@atlasauth/cli 0.12.0 → 0.13.0

package/dist/migrate/export/propelauth.d.ts

@@ -0,0 +1,48 @@
+import type { UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export propelauth` — a PropelAuth project onto the canonical
+ * bundle models, read with a backend API key on this machine.
+ *
+ *   - users (email + confirmed flag, username, names, picture, locked /
+ *     disabled, metadata) with every organization they belong to and the role
+ *     they hold there;
+ *   - organizations (slug, self-join domains, member cap), the roles seen on
+ *     members (with the permissions they carry) and pending invitations;
+ *   - password hashes: PropelAuth has no password-verify API and does not
+ *     return hashes. Support can export them; pass that file with
+ *     --propelauth-hashes-file (self-describing hashes are recognised on their
+ *     own). Without it members set a password again (reset link) — or sign in
+ *     with the method they already use.
+ *
+ * Not exportable: TOTP secrets (only the factor type is readable), social
+ * account ids (users relink by verified email), end-user API key secrets
+ * (reissue), SAML IdP settings (write-only: set the connection up again).
+ * Sessions are RS256 tokens verified with the project's verifier key: see the
+ * `propelauth` bridge preset.
+ */
+export interface PropelauthExportOptions {
+    /** The project's auth URL (https://123456.propelauthtest.com or a custom domain). */
+    authUrl: string;
+    apiKey: string;
+    /** Backend API host (default https://propelauth-api.com). */
+    apiBase?: string;
+    /** The password-hash export from PropelAuth support (CSV or NDJSON). */
+    hashesText?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** `https://x.propelauthtest.com/` → `https://x.propelauthtest.com`; anything but a plain https origin is refused. */
+export declare function normalizeAuthUrl(raw: string): string;
+export declare function propelauthHttp(o: {
+    authUrl: string;
+    apiKey: string;
+    apiBase?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+}): VendorHttp;
+export declare function exportPropelauth(opts: PropelauthExportOptions): Promise<RecordSet>;
+/** One PropelAuth user (user query result) → a user record. */
+export declare function mapPropelauthUser(u: Obj): UserRecord | null;

package/dist/migrate/export/propelauth.js

@@ -0,0 +1,255 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeAuthUrl = normalizeAuthUrl;
+exports.propelauthHttp = propelauthHttp;
+exports.exportPropelauth = exportPropelauth;
+exports.mapPropelauthUser = mapPropelauthUser;
+const csv_1 = require("../../import/csv");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+const API = 'https://propelauth-api.com';
+const PAGE = 100;
+const MAX_PAGES = 100_000;
+const BUILT_IN_ROLES = new Set(['admin', 'member']);
+/** `https://x.propelauthtest.com/` → `https://x.propelauthtest.com`; anything but a plain https origin is refused. */
+function normalizeAuthUrl(raw) {
+    const url = raw.trim().replace(/\/+$/, '');
+    const withScheme = /^https:\/\//.test(url) ? url : /^[a-z0-9.-]+$/i.test(url) ? `https://${url}` : url;
+    if (!/^https:\/\/[a-z0-9.-]+(:\d+)?$/i.test(withScheme))
+        throw new Error(`Not a PropelAuth auth URL: ${raw}`);
+    return withScheme;
+}
+function propelauthHttp(o) {
+    return new vendor_http_1.VendorHttp({
+        vendor: 'PropelAuth',
+        baseUrl: (o.apiBase ?? API).replace(/\/+$/, ''),
+        headers: { authorization: `Bearer ${o.apiKey}`, 'x-propelauth-url': normalizeAuthUrl(o.authUrl).replace(/^https:\/\//, '') },
+        fetchImpl: o.fetchImpl,
+        sleep: o.sleep,
+    });
+}
+async function exportPropelauth(opts) {
+    const set = new record_set_1.RecordSet();
+    const authUrl = normalizeAuthUrl(opts.authUrl);
+    if (!opts.apiKey)
+        throw new Error('PropelAuth export needs a backend API key (PROPELAUTH_API_KEY).');
+    const progress = opts.onProgress ?? (() => undefined);
+    const http = propelauthHttp({ authUrl, apiKey: opts.apiKey, apiBase: opts.apiBase, fetchImpl: opts.fetchImpl, sleep: opts.sleep });
+    progress('organizations');
+    const orgs = await listOrgs(http);
+    const orgIds = new Set();
+    let saml = 0;
+    for (const o of orgs) {
+        const id = (0, record_set_1.str)(o.org_id);
+        const name = (0, record_set_1.str)(o.name) ?? (0, record_set_1.str)(o.org_name) ?? id;
+        if (!id || !name)
+            continue;
+        orgIds.add(id);
+        const detail = await optional(async () => (await http.get(`/api/backend/v1/org/${encodeURIComponent(id)}`)).body);
+        const domains = detail && detail.domain_autojoin === true ? [(0, record_set_1.str)(detail.domain), ...(0, record_set_1.strs)(detail.extra_domains)].filter((d) => !!d) : [];
+        set.add('organization', (0, record_set_1.compact)({
+            id,
+            name,
+            slug: (0, record_set_1.str)(detail?.url_safe_org_slug) ?? (0, record_set_1.str)(o.url_safe_org_slug) ?? (0, record_set_1.str)(o.url_safe_org_name),
+            domains: [...new Set(domains.map((d) => d.toLowerCase()))],
+            max_members: typeof o.max_users === 'number' && o.max_users > 0 ? o.max_users : undefined,
+            public_metadata: (0, record_set_1.bag)(o.metadata),
+            created_at: toMs(o.created_at),
+        }), id);
+        if (o.is_saml_configured === true)
+            saml++;
+    }
+    if (saml > 0) {
+        set.omit('sso_connection', 'PropelAuth never returns a SAML connection\'s IdP settings (write-only): set the connection up again in Atlas, with the same IdP', saml);
+    }
+    progress('users');
+    const hashes = opts.hashesText ? indexHashes(opts.hashesText) : null;
+    const userIds = new Set();
+    const rolePerms = new Map();
+    let withHash = 0;
+    let noPassword = 0;
+    let multiRole = false;
+    const users = await listAll(http, '/api/backend/v1/user/query?include_orgs=true&order_by=CREATED_AT_ASC', 'users');
+    for (const u of users) {
+        const user = mapPropelauthUser(u);
+        if (!user) {
+            set.omit('user', 'no email or username');
+            continue;
+        }
+        const email = user.emails?.[0]?.email;
+        const h = hashes ? (hashes.get(user.id) ?? (email ? hashes.get(email) : undefined) ?? hashes.get((0, record_set_1.str)(u.legacy_user_id) ?? '\0')) : undefined;
+        if (h) {
+            user.password = { algorithm: 'auto', hash: h };
+            withHash++;
+        }
+        if (u.has_password === false)
+            noPassword++;
+        set.add('user', user, user.id);
+        userIds.add(user.id);
+        if (u.mfa_enabled === true)
+            set.omit('mfa_factor', 'PropelAuth does not export TOTP secrets; members enrol again in Atlas');
+        const info = (0, record_set_1.isObj)(u.org_id_to_org_info) ? u.org_id_to_org_info : {};
+        for (const [orgId, raw] of Object.entries(info)) {
+            if (!(0, record_set_1.isObj)(raw))
+                continue;
+            if (!orgIds.has(orgId)) {
+                // Listed on a member but missing from the organization listing: keep the membership.
+                orgIds.add(orgId);
+                set.add('organization', (0, record_set_1.compact)({ id: orgId, name: (0, record_set_1.str)(raw.org_name) ?? orgId, slug: (0, record_set_1.str)(raw.url_safe_org_name) }), orgId);
+            }
+            const role = (0, translate_kit_1.keyOf)((0, record_set_1.str)(raw.user_role) ?? 'member');
+            if ((0, record_set_1.strs)(raw.additional_roles).length > 0)
+                multiRole = true;
+            else if (!rolePerms.has(role))
+                rolePerms.set(role, new Set((0, record_set_1.strs)(raw.user_permissions)));
+            else
+                for (const p of (0, record_set_1.strs)(raw.user_permissions))
+                    rolePerms.get(role).add(p);
+            set.add('membership', { organization_id: orgId, user_id: user.id, role }, `${orgId}:${user.id}`);
+        }
+    }
+    if (multiRole)
+        set.warn('Some members hold additional roles in an organization; Atlas seats each member with one role (their main role).');
+    if (noPassword > 0) {
+        set.omit('identity', "PropelAuth does not export social accounts' provider user ids: they relink by verified email on first social sign-in", noPassword);
+    }
+    if (!hashes && set.count('user') > 0) {
+        set.warn('No password hashes: PropelAuth has no password-verify API, so only a hash export from PropelAuth support can carry passwords. Pass it with --propelauth-hashes-file, or members set a password again on first sign-in.');
+    }
+    else if (hashes && withHash === 0) {
+        set.warn('The hash file matched no user (by user id, email or legacy user id): check its columns.');
+    }
+    progress('invitations');
+    const invitedRoles = new Set();
+    for (const orgId of orgIds) {
+        const invites = await optional(() => listAll(http, `/api/backend/v1/pending_org_invites?org_id=${encodeURIComponent(orgId)}`, 'invites'));
+        for (const inv of invites ?? []) {
+            const email = (0, record_set_1.str)(inv.invitee_email)?.toLowerCase();
+            if (!email)
+                continue;
+            const role = (0, translate_kit_1.keyOf)((0, record_set_1.str)(inv.role_in_org) ?? 'member');
+            invitedRoles.add(role);
+            const inviter = (0, record_set_1.str)(inv.inviter_user_id);
+            set.add('invitation', (0, record_set_1.compact)({
+                id: `${orgId}:${email}`,
+                organization_id: orgId,
+                email,
+                role,
+                status: 'pending',
+                inviter_user_id: inviter && userIds.has(inviter) ? inviter : undefined,
+                expires_at: toMs(inv.expires_at),
+                created_at: toMs(inv.created_at),
+            }), `${orgId}:${email}`);
+        }
+    }
+    const roleKeys = new Set([...rolePerms.keys(), ...invitedRoles]);
+    for (const key of roleKeys) {
+        if (BUILT_IN_ROLES.has(key))
+            continue;
+        set.add('role', (0, record_set_1.compact)({ key, name: key, scope: 'organization', permissions: [...(rolePerms.get(key) ?? [])] }), key);
+    }
+    progress('api keys');
+    const keys = (await optional(() => listAll(http, '/api/backend/v1/end_user_api_keys', 'api_keys'))) ?? [];
+    if (keys.length)
+        set.omit('api_key', 'PropelAuth never reveals end-user API key secrets: reissue them as Atlas API keys', keys.length);
+    set.manifest = { origin: authUrl, settings: { auth_url: authUrl } };
+    return set;
+}
+/** One PropelAuth user (user query result) → a user record. */
+function mapPropelauthUser(u) {
+    const id = (0, record_set_1.str)(u.user_id);
+    if (!id)
+        return null;
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    const username = (0, record_set_1.str)(u.username);
+    const legacy = (0, record_set_1.str)(u.legacy_user_id);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails: email ? [{ email, verified: u.email_confirmed === true, primary: true }] : [],
+        username,
+        first_name: (0, record_set_1.str)(u.first_name),
+        last_name: (0, record_set_1.str)(u.last_name),
+        image_url: (0, record_set_1.str)(u.picture_url),
+        banned: u.enabled === false ? true : undefined,
+        locked: u.locked === true ? true : undefined,
+        private_metadata: (0, record_set_1.bag)({ ...((0, record_set_1.isObj)(u.metadata) ? u.metadata : {}), ...(legacy ? { propelauth_legacy_user_id: legacy } : {}) }),
+        created_at: toMs(u.created_at),
+        last_sign_in_at: toMs(u.last_active_at),
+    });
+    return user.emails?.length || user.username ? user : null;
+}
+/** PropelAuth timestamps are Unix seconds. */
+function toMs(v) {
+    return typeof v === 'number' && Number.isFinite(v) && v > 0 ? (v < 1e11 ? v * 1000 : v) : undefined;
+}
+/**
+ * The support export, by user id, email and legacy user id (emails lowercased).
+ * Its layout is not published: CSV with a hash column and an id / email
+ * column, or NDJSON objects with the same names.
+ */
+function indexHashes(text) {
+    const t = text.trim();
+    const rows = t.startsWith('{') ? t.split(/\r?\n/).filter((l) => l.trim()).map((l) => JSON.parse(l)) : (0, csv_1.parseCsv)(t);
+    const out = new Map();
+    for (const r of rows) {
+        const keys = Object.keys(r);
+        const hashKey = keys.find((k) => /hash/i.test(k) && !/algo/i.test(k));
+        const hash = hashKey ? (0, record_set_1.str)(r[hashKey]) : undefined;
+        if (!hash)
+            continue;
+        for (const k of keys) {
+            const v = (0, record_set_1.str)(r[k]);
+            if (!v)
+                continue;
+            if (/^(user_?id|legacy_?user_?id)$/i.test(k))
+                out.set(v, hash);
+            else if (/^e-?mail$/i.test(k))
+                out.set(v.toLowerCase(), hash);
+        }
+    }
+    return out;
+}
+async function listAll(http, path, key) {
+    const out = [];
+    for (let n = 0; n < MAX_PAGES; n++) {
+        const sep = path.includes('?') ? '&' : '?';
+        const { body } = await http.get(`${path}${sep}page_size=${PAGE}&page_number=${n}`);
+        const rows = (0, record_set_1.objs)(body?.[key]);
+        out.push(...rows);
+        if (body?.has_more_results !== true || rows.length === 0)
+            break;
+    }
+    return out;
+}
+/** Organizations: a GET with query parameters, or (older projects) a POST with a JSON body. */
+async function listOrgs(http) {
+    try {
+        return await listAll(http, '/api/backend/v1/org/query?order_by=CREATED_AT_ASC', 'orgs');
+    }
+    catch (err) {
+        if (!(err instanceof vendor_http_1.VendorApiError) || ![404, 405].includes(err.status))
+            throw err;
+    }
+    const out = [];
+    for (let n = 0; n < MAX_PAGES; n++) {
+        const { body } = await http.post('/api/backend/v1/org/query', { page_size: PAGE, page_number: n, order_by: 'CREATED_AT_ASC' });
+        const rows = (0, record_set_1.objs)(body?.orgs);
+        out.push(...rows);
+        if (body?.has_more_results !== true || rows.length === 0)
+            break;
+    }
+    return out;
+}
+/** A call that may be missing or not permitted for this project: `null` then. */
+async function optional(fn) {
+    try {
+        return await fn();
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404, 405].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+//# sourceMappingURL=propelauth.js.map

package/dist/migrate/export/propelauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propelauth.js","sourceRoot":"","sources":["../../../src/migrate/export/propelauth.ts"],"names":[],"mappings":";;AA+CA,4CAKC;AAED,wCAQC;AAED,4CA6HC;AAGD,8CAoBC;AAnND,0CAA4C;AAC5C,6CAAyF;AACzF,mDAAwC;AACxC,+CAA2D;AAqC3D,MAAM,GAAG,GAAG,4BAA4B,CAAC;AACzC,MAAM,IAAI,GAAG,GAAG,CAAC;AACjB,MAAM,SAAS,GAAG,OAAO,CAAC;AAC1B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEpD,sHAAsH;AACtH,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACvG,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IAC9G,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,cAAc,CAAC,CAAyH;IACtJ,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE;QAC5H,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,IAA6B;IAClE,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAEnI,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAS;QAC3B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvH,MAAM,OAAO,GAAG,MAAM,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrJ,GAAG,CAAC,GAAG,CACL,cAAc,EACd,IAAA,oBAAO,EAAC;YACN,EAAE;YACF,IAAI;YACJ,IAAI,EAAE,IAAA,gBAAG,EAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC;YAC5F,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC1D,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACzF,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;YAChC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;SAC/B,CAAC,EACF,EAAE,CACH,CAAC;QACF,IAAI,CAAC,CAAC,kBAAkB,KAAK,IAAI;YAAE,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,kIAAkI,EAAE,IAAI,CAAC,CAAC;IACvK,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,sEAAsE,EAAE,OAAO,CAAC,CAAC;IACnH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QACtC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7I,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,CAAC,QAAQ,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,QAAQ,EAAE,CAAC;QACb,CAAC;QACD,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK;YAAE,UAAU,EAAE,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,uEAAuE,CAAC,CAAC;QAC5H,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC;gBAAE,SAAS;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvB,qFAAqF;gBACrF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAClB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7H,CAAC;YACD,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC;YACnD,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;iBACvD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;;gBACnF,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC;oBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7E,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,IAAI,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,iHAAiH,CAAC,CAAC;IAC3I,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,sHAAsH,EAAE,UAAU,CAAC,CAAC;IAC3J,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,wNAAwN,CAAC,CAAC;IACrO,CAAC;SAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;IACtG,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,8CAA8C,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1I,KAAK,MAAM,GAAG,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,CAAC;YACrD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACzC,GAAG,CAAC,GAAG,CACL,YAAY,EACZ,IAAA,oBAAO,EAAC;gBACN,EAAE,EAAE,GAAG,KAAK,IAAI,KAAK,EAAE;gBACvB,eAAe,EAAE,KAAK;gBACtB,KAAK;gBACL,IAAI;gBACJ,MAAM,EAAE,SAAkB;gBAC1B,eAAe,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACtE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;gBAChC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;aACjC,CAAC,EACF,GAAG,KAAK,IAAI,KAAK,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IACjE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,cAAuB,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAClI,CAAC;IAED,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,mCAAmC,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1G,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,mFAAmF,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEvI,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+DAA+D;AAC/D,SAAgB,iBAAiB,CAAC,CAAM;IACtC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACrC,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,eAAe,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACrF,QAAQ;QACR,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC3B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC5C,gBAAgB,EAAE,IAAA,gBAAG,EAAC,EAAE,GAAG,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7H,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;QAC9B,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;KACxC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,8CAA8C;AAC9C,SAAS,IAAI,CAAC,CAAU;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,IAAI,GAAU,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,cAAQ,EAAC,CAAC,CAAC,CAAC;IAChI,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;iBAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IAChE,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,GAAG,GAAG,aAAa,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAClB,IAAI,IAAI,EAAE,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,mDAAmD,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,GAAG,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,2BAA2B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpI,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAClB,IAAI,IAAI,EAAE,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,QAAQ,CAAI,EAAoB;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/migrate/export/source-lines.d.ts

@@ -0,0 +1,17 @@
+import type { ReportStatus } from '../framework/plugin';
+import type { ConfigBuilder } from './translate-kit';
+/**
+ * Report lines that point at a config FILE the owner keeps (appwrite.json,
+ * nhost.toml, pb_schema.json): the 1-based line a setting sits on, so the
+ * report reads `nhost/nhost.toml:42` instead of a bare setting path.
+ */
+/**
+ * The line of a JSON key path (`["settings", "auth", "security", "duration"]`)
+ * in a JSON text, found by walking the quoted keys in order. Undefined when a
+ * key is missing (the report then names only the setting path).
+ */
+export declare function jsonKeyLine(text: string, path: string[]): number | undefined;
+/** The 1-based line of a character offset. */
+export declare function lineAt(text: string, offset: number): number;
+/** Add a report line with a file location (when the line is known). */
+export declare function addAt(b: ConfigBuilder, file: string | undefined, line: number | undefined, status: ReportStatus, area: string, setting: string, note: string, atlas?: string): void;

package/dist/migrate/export/source-lines.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jsonKeyLine = jsonKeyLine;
+exports.lineAt = lineAt;
+exports.addAt = addAt;
+/**
+ * Report lines that point at a config FILE the owner keeps (appwrite.json,
+ * nhost.toml, pb_schema.json): the 1-based line a setting sits on, so the
+ * report reads `nhost/nhost.toml:42` instead of a bare setting path.
+ */
+/**
+ * The line of a JSON key path (`["settings", "auth", "security", "duration"]`)
+ * in a JSON text, found by walking the quoted keys in order. Undefined when a
+ * key is missing (the report then names only the setting path).
+ */
+function jsonKeyLine(text, path) {
+    let at = 0;
+    for (const key of path) {
+        const i = text.indexOf(`"${key}"`, at);
+        if (i < 0)
+            return undefined;
+        at = i + key.length + 2;
+    }
+    return lineAt(text, at);
+}
+/** The 1-based line of a character offset. */
+function lineAt(text, offset) {
+    let line = 1;
+    for (let i = 0; i < offset && i < text.length; i++)
+        if (text.charCodeAt(i) === 10)
+            line++;
+    return line;
+}
+/** Add a report line with a file location (when the line is known). */
+function addAt(b, file, line, status, area, setting, note, atlas) {
+    b.add(status, area, setting, note, atlas);
+    if (file && line) {
+        const entry = b.report[b.report.length - 1];
+        entry.file = file;
+        entry.line = line;
+    }
+}
+//# sourceMappingURL=source-lines.js.map

package/dist/migrate/export/source-lines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-lines.js","sourceRoot":"","sources":["../../../src/migrate/export/source-lines.ts"],"names":[],"mappings":";;AAcA,kCAQC;AAGD,wBAIC;AAGD,sBAOC;AApCD;;;;GAIG;AAEH;;;;GAIG;AACH,SAAgB,WAAW,CAAC,IAAY,EAAE,IAAc;IACtD,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5B,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,8CAA8C;AAC9C,SAAgB,MAAM,CAAC,IAAY,EAAE,MAAc;IACjD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,CAAC;IAC1F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,SAAgB,KAAK,CAAC,CAAgB,EAAE,IAAwB,EAAE,IAAwB,EAAE,MAAoB,EAAE,IAAY,EAAE,OAAe,EAAE,IAAY,EAAE,KAAc;IAC3K,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/migrate/export/sso-metadata.d.ts

@@ -0,0 +1,47 @@
+import type { SsoConnectionRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+export interface SamlIdp {
+    entityId: string;
+    ssoUrl?: string;
+    ssoBinding?: string;
+    certificates: string[];
+    nameIdFormat?: string;
+    wantAuthnRequestsSigned?: boolean;
+}
+/** Every identity provider in a metadata document. Throws on a document with none. */
+export declare function parseSamlMetadata(xml: string): SamlIdp[];
+export interface SsoConnectionOptions {
+    name?: string;
+    domains?: string[];
+    organizationId?: string;
+    metadataUrl?: string;
+    id?: string;
+}
+export declare function samlConnections(xml: string, o?: SsoConnectionOptions): {
+    connections: SsoConnectionRecord[];
+    warnings: string[];
+};
+export interface OidcDiscovery {
+    issuer: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    userinfo_endpoint?: string;
+    jwks_uri?: string;
+    scopes_supported: string[];
+    grant_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+}
+/** The discovery URL for an issuer or a discovery URL. */
+export declare function discoveryUrl(input: string): string;
+export declare function parseDiscovery(doc: unknown, requested: string): OidcDiscovery;
+export declare function fetchDiscovery(fetchImpl: typeof fetch, input: string): Promise<OidcDiscovery>;
+export declare function oidcConnection(d: OidcDiscovery, o?: SsoConnectionOptions & {
+    clientId?: string;
+    clientSecret?: string;
+}): SsoConnectionRecord;
+/** The records an SSO-only route writes: the connection, and an organization when it belongs to one. */
+export declare function connectionSet(connections: SsoConnectionRecord[], origin: string, organization?: {
+    id: string;
+    name: string;
+}): RecordSet;
+export type { Obj };

package/dist/migrate/export/sso-metadata.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSamlMetadata = parseSamlMetadata;
+exports.samlConnections = samlConnections;
+exports.discoveryUrl = discoveryUrl;
+exports.parseDiscovery = parseDiscovery;
+exports.fetchDiscovery = fetchDiscovery;
+exports.oidcConnection = oidcConnection;
+exports.connectionSet = connectionSet;
+const record_set_1 = require("./record-set");
+/**
+ * The SSO connections any identity provider hands over as standard documents:
+ * SAML 2.0 IdP metadata (an EntityDescriptor, or an EntitiesDescriptor
+ * federation) and an OpenID Connect discovery document. Used by the `saml` and
+ * `oidc` routes, and by every vendor whose enterprise connections are
+ * described by one of the two.
+ */
+// ── SAML metadata ───────────────────────────────────────────────────────────
+const attr = (tag, name) => {
+    const m = new RegExp(`\\b${name}\\s*=\\s*("([^"]*)"|'([^']*)')`).exec(tag);
+    const v = m ? (m[2] ?? m[3]) : undefined;
+    return v === undefined ? undefined : decodeXml(v);
+};
+function decodeXml(s) {
+    return s.replace(/&(lt|gt|amp|quot|apos|#x[0-9a-f]+|#\d+);/gi, (_, e) => {
+        const l = e.toLowerCase();
+        if (l === 'lt')
+            return '<';
+        if (l === 'gt')
+            return '>';
+        if (l === 'amp')
+            return '&';
+        if (l === 'quot')
+            return '"';
+        if (l === 'apos')
+            return "'";
+        return String.fromCodePoint(l.startsWith('#x') ? parseInt(l.slice(2), 16) : parseInt(l.slice(1), 10));
+    });
+}
+/** Elements by local name, ignoring any namespace prefix (`md:`, `ds:`, none). */
+function elements(xml, local) {
+    const out = [];
+    const re = new RegExp(`<(?:[A-Za-z0-9_-]+:)?${local}\\b([^>]*?)(/>|>([\\s\\S]*?)</(?:[A-Za-z0-9_-]+:)?${local}\\s*>)`, 'g');
+    for (let m = re.exec(xml); m; m = re.exec(xml))
+        out.push({ tag: m[1], body: m[3] ?? '' });
+    return out;
+}
+/** Every identity provider in a metadata document. Throws on a document with none. */
+function parseSamlMetadata(xml) {
+    if (/<!DOCTYPE|<!ENTITY/i.test(xml))
+        throw new Error('The metadata contains a DOCTYPE / ENTITY declaration, which is refused.');
+    const idps = [];
+    const scoped = elements(xml, 'EntityDescriptor');
+    // An EntityDescriptor nested in an EntitiesDescriptor is matched by the regex too; a lone one matches once.
+    for (const ed of scoped) {
+        const idp = elements(ed.body, 'IDPSSODescriptor')[0];
+        const entityId = attr(`${ed.tag}`, 'entityID');
+        if (!idp || !entityId)
+            continue;
+        const services = elements(idp.body, 'SingleSignOnService').map((s) => ({ binding: attr(s.tag, 'Binding') ?? '', location: attr(s.tag, 'Location') }));
+        const pick = services.find((s) => s.binding.endsWith('HTTP-Redirect') && s.location) ?? services.find((s) => s.binding.endsWith('HTTP-POST') && s.location) ?? services.find((s) => s.location);
+        const certs = [];
+        for (const k of elements(idp.body, 'KeyDescriptor')) {
+            if (attr(k.tag, 'use') === 'encryption')
+                continue;
+            for (const c of elements(k.body, 'X509Certificate')) {
+                const b64 = c.body.replace(/\s+/g, '');
+                if (/^[A-Za-z0-9+/=]+$/.test(b64) && !certs.includes(b64))
+                    certs.push(b64);
+            }
+        }
+        idps.push((0, record_set_1.compact)({
+            entityId,
+            ssoUrl: pick?.location,
+            ssoBinding: pick?.binding,
+            certificates: certs,
+            nameIdFormat: elements(idp.body, 'NameIDFormat')[0]?.body.trim() || undefined,
+            wantAuthnRequestsSigned: attr(idp.tag, 'WantAuthnRequestsSigned') === 'true' ? true : undefined,
+        }));
+    }
+    if (!idps.length)
+        throw new Error('No identity provider (IDPSSODescriptor) found in the SAML metadata.');
+    return idps;
+}
+const pem = (b64) => `-----BEGIN CERTIFICATE-----\n${b64.match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----\n`;
+function samlConnections(xml, o = {}) {
+    const idps = parseSamlMetadata(xml);
+    const warnings = [];
+    const connections = idps.map((idp, i) => {
+        // compact() drops an empty certificate list.
+        const certificates = idp.certificates ?? [];
+        if (!idp.ssoUrl)
+            warnings.push(`${idp.entityId}: no SingleSignOnService in the metadata.`);
+        if (!certificates.length)
+            warnings.push(`${idp.entityId}: no signing certificate in the metadata; Atlas cannot verify its assertions.`);
+        if (certificates.length > 1)
+            warnings.push(`${idp.entityId}: ${certificates.length} signing certificates; the first is imported, add the others in the dashboard when the IdP rolls its key.`);
+        return (0, record_set_1.compact)({
+            id: o.id ?? (idps.length > 1 ? `${slug(idp.entityId)}-${i + 1}` : slug(idp.entityId)),
+            name: o.name ?? hostName(idp.entityId),
+            organization_id: o.organizationId,
+            protocol: 'saml',
+            domains: o.domains,
+            enabled: true,
+            saml: (0, record_set_1.compact)({
+                idp_entity_id: idp.entityId,
+                idp_sso_url: idp.ssoUrl,
+                idp_certificate: certificates[0] ? pem(certificates[0]) : undefined,
+                idp_metadata_url: o.metadataUrl,
+                idp_metadata_xml: idps.length === 1 ? xml : undefined,
+            }),
+        });
+    });
+    return { connections, warnings };
+}
+const slug = (s) => s.replace(/^https?:\/\//, '').replace(/[^A-Za-z0-9]+/g, '-').replace(/^-+|-+$/g, '').toLowerCase().slice(0, 64) || 'saml';
+const hostName = (entityId) => {
+    try {
+        return new URL(entityId).host;
+    }
+    catch {
+        return entityId.slice(0, 64);
+    }
+};
+/** The discovery URL for an issuer or a discovery URL. */
+function discoveryUrl(input) {
+    const u = input.trim().replace(/\/+$/, '');
+    if (!/^https:\/\//i.test(u))
+        throw new Error('The OpenID Connect issuer must be an https:// URL.');
+    return u.endsWith('/.well-known/openid-configuration') ? u : `${u}/.well-known/openid-configuration`;
+}
+function parseDiscovery(doc, requested) {
+    if (!(0, record_set_1.isObj)(doc) || !(0, record_set_1.str)(doc.issuer))
+        throw new Error('The discovery document has no issuer.');
+    const issuer = (0, record_set_1.str)(doc.issuer);
+    const want = requested.replace(/\/\.well-known\/openid-configuration$/, '').replace(/\/+$/, '');
+    // RFC 8414 §3.3: the issuer in the document must equal the one it was fetched for.
+    if (issuer.replace(/\/+$/, '') !== want)
+        throw new Error(`The discovery document names issuer ${issuer}, not ${want}.`);
+    return {
+        issuer,
+        authorization_endpoint: (0, record_set_1.str)(doc.authorization_endpoint),
+        token_endpoint: (0, record_set_1.str)(doc.token_endpoint),
+        userinfo_endpoint: (0, record_set_1.str)(doc.userinfo_endpoint),
+        jwks_uri: (0, record_set_1.str)(doc.jwks_uri),
+        scopes_supported: (0, record_set_1.strs)(doc.scopes_supported),
+        grant_types_supported: (0, record_set_1.strs)(doc.grant_types_supported),
+        id_token_signing_alg_values_supported: (0, record_set_1.strs)(doc.id_token_signing_alg_values_supported),
+    };
+}
+async function fetchDiscovery(fetchImpl, input) {
+    const url = discoveryUrl(input);
+    const res = await fetchImpl(url, { headers: { accept: 'application/json' }, redirect: 'error' });
+    if (res.status !== 200)
+        throw new Error(`${url} answered ${res.status}.`);
+    return parseDiscovery(await res.json().catch(() => null), input.trim().replace(/\/\.well-known\/openid-configuration$/, ''));
+}
+function oidcConnection(d, o = {}) {
+    const scopes = ['openid', 'email', 'profile'].filter((s) => d.scopes_supported.length === 0 || d.scopes_supported.includes(s));
+    return (0, record_set_1.compact)({
+        id: o.id ?? slug(d.issuer),
+        name: o.name ?? hostName(d.issuer),
+        organization_id: o.organizationId,
+        protocol: 'oidc',
+        domains: o.domains,
+        enabled: true,
+        oidc: (0, record_set_1.compact)({ issuer: d.issuer, discovery_url: discoveryUrl(d.issuer), client_id: o.clientId, client_secret: o.clientSecret, scopes }),
+    });
+}
+/** The records an SSO-only route writes: the connection, and an organization when it belongs to one. */
+function connectionSet(connections, origin, organization) {
+    const set = new record_set_1.RecordSet();
+    set.manifest = { origin };
+    if (organization)
+        set.add('organization', { id: organization.id, name: organization.name, slug: slug(organization.name) }, organization.id);
+    for (const c of connections)
+        set.add('sso_connection', organization ? { ...c, organization_id: organization.id } : c, c.id);
+    return set;
+}
+//# sourceMappingURL=sso-metadata.js.map

package/dist/migrate/export/sso-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-metadata.js","sourceRoot":"","sources":["../../../src/migrate/export/sso-metadata.ts"],"names":[],"mappings":";;AAiDA,8CA8BC;AAYD,0CA0BC;AAyBD,oCAIC;AAED,wCAgBC;AAED,wCAKC;AAED,wCAWC;AAGD,sCAMC;AAhMD,6CAA8E;AAE9E;;;;;;GAMG;AAEH,+EAA+E;AAE/E,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,IAAY,EAAsB,EAAE;IAC7D,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,gCAAgC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,4CAA4C,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE;QAC9E,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QAC3B,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC;QAC5B,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,GAAG,CAAC;QAC7B,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,GAAG,CAAC;QAC7B,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,GAAW,EAAE,KAAa;IAC1C,MAAM,GAAG,GAAyC,EAAE,CAAC;IACrD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,wBAAwB,KAAK,qDAAqD,KAAK,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5H,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,sFAAsF;AACtF,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAChI,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACjD,4GAA4G;IAC5G,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ;YAAE,SAAS;QAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACtJ,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChM,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,YAAY;gBAAE,SAAS;YAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBACpD,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACvC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAA,oBAAO,EAAC;YAChB,QAAQ;YACR,MAAM,EAAE,IAAI,EAAE,QAAQ;YACtB,UAAU,EAAE,IAAI,EAAE,OAAO;YACzB,YAAY,EAAE,KAAK;YACnB,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,SAAS;YAC7E,uBAAuB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SACrF,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,gCAAgC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;AAU9H,SAAgB,eAAe,CAAC,GAAW,EAAE,IAA0B,EAAE;IACvE,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAuB,EAAE;QAC3D,6CAA6C;QAC7C,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,2CAA2C,CAAC,CAAC;QAC3F,IAAI,CAAC,YAAY,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,+EAA+E,CAAC,CAAC;QACxI,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,MAAM,2GAA2G,CAAC,CAAC;QAC/L,OAAO,IAAA,oBAAO,EAAC;YACb,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrF,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,eAAe,EAAE,CAAC,CAAC,cAAc;YACjC,QAAQ,EAAE,MAAe;YACzB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,aAAa,EAAE,GAAG,CAAC,QAAQ;gBAC3B,WAAW,EAAE,GAAG,CAAC,MAAM;gBACvB,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnE,gBAAgB,EAAE,CAAC,CAAC,WAAW;gBAC/B,gBAAgB,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;aACtD,CAAC;SACoB,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;AACtJ,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC;AAeF,0DAA0D;AAC1D,SAAgB,YAAY,CAAC,KAAa;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mCAAmC,CAAC;AACvG,CAAC;AAED,SAAgB,cAAc,CAAC,GAAY,EAAE,SAAiB;IAC5D,IAAI,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,mFAAmF;IACnF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,SAAS,IAAI,GAAG,CAAC,CAAC;IACxH,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,sBAAsB,CAAC;QACvD,cAAc,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,cAAc,CAAC;QACvC,iBAAiB,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,iBAAiB,CAAC;QAC7C,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC;QAC3B,gBAAgB,EAAE,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC;QAC5C,qBAAqB,EAAE,IAAA,iBAAI,EAAC,GAAG,CAAC,qBAAqB,CAAC;QACtD,qCAAqC,EAAE,IAAA,iBAAI,EAAC,GAAG,CAAC,qCAAqC,CAAC;KACvF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,SAAuB,EAAE,KAAa;IACzE,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACjG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/H,CAAC;AAED,SAAgB,cAAc,CAAC,CAAgB,EAAE,IAAyE,EAAE;IAC1H,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/H,OAAO,IAAA,oBAAO,EAAC;QACb,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,eAAe,EAAE,CAAC,CAAC,cAAc;QACjC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;KAClH,CAAC,CAAC;AAC5B,CAAC;AAED,wGAAwG;AACxG,SAAgB,aAAa,CAAC,WAAkC,EAAE,MAAc,EAAE,YAA2C;IAC3H,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,CAAC;IAC1B,IAAI,YAAY;QAAE,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;IAC5I,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5H,OAAO,GAAG,CAAC;AACb,CAAC"}