@atlasauth/cli 0.12.0 → 0.13.0

package/dist/migrate/export/authentik-config.js

@@ -0,0 +1,357 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTHENTIK_CONFIG_ENDPOINTS = void 0;
+exports.snapshotFromBlueprint = snapshotFromBlueprint;
+exports.fetchAuthentikConfig = fetchAuthentikConfig;
+exports.timedeltaMs = timedeltaMs;
+exports.translateAuthentikConfig = translateAuthentikConfig;
+const authentik_1 = require("./authentik");
+const mini_yaml_1 = require("./mini-yaml");
+const vendor_http_1 = require("./vendor-http");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+// ── readers ─────────────────────────────────────────────────────────────────
+/** `key: !Env NAME` → `key: "@env:NAME"`: tagged values are references, not values. */
+function neutralizeTags(text) {
+    return text
+        .split('\n')
+        .map((line) => {
+        const m = /^(\s*(?:-\s+)?[^\s#:][^:#]*:\s+)!([A-Za-z]+)\s+(.*?)\s*$/.exec(line);
+        if (!m)
+            return line;
+        const first = m[3].replace(/^[[(]\s*/, '').split(/[\s,\])]/)[0].replace(/^['"]|['"]$/g, '');
+        return `${m[1]}"@${m[2].toLowerCase()}:${first}"`;
+    })
+        .join('\n');
+}
+function snapshotFromBlueprint(text, file, baseUrl) {
+    const doc = (0, mini_yaml_1.parseYaml)(neutralizeTags(text));
+    const root = (0, record_set_1.isObj)(doc.value) ? doc.value : {};
+    const entries = [];
+    (0, record_set_1.objs)(root.entries).forEach((e, i) => {
+        const model = (0, record_set_1.str)(e.model)?.toLowerCase();
+        if (!model)
+            return;
+        entries.push({
+            model,
+            identifiers: (0, record_set_1.isObj)(e.identifiers) ? e.identifiers : {},
+            attrs: (0, record_set_1.isObj)(e.attrs) ? e.attrs : {},
+            file,
+            line: doc.line(`entries.${i}.model`) ?? doc.line(`entries.${i}`),
+        });
+    });
+    return { origin: `authentik blueprint ${file}`, baseUrl, entries, complete: false };
+}
+exports.AUTHENTIK_CONFIG_ENDPOINTS = [
+    ['/policies/password/', 'authentik_policies_password.passwordpolicy'],
+    ['/stages/password/', 'authentik_stages_password.passwordstage'],
+    ['/stages/user_login/', 'authentik_stages_user_login.userloginstage'],
+    ['/stages/user_write/', 'authentik_stages_user_write.userwritestage'],
+    ['/stages/identification/', 'authentik_stages_identification.identificationstage'],
+    ['/stages/email/', 'authentik_stages_email.emailstage'],
+    ['/stages/authenticator/totp/', 'authentik_stages_authenticator_totp.authenticatortotpstage'],
+    ['/stages/authenticator/webauthn/', 'authentik_stages_authenticator_webauthn.authenticatorwebauthnstage'],
+    ['/stages/authenticator/sms/', 'authentik_stages_authenticator_sms.authenticatorsmsstage'],
+    ['/stages/authenticator/static/', 'authentik_stages_authenticator_static.authenticatorstaticstage'],
+    ['/stages/authenticator/validate/', 'authentik_stages_authenticator_validate.authenticatorvalidatestage'],
+    ['/flows/instances/', 'authentik_flows.flow'],
+    ['/sources/oauth/', 'authentik_sources_oauth.oauthsource'],
+    ['/sources/saml/', 'authentik_sources_saml.samlsource'],
+    ['/sources/ldap/', 'authentik_sources_ldap.ldapsource'],
+    ['/providers/oauth2/', 'authentik_providers_oauth2.oauth2provider'],
+    ['/providers/saml/', 'authentik_providers_saml.samlprovider'],
+    ['/core/applications/', 'authentik_core.application'],
+    ['/core/brands/', 'authentik_brands.brand'],
+];
+/** Read the settings objects through the API (the token needs read access to them). */
+async function fetchAuthentikConfig(o) {
+    const base = o.baseUrl.replace(/\/+$/, '');
+    const http = new vendor_http_1.VendorHttp({ vendor: 'authentik', baseUrl: `${base}/api/v3`, headers: { authorization: `Bearer ${o.token}` }, fetchImpl: o.fetchImpl, sleep: o.sleep });
+    const entries = [];
+    let missing = 0;
+    for (const [path, model] of exports.AUTHENTIK_CONFIG_ENDPOINTS) {
+        let list;
+        try {
+            list = await (0, authentik_1.authentikList)(http, path);
+        }
+        catch (err) {
+            // An authentik without that object type, or a token that cannot read it.
+            if (err instanceof vendor_http_1.VendorApiError && [403, 404].includes(err.status)) {
+                missing++;
+                continue;
+            }
+            throw err;
+        }
+        for (const attrs of list)
+            entries.push({ model, identifiers: { pk: attrs.pk ?? attrs.pbm_uuid, name: attrs.name, slug: attrs.slug }, attrs });
+    }
+    return { origin: `authentik ${base.replace(/^https?:\/\//, '')}`, baseUrl: base, entries, complete: missing === 0 };
+}
+// ── translation ─────────────────────────────────────────────────────────────
+const UNITS = { weeks: 604_800_000, days: 86_400_000, hours: 3_600_000, minutes: 60_000, seconds: 1000, milliseconds: 1 };
+/** authentik's timedelta strings: `hours=1,minutes=30`, `seconds=0`, `days=1`. */
+function timedeltaMs(v) {
+    if (typeof v === 'number')
+        return v;
+    const s = (0, record_set_1.str)(v);
+    if (!s)
+        return undefined;
+    let total = 0;
+    for (const part of s.split(/[,;\s]+/).filter(Boolean)) {
+        const m = /^([a-z]+)=(-?\d+(?:\.\d+)?)$/.exec(part);
+        const unit = m ? UNITS[m[1]] : undefined;
+        if (!m || unit === undefined)
+            return undefined;
+        total += Number(m[2]) * unit;
+    }
+    return total;
+}
+const isRef = (v) => typeof v === 'string' && v.startsWith('@');
+/** A literal string attribute (a tagged reference or an empty value is not one). */
+const lit = (v) => (isRef(v) ? undefined : (0, record_set_1.str)(v));
+const num = (v) => (typeof v === 'number' ? v : typeof v === 'string' && /^\d+$/.test(v) ? Number(v) : undefined);
+/** The `@env:NAME` a tagged value reads, for the report. */
+const envName = (v) => (typeof v === 'string' && v.startsWith('@env:') ? v.slice(5) : undefined);
+const OIDC_SOURCE_TYPES = new Set(['openidconnect', 'okta', 'keycloak', 'authentik', 'entraid_oidc']);
+function translateAuthentikConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const m = (suffix) => snap.entries.filter((e) => e.model.endsWith(`.${suffix}`));
+    const add = (status, area, e, attr, note, atlas) => {
+        const name = (0, record_set_1.str)(e.identifiers.name) ?? (0, record_set_1.str)(e.identifiers.slug) ?? (0, record_set_1.str)(e.attrs.name) ?? (0, record_set_1.str)(e.attrs.slug) ?? '?';
+        b.report.push({
+            status,
+            area,
+            setting: `${e.model} ${name}${attr ? `.${attr}` : ''}`,
+            note,
+            ...(atlas ? { atlas } : {}),
+            ...(e.file ? { file: e.file, line: e.line } : {}),
+        });
+    };
+    // ── passwords ──
+    const policies = m('passwordpolicy');
+    policies.forEach((p, i) => {
+        if (i > 0) {
+            add('differs', 'passwords', p, null, 'Atlas has one password policy: only the first authentik policy was translated; fold the rules of this one into it.');
+            return;
+        }
+        const min = num(p.attrs.length_min);
+        if (min !== undefined) {
+            b.set('passwordPolicy.minLength', Math.max(min, 6));
+            add(min >= 6 ? 'mapped' : 'differs', 'passwords', p, 'length_min', min >= 6 ? `Minimum ${min} characters.` : `authentik allowed ${min} characters; Atlas requires at least 6.`, 'auth_config.passwordPolicy.minLength');
+        }
+        for (const [attr, key, label] of [
+            ['amount_digits', 'requireNumber', 'a digit'],
+            ['amount_uppercase', 'requireUppercase', 'an uppercase letter'],
+            ['amount_lowercase', 'requireLowercase', 'a lowercase letter'],
+            ['amount_symbols', 'requireSymbol', 'a symbol'],
+        ]) {
+            if ((num(p.attrs[attr]) ?? 0) > 0) {
+                b.set(`passwordPolicy.${key}`, true);
+                add('mapped', 'passwords', p, attr, `Passwords need ${label}${(num(p.attrs[attr]) ?? 0) > 1 ? ' (Atlas asks for one, not a count)' : ''}.`, `auth_config.passwordPolicy.${key}`);
+            }
+        }
+        if (p.attrs.check_have_i_been_pwned === true)
+            add('manual', 'passwords', p, 'check_have_i_been_pwned', 'Turn on breached-password protection in Atlas attack protection (the Have I Been Pwned check does not carry over).');
+        if (p.attrs.check_zxcvbn === true)
+            add('differs', 'passwords', p, 'check_zxcvbn', 'The zxcvbn strength score has no Atlas setting; Atlas rejects common and breached passwords instead.');
+        if ((0, record_set_1.str)(p.attrs.password_field) && p.attrs.password_field !== 'password')
+            add('differs', 'passwords', p, 'password_field', 'Policy applied to a custom prompt field; Atlas applies its policy to the password field.');
+    });
+    // ── sessions ──
+    for (const s of m('userloginstage')) {
+        const ms = timedeltaMs(s.attrs.session_duration);
+        if (ms === 0)
+            add('differs', 'sessions', s, 'session_duration', 'authentik ended the session with the browser (seconds=0); Atlas sessions persist until their idle and absolute limits (auth_config.session).');
+        else if (ms !== undefined) {
+            b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(ms));
+            add((0, translate_kit_1.clampSessionMs)(ms) === ms ? 'mapped' : 'differs', 'sessions', s, 'session_duration', 'Session duration becomes the absolute session lifetime.', 'auth_config.session.absoluteMs');
+        }
+        if (s.attrs.terminate_other_sessions === true)
+            add('manual', 'sessions', s, 'terminate_other_sessions', 'Signing in no longer ends the user\'s other sessions: use a session limit or revoke sessions from an Action.');
+        if ((0, record_set_1.str)(s.attrs.network_binding) && s.attrs.network_binding !== 'no_binding')
+            add('differs', 'sessions', s, 'network_binding', 'Sessions are not bound to the client network; Atlas applies device and risk checks instead.');
+        if ((0, record_set_1.str)(s.attrs.geoip_binding) && s.attrs.geoip_binding !== 'no_binding')
+            add('differs', 'sessions', s, 'geoip_binding', 'Sessions are not bound to the client location; Atlas applies device and risk checks instead.');
+        if (timedeltaMs(s.attrs.remember_me_offset))
+            add('differs', 'sessions', s, 'remember_me_offset', 'Atlas has no separate "remember me" lifetime.');
+    }
+    // ── sign-up, sign-in methods ──
+    const flows = m('flow');
+    const enrollment = flows.find((f) => f.attrs.designation === 'enrollment');
+    if (enrollment) {
+        b.set('signUpMode', 'public');
+        add('mapped', 'sign-up', enrollment, 'designation', 'An enrollment flow exists: public sign-up.', 'auth_config.signUpMode');
+    }
+    else if (snap.complete) {
+        b.set('signUpMode', 'restricted');
+        b.add('mapped', 'sign-up', 'flows (no enrollment flow)', 'No enrollment flow: sign-up is closed (invitations and imports still work).', 'auth_config.signUpMode');
+    }
+    const recovery = flows.find((f) => f.attrs.designation === 'recovery');
+    if (recovery)
+        add('mapped', 'sign-in', recovery, 'designation', 'A recovery flow exists: password reset by email is on in Atlas by default.', 'auth_config.strategies.password');
+    for (const s of m('identificationstage')) {
+        const passwordless = s.attrs.passwordless_flow;
+        if (passwordless !== undefined && passwordless !== null && passwordless !== '') {
+            b.set('strategies.passkey', true);
+            add('mapped', 'sign-in', s, 'passwordless_flow', 'Passwordless (WebAuthn) sign-in becomes passkey sign-in.', 'auth_config.strategies.passkey');
+        }
+        const fields = (0, record_set_1.strs)(s.attrs.user_fields);
+        if (fields.length)
+            add('differs', 'sign-in', s, 'user_fields', `Sign-in by ${fields.join(', ')}: Atlas accepts the identifiers the sign-up form collects (email, username, phone); check the instance's sign-in identifiers.`);
+        if ((0, record_set_1.strs)(s.attrs.sources).length)
+            add('mapped', 'sign-in', s, 'sources', 'The social and SAML sources offered here are translated below.');
+    }
+    for (const s of m('userwritestage')) {
+        if (s.attrs.create_users_as_inactive === true)
+            add('differs', 'sign-up', s, 'create_users_as_inactive', 'New users were created inactive until activated by another stage; Atlas holds sign-ups with its email verification and approval settings instead.');
+    }
+    for (const s of m('emailstage')) {
+        add('manual', 'email', s, null, `Connect your own email provider in Atlas (SMTP host ${lit(s.attrs.host) ?? 'from authentik settings'} is not copied) and recreate the template "${lit(s.attrs.template) ?? 'email/…'}" as an Atlas email template.`);
+        const exp = num(s.attrs.token_expiry);
+        if (exp !== undefined)
+            add('differs', 'email', s, 'token_expiry', `Links expired after ${exp} minutes; Atlas uses its own link and code lifetimes.`);
+    }
+    // ── multi-factor ──
+    for (const s of m('authenticatortotpstage')) {
+        b.set('mfa.factors.totp', true);
+        add('mapped', 'multi-factor', s, null, `Authenticator-app second factor on${num(s.attrs.digits) === 8 || s.attrs.digits === '8' ? ' (8-digit devices keep their shape when imported)' : ''}. Enrolled devices move with the database export (seeds included).`, 'auth_config.mfa.factors.totp');
+    }
+    for (const s of m('authenticatorwebauthnstage')) {
+        b.set('mfa.factors.passkey', true);
+        add('mapped', 'multi-factor', s, null, 'WebAuthn second factor on. Devices move only with the database export and the same RP id (your authentik host).', 'auth_config.mfa.factors.passkey');
+        if (lit(s.attrs.authenticator_attachment))
+            add('differs', 'multi-factor', s, 'authenticator_attachment', 'Atlas lets the user pick a platform or roaming authenticator.');
+    }
+    for (const s of m('authenticatorsmsstage')) {
+        b.set('mfa.factors.sms', true);
+        add('mapped', 'multi-factor', s, null, 'SMS second factor on.', 'auth_config.mfa.factors.sms');
+        add('manual', 'multi-factor', s, 'provider', `Connect your own SMS provider (${lit(s.attrs.provider) ?? 'twilio / generic'}); its credentials are not copied.`);
+    }
+    for (const s of m('authenticatorstaticstage')) {
+        add('differs', 'multi-factor', s, null, 'Static recovery tokens move as backup codes with the database export; Atlas generates its own codes for new enrolments.', 'auth_config.mfa');
+    }
+    for (const s of m('authenticatorvalidatestage')) {
+        const action = lit(s.attrs.not_configured_action);
+        add('differs', 'multi-factor', s, 'not_configured_action', action === 'deny' ? 'Users without a factor were refused: turn on "require a second factor" in the Atlas MFA settings.' : action === 'configure' ? 'Users without a factor had to enrol one: turn on "require a second factor" in the Atlas MFA settings.' : 'Users without a factor skipped the check; Atlas asks for a second factor only from users who enrolled one unless you require it.', 'auth_config.mfa');
+    }
+    // ── social and SAML sources ──
+    for (const s of m('oauthsource')) {
+        if (s.attrs.enabled === false)
+            continue;
+        const slug = lit(s.identifiers.slug) ?? lit(s.attrs.slug) ?? '?';
+        const type = lit(s.attrs.provider_type)?.toLowerCase() ?? '';
+        const key = OIDC_SOURCE_TYPES.has(type) ? null : (0, translate_kit_1.socialKey)(type);
+        const clientId = lit(s.attrs.consumer_key);
+        if (key) {
+            b.socialProvider({ atlasKey: key, vendorName: slug, area: 'sources', setting: `${s.model} ${slug}.provider_type`, clientId });
+            const last = b.report[b.report.length - 1];
+            if (s.file)
+                Object.assign(last, { file: s.file, line: s.line });
+            continue;
+        }
+        if (OIDC_SOURCE_TYPES.has(type) || type === 'oauth' || type === '') {
+            const providerKey = slug.toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '').slice(0, 48) || 'oidc';
+            const upper = providerKey.toUpperCase();
+            const doc = {
+                provider_key: providerKey,
+                display_name: (0, record_set_1.str)(s.attrs.name) ?? slug,
+                protocol: 'oidc',
+                client_id: clientId ?? b.placeholder(`${upper}_CLIENT_ID`, `${slug} client id`),
+                client_secret: b.placeholder(`${upper}_CLIENT_SECRET`, `${slug} client secret`),
+                enabled: true,
+                allow_sign_in: true,
+                allow_sign_up: s.attrs.enrollment_flow !== null,
+            };
+            const wellKnown = lit(s.attrs.oidc_well_known_url);
+            if (wellKnown)
+                doc.discovery_url = wellKnown;
+            if (lit(s.attrs.authorization_url))
+                doc.authorization_url = lit(s.attrs.authorization_url);
+            if (lit(s.attrs.access_token_url))
+                doc.token_url = lit(s.attrs.access_token_url);
+            if (lit(s.attrs.profile_url))
+                doc.userinfo_url = lit(s.attrs.profile_url);
+            b.push('custom_oauth_providers', doc);
+            b.providers[slug] = providerKey;
+            add('differs', 'sources', s, 'provider_type', `Source "${slug}" (${type || 'oauth'}) becomes the custom OIDC provider "${providerKey}". Add Atlas's redirect URI to the upstream app and set ${upper}_CLIENT_SECRET. Imported identities keep provider "${slug}"; map it with provider_map ${slug}=${providerKey}.`, `custom_oauth_providers ${providerKey}`);
+            continue;
+        }
+        add('manual', 'sources', s, 'provider_type', `"${type}" is not a built-in Atlas provider: add it as a custom OAuth provider with the same upstream app.`, 'custom_oauth_providers');
+    }
+    for (const s of m('samlsource')) {
+        add('mapped', 'sources', s, null, 'SAML source: moves with the data export as an SSO connection. Give the IdP Atlas\'s ACS URL and entity id (they replace authentik\'s) before turning it on.', 'sso_connections');
+    }
+    for (const s of m('ldapsource')) {
+        add('manual', 'sources', s, null, 'LDAP source: authentik checks these passwords against your directory. Connect the directory to Atlas (SCIM or an LDAP-backed connection), or let those users move by lazy migration (the authentik preset signs them in through authentik first).');
+    }
+    // ── applications, providers, the bridge ──
+    const providers = m('oauth2provider');
+    const apps = m('application');
+    const redirects = new Set();
+    let wildcard = false;
+    for (const p of providers) {
+        const list = Array.isArray(p.attrs.redirect_uris) ? p.attrs.redirect_uris : typeof p.attrs.redirect_uris === 'string' ? p.attrs.redirect_uris.split('\n').map((url) => ({ matching_mode: 'strict', url })) : [];
+        for (const r of list) {
+            const url = (0, record_set_1.isObj)(r) ? lit(r.url) : lit(r);
+            const regex = (0, record_set_1.isObj)(r) && r.matching_mode === 'regex';
+            if (!url)
+                continue;
+            if (regex || url.includes('*'))
+                wildcard = true;
+            else
+                redirects.add(url);
+        }
+        if (p.attrs.signing_key === null || p.attrs.signing_key === '') {
+            add('manual', 'providers', p, 'signing_key', 'No signing key: authentik signs tokens with the client secret (HS256), which the session bridge cannot verify. Select a certificate on the provider before the cutover.');
+        }
+    }
+    for (const url of redirects)
+        b.push('redirect_urls', { url });
+    if (redirects.size || wildcard) {
+        const p = providers[0];
+        add(wildcard ? 'differs' : 'mapped', 'providers', p, 'redirect_uris', `${redirects.size} redirect URI(s) become redirect URLs${wildcard ? '; regex and wildcard URIs are not translated (Atlas redirect URLs are exact: list each one)' : ''}.`, 'redirect_urls');
+    }
+    for (const a of apps) {
+        add('manual', 'applications', a, null, 'Application: the policy bindings that decide who may open it become Atlas roles or organization membership checks in your app; the launch URL and icon are not copied.');
+    }
+    for (const p of m('samlprovider'))
+        add('manual', 'providers', p, null, 'SAML provider (authentik as the identity provider): configure Atlas as the SAML IdP for that service provider, or keep authentik for it.');
+    for (const br of m('brand')) {
+        add('manual', 'branding', br, 'branding_title', `Brand "${lit(br.attrs.branding_title) ?? lit(br.attrs.domain) ?? ''}": recreate the logo, title and colours in Atlas branding.`);
+    }
+    // Bridge and lazy presets, when the snapshot tells enough.
+    const result = {};
+    // The application of the one provider: linked by primary key (API), or the only application (blueprint).
+    const linked = providers.length === 1
+        ? (apps.find((a) => a.attrs.provider !== undefined && !isRef(a.attrs.provider) && String(a.attrs.provider) === String(providers[0].identifiers.pk)) ?? (apps.length === 1 ? apps[0] : undefined))
+        : undefined;
+    const appSlug = lit(linked?.attrs.slug ?? linked?.identifiers.slug);
+    const only = providers.length === 1 && appSlug ? { p: providers[0], slug: appSlug } : undefined;
+    if (snap.baseUrl && only) {
+        const clientId = lit(only.p.attrs.client_id);
+        result.bridge = { preset: 'authentik', vars: { issuer: `${snap.baseUrl}/application/o/${only.slug}`, ...(clientId ? { client_id: clientId } : {}) } };
+        add('mapped', 'bridge', only.p, 'client_id', `The bridge accepts tokens of "${only.slug}" (issuer ${snap.baseUrl}/application/o/${only.slug}/).`, 'migrations authentik bridge');
+    }
+    else if (providers.length > 1) {
+        add('differs', 'bridge', providers[0], null, `${providers.length} OAuth2 providers: the bridge accepts one provider's tokens at a time; pass --set authentik-issuer and --set authentik-client-id for the one your app uses.`);
+    }
+    const subModes = [...new Set(providers.map((p) => lit(p.attrs.sub_mode) ?? 'hashed_user_id'))];
+    for (const mode of subModes) {
+        if (mode === 'user_uuid' || mode === 'user_upn')
+            add('differs', 'providers', providers.find((p) => (lit(p.attrs.sub_mode) ?? 'hashed_user_id') === mode), 'sub_mode', `Subject mode ${mode}: export with --set authentik-sub-mode=${mode}; lazy migration cannot read it from a session, so use the database export.`);
+    }
+    if (subModes.length > 1)
+        add('differs', 'providers', providers[0], 'sub_mode', `Providers use different subject modes (${subModes.join(', ')}); the export keys users by one of them.`);
+    const authFlow = flows.find((f) => f.attrs.designation === 'authentication');
+    if (snap.baseUrl) {
+        const subMode = subModes.length === 1 && ['hashed_user_id', 'user_id', 'user_username', 'user_email'].includes(subModes[0]) ? subModes[0] : undefined;
+        result.lazy = { preset: 'authentik', config: { base_url: snap.baseUrl, ...(lit(authFlow?.attrs.slug ?? authFlow?.identifiers.slug) ? { flow_slug: lit(authFlow?.attrs.slug ?? authFlow?.identifiers.slug) } : {}), ...(subMode ? { sub_mode: subMode } : {}) } };
+    }
+    // Env names a blueprint read, for the operator.
+    for (const e of snap.entries)
+        for (const [k, v] of Object.entries(e.attrs))
+            if (envName(v) && /secret|password|token/i.test(k))
+                add('manual', 'secrets', e, k, `Read from the environment (${envName(v)}) in the blueprint: set the Atlas value separately, secrets are never copied.`);
+    return b.result(snap.origin, result);
+}
+//# sourceMappingURL=authentik-config.js.map

package/dist/migrate/export/authentik-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentik-config.js","sourceRoot":"","sources":["../../../src/migrate/export/authentik-config.ts"],"names":[],"mappings":";;;AAyDA,sDAgBC;AAyBD,oDAoBC;AAOD,kCAYC;AAWD,4DAiOC;AApXD,2CAA4C;AAC5C,2CAAwC;AACxC,+CAA2D;AAC3D,6CAAgE;AAChE,mDAA2E;AAqC3E,+EAA+E;AAE/E,uFAAuF;AACvF,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,CAAC,GAAG,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9F,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,IAAI,KAAK,GAAG,CAAC;IACrD,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAAY,EAAE,IAAY,EAAE,OAAgB;IAChF,MAAM,GAAG,GAAG,IAAA,qBAAS,EAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAA,iBAAI,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,OAAO,CAAC,IAAI,CAAC;YACX,KAAK;YACL,WAAW,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YACtD,KAAK,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACpC,IAAI;YACJ,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,uBAAuB,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtF,CAAC;AAEY,QAAA,0BAA0B,GAA4B;IACjE,CAAC,qBAAqB,EAAE,4CAA4C,CAAC;IACrE,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;IAChE,CAAC,qBAAqB,EAAE,4CAA4C,CAAC;IACrE,CAAC,qBAAqB,EAAE,4CAA4C,CAAC;IACrE,CAAC,yBAAyB,EAAE,qDAAqD,CAAC;IAClF,CAAC,gBAAgB,EAAE,mCAAmC,CAAC;IACvD,CAAC,6BAA6B,EAAE,4DAA4D,CAAC;IAC7F,CAAC,iCAAiC,EAAE,oEAAoE,CAAC;IACzG,CAAC,4BAA4B,EAAE,0DAA0D,CAAC;IAC1F,CAAC,+BAA+B,EAAE,gEAAgE,CAAC;IACnG,CAAC,iCAAiC,EAAE,oEAAoE,CAAC;IACzG,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;IAC7C,CAAC,iBAAiB,EAAE,qCAAqC,CAAC;IAC1D,CAAC,gBAAgB,EAAE,mCAAmC,CAAC;IACvD,CAAC,gBAAgB,EAAE,mCAAmC,CAAC;IACvD,CAAC,oBAAoB,EAAE,2CAA2C,CAAC;IACnE,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;IAC7D,CAAC,qBAAqB,EAAE,4BAA4B,CAAC;IACrD,CAAC,eAAe,EAAE,wBAAwB,CAAC;CAC5C,CAAC;AAEF,uFAAuF;AAChF,KAAK,UAAU,oBAAoB,CAAC,CAAsG;IAC/I,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACzK,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,kCAA0B,EAAE,CAAC;QACvD,IAAI,IAAW,CAAC;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAA,yBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrE,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAChJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,KAAK,CAAC,EAAE,CAAC;AACtH,CAAC;AAED,+EAA+E;AAE/E,MAAM,KAAK,GAA2B,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AAElJ,kFAAkF;AAClF,SAAgB,WAAW,CAAC,CAAU;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC/C,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClF,oFAAoF;AACpF,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC,CAAC;AAChF,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC/I,4DAA4D;AAC5D,MAAM,OAAO,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE9H,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAEtG,SAAgB,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,CAAC,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,CAAC,MAAuC,EAAE,IAAY,EAAE,CAAiB,EAAE,IAAmB,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE;QAC1I,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QACjH,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACZ,MAAM;YACN,IAAI;YACJ,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACtD,IAAI;YACJ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,kBAAkB;IAClB,MAAM,QAAQ,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,oHAAoH,CAAC,CAAC;YAC3J,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,qBAAqB,GAAG,yCAAyC,EAAE,sCAAsC,CAAC,CAAC;QAC1N,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI;YAC/B,CAAC,eAAe,EAAE,eAAe,EAAE,SAAS,CAAC;YAC7C,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,CAAC;YAC/D,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;SACvC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,CAAC,CAAC,GAAG,CAAC,kBAAkB,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;gBACrC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,8BAA8B,GAAG,EAAE,CAAC,CAAC;YACnL,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI;YAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,yBAAyB,EAAE,oHAAoH,CAAC,CAAC;QAC7N,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI;YAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,cAAc,EAAE,sGAAsG,CAAC,CAAC;QAC1L,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,KAAK,UAAU;YAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,gBAAgB,EAAE,0FAA0F,CAAC,CAAC;IACzN,CAAC,CAAC,CAAC;IAEH,iBAAiB;IACjB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACjD,IAAI,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,kBAAkB,EAAE,8IAA8I,CAAC,CAAC;aAC3M,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YAC1B,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,EAAE,CAAC,CAAC,CAAC;YAChD,GAAG,CAAC,IAAA,8BAAc,EAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,kBAAkB,EAAE,yDAAyD,EAAE,gCAAgC,CAAC,CAAC;QACxL,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,CAAC,wBAAwB,KAAK,IAAI;YAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,0BAA0B,EAAE,8GAA8G,CAAC,CAAC;QACxN,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,YAAY;YAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,iBAAiB,EAAE,6FAA6F,CAAC,CAAC;QAC9N,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,KAAK,YAAY;YAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,eAAe,EAAE,8FAA8F,CAAC,CAAC;QACzN,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,oBAAoB,EAAE,+CAA+C,CAAC,CAAC;IACpJ,CAAC;IAED,iCAAiC;IACjC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC9B,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,4CAA4C,EAAE,wBAAwB,CAAC,CAAC;IAC9H,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,4BAA4B,EAAE,6EAA6E,EAAE,wBAAwB,CAAC,CAAC;IACpK,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;IACvE,IAAI,QAAQ;QAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,4EAA4E,EAAE,iCAAiC,CAAC,CAAC;IACjL,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC/C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YAC/E,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAClC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,mBAAmB,EAAE,0DAA0D,EAAE,gCAAgC,CAAC,CAAC;QACjJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,cAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,+HAA+H,CAAC,CAAC;QAC/N,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,gEAAgE,CAAC,CAAC;IAC7I,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,KAAK,CAAC,wBAAwB,KAAK,IAAI;YAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,0BAA0B,EAAE,mJAAmJ,CAAC,CAAC;IAC/P,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,uDAAuD,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,yBAAyB,8CAA8C,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,+BAA+B,CAAC,CAAC;QACtP,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,uBAAuB,GAAG,uDAAuD,CAAC,CAAC;IACvJ,CAAC;IAED,qBAAqB;IACrB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAChC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,qCAAqC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,EAAE,oEAAoE,EAAE,8BAA8B,CAAC,CAAC;IAClS,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAChD,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,iHAAiH,EAAE,iCAAiC,CAAC,CAAC;QAC7L,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE,0BAA0B,EAAE,+DAA+D,CAAC,CAAC;IAC5K,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC3C,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAC/B,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,6BAA6B,CAAC,CAAC;QAC/F,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,kCAAkC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,kBAAkB,oCAAoC,CAAC,CAAC;IAClK,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,yHAAyH,EAAE,iBAAiB,CAAC,CAAC;IACxL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAClD,GAAG,CACD,SAAS,EACT,cAAc,EACd,CAAC,EACD,uBAAuB,EACvB,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,mGAAmG,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,uGAAuG,CAAC,CAAC,CAAC,kIAAkI,EAC/X,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QACjE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,yBAAS,EAAC,IAAI,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,GAAG,EAAE,CAAC;YACR,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9H,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,IAAI;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACnE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;YAClH,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,GAAG,GAAyB;gBAChC,YAAY,EAAE,WAAW;gBACzB,YAAY,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI;gBACvC,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,YAAY,EAAE,GAAG,IAAI,YAAY,CAAC;gBAC/E,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,gBAAgB,EAAE,GAAG,IAAI,gBAAgB,CAAC;gBAC/E,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,IAAI;gBACnB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI;aAChD,CAAC;YACF,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACnD,IAAI,SAAS;gBAAE,GAAG,CAAC,aAAa,GAAG,SAAS,CAAC;YAC7C,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;gBAAE,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAE,CAAC;YAC5F,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAAE,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAE,CAAC;YAClF,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;gBAAE,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAE,CAAC;YAC3E,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;YAChC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,eAAe,EAAE,WAAW,IAAI,MAAM,IAAI,IAAI,OAAO,uCAAuC,WAAW,2DAA2D,KAAK,sDAAsD,IAAI,+BAA+B,IAAI,IAAI,WAAW,GAAG,EAAE,0BAA0B,WAAW,EAAE,CAAC,CAAC;YAC9V,SAAS;QACX,CAAC;QACD,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,IAAI,mGAAmG,EAAE,wBAAwB,CAAC,CAAC;IACtL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,6JAA6J,EAAE,iBAAiB,CAAC,CAAC;IACtN,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,mPAAmP,CAAC,CAAC;IACzR,CAAC;IAED,4CAA4C;IAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChN,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC;YACtD,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,IAAI,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC;;gBAC3C,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,yKAAyK,CAAC,CAAC;QAC1N,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,SAAS;QAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,IAAI,SAAS,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;QACxB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG,SAAS,CAAC,IAAI,wCAAwC,QAAQ,CAAC,CAAC,CAAC,6FAA6F,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IACpQ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,wKAAwK,CAAC,CAAC;IACnN,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC;QAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,0IAA0I,CAAC,CAAC;IACnN,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,4DAA4D,CAAC,CAAC;IACpL,CAAC;IAED,2DAA2D;IAC3D,MAAM,MAAM,GAA+C,EAAE,CAAC;IAC9D,yGAAyG;IACzG,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,KAAK,CAAC;QACpB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClM,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,kBAAkB,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACtJ,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE,iCAAiC,IAAI,CAAC,IAAI,aAAa,IAAI,CAAC,OAAO,kBAAkB,IAAI,CAAC,IAAI,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACnL,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,6JAA6J,CAAC,CAAC;IAClO,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC/F,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,UAAU;YAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,KAAK,IAAI,CAAE,EAAE,UAAU,EAAE,gBAAgB,IAAI,0CAA0C,IAAI,6EAA6E,CAAC,CAAC;IAC1T,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,UAAU,EAAE,0CAA0C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACzL,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,gBAAgB,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxJ,MAAM,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IACpQ,CAAC;IAED,gDAAgD;IAChD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,8BAA8B,OAAO,CAAC,CAAC,CAAC,+EAA+E,CAAC,CAAC;IAExR,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC"}

package/dist/migrate/export/authentik.d.ts

@@ -0,0 +1,110 @@
+import type { PasswordHash } from '@atlasauth/migrate';
+import { type Tables } from './frameworks/tables';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export authentik` — a self-hosted authentik (goauthentik)
+ * instance onto the canonical bundle models. Two ways in:
+ *
+ *   DATABASE DUMP (the full export): authentik's API never returns password
+ *   hashes, TOTP seeds, recovery codes or WebAuthn public keys, so the owner
+ *   dumps authentik's own PostgreSQL tables (one `<table>.csv|json|ndjson` per
+ *   table, `psql \copy`) and the exporter reads them on this machine:
+ *
+ *     authentik_core_user              → user (Django password digest verbatim,
+ *                                        `!…` unusable passwords dropped)
+ *     authentik_install_id             → the hashed `sub` (see below); never
+ *                                        written to the bundle (old installs
+ *                                        use the SECRET_KEY as the install id)
+ *     authentik_core_group (+ parentage, user_groups / user_ak_groups)
+ *                                      → app roles (default) or organizations;
+ *                                        superuser groups → the `admin` role
+ *     authentik_rbac_role (+ user_roles, group_roles)
+ *                                      → app roles `rbac:<name>`
+ *     authentik_core_usersourceconnection (+ oauth / saml subtables, sources)
+ *                                      → identities; SAML sources → SSO connections
+ *     authentik_core_token             → API keys (sha256 of the plaintext key,
+ *                                        so `api` and `app_password` tokens keep working)
+ *     authentik_stages_authenticator_* → TOTP (hex seed → base32, 6/8 digits,
+ *                                        its step), static recovery tokens,
+ *                                        WebAuthn passkeys, SMS / email factors
+ *
+ *   API (no hashes): `/api/v3` with an API token — users, groups, roles,
+ *   source links, API keys (`view_key`). Passwords then move by lazy
+ *   migration (the `authentik` preset) and factors are re-enrolled.
+ *
+ * THE USER ID. Atlas keys imported users by the subject the vendor's tokens
+ * carry. authentik's OAuth2/OIDC providers choose `sub` per provider
+ * (`sub_mode`, core: authentik/providers/oauth2/id_token.py `_resolve_sub`):
+ *   hashed_user_id (default) sha256(f"{pk}-{install_id}") hex — `User.uid`
+ *   user_id   the integer pk          user_uuid   the user's uuid
+ *   user_username / user_email        user_upn    attributes.upn, else uid
+ * The export uses one mode (`--set authentik-sub-mode`, or the one every
+ * provider in the dump uses) and keeps the other ids in private metadata.
+ */
+export type AuthentikSubMode = 'hashed_user_id' | 'user_id' | 'user_uuid' | 'user_username' | 'user_email' | 'user_upn';
+export declare const AUTHENTIK_SUB_MODES: readonly AuthentikSubMode[];
+export interface AuthentikExportOptions {
+    /** authentik's tables (a dump directory read with `readDumpDir`): the full export. */
+    tables?: Tables;
+    /** The authentik URL (`https://auth.example.com`): the API export, and the SAML ACS URLs. */
+    baseUrl?: string;
+    /** An authentik API token (Directory → Tokens, intent API) for the API export. */
+    token?: string;
+    /** Which `sub` the apps' tokens carry; default: the mode the providers use, else hashed_user_id. */
+    subMode?: AuthentikSubMode;
+    /** The install id for `hashed_user_id` when the dump has no `authentik_install_id` table. */
+    installId?: string;
+    groupsAs?: 'roles' | 'organizations' | 'skip';
+    /** The WebAuthn RP id for passkeys registered before authentik stored one per device. */
+    rpId?: string;
+    /** authentik has no verified-email flag: treat every address as verified. Default false. */
+    trustEmails?: boolean;
+    /** Carry the stored upstream OAuth access tokens of social links. Default false. */
+    oauthTokens?: boolean;
+    now?: Date;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** One user as the dump or the API has it (the API never has `password`). */
+interface AkUser {
+    pk: string;
+    uuid?: string;
+    /** `User.uid` when the API reported it. */
+    uid?: string;
+    username?: string;
+    email?: string;
+    name?: string;
+    password?: string;
+    isActive: boolean;
+    type?: string;
+    path?: string;
+    attributes: Obj;
+    lastLogin?: string | number;
+    dateJoined?: string | number;
+}
+export declare function exportAuthentik(opts: AuthentikExportOptions): Promise<RecordSet>;
+/** `User.uid` (authentik/core/models.py): sha256 of "<pk>-<install id>", hex. */
+export declare function authentikUid(pk: string, installId: string): string;
+/** The id a user's tokens carry as `sub` under a provider's sub_mode; undefined when the user has none. */
+export declare function authentikSubject(u: AkUser, mode: AuthentikSubMode, installId?: string): string | undefined;
+/**
+ * A Django password digest (authentik uses Django's default hashers) as a
+ * bundle password, in a form Atlas's registry verifies:
+ *   pbkdf2_sha256$… / pbkdf2_sha1$…  → pbkdf2_django (verbatim)
+ *   bcrypt_sha256$$2b$…              → bcrypt_sha256_django (verbatim)
+ *   argon2$argon2id$v=19$…           → argon2, the argon2-cffi PHC string
+ *                                      (a version-less hash is Argon2 v1.0: `v=16`)
+ *   bcrypt$$2b$…                     → bcrypt, the plain bcrypt digest
+ *   scrypt$<n>$<salt>$<r>$<p>$<hash> → scrypt with its parameters (64-byte key)
+ * Null for an unusable (`!…`) or unknown digest.
+ */
+export declare function djangoPassword(digest: string | undefined): PasswordHash | null;
+/** RFC 4648 base32, unpadded. */
+export declare function base32(bytes: Buffer): string;
+export declare function exportAuthentikDump(tables: Tables, opts?: Omit<AuthentikExportOptions, 'tables'>): RecordSet;
+/** Every page of an authentik list endpoint (`{ pagination: { next }, results }`, next = 0 on the last page). */
+export declare function authentikList(http: VendorHttp, path: string): Promise<Obj[]>;
+export declare function exportAuthentikApi(opts: AuthentikExportOptions): Promise<RecordSet>;
+export {};