@atlasauth/cli 0.12.0 → 0.13.0

package/dist/migrate/export/zitadel-config.js

@@ -0,0 +1,279 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configSnapshotFromExport = configSnapshotFromExport;
+exports.fetchZitadelPolicies = fetchZitadelPolicies;
+exports.fetchZitadelConfig = fetchZitadelConfig;
+exports.translateZitadelConfig = translateZitadelConfig;
+const zitadel_1 = require("./zitadel");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+const num = (v) => {
+    const n = typeof v === 'number' ? v : typeof v === 'string' && v.trim() ? Number(v) : NaN;
+    return Number.isFinite(n) ? n : undefined;
+};
+const sub = (o, camel) => {
+    const v = (0, zitadel_1.g)(o, camel);
+    return (0, record_set_1.isObj)(v) ? v : undefined;
+};
+const flag = (o, camel) => {
+    const v = (0, zitadel_1.g)(o, camel);
+    return typeof v === 'boolean' ? v : undefined;
+};
+// ── reading ─────────────────────────────────────────────────────────────────
+/** An export document (`{ orgs }`) as a config snapshot; no instance defaults. */
+function configSnapshotFromExport(doc, origin, instance) {
+    const snap = (0, zitadel_1.readZitadelExport)(doc);
+    return { origin, orgs: snap.orgs, idpTemplates: [], defaults: {}, instance };
+}
+/** The instance's default policies, best effort (a narrow role or an old version answers 4xx for some). */
+async function fetchZitadelPolicies(http) {
+    const policy = async (path) => {
+        try {
+            const { body } = await http.get(path);
+            return (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.policy) ? body.policy : undefined;
+        }
+        catch (err) {
+            if (err instanceof vendor_http_1.VendorApiError && err.status > 0 && err.status < 500)
+                return undefined;
+            throw err;
+        }
+    };
+    const factors = async (path) => {
+        try {
+            const { body } = await http.get(path);
+            return (0, record_set_1.isObj)(body) ? (0, record_set_1.strs)(body.result) : undefined;
+        }
+        catch (err) {
+            if (err instanceof vendor_http_1.VendorApiError && err.status > 0 && err.status < 500)
+                return undefined;
+            throw err;
+        }
+    };
+    return {
+        login: await policy('/admin/v1/policies/login'),
+        passwordComplexity: await policy('/admin/v1/policies/password/complexity'),
+        lockout: await policy('/admin/v1/policies/lockout'),
+        secondFactors: await factors('/admin/v1/policies/login/second_factors'),
+        multiFactors: await factors('/admin/v1/policies/login/multi_factors'),
+    };
+}
+/** Read the instance through the Admin API (an IAM_OWNER token): the export WITHOUT secrets, plus the default policies. */
+async function fetchZitadelConfig(o) {
+    const http = (0, zitadel_1.zitadelHttp)(o);
+    const instance = (0, zitadel_1.zitadelBase)(o.instance);
+    const { body } = await http.post('/admin/v1/export', { withPasswords: false, withOtp: false, responseOutput: true });
+    const snap = (0, zitadel_1.readZitadelExport)(body);
+    return { origin: `ZITADEL ${instance.replace(/^https?:\/\//, '')}`, orgs: snap.orgs, idpTemplates: await (0, zitadel_1.fetchIdpTemplates)(http), defaults: await fetchZitadelPolicies(http), instance };
+}
+// ── translation ─────────────────────────────────────────────────────────────
+/** The first organization that overrides a policy, or the instance default; notes when organizations disagree. */
+function pick(snap, camel, fallback) {
+    const found = snap.orgs.map((o) => sub(o, camel)).filter((p) => p !== undefined);
+    const distinct = new Set(found.map((p) => JSON.stringify(p)));
+    return { value: fallback ?? found[0], overridden: fallback ? found.length : distinct.size > 1 ? distinct.size : 0 };
+}
+const SECOND_FACTORS = {
+    SECOND_FACTOR_TYPE_OTP: { atlas: 'totp', label: 'Authenticator apps' },
+    SECOND_FACTOR_TYPE_U2F: { atlas: 'passkey', label: 'Security keys' },
+    SECOND_FACTOR_TYPE_OTP_EMAIL: { atlas: 'emailCode', label: 'Email code' },
+    SECOND_FACTOR_TYPE_OTP_SMS: { atlas: 'sms', label: 'SMS code' },
+};
+function translateZitadelConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const add = (status, area, setting, note, atlas) => b.add(status, area, setting, note, atlas);
+    // ── login policy ──
+    const login = pick(snap, 'loginPolicy', snap.defaults.login);
+    const lp = login.value;
+    if (login.overridden)
+        add('differs', 'login policy', 'loginPolicy', `${login.overridden} organization(s) override the instance login policy; Atlas settings are instance-wide, so the ${snap.defaults.login ? 'instance default' : 'first organization\'s policy'} is used. Check the others by hand.`);
+    if (lp) {
+        if (flag(lp, 'allowRegister') !== undefined) {
+            const open = flag(lp, 'allowRegister') === true;
+            b.set('signUpMode', open ? 'public' : 'restricted');
+            add('mapped', 'login policy', 'loginPolicy.allowRegister', open ? 'Public sign-up.' : 'Sign-up closed (invitations and the allowlist still work).', 'auth_config.signUpMode');
+        }
+        if (flag(lp, 'allowUsernamePassword') !== undefined) {
+            const on = flag(lp, 'allowUsernamePassword') === true;
+            b.set('strategies.password', on);
+            add('mapped', 'login policy', 'loginPolicy.allowUsernamePassword', on ? 'Password sign-in on.' : 'Password sign-in off.', 'auth_config.strategies.password');
+        }
+        if (flag(lp, 'allowExternalIdp') === false)
+            add('differs', 'login policy', 'loginPolicy.allowExternalIdp', 'External sign-in is off in ZITADEL: leave the social providers below disabled in Atlas.');
+        if ((0, record_set_1.str)((0, zitadel_1.g)(lp, 'passwordlessType')) === 'PASSWORDLESS_TYPE_ALLOWED') {
+            b.set('strategies.passkey', true);
+            add('mapped', 'login policy', 'loginPolicy.passwordlessType', 'Passwordless (passkey) sign-in on.', 'auth_config.strategies.passkey');
+        }
+        if (flag(lp, 'forceMfa') === true) {
+            b.set('mfaPolicy', 'required');
+            add(flag(lp, 'forceMfaLocalOnly') === true ? 'differs' : 'mapped', 'login policy', 'loginPolicy.forceMfa', flag(lp, 'forceMfaLocalOnly') === true ? 'MFA is required for every user in Atlas; ZITADEL required it only for password sign-ins (forceMfaLocalOnly).' : 'MFA always required.', 'auth_config.mfaPolicy');
+        }
+        if (flag(lp, 'hidePasswordReset') === true)
+            add('differs', 'login policy', 'loginPolicy.hidePasswordReset', 'Atlas shows "Forgot password?" whenever password sign-in is on.');
+        if (flag(lp, 'ignoreUnknownUsernames') === true)
+            add('mapped', 'login policy', 'loginPolicy.ignoreUnknownUsernames', 'Atlas answers uniformly for unknown users.');
+        const redirect = (0, record_set_1.str)((0, zitadel_1.g)(lp, 'defaultRedirectUri'));
+        if (redirect) {
+            b.push('redirect_urls', { url: redirect });
+            add('mapped', 'login policy', 'loginPolicy.defaultRedirectUri', 'Becomes a redirect URL.', 'redirect_urls');
+        }
+        for (const field of ['passwordCheckLifetime', 'externalLoginCheckLifetime', 'secondFactorCheckLifetime', 'multiFactorCheckLifetime', 'mfaInitSkipLifetime']) {
+            if ((0, zitadel_1.g)(lp, field) !== undefined)
+                add('differs', 'login policy', `loginPolicy.${field}`, `ZITADEL re-checks this factor after ${String((0, zitadel_1.g)(lp, field))}; Atlas sessions have one lifetime (auth_config.session) and sensitive actions use step-up (auth_config.stepUp).`, 'auth_config.stepUp');
+        }
+    }
+    const second = snap.defaults.secondFactors ?? [...new Set(snap.orgs.flatMap((o) => (0, record_set_1.strs)((0, zitadel_1.g)(o, 'secondFactors'))))];
+    const multi = snap.defaults.multiFactors ?? [...new Set(snap.orgs.flatMap((o) => (0, record_set_1.strs)((0, zitadel_1.g)(o, 'multiFactors'))))];
+    for (const f of second) {
+        const known = SECOND_FACTORS[f];
+        if (!known) {
+            add('manual', 'login policy', `secondFactors ${f}`, 'No Atlas counterpart.');
+            continue;
+        }
+        b.set(`mfa.factors.${known.atlas}`, true);
+        add('mapped', 'login policy', `secondFactors ${f}`, `${known.label} second factor.${known.atlas === 'totp' ? ' Seeds move with the export (`withOtp`).' : known.atlas === 'passkey' ? ' ZITADEL does not export security keys: users register again.' : ''}`, `auth_config.mfa.factors.${known.atlas}`);
+    }
+    if (multi.includes('MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION')) {
+        b.set('mfa.factors.passkey', true);
+        add('mapped', 'login policy', 'multiFactors MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION', 'Passkeys with user verification.', 'auth_config.mfa.factors.passkey');
+    }
+    // ── password complexity, lockout ──
+    const complexity = pick(snap, 'passwordComplexityPolicy', snap.defaults.passwordComplexity);
+    const pc = complexity.value;
+    if (complexity.overridden)
+        add('differs', 'password policy', 'passwordComplexityPolicy', `${complexity.overridden} organization(s) override the password policy; Atlas has one instance-wide policy.`);
+    if (pc) {
+        const min = num((0, zitadel_1.g)(pc, 'minLength'));
+        if (min !== undefined) {
+            b.set('passwordPolicy.minLength', Math.max(min, 6));
+            add('mapped', 'password policy', 'passwordComplexityPolicy.minLength', `Minimum ${min} characters.`, 'auth_config.passwordPolicy.minLength');
+        }
+        for (const [field, key, label] of [['hasUppercase', 'requireUppercase', 'an uppercase letter'], ['hasLowercase', 'requireLowercase', 'a lowercase letter'], ['hasNumber', 'requireNumber', 'a digit'], ['hasSymbol', 'requireSymbol', 'a symbol']]) {
+            if (flag(pc, field) === true) {
+                b.set(`passwordPolicy.${key}`, true);
+                add('mapped', 'password policy', `passwordComplexityPolicy.${field}`, `Requires ${label}.`, `auth_config.passwordPolicy.${key}`);
+            }
+        }
+    }
+    const lock = pick(snap, 'lockoutPolicy', snap.defaults.lockout).value;
+    if (lock) {
+        if (num((0, zitadel_1.g)(lock, 'maxPasswordAttempts')))
+            add('differs', 'lockout', 'lockoutPolicy.maxPasswordAttempts', `ZITADEL locks an account after ${String((0, zitadel_1.g)(lock, 'maxPasswordAttempts'))} failed passwords; Atlas throttles failed sign-ins per account and per IP with its own thresholds.`);
+        if (num((0, zitadel_1.g)(lock, 'maxOtpAttempts')))
+            add('differs', 'lockout', 'lockoutPolicy.maxOtpAttempts', 'Atlas limits second-factor attempts with its own thresholds.');
+    }
+    const domain = pick(snap, 'domainPolicy', undefined).value;
+    if (flag(domain, 'userLoginMustBeDomain') === true)
+        add('differs', 'login policy', 'domainPolicy.userLoginMustBeDomain', 'ZITADEL login names carried the organization domain (user@org.domain); Atlas users sign in with their email address or username (kept from the export).');
+    const privacy = pick(snap, 'privacyPolicy', undefined).value;
+    if (privacy)
+        add('manual', 'privacy policy', 'privacyPolicy', `Terms of service, privacy and help links (${[(0, record_set_1.str)((0, zitadel_1.g)(privacy, 'tosLink')), (0, record_set_1.str)((0, zitadel_1.g)(privacy, 'privacyLink')), (0, record_set_1.str)((0, zitadel_1.g)(privacy, 'helpLink'))].filter(Boolean).join(', ') || 'none set'}): publish them as Atlas policies and turn on policy acceptance.`);
+    if (pick(snap, 'labelPolicy', undefined).value)
+        add('manual', 'branding', 'labelPolicy', 'Colors, logo, icon and font: recreate them in the Atlas branding designer (per organization when needed). Custom login texts are rewritten in Atlas\'s localization.');
+    // ── projects, roles, applications ──
+    const roles = new Map();
+    let roleAssertions = 0;
+    const redirects = new Set();
+    const origins = new Set();
+    for (const org of snap.orgs) {
+        for (const r of (0, record_set_1.objs)((0, zitadel_1.g)(org, 'projectRoles'))) {
+            const key = (0, record_set_1.str)((0, zitadel_1.g)(r, 'roleKey'));
+            if (key && !roles.has(key))
+                roles.set(key, r);
+        }
+        for (const p of (0, record_set_1.objs)((0, zitadel_1.g)(org, 'projects'))) {
+            if (flag(sub(p, 'project'), 'projectRoleAssertion') === true)
+                roleAssertions++;
+        }
+        for (const a of (0, record_set_1.objs)((0, zitadel_1.g)(org, 'oidcApps'))) {
+            const app = sub(a, 'app') ?? a;
+            const name = (0, record_set_1.str)((0, zitadel_1.g)(app, 'name')) ?? (0, record_set_1.str)((0, zitadel_1.g)(a, 'appId')) ?? 'application';
+            for (const u of [...(0, record_set_1.strs)((0, zitadel_1.g)(app, 'redirectUris')), ...(0, record_set_1.strs)((0, zitadel_1.g)(app, 'postLogoutRedirectUris'))])
+                redirects.add(u);
+            for (const o of (0, record_set_1.strs)((0, zitadel_1.g)(app, 'additionalOrigins')))
+                origins.add(o);
+            const type = (0, record_set_1.str)((0, zitadel_1.g)(app, 'appType'));
+            if (type === 'OIDC_APP_TYPE_NATIVE')
+                add('manual', `applications ${name}`, 'appType NATIVE', 'A native app: register its bundle id / package name under auth_config.nativeApps and use the Atlas native SDK.', 'auth_config.nativeApps');
+            if ((0, record_set_1.strs)((0, zitadel_1.g)(app, 'grantTypes')).includes('OIDC_GRANT_TYPE_CLIENT_CREDENTIALS'))
+                add('manual', `applications ${name}`, 'grantTypes client_credentials', 'A service application: create an Atlas M2M client for it.', 'oauth_clients');
+            if ((0, record_set_1.str)((0, zitadel_1.g)(app, 'authMethodType')) === 'OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT')
+                add('manual', `applications ${name}`, 'authMethodType private_key_jwt', 'Client authentication with a signed JWT: register the application\'s public key in Atlas.');
+        }
+        for (const a of (0, record_set_1.objs)((0, zitadel_1.g)(org, 'apiApps')))
+            add('manual', `applications ${(0, record_set_1.str)((0, zitadel_1.g)(sub(a, 'app') ?? a, 'name')) ?? 'api'}`, 'API application', 'A ZITADEL API application (token introspection / JWT profile): register the API as a resource server in Atlas and verify Atlas tokens with the instance JWKS.', 'resource_servers');
+        for (const action of (0, record_set_1.objs)((0, zitadel_1.g)(org, 'actions'))) {
+            const name = (0, record_set_1.str)((0, zitadel_1.g)(sub(action, 'action') ?? action, 'name')) ?? (0, record_set_1.str)((0, zitadel_1.g)(action, 'actionId')) ?? 'action';
+            add('manual', 'actions', `action ${name}`, 'A ZITADEL Action (script on a flow trigger): rebuild it as an Atlas Action or webhook.');
+        }
+    }
+    let exact = 0;
+    for (const url of redirects) {
+        if (url.includes('*')) {
+            add('differs', 'applications', `redirectUris ${url}`, 'Atlas redirect URLs are exact (no wildcards); list each URL.', 'redirect_urls');
+            continue;
+        }
+        b.push('redirect_urls', { url });
+        exact++;
+    }
+    if (exact)
+        add('mapped', 'applications', 'oidcApps redirectUris', `${exact} redirect / post-logout URL(s) become redirect URLs.`, 'redirect_urls');
+    if (origins.size) {
+        b.instance.allowed_origins = [...origins].filter((o) => !o.includes('*'));
+        add('mapped', 'applications', 'additionalOrigins', 'Allowed origins for the browser SDK.', 'instance.allowed_origins');
+    }
+    for (const [key, r] of roles) {
+        b.push('roles', { key: (0, translate_kit_1.keyOf)(key), name: (0, record_set_1.str)((0, zitadel_1.g)(r, 'displayName')) ?? key, description: (0, record_set_1.str)((0, zitadel_1.g)(r, 'group')) ?? '', permissions: [] });
+        if ((0, translate_kit_1.keyOf)(key) !== key)
+            b.roles[key] = (0, translate_kit_1.keyOf)(key);
+    }
+    if (roles.size)
+        add('mapped', 'projects', 'projectRoles', `${roles.size} project role(s) become app roles; user grants move with the data export. Roles of different projects share one namespace in Atlas.`, 'roles');
+    if (roleAssertions)
+        add('manual', 'projects', 'projectRoleAssertion', 'ZITADEL put roles in the urn:zitadel:iam:org:project:roles claim: add the roles claim your apps read as an Atlas JWT template / session claim.', 'jwt_templates');
+    // ── identity providers ──
+    for (const idp of (0, zitadel_1.collectIdps)({ orgs: snap.orgs, idpTemplates: snap.idpTemplates, source: 'api' }).values()) {
+        const where = `identity provider ${idp.name}`;
+        const social = (0, translate_kit_1.socialKey)(idp.kind);
+        const clientId = (0, record_set_1.str)((0, zitadel_1.g)(idp.config, 'clientId'));
+        if (social) {
+            b.socialProvider({ atlasKey: social, vendorName: social, area: 'identity providers', setting: where, clientId, scopes: (0, record_set_1.strs)((0, zitadel_1.g)(idp.config, 'scopes')).length ? (0, record_set_1.strs)((0, zitadel_1.g)(idp.config, 'scopes')) : undefined });
+        }
+        else if (idp.kind === 'oidc') {
+            const providerKey = (0, translate_kit_1.keyOf)(idp.name).replace(/:/g, '_').slice(0, 48) || 'oidc';
+            const upper = providerKey.toUpperCase();
+            const issuer = (0, record_set_1.str)((0, zitadel_1.g)(idp.config, 'issuer'));
+            const doc = {
+                provider_key: providerKey,
+                display_name: idp.name,
+                protocol: 'oidc',
+                client_id: clientId ?? b.placeholder(`${upper}_CLIENT_ID`, `${idp.name} client id`),
+                client_secret: b.placeholder(`${upper}_CLIENT_SECRET`, `${idp.name} client secret`),
+                enabled: true,
+                allow_sign_in: true,
+                allow_sign_up: true,
+            };
+            if (issuer) {
+                doc.issuer = issuer;
+                doc.discovery_url = `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`;
+            }
+            if ((0, record_set_1.strs)((0, zitadel_1.g)(idp.config, 'scopes')).length)
+                doc.scopes = (0, record_set_1.strs)((0, zitadel_1.g)(idp.config, 'scopes'));
+            b.push('custom_oauth_providers', doc);
+            b.providers[idp.name] = providerKey;
+            add('differs', 'identity providers', where, `Generic OIDC provider "${idp.name}"${issuer ? ` (issuer ${issuer})` : ''} moves with the data export as an SSO connection when it serves an organization, and as the custom OIDC provider "${providerKey}" for sign-in. Add Atlas's redirect URI at the provider and set ${upper}_CLIENT_SECRET.`, `custom_oauth_providers ${providerKey}`);
+        }
+        else if (idp.kind === 'saml') {
+            add('mapped', 'identity providers', where, 'SAML provider: moves with the data export as an SSO connection. Give the IdP Atlas\'s ACS URL and entity id before turning it on.', 'sso_connections');
+        }
+        else {
+            add('manual', 'identity providers', where, `A ${idp.kind} identity provider has no built-in Atlas provider: add it as a custom OAuth provider, or let those users sign in with email.`, 'custom_oauth_providers');
+        }
+    }
+    const vars = snap.instance ? { issuer: snap.instance } : {};
+    return b.result(snap.origin, {
+        bridge: { preset: 'zitadel', vars },
+        ...(snap.instance ? { lazy: { preset: 'zitadel', config: { base_url: snap.instance } } } : {}),
+    });
+}
+//# sourceMappingURL=zitadel-config.js.map

package/dist/migrate/export/zitadel-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadel-config.js","sourceRoot":"","sources":["../../../src/migrate/export/zitadel-config.ts"],"names":[],"mappings":";;AAoDA,4DAGC;AAGD,oDA0BC;AAGD,gDAMC;AAkBD,wDA8KC;AA3RD,uCAAmI;AACnI,6CAAgE;AAChE,mDAAkE;AAClE,+CAA2D;AA+B3D,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE;IAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1F,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC,CAAC;AACF,MAAM,GAAG,GAAG,CAAC,CAAkB,EAAE,KAAa,EAAmB,EAAE;IACjE,MAAM,CAAC,GAAG,IAAA,WAAC,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,OAAO,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClC,CAAC,CAAC;AACF,MAAM,IAAI,GAAG,CAAC,CAAkB,EAAE,KAAa,EAAuB,EAAE;IACtE,MAAM,CAAC,GAAG,IAAA,WAAC,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC,CAAC;AAEF,+EAA+E;AAE/E,kFAAkF;AAClF,SAAgB,wBAAwB,CAAC,GAAY,EAAE,MAAc,EAAE,QAAiB;IACtF,MAAM,IAAI,GAAG,IAAA,2BAAiB,EAAC,GAAG,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC/E,CAAC;AAED,2GAA2G;AACpG,KAAK,UAAU,oBAAoB,CAAC,IAAgB;IACzD,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAA4B,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;YAC/C,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAAc,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC1F,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAiC,EAAE;QACpE,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;YAC/C,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAAc,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC1F,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,MAAM,MAAM,CAAC,0BAA0B,CAAC;QAC/C,kBAAkB,EAAE,MAAM,MAAM,CAAC,wCAAwC,CAAC;QAC1E,OAAO,EAAE,MAAM,MAAM,CAAC,4BAA4B,CAAC;QACnD,aAAa,EAAE,MAAM,OAAO,CAAC,yCAAyC,CAAC;QACvE,YAAY,EAAE,MAAM,OAAO,CAAC,wCAAwC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,2HAA2H;AACpH,KAAK,UAAU,kBAAkB,CAAC,CAAwE;IAC/G,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAU,kBAAkB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9H,MAAM,IAAI,GAAG,IAAA,2BAAiB,EAAC,IAAI,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,IAAA,2BAAiB,EAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC3L,CAAC;AAED,+EAA+E;AAE/E,kHAAkH;AAClH,SAAS,IAAI,CAAC,IAA2B,EAAE,KAAa,EAAE,QAAyB;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtH,CAAC;AAED,MAAM,cAAc,GAAqD;IACvE,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACtE,sBAAsB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE;IACpE,4BAA4B,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE;IACzE,0BAA0B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE;CAChE,CAAC;AAEF,SAAgB,sBAAsB,CAAC,IAA2B;IAChE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,MAAuC,EAAE,IAAY,EAAE,OAAe,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAEhK,qBAAqB;IACrB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC;IACvB,IAAI,KAAK,CAAC,UAAU;QAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,iGAAiG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,8BAA8B,qCAAqC,CAAC,CAAC;IACxS,IAAI,EAAE,EAAE,CAAC;QACP,IAAI,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,KAAK,IAAI,CAAC;YAChD,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACpD,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,2BAA2B,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,4DAA4D,EAAE,wBAAwB,CAAC,CAAC;QAChL,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,uBAAuB,CAAC,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,uBAAuB,CAAC,KAAK,IAAI,CAAC;YACtD,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;YACjC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,mCAAmC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,uBAAuB,EAAE,iCAAiC,CAAC,CAAC;QAC/J,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC,KAAK,KAAK;YAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,8BAA8B,EAAE,yFAAyF,CAAC,CAAC;QACtM,IAAI,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC,KAAK,2BAA2B,EAAE,CAAC;YACnE,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAClC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,gCAAgC,CAAC,CAAC;QACxI,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,8GAA8G,CAAC,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;QACxT,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,+BAA+B,EAAE,iEAAiE,CAAC,CAAC;QAC/K,IAAI,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,oCAAoC,EAAE,4CAA4C,CAAC,CAAC;QACnK,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,eAAe,CAAC,CAAC;QAC9G,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,uBAAuB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,qBAAqB,CAAC,EAAE,CAAC;YAC5J,IAAI,IAAA,WAAC,EAAC,EAAE,EAAE,KAAK,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,eAAe,KAAK,EAAE,EAAE,uCAAuC,MAAM,CAAC,IAAA,WAAC,EAAC,EAAE,EAAE,KAAK,CAAC,CAAC,kHAAkH,EAAE,oBAAoB,CAAC,CAAC;QAC9R,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,iBAAiB,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,iBAAiB,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,kBAAkB,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,2BAA2B,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1S,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;QAC9D,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,sDAAsD,EAAE,kCAAkC,EAAE,iCAAiC,CAAC,CAAC;IAC/J,CAAC;IAED,qCAAqC;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC5F,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC;IAC5B,IAAI,UAAU,CAAC,UAAU;QAAE,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,GAAG,UAAU,CAAC,UAAU,oFAAoF,CAAC,CAAC;IACvM,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,GAAG,GAAG,GAAG,CAAC,IAAA,WAAC,EAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACpD,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,oCAAoC,EAAE,WAAW,GAAG,cAAc,EAAE,sCAAsC,CAAC,CAAC;QAC/I,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,kBAAkB,EAAE,qBAAqB,CAAC,EAAE,CAAC,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,EAAE,CAAC,WAAW,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,CAAC,CAAU,EAAE,CAAC;YAC5P,IAAI,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7B,CAAC,CAAC,GAAG,CAAC,kBAAkB,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;gBACrC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,4BAA4B,KAAK,EAAE,EAAE,YAAY,KAAK,GAAG,EAAE,8BAA8B,GAAG,EAAE,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;IACtE,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,GAAG,CAAC,IAAA,WAAC,EAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,mCAAmC,EAAE,kCAAkC,MAAM,CAAC,IAAA,WAAC,EAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,oGAAoG,CAAC,CAAC;QACtR,IAAI,GAAG,CAAC,IAAA,WAAC,EAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,8BAA8B,EAAE,8DAA8D,CAAC,CAAC;IAChK,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,oCAAoC,EAAE,yJAAyJ,CAAC,CAAC;IACpR,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC;IAC7D,IAAI,OAAO;QAAE,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,eAAe,EAAE,6CAA6C,CAAC,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,kEAAkE,CAAC,CAAC;IACjT,IAAI,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,KAAK;QAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,sKAAsK,CAAC,CAAC;IAEjQ,sCAAsC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAe,CAAC;IACrC,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YACjC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,sBAAsB,CAAC,KAAK,IAAI;gBAAE,cAAc,EAAE,CAAC;QACjF,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,aAAa,CAAC;YACxE,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/G,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YACpC,IAAI,IAAI,KAAK,sBAAsB;gBAAE,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,gBAAgB,EAAE,gHAAgH,EAAE,wBAAwB,CAAC,CAAC;YACzO,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;gBAAE,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,+BAA+B,EAAE,2DAA2D,EAAE,eAAe,CAAC,CAAC;YACpO,IAAI,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,KAAK,uCAAuC;gBAAE,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,gCAAgC,EAAE,2FAA2F,CAAC,CAAC;QACtP,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,KAAK,EAAE,EAAE,iBAAiB,EAAE,+JAA+J,EAAE,kBAAkB,CAAC,CAAC;QAC9T,KAAK,MAAM,MAAM,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,QAAQ,CAAC;YACvG,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,wFAAwF,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,GAAG,EAAE,EAAE,8DAA8D,EAAE,eAAe,CAAC,CAAC;YACvI,SAAS;QACX,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,KAAK;QAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,uBAAuB,EAAE,GAAG,KAAK,sDAAsD,EAAE,eAAe,CAAC,CAAC;IACnJ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,eAAe,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC;IACzH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAA,qBAAK,EAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,aAAa,CAAC,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;QAC5I,IAAI,IAAA,qBAAK,EAAC,GAAG,CAAC,KAAK,GAAG;YAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI;QAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,IAAI,qIAAqI,EAAE,OAAO,CAAC,CAAC;IACvN,IAAI,cAAc;QAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,sBAAsB,EAAE,gJAAgJ,EAAE,eAAe,CAAC,CAAC;IAEzO,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5G,MAAM,KAAK,GAAG,qBAAqB,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7M,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,IAAA,qBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;YAC9E,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAyB;gBAChC,YAAY,EAAE,WAAW;gBACzB,YAAY,EAAE,GAAG,CAAC,IAAI;gBACtB,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,YAAY,EAAE,GAAG,GAAG,CAAC,IAAI,YAAY,CAAC;gBACnF,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,gBAAgB,EAAE,GAAG,GAAG,CAAC,IAAI,gBAAgB,CAAC;gBACnF,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,IAAI;gBACnB,aAAa,EAAE,IAAI;aACpB,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;gBACpB,GAAG,CAAC,aAAa,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC;YACvF,CAAC;YACD,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM;gBAAE,GAAG,CAAC,MAAM,GAAG,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrF,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;YACpC,GAAG,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,0BAA0B,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,YAAY,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,qHAAqH,WAAW,mEAAmE,KAAK,iBAAiB,EAAE,0BAA0B,WAAW,EAAE,CAAC,CAAC;QAC3X,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/B,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,mIAAmI,EAAE,iBAAiB,CAAC,CAAC;QACrM,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,IAAI,8HAA8H,EAAE,wBAAwB,CAAC,CAAC;QACpN,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAA2B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;QAC3B,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/zitadel.d.ts

@@ -0,0 +1,82 @@
+import type { PasswordHash } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export zitadel` — a ZITADEL instance (ZITADEL Cloud or
+ * self-hosted) onto the canonical bundle models. Two ways in, both on the
+ * owner's machine, and both read ZITADEL's own EXPORT document (the
+ * `ImportData` the `zitadel export` command and `POST /admin/v1/export` write,
+ * with `withPasswords` / `withOtp` on):
+ *
+ *   - the FILE a `zitadel export` run (or a saved admin export response) wrote;
+ *   - the ADMIN API, `POST /admin/v1/export` with a service-user token that has
+ *     the IAM_OWNER role. When the export endpoint is refused or missing (older
+ *     versions, a user that is only IAM_OWNER_VIEWER) the exporter falls back to
+ *     listing users with the v2 user API: profile, email and phone, but no
+ *     password hashes, TOTP seeds or social links.
+ *
+ * The export carries, per organization: the human users with their hashed
+ * password (the exact `$2a$…`, `$argon2id$…`, `$scrypt$…`, `$pbkdf2-…` string
+ * ZITADEL verifies), TOTP secret, social-login links, profile, verified email
+ * and phone; project roles and user grants; organization members and domains;
+ * identity providers. The ZITADEL user id is the `sub` of every ZITADEL token,
+ * so it is the user id here.
+ *
+ * Not exportable: passkeys and U2F keys (ZITADEL keeps them only in its event
+ * store), machine users' keys, and live sessions (ZITADEL sessions are opaque;
+ * the bridge accepts ID tokens and JWT access tokens instead).
+ *
+ * Schemas: github.com/zitadel/zitadel proto/zitadel/admin.proto
+ * (`ImportDataOrg`, `ExportDataRequest`) and management.proto
+ * (`ImportHumanUserRequest`).
+ */
+export interface ZitadelSnapshot {
+    /** `ImportDataOrg` objects (camelCase from the API, either case from a file). */
+    orgs: Obj[];
+    /** Identity provider templates (`POST /admin/v1/idps/templates/_search`), to type the links an export names only by id. */
+    idpTemplates: Obj[];
+    source: 'file' | 'api' | 'users';
+    /** The instance URL (`https://acme-abc123.zitadel.cloud`), when known. */
+    instance?: string;
+}
+export interface ZitadelMapOptions {
+    /** Organizations become Atlas organizations: `all`, `skip`, or `auto` (when the instance has more than one). */
+    orgs?: 'auto' | 'all' | 'skip';
+}
+/** A field by its camelCase name, falling back to snake_case (the files `zitadel export` writes use either). */
+export declare function g(o: Obj | undefined, camel: string): unknown;
+/** The orgs in an export document: `{ orgs: [...] }`, a bare array, or one org object. */
+export declare function readZitadelExport(doc: unknown): ZitadelSnapshot;
+/**
+ * A ZITADEL `hashedPassword` ({ value, algorithm }) as a bundle password; null
+ * when Atlas cannot verify it. ZITADEL stores the self-describing encoding its
+ * hasher (passwap) verifies, so those are recognised by Atlas on their own
+ * ("auto"); the one bare form (a hex MD5) is mapped by the algorithm hint.
+ */
+export declare function zitadelPassword(hashed: unknown): PasswordHash | null;
+export interface Idp {
+    id: string;
+    name: string;
+    /** `google`, `github`, `oidc`, `saml`, `jwt`, `ldap` … */
+    kind: string;
+    config: Obj;
+}
+/** The identity providers an export names, keyed by config id; templates from the API fill gaps. */
+export declare function collectIdps(snap: ZitadelSnapshot): Map<string, Idp>;
+export declare function mapZitadel(snap: ZitadelSnapshot, opts?: ZitadelMapOptions): RecordSet;
+export interface ZitadelApiOptions {
+    /** `https://acme-abc123.zitadel.cloud` or your own domain; a bare host gets https. */
+    instance: string;
+    /** A service user's personal access token (IAM_OWNER, or IAM_OWNER_VIEWER for the no-secrets fallback). */
+    token: string;
+    pageSize?: number;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+export declare function zitadelBase(raw: string): string;
+export declare function zitadelHttp(o: Pick<ZitadelApiOptions, 'instance' | 'token' | 'fetchImpl' | 'sleep'>): VendorHttp;
+/** Identity provider templates, to type the links; best effort (an older instance or a narrow role answers 4xx). */
+export declare function fetchIdpTemplates(http: VendorHttp): Promise<Obj[]>;
+export declare function fetchZitadel(o: ZitadelApiOptions): Promise<ZitadelSnapshot>;
+export declare function exportZitadelApi(o: ZitadelApiOptions & ZitadelMapOptions): Promise<RecordSet>;