.line = entry.line;
+            if (name === 'azuread' || name === 'entraid') {
+                const tenant = val(`method.oauth.${name}.tenant`);
+                put('differs', `method.oauth.${name}.tenant`, `Microsoft sign-in${typeof tenant === 'string' && tenant ? ` for tenant ${tenant}` : ''}: set the tenant on Atlas's microsoft provider (or add the tenant as an enterprise OIDC connection).`, 'oauth_providers microsoft');
+            }
+        }
+        else {
+            put('manual', `method.oauth.${name}.enabled`, `"${name}" is not an Atlas built-in provider: add it as a custom OAuth/OIDC provider (or an enterprise connection for WorkOS) with the same client id.`, 'custom_oauth_providers');
+        }
+    }
+    // ── sessions and tokens ──
+    const refresh = val('session.refreshToken.expiresIn');
+    if (typeof refresh === 'number' && refresh > 0) {
+        const ms = (0, translate_kit_1.clampSessionMs)(refresh * 1000);
+        b.set('session.absoluteMs', ms);
+        put(ms === refresh * 1000 ? 'mapped' : 'differs', 'session.refreshToken.expiresIn', `Sessions last ${refresh} s${ms !== refresh * 1000 ? ' (clamped to Atlas\'s 5-minute to 90-day range)' : ''}.`, 'auth_config.session.absoluteMs');
+    }
+    const access = val('session.accessToken.expiresIn');
+    if (typeof access === 'number' && access > 0) {
+        b.set('session.jwtTtlSeconds', access);
+        put('mapped', 'session.accessToken.expiresIn', `Access tokens live ${access} s.`, 'auth_config.session.jwtTtlSeconds');
+    }
+    const claims = {};
+    for (const [k, entry] of toml) {
+        const m = /^auth\.session\.accessToken\.customClaims\.(\d+)\.key$/.exec(k);
+        if (!m || typeof entry.value !== 'string')
+            continue;
+        const v = toml.get(`auth.session.accessToken.customClaims.${m[1]}.value`)?.value;
+        if (typeof v === 'string')
+            claims[entry.value] = v;
+    }
+    if (Object.keys(claims).length) {
+        const at = [...toml.entries()].find(([k]) => k.startsWith('auth.session.accessToken.customClaims'))?.[1];
+        (0, source_lines_1.addAt)(b, at ? file.path : undefined, at?.line, 'manual', 'auth', 'auth.session.accessToken.customClaims', `Custom Hasura claims (${Object.entries(claims).map(([c, p]) => `${c} ← ${p}`).join(', ')}) read from the database: recreate them as an Atlas JWT template, Hasura shape (https://hasura.io/jwt/claims), with values from user metadata.`, 'jwt_templates');
+    }
+    b.add('differs', 'hasura', 'hasura.jwtSecrets', 'Hasura must trust Atlas tokens: add Atlas\'s JWKS URL as a Hasura JWT secret (jwk_url) next to the Nhost one during the cutover, with the "hasura" JWT template.', 'jwt_templates hasura');
+    // ── roles ──
+    const allowed = val('user.roles.allowed');
+    if (Array.isArray(allowed)) {
+        const custom = allowed.filter((r) => typeof r === 'string' && !['user', 'me', 'anonymous', 'public'].includes(r));
+        for (const r of custom) {
+            const key = (0, translate_kit_1.keyOf)(r);
+            b.roles[r] = key;
+            b.push('roles', { key, name: r, description: 'Hasura role from Nhost', permissions: [] });
+        }
+        if (custom.length)
+            put('mapped', 'user.roles.allowed', `${custom.length} Hasura role(s) become Atlas app roles; assignments move with the data export.`, 'roles');
+    }
+    const def = val('user.roles.default');
+    if (typeof def === 'string' && def !== 'user')
+        put('manual', 'user.roles.default', `New users get the Hasura role "${def}": assign the matching Atlas app role in a sign-up action.`, 'actions');
+    // ── user rules ──
+    for (const k of ['user.email.allowed', 'user.emailDomains.allowed']) {
+        const v = val(k);
+        if (Array.isArray(v) && v.length)
+            put('manual', k, `Sign-up limited to ${v.join(', ')}: add them to the Atlas allowlist (restrictions.allowlistOnly).`, 'auth_config.restrictions');
+    }
+    for (const k of ['user.email.blocked', 'user.emailDomains.blocked']) {
+        const v = val(k);
+        if (Array.isArray(v) && v.length)
+            put('manual', k, `Blocked: ${v.join(', ')}. Add them to the Atlas blocklist.`, 'blocklist');
+    }
+    if (val('user.gravatar.enabled') === true)
+        put('differs', 'user.gravatar.enabled', 'Nhost fills avatarUrl from Gravatar; Atlas shows initials or the social profile picture. Imported avatar URLs are kept.', 'user image');
+    const locales = val('user.locale.allowed');
+    if (Array.isArray(locales) && locales.length > 1)
+        put('differs', 'user.locale.allowed', 'Per-user locale is kept in public metadata; set the Atlas localization languages to match.', 'auth_config.localization');
+    // ── MFA ──
+    if (val('totp.enabled') === true) {
+        b.set('mfa.factors.totp', true);
+        put('mapped', 'totp.enabled', 'Authenticator apps. Secrets move with the export (decrypted on your machine with AUTH_ENCRYPTION_KEY on current Nhost).', 'auth_config.mfa.factors.totp');
+    }
+    if (val('elevatedPrivileges.mode') === 'required' || val('elevatedPrivileges.mode') === 'recommended') {
+        put('differs', 'elevatedPrivileges.mode', 'Nhost elevates with a security key before sensitive changes; Atlas uses step-up (reverification) for the same actions.', 'auth_config.stepUp');
+    }
+    // ── redirects ──
+    const clientUrl = val('redirections.clientUrl');
+    if (typeof clientUrl === 'string' && clientUrl)
+        put('mapped', 'redirections.clientUrl', `${clientUrl} becomes an Atlas redirect URL.`, 'redirect_urls');
+    const urls = val('redirections.allowedUrls');
+    if (Array.isArray(urls))
+        for (const u of urls)
+            if (typeof u === 'string' && /^https?:\/\//.test(u))
+                b.push('redirect_urls', { url: u });
+    if (Array.isArray(urls) && urls.length)
+        put('mapped', 'redirections.allowedUrls', `${urls.length} allowed redirect URL(s).`, 'redirect_urls');
+    if (typeof clientUrl === 'string' && /^https?:\/\//.test(clientUrl))
+        b.push('redirect_urls', { url: clientUrl });
+    // ── what the bridge and lazy presets need ──
+    const issuer = toml.get('hasura.jwtSecrets.0.issuer');
+    if (typeof issuer?.value === 'string' && issuer.value) {
+        (0, source_lines_1.addAt)(b, file.path, issuer.line, 'mapped', 'hasura', 'hasura.jwtSecrets.issuer', `Access tokens carry iss "${issuer.value}": the nhost_jwt bridge preset accepts them with its issuer variable set to that value.`, 'migrations bridge nhost_jwt');
+    }
+    return b.result(file.path, {
+        bridge: { preset: 'nhost', vars: {} },
+        lazy: { preset: 'nhost', config: opts.authUrl ? { auth_url: opts.authUrl.replace(/\/+$/, '') } : {} },
+    });
+}
+//# sourceMappingURL=nhost-config.js.map

package/dist/migrate/export/nhost-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nhost-config.js","sourceRoot":"","sources":["../../../src/migrate/export/nhost-config.ts"],"names":[],"mappings":";;AA2BA,4BA6CC;AAqHD,oDA6JC;AAxVD,iDAAuC;AACvC,mDAAkF;AAiBlF;;;;;;GAMG;AACH,SAAgB,QAAQ,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;YAC1B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,yEAAyE;QACzE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9C,CAAC,EAAE,CAAC;YACJ,GAAG,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,GAAG,GAAG,GAAG,CAAC;QACV,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,GAAG,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/C,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAA2B,EAAE,IAAY,EAAE,KAAc,EAAE,IAAY;IAC1F,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;iBAChC,IAAI,CAAC,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;QACrC,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,GAAG,CAAC,CAAC;aACxC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAChB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;iBAChC,IAAI,CAAC,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;QACrC,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,GAAG,CAAC,CAAC;aACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,WAAW;IAEc;IADrB,CAAC,GAAG,CAAC,CAAC;IACd,YAA6B,CAAS;QAAT,MAAC,GAAD,CAAC,CAAQ;IAAG,CAAC;IAE1C,KAAK;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,EAAE,CAAC;QACV,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,EAAE;QACR,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAAE,IAAI,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,GAAG,GAAc,EAAE,CAAC;YAC1B,SAAS,CAAC;gBACR,IAAI,CAAC,EAAE,EAAE,CAAC;gBACV,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;oBACT,OAAO,GAAG,CAAC;gBACb,CAAC;gBACD,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,SAAS,CAAC;gBACR,IAAI,CAAC,EAAE,EAAE,CAAC;gBACV,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;oBACT,OAAO,GAAG,CAAC;gBACb,CAAC;gBACD,MAAM,CAAC,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBAC5C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,gEAAgE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAEO,MAAM,CAAC,CAAS;QACtB,IAAI,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC;YACxB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAE,CAAC;gBAC5B,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,CAAC;;gBAAM,GAAG,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;CACF;AAED,+EAA+E;AAE/E,MAAM,UAAU,GAAG,0CAA0C,CAAC;AAE9D,SAAgB,oBAAoB,CAAC,IAAoC,EAAE,OAA6B,EAAE;IACxG,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,CAAC,MAAuC,EAAE,CAAS,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE;QAC/F,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3F,CAAC,CAAC;IACF,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACzE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,IAAI,+CAA+C,CAAC,CAAC;IACjG,CAAC;IAED,gBAAgB;IAChB,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,KAAK,IAAI,GAAG,CAAC,wBAAwB,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9E,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAClC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,wBAAwB,EAAE,oEAAoE,EAAE,wBAAwB,CAAC,CAAC;IAC/L,CAAC;IACD,IAAI,GAAG,CAAC,0BAA0B,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,SAAS,EAAE,0BAA0B,EAAE,uIAAuI,EAAE,wBAAwB,CAAC,CAAC;IAC5P,IAAI,OAAO,GAAG,CAAC,4BAA4B,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,SAAS,EAAE,4BAA4B,EAAE,uGAAuG,EAAE,qBAAqB,CAAC,CAAC;IAExO,gBAAgB;IAChB,MAAM,aAAa,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,aAAa,EAAE,CAAC;QAClB,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,EAAE,mGAAmG,EAAE,iCAAiC,CAAC,CAAC;IAChL,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,wCAAwC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,GAAG,iEAAiE,CAAC,CAAC,CAAC,GAAG,GAAG,sBAAsB,EAAE,sCAAsC,CAAC,CAAC;IACvP,CAAC;IACD,IAAI,GAAG,CAAC,kCAAkC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,QAAQ,EAAE,kCAAkC,EAAE,sDAAsD,EAAE,0CAA0C,CAAC,CAAC;IACxJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,gDAAgD,CAAC,CAAC;IACrE,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;QAC1C,GAAG,CAAC,QAAQ,EAAE,gDAAgD,EAAE,MAAM,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,yCAAyC,EAAE,sCAAsC,CAAC,CAAC;IACnN,CAAC;IACD,MAAM,KAAK,GAAoC;QAC7C,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,kBAAkB,CAAC;QACxE,CAAC,kCAAkC,EAAE,sBAAsB,EAAE,cAAc,CAAC;QAC5E,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,uBAAuB,CAAC;QAC7E,CAAC,gCAAgC,EAAE,sBAAsB,EAAE,mDAAmD,CAAC;QAC/G,CAAC,yBAAyB,EAAE,oBAAoB,EAAE,wGAAwG,CAAC;KAC5J,CAAC;IACF,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnB,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACpD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI;QAAE,GAAG,CAAC,QAAQ,EAAE,iCAAiC,EAAE,kBAAkB,IAAI,iFAAiF,EAAE,2BAA2B,CAAC,CAAC;IAE7N,cAAc;IACd,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAA,yBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,IAAI,WAAW,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1G,IAAI,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,qBAAqB,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACjI,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACvB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,IAAI,SAAS,CAAC,CAAC;gBAClD,GAAG,CAAC,SAAS,EAAE,gBAAgB,IAAI,SAAS,EAAE,oBAAoB,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,sGAAsG,EAAE,2BAA2B,CAAC,CAAC;YAC5Q,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,UAAU,EAAE,IAAI,IAAI,+IAA+I,EAAE,wBAAwB,CAAC,CAAC;QACnO,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACtD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,IAAA,8BAAc,EAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,EAAE,KAAK,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,gCAAgC,EAAE,iBAAiB,OAAO,KAAK,EAAE,KAAK,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;IACxO,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACvC,GAAG,CAAC,QAAQ,EAAE,+BAA+B,EAAE,sBAAsB,MAAM,KAAK,EAAE,mCAAmC,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,wDAAwD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAAE,SAAS;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;QACjF,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,uCAAuC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzG,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,uCAAuC,EAAE,yBAAyB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gJAAgJ,EAAE,eAAe,CAAC,CAAC;IACxW,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,mBAAmB,EAAE,kKAAkK,EAAE,sBAAsB,CAAC,CAAC;IAE5O,cAAc;IACd,MAAM,OAAO,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/H,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,CAAC,CAAC,CAAC;YACrB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC,MAAM,gFAAgF,EAAE,OAAO,CAAC,CAAC;IACpK,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM;QAAE,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,kCAAkC,GAAG,4DAA4D,EAAE,SAAS,CAAC,CAAC;IAEjM,mBAAmB;IACnB,KAAK,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iEAAiE,EAAE,0BAA0B,CAAC,CAAC;IACtL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,EAAE,WAAW,CAAC,CAAC;IAChI,CAAC;IACD,IAAI,GAAG,CAAC,uBAAuB,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,SAAS,EAAE,uBAAuB,EAAE,yHAAyH,EAAE,YAAY,CAAC,CAAC;IAC5N,MAAM,OAAO,GAAG,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,EAAE,qBAAqB,EAAE,4FAA4F,EAAE,0BAA0B,CAAC,CAAC;IAElN,YAAY;IACZ,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAChC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,yHAAyH,EAAE,8BAA8B,CAAC,CAAC;IAC3L,CAAC;IACD,IAAI,GAAG,CAAC,yBAAyB,CAAC,KAAK,UAAU,IAAI,GAAG,CAAC,yBAAyB,CAAC,KAAK,aAAa,EAAE,CAAC;QACtG,GAAG,CAAC,SAAS,EAAE,yBAAyB,EAAE,wHAAwH,EAAE,oBAAoB,CAAC,CAAC;IAC5L,CAAC;IAED,kBAAkB;IAClB,MAAM,SAAS,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS;QAAE,GAAG,CAAC,QAAQ,EAAE,wBAAwB,EAAE,GAAG,SAAS,iCAAiC,EAAE,eAAe,CAAC,CAAC;IACxJ,MAAM,IAAI,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,EAAU,CAAC,CAAC;IAChJ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,QAAQ,EAAE,0BAA0B,EAAE,GAAG,IAAI,CAAC,MAAM,2BAA2B,EAAE,eAAe,CAAC,CAAC;IAC9I,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,SAAS,EAAU,CAAC,CAAC;IAEzH,8CAA8C;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACtD,IAAI,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACtD,IAAA,oBAAK,EAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,EAAE,4BAA4B,MAAM,CAAC,KAAK,yFAAyF,EAAE,6BAA6B,CAAC,CAAC;IACrP,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACrC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;KACtG,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/nhost.d.ts

@@ -0,0 +1,64 @@
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export nhost` — an Nhost project's `auth` schema.
+ *
+ * Nhost tracks its auth tables in Hasura, so the export reads them through the
+ * project's GraphQL endpoint with the admin secret (on this machine only):
+ * `users` (bcrypt `passwordHash`, TOTP secret), `authUserProviders`,
+ * `authUserSecurityKeys`, `authUserRoles` and `authRefreshTokens`. A
+ * self-hosted project can instead hand over a dump of the `auth.*` tables
+ * (`psql \copy … to 'users.csv' csv header`, or JSON), snake_case columns.
+ *
+ * What moves: users with verified email / phone, display name, avatar,
+ * locale and metadata, disabled → banned, anonymous users; bcrypt hashes as
+ * they are; social links; WebAuthn security keys (as passkeys, for the
+ * relying-party id the project used); allowed roles as app roles; TOTP
+ * secrets (plaintext on legacy hasura-auth, AES-256-GCM under
+ * AUTH_ENCRYPTION_KEY on current versions — decrypted here when the key is
+ * given, else those users enrol again); SMS second factors by phone; and live
+ * refresh tokens. Nhost stores `\x` + hex(sha256(refresh token)), exactly the
+ * `token_hash` the `nhost` bridge preset looks up, so signed-in users move
+ * without a new sign-in. Personal access tokens are left out (reissue them).
+ */
+export interface NhostRows {
+    users: Obj[];
+    providers: Obj[];
+    securityKeys: Obj[];
+    userRoles: Obj[];
+    refreshTokens: Obj[];
+}
+export interface NhostExportOptions {
+    /** AUTH_ENCRYPTION_KEY (64 hex chars) to decrypt TOTP secrets. */
+    encryptionKey?: string;
+    /** The WebAuthn relying-party id security keys were registered for (nhost.toml auth.method.webauthn.relyingParty.id). */
+    rpId?: string;
+    origin?: string;
+    now?: () => number;
+}
+export declare function exportNhost(rows: NhostRows, opts?: NhostExportOptions): RecordSet;
+/** `\x` + hex(sha256(token)) as Nhost stores it → the bundle's lowercase hex. */
+export declare function refreshTokenHash(t: Obj): string | undefined;
+/**
+ * Current Nhost encrypts TOTP secrets: AES-256-GCM, stored as
+ * hex(nonce(12) || ciphertext || tag(16)), key = AUTH_ENCRYPTION_KEY (hex).
+ */
+export declare function decryptTotp(stored: string, key: Buffer): string | undefined;
+/** Postgres bytea as Hasura / psql print it (`\x…` hex), or base64 → base64url. */
+export declare function byteaToBase64url(v: unknown): string | undefined;
+/** Nhost Cloud's GraphQL endpoint for a subdomain and region. */
+export declare function nhostGraphqlUrl(o: {
+    subdomain: string;
+    region: string;
+}): string;
+/** The auth tables through Hasura with the admin secret (sent only to the project). */
+export declare function fetchNhostRows(opts: {
+    graphqlUrl: string;
+    adminSecret: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (m: string) => void;
+}): Promise<NhostRows>;
+export declare class GraphqlError extends Error {
+}
+/** A folder of `auth.*` table dumps (JSON, NDJSON or CSV with a header; snake_case columns). */
+export declare function readNhostDump(dir: string): NhostRows;