@atlasauth/cli 0.12.0 → 0.13.0

package/dist/migrate/export/frontegg.js

@@ -0,0 +1,410 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRONTEGG_REGIONS = void 0;
+exports.fronteggApiRoot = fronteggApiRoot;
+exports.fronteggApi = fronteggApi;
+exports.listOf = listOf;
+exports.optional = optional;
+exports.metadataOf = metadataOf;
+exports.exportFrontegg = exportFrontegg;
+exports.mapFronteggUser = mapFronteggUser;
+exports.mapSsoConfig = mapSsoConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+/**
+ * `atlas migrate export frontegg` — a Frontegg environment onto the canonical
+ * bundle models, read with the environment's client id and API key on this
+ * machine (`POST /auth/vendor` → a management token).
+ *
+ *   - users (email, verified flag, phone, name, picture, metadata and
+ *     vendorMetadata, usernames, locked / disabled state) with each account
+ *     (tenant) membership and its roles;
+ *   - accounts (tenants) → organizations (verified SSO domains included), roles
+ *     and their permissions, user groups (kept on the user, their roles folded
+ *     into the member's roles), invitations, and each account's SAML / OIDC
+ *     SSO configuration;
+ *   - password hashes: Frontegg never returns them (its API and its docs only
+ *     IMPORT bcrypt / scrypt / firebase hashes). Turn on the `frontegg`
+ *     lazy-migration preset: Atlas checks each password against Frontegg on
+ *     the user's first sign-in.
+ *
+ * Authenticator-app and SMS second factors, passkeys, social-login provider
+ * user ids and API token secrets are not exportable: they are reported as left
+ * out with what to do instead.
+ */
+exports.FRONTEGG_REGIONS = {
+    eu: 'https://api.frontegg.com',
+    us: 'https://api.us.frontegg.com',
+    ca: 'https://api.ca.frontegg.com',
+    au: 'https://api.au.frontegg.com',
+};
+const PAGE = 200;
+/** The API root for a region name (or an explicit override). */
+function fronteggApiRoot(region, baseUrl) {
+    if (baseUrl)
+        return baseUrl.replace(/\/+$/, '');
+    const key = (region ?? 'eu').trim().toLowerCase();
+    const root = exports.FRONTEGG_REGIONS[key];
+    if (!root)
+        throw new Error(`Unknown Frontegg region "${region}": use eu, us, ca or au.`);
+    return root;
+}
+/**
+ * Authenticates with the environment credentials (`POST /auth/vendor`) and
+ * renews the management token a minute before it expires.
+ */
+function fronteggApi(c) {
+    if (!c.clientId || !c.apiKey)
+        throw new Error('Frontegg needs the environment client id and API key.');
+    const root = fronteggApiRoot(c.region, c.baseUrl);
+    const now = c.now ?? Date.now;
+    const auth = new vendor_http_1.VendorHttp({ vendor: 'Frontegg', baseUrl: root, fetchImpl: c.fetchImpl, sleep: c.sleep });
+    let token;
+    let expiresAt = 0;
+    const authHeaders = async () => {
+        if (!token || now() >= expiresAt - 60_000) {
+            // A refused login must not look like "feature off" to optional().
+            const { body } = await auth.post('/auth/vendor', { clientId: c.clientId, secret: c.apiKey }).catch((err) => {
+                throw err instanceof vendor_http_1.VendorApiError ? new Error(`Frontegg refused the environment credentials (${err.status}): check the client id and API key.`) : err;
+            });
+            const t = (0, record_set_1.str)(body?.token);
+            if (!t)
+                throw new Error('Frontegg did not return a management token: check the client id and API key.');
+            token = t;
+            const secs = typeof body.expiresIn === 'number' ? body.expiresIn : 3600;
+            expiresAt = now() + secs * 1000;
+        }
+        return { authorization: `Bearer ${token}` };
+    };
+    const make = (extra) => new vendor_http_1.VendorHttp({ vendor: 'Frontegg', baseUrl: root, fetchImpl: c.fetchImpl, sleep: c.sleep, headers: async () => ({ ...(await authHeaders()), ...extra }) });
+    const cache = new Map();
+    return {
+        http: make({}),
+        tenant(tenantId) {
+            let client = cache.get(tenantId);
+            if (!client) {
+                client = make({ 'frontegg-tenant-id': tenantId });
+                cache.set(tenantId, client);
+            }
+            return client;
+        },
+    };
+}
+/** A body that is a list, or wraps one under a known key. */
+function listOf(body, ...keys) {
+    if (Array.isArray(body))
+        return (0, record_set_1.objs)(body);
+    if (!(0, record_set_1.isObj)(body))
+        return [];
+    for (const k of ['items', ...keys])
+        if (Array.isArray(body[k]))
+            return (0, record_set_1.objs)(body[k]);
+    return [];
+}
+/** A call whose "not available" answers (feature off, no permission) mean "nothing there". */
+async function optional(http, path) {
+    try {
+        return (await http.get(path)).body;
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 401, 403, 404, 405].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+/** Every page of a listing, stopping on a short page, the reported page count, or a page that repeats. */
+async function* pages(http, path, idOf, keys) {
+    const seen = new Set();
+    for (let page = 0;; page++) {
+        const sep = path.includes('?') ? '&' : '?';
+        let body;
+        try {
+            body = (await http.get(`${path}${sep}_limit=${PAGE}&_offset=${page}`)).body;
+        }
+        catch (err) {
+            if (page === 0 && err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
+                return;
+            throw err;
+        }
+        const items = listOf(body, ...keys);
+        const fresh = items.filter((o) => {
+            const id = idOf(o);
+            if (id === undefined)
+                return true;
+            if (seen.has(id))
+                return false;
+            seen.add(id);
+            return true;
+        });
+        if (fresh.length > 0)
+            yield fresh;
+        const totalPages = (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body._metadata) && typeof body._metadata.totalPages === 'number' ? body._metadata.totalPages : undefined;
+        if (items.length < PAGE || fresh.length === 0 || (totalPages !== undefined && page + 1 >= totalPages))
+            return;
+    }
+}
+/** A metadata field: Frontegg stores it as a JSON string. */
+function metadataOf(v) {
+    if ((0, record_set_1.isObj)(v))
+        return (0, record_set_1.bag)(v);
+    const s = (0, record_set_1.str)(v);
+    if (!s)
+        return undefined;
+    try {
+        const parsed = JSON.parse(s);
+        return (0, record_set_1.bag)(parsed);
+    }
+    catch {
+        return undefined;
+    }
+}
+const SOCIAL_PROVIDERS = new Set(['google', 'github', 'facebook', 'microsoft', 'linkedin', 'slack', 'apple', 'twitter', 'x', 'gitlab', 'discord']);
+async function exportFrontegg(opts) {
+    const set = new record_set_1.RecordSet();
+    const progress = opts.onProgress ?? (() => undefined);
+    const api = fronteggApi(opts);
+    const http = api.http;
+    const root = fronteggApiRoot(opts.region, opts.baseUrl);
+    progress('accounts (tenants)');
+    const tenants = [];
+    const tenantIds = new Set();
+    for await (const batch of pages(http, '/tenants/resources/tenants/v2', (o) => (0, record_set_1.str)(o.tenantId), ['tenants'])) {
+        for (const t of batch) {
+            const id = (0, record_set_1.str)(t.tenantId);
+            if (!id || tenantIds.has(id))
+                continue;
+            tenantIds.add(id);
+            tenants.push(t);
+            if ((0, record_set_1.str)(t.parentTenantId))
+                set.warn('Some accounts are sub-accounts: Atlas organizations are flat, so each one is imported on its own and the parent link is kept in public_metadata.frontegg_parent_tenant_id.');
+        }
+    }
+    progress('permissions and roles');
+    const permissionKeys = new Map();
+    for (const p of listOf(await optional(http, '/identity/resources/permissions/v1'))) {
+        const id = (0, record_set_1.str)(p.id);
+        const key = (0, record_set_1.str)(p.key);
+        if (id && key)
+            permissionKeys.set(id, key);
+    }
+    const roleKeys = new Map(); // Frontegg role id → Atlas role key
+    const addRole = (r) => {
+        const raw = (0, record_set_1.str)(r.key) ?? (0, record_set_1.str)(r.name);
+        if (!raw)
+            return undefined;
+        const key = (0, translate_kit_1.keyOf)(raw);
+        const id = (0, record_set_1.str)(r.id);
+        if (id)
+            roleKeys.set(id, key);
+        const tenantId = (0, record_set_1.str)(r.tenantId);
+        const org = tenantId && tenantIds.has(tenantId) ? tenantId : undefined;
+        const permissions = (Array.isArray(r.permissions) ? r.permissions : [])
+            .map((p) => ((0, record_set_1.isObj)(p) ? ((0, record_set_1.str)(p.key) ?? permissionKeys.get((0, record_set_1.str)(p.id) ?? '')) : (permissionKeys.get(String(p)) ?? undefined)))
+            .filter((p) => !!p);
+        set.add('role', (0, record_set_1.compact)({ key, name: (0, record_set_1.str)(r.name) ?? raw, description: (0, record_set_1.str)(r.description), scope: 'organization', organization_id: org, permissions }), `org:${org ?? ''}:${key}`);
+        return key;
+    };
+    for await (const batch of pages(http, '/identity/resources/roles/v2', (o) => (0, record_set_1.str)(o.id), ['roles']))
+        for (const r of batch)
+            addRole(r);
+    progress('user groups');
+    // userId → groups of one account, with the role keys each group grants there.
+    const groupsOf = new Map();
+    for (const tid of tenantIds) {
+        for await (const batch of pages(api.tenant(tid), '/identity/resources/groups/v2?_groupsRelations=rolesAndUsers', (o) => (0, record_set_1.str)(o.id), ['groups'])) {
+            for (const g of batch) {
+                const name = (0, record_set_1.str)(g.name);
+                if (!name)
+                    continue;
+                const roles = (0, record_set_1.objs)(g.roles).map(addRole).filter((k) => !!k);
+                for (const m of (0, record_set_1.objs)(g.users)) {
+                    const uid = (0, record_set_1.str)(m.id);
+                    if (!uid)
+                        continue;
+                    const list = groupsOf.get(uid) ?? [];
+                    list.push({ tenantId: tid, name, roles });
+                    groupsOf.set(uid, list);
+                }
+            }
+        }
+    }
+    progress('single sign-on');
+    const domainsOf = new Map();
+    for (const tid of tenantIds) {
+        const body = await optional(api.tenant(tid), '/team/resources/sso/v1/configurations');
+        for (const c of listOf(body, 'configurations')) {
+            const conn = mapSsoConfig(c, tid);
+            if (!conn)
+                continue;
+            set.add('sso_connection', conn, conn.id);
+            domainsOf.set(tid, [...new Set([...(domainsOf.get(tid) ?? []), ...(conn.domains ?? [])])]);
+            if (conn.protocol === 'oidc')
+                set.warn(`Account ${tid} OIDC SSO: Frontegg does not return the client secret; enter it in Atlas after the import.`);
+        }
+    }
+    for (const t of tenants) {
+        const id = (0, record_set_1.str)(t.tenantId);
+        set.add('organization', (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(t.name) ?? id,
+            image_url: (0, record_set_1.str)(t.logoUrl),
+            domains: domainsOf.get(id),
+            public_metadata: (0, record_set_1.bag)({ ...metadataOf(t.metadata), ...((0, record_set_1.str)(t.parentTenantId) ? { frontegg_parent_tenant_id: (0, record_set_1.str)(t.parentTenantId) } : {}) }),
+            created_at: (0, record_set_1.str)(t.createdAt),
+        }));
+    }
+    progress('usernames');
+    const usernames = new Map();
+    for await (const batch of pages(http, '/identity/resources/usernames/v1', (o) => `${(0, record_set_1.str)(o.userId)}:${(0, record_set_1.str)(o.username)}`, ['usernames'])) {
+        for (const u of batch) {
+            const uid = (0, record_set_1.str)(u.userId);
+            const name = (0, record_set_1.str)(u.username);
+            if (uid && name)
+                usernames.set(uid, name);
+        }
+    }
+    progress('users');
+    const emailOf = new Map();
+    for await (const batch of pages(http, '/identity/resources/users/v3?_sortBy=id&_order=ASC', (o) => (0, record_set_1.str)(o.id), ['users'])) {
+        for (const u of batch) {
+            const user = mapFronteggUser(u, usernames);
+            if (!user) {
+                set.omit('user', u.invisible === true ? 'invisible (support) user' : 'no email, phone number or username');
+                continue;
+            }
+            const groups = groupsOf.get(user.id) ?? [];
+            if (groups.length)
+                user.private_metadata = { ...user.private_metadata, frontegg_groups: groups.map((g) => ({ tenant_id: g.tenantId, name: g.name })) };
+            set.add('user', user, user.id);
+            const email = user.emails?.[0]?.email;
+            if (email)
+                emailOf.set(user.id, email);
+            for (const m of (0, record_set_1.objs)(u.tenants)) {
+                const tid = (0, record_set_1.str)(m.tenantId);
+                if (!tid)
+                    continue;
+                if (!tenantIds.has(tid)) {
+                    set.omit('membership', 'account not in the tenant listing');
+                    continue;
+                }
+                const direct = (0, record_set_1.objs)(m.roles).map(addRole).filter((k) => !!k);
+                const viaGroups = groups.filter((g) => g.tenantId === tid).flatMap((g) => g.roles);
+                const all = [...new Set([...direct, ...viaGroups])];
+                if (all.length > 1)
+                    set.warn('Some members hold several Frontegg roles; Atlas seats each member with one role (the first, direct roles before group roles).');
+                set.add('membership', (0, record_set_1.compact)({ organization_id: tid, user_id: user.id, role: all[0] ?? 'member' }), `${tid}:${user.id}`);
+            }
+            if (u.mfaEnrolled === true)
+                set.omit('mfa_factor', 'Frontegg does not export authenticator-app or SMS second factors; re-enrol in Atlas');
+            if (SOCIAL_PROVIDERS.has(((0, record_set_1.str)(u.provider) ?? '').toLowerCase())) {
+                set.omit('identity', "Frontegg does not export social accounts' provider user ids: they relink by verified email on first social sign-in");
+            }
+        }
+    }
+    if (set.count('user') > 0) {
+        set.warn('No password hashes: Frontegg never returns them. Turn on the frontegg lazy-migration preset so each password moves on its first sign-in.');
+    }
+    progress('invitations');
+    for (const inv of listOf(await optional(http, '/identity/resources/tenants/invites/v1/all'))) {
+        const id = (0, record_set_1.str)(inv.id);
+        const tid = (0, record_set_1.str)(inv.tenantId);
+        const email = emailOf.get((0, record_set_1.str)(inv.userId) ?? '');
+        if (!id || !tid || !tenantIds.has(tid) || !email) {
+            set.omit('invitation', 'invitation without a known account or user email');
+            continue;
+        }
+        const role = (0, record_set_1.strs)(inv.roleIds).map((r) => roleKeys.get(r)).find((r) => !!r);
+        const record = (0, record_set_1.compact)({ id, organization_id: tid, email, role, status: 'pending', expires_at: (0, record_set_1.str)(inv.expires) });
+        set.add('invitation', record, id);
+    }
+    progress('api tokens');
+    let tokens = 0;
+    for (const tid of tenantIds) {
+        const scope = api.tenant(tid);
+        tokens += listOf(await optional(scope, '/identity/resources/tenants/api-tokens/v1')).length;
+        tokens += listOf(await optional(scope, '/identity/resources/tenants/access-tokens/v1'), 'accessTokens').length;
+    }
+    if (tokens)
+        set.omit('api_key', 'Frontegg never reveals API token secrets: reissue them as Atlas API keys', tokens);
+    set.manifest = { origin: root, settings: { region: (opts.region ?? 'eu').toLowerCase() } };
+    return set;
+}
+/** One Frontegg user (v3 listing) → a user record. */
+function mapFronteggUser(u, usernames = new Map()) {
+    const id = (0, record_set_1.str)(u.id) ?? (0, record_set_1.str)(u.sub);
+    if (!id || u.invisible === true)
+        return null;
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(u.phoneNumber);
+    const username = usernames.get(id);
+    const memberships = (0, record_set_1.objs)(u.tenants);
+    const disabled = memberships.length > 0 && memberships.every((m) => m.isDisabled === true);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails: email ? [{ email, verified: u.verified === true, primary: true }] : [],
+        // Frontegg verifies a number before storing it, but does not say so in the listing: the safe default is unverified.
+        phones: phone ? [{ phone, verified: false, primary: !email }] : [],
+        username,
+        name: (0, record_set_1.str)(u.name),
+        image_url: (0, record_set_1.str)(u.profilePictureUrl),
+        banned: disabled ? true : undefined,
+        locked: u.isLocked === true ? true : undefined,
+        public_metadata: metadataOf(u.metadata),
+        private_metadata: (0, record_set_1.bag)({
+            ...metadataOf(u.vendorMetadata),
+            ...((0, record_set_1.str)(u.externalId) ? { frontegg_external_id: (0, record_set_1.str)(u.externalId) } : {}),
+            ...(u.superUser === true ? { frontegg_super_user: true } : {}),
+        }),
+        created_at: (0, record_set_1.str)(u.createdAt),
+        last_sign_in_at: (0, record_set_1.str)(u.lastLogin),
+    });
+    return user.emails?.length || user.phones?.length || user.username ? user : null;
+}
+/**
+ * One SSO configuration of an account → a connection. The listing's exact
+ * shape is not in the public reference beyond its create request, so both the
+ * flat request names (`ssoEndpoint`, `publicCertificate`, `acsUrl`,
+ * `spEntityId`, `oidcClientId`) and `configMetadata` are read.
+ */
+function mapSsoConfig(c, tenantId) {
+    const type = ((0, record_set_1.str)(c.type) ?? '').toLowerCase();
+    const meta = (0, record_set_1.isObj)(c.configMetadata) ? c.configMetadata : {};
+    const domains = (Array.isArray(c.domains) ? c.domains : [])
+        .map((d) => ((0, record_set_1.isObj)(d) ? (d.validated === false ? undefined : (0, record_set_1.str)(d.domain)) : (0, record_set_1.str)(d)))
+        .filter((d) => !!d);
+    const base = { name: (0, record_set_1.str)(c.name), organization_id: tenantId, domains: [...new Set(domains)], enabled: c.enabled === false ? false : undefined };
+    const rawId = (0, record_set_1.str)(c.id);
+    if (type === 'oidc' || (!type && (0, record_set_1.str)(c.oidcClientId))) {
+        const clientId = (0, record_set_1.str)(c.oidcClientId);
+        if (!clientId)
+            return null;
+        return (0, record_set_1.compact)({
+            id: rawId ?? `${tenantId}:oidc`,
+            ...base,
+            name: base.name ?? `${tenantId} OIDC`,
+            protocol: 'oidc',
+            oidc: (0, record_set_1.compact)({ issuer: (0, record_set_1.str)(meta.issuer), discovery_url: (0, record_set_1.str)(meta.discoveryUrl) ?? (0, record_set_1.str)(meta.wellKnownUrl), client_id: clientId, scopes: (0, record_set_1.strs)(meta.scopes) }),
+        });
+    }
+    const sso = (0, record_set_1.str)(c.ssoEndpoint);
+    const cert = (0, record_set_1.str)(c.publicCertificate);
+    const entity = (0, record_set_1.str)(meta.entityId) ?? (0, record_set_1.str)(meta.idpEntityId) ?? (0, record_set_1.str)(meta.issuer);
+    if (!sso && !cert && !entity)
+        return null;
+    return (0, record_set_1.compact)({
+        id: rawId ?? `${tenantId}:saml`,
+        ...base,
+        name: base.name ?? `${tenantId} SAML`,
+        protocol: 'saml',
+        saml: (0, record_set_1.compact)({
+            idp_entity_id: entity,
+            idp_sso_url: sso,
+            idp_certificate: cert,
+            idp_metadata_url: (0, record_set_1.str)(meta.metadataUrl),
+            sp_entity_id: (0, record_set_1.str)(c.spEntityId),
+            sp_acs_url: (0, record_set_1.str)(c.acsUrl),
+        }),
+    });
+}
+//# sourceMappingURL=frontegg.js.map

package/dist/migrate/export/frontegg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontegg.js","sourceRoot":"","sources":["../../../src/migrate/export/frontegg.ts"],"names":[],"mappings":";;;AAqDA,0CAMC;AAYD,kCAmCC;AAGD,wBAKC;AAGD,4BAOC;AAkCD,gCAUC;AAID,wCAwKC;AAGD,0CA4BC;AAQD,oCAqCC;AA/ZD,6CAA+F;AAC/F,mDAAwC;AACxC,+CAA2D;AAE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AAEU,QAAA,gBAAgB,GAA2B;IACtD,EAAE,EAAE,0BAA0B;IAC9B,EAAE,EAAE,6BAA6B;IACjC,EAAE,EAAE,6BAA6B;IACjC,EAAE,EAAE,6BAA6B;CAClC,CAAC;AAkBF,MAAM,IAAI,GAAG,GAAG,CAAC;AAEjB,gEAAgE;AAChE,SAAgB,eAAe,CAAC,MAA0B,EAAE,OAAgB;IAC1E,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,wBAAgB,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,0BAA0B,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;GAGG;AACH,SAAgB,WAAW,CAAC,CAAqB;IAC/C,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3G,IAAI,KAAyB,CAAC;IAC9B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,WAAW,GAAG,KAAK,IAAqC,EAAE;QAC9D,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,SAAS,GAAG,MAAM,EAAE,CAAC;YAC1C,kEAAkE;YAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACvH,MAAM,GAAG,YAAY,4BAAc,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,iDAAiD,GAAG,CAAC,MAAM,qCAAqC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC1J,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;YACxG,KAAK,GAAG,CAAC,CAAC;YACV,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;YACxE,SAAS,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;IAC9C,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAA6B,EAAE,EAAE,CAC7C,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,WAAW,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/J,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,QAAQ;YACb,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,IAAI,CAAC,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAClD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAgB,MAAM,CAAC,IAAa,EAAE,GAAG,IAAc;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAA,iBAAI,EAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAA,kBAAK,EAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAAE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAA,iBAAI,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8FAA8F;AACvF,KAAK,UAAU,QAAQ,CAAI,IAAgB,EAAE,IAAY;IAC9D,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACjG,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,KAAK,SAAS,CAAC,CAAC,KAAK,CACnB,IAAgB,EAChB,IAAY,EACZ,IAAoC,EACpC,IAAc;IAEd,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAU,GAAG,IAAI,GAAG,GAAG,UAAU,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO;YAChG,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAClC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC;QAClC,MAAM,UAAU,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACjJ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC;YAAE,OAAO;IAChH,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,SAAgB,UAAU,CAAC,CAAU;IACnC,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC;QAAE,OAAO,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,OAAO,IAAA,gBAAG,EAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAE5I,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAExD,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAU,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC5G,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC3B,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YACvC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,4KAA4K,CAAC,CAAC;QACpN,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAClC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,QAAQ,CAAU,IAAI,EAAE,oCAAoC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG;YAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,oCAAoC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAM,EAAsB,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;aAC3H,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,cAAuB,EAAE,eAAe,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,EAC9I,OAAO,GAAG,IAAI,EAAE,IAAI,GAAG,EAAE,CAC1B,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAAE,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAEtI,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsE,CAAC;IAC/F,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,8DAA8D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC/I,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzE,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9B,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACtB,IAAI,CAAC,GAAG;wBAAE,SAAS;oBACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACrC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC1C,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAU,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,uCAAuC,CAAC,CAAC;QAC/F,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3F,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,4FAA4F,CAAC,CAAC;QACrJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAE,CAAC;QAC5B,GAAG,CAAC,GAAG,CACL,cAAc,EACd,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;YACvB,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;YACzB,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,eAAe,EAAE,IAAA,gBAAG,EAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3I,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;SAC7B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACvI,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC7B,IAAI,GAAG,IAAI,IAAI;gBAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,oDAAoD,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACzH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC;gBAC3G,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,MAAM;gBAAE,IAAI,CAAC,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACvJ,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;YACtC,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAC5B,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,mCAAmC,CAAC,CAAC;oBAC5D,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1E,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACnF,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACpD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,+HAA+H,CAAC,CAAC;gBAC9J,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5H,CAAC;YACD,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,qFAAqF,CAAC,CAAC;YAC1I,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,oHAAoH,CAAC,CAAC;YAC7I,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,0IAA0I,CAAC,CAAC;IACvJ,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,QAAQ,CAAU,IAAI,EAAE,4CAA4C,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,kDAAkD,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAqB,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAkB,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9I,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,MAAM,CAAC,MAAM,QAAQ,CAAU,KAAK,EAAE,2CAA2C,CAAC,CAAC,CAAC,MAAM,CAAC;QACrG,MAAM,IAAI,MAAM,CAAC,MAAM,QAAQ,CAAU,KAAK,EAAE,8CAA8C,CAAC,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC;IAC1H,CAAC;IACD,IAAI,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,0EAA0E,EAAE,MAAM,CAAC,CAAC;IAEpH,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sDAAsD;AACtD,SAAgB,eAAe,CAAC,CAAM,EAAE,YAAyC,IAAI,GAAG,EAAE;IACxF,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAC9E,oHAAoH;QACpH,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAClE,QAAQ;QACR,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;QACjB,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC;QACnC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACnC,MAAM,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC9C,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvC,gBAAgB,EAAE,IAAA,gBAAG,EAAC;YACpB,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;YAC/B,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;QACF,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;KAClC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,CAAM,EAAE,QAAgB;IACnD,MAAM,IAAI,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC,CAAC;SACrF,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAChJ,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,IAAA,oBAAO,EAAC;YACb,EAAE,EAAE,KAAK,IAAI,GAAG,QAAQ,OAAO;YAC/B,GAAG,IAAI;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG,QAAQ,OAAO;YACrC,QAAQ,EAAE,MAAe;YACzB,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;SAC7J,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/E,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAA,oBAAO,EAAC;QACb,EAAE,EAAE,KAAK,IAAI,GAAG,QAAQ,OAAO;QAC/B,GAAG,IAAI;QACP,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG,QAAQ,OAAO;QACrC,QAAQ,EAAE,MAAe;QACzB,IAAI,EAAE,IAAA,oBAAO,EAAC;YACZ,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,GAAG;YAChB,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,WAAW,CAAC;YACvC,YAAY,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;YAC/B,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC;SAC1B,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/fusionauth-config.d.ts

@@ -0,0 +1,26 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { type VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate fusionauth config` — a FusionAuth tenant's settings → Atlas
+ * config: password validation rules, breach detection and password history,
+ * multi-factor policy, token and session lifetimes, WebAuthn, application
+ * registration and OAuth redirect URLs, application roles, and identity
+ * providers (social providers become Atlas providers; SAML v2 / OpenID Connect
+ * move with the data export as SSO connections). Lambdas, webhooks, themes,
+ * the email server, entities and FusionAuth acting as a SAML IdP are reported
+ * as manual.
+ */
+export interface FusionAuthConfigSnapshot {
+    baseUrl?: string;
+    tenants: Obj[];
+    applications: Obj[];
+    identityProviders: Obj[];
+    lambdas: Obj[];
+    webhooks: Obj[];
+    themes: Obj[];
+}
+export declare function fetchFusionAuthConfig(http: VendorHttp, baseUrl?: string, warn?: (m: string) => void): Promise<FusionAuthConfigSnapshot>;
+export declare function translateFusionAuthConfig(snap: FusionAuthConfigSnapshot, opts?: {
+    tenantId?: string;
+}): TranslationResult;