@atlasauth/cli 0.12.0 → 0.13.0

package/dist/migrate/export/azure.js

@@ -0,0 +1,373 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GRAPH = void 0;
+exports.graphToken = graphToken;
+exports.graphHttp = graphHttp;
+exports.graphAll = graphAll;
+exports.providerOfIssuer = providerOfIssuer;
+exports.extensionAttributes = extensionAttributes;
+exports.isDirectoryUser = isDirectoryUser;
+exports.mapAzureUser = mapAzureUser;
+exports.azureFactors = azureFactors;
+exports.azureTenantInfo = azureTenantInfo;
+exports.userExtensionNames = userExtensionNames;
+exports.exportAzure = exportAzure;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+exports.GRAPH = 'https://graph.microsoft.com/v1.0';
+/** The client-credentials token for Microsoft Graph (sent to login.microsoftonline.com only). */
+async function graphToken(tenant, clientId, clientSecret, fetchImpl = fetch) {
+    const res = await fetchImpl(`https://login.microsoftonline.com/${encodeURIComponent(tenant)}/oauth2/v2.0/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+        body: new URLSearchParams({ grant_type: 'client_credentials', client_id: clientId, client_secret: clientSecret, scope: 'https://graph.microsoft.com/.default' }).toString(),
+    });
+    const text = await res.text();
+    let body = {};
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        // not JSON: reported below
+    }
+    const token = (0, record_set_1.str)(body.access_token);
+    if (!res.ok || !token) {
+        const detail = ((0, record_set_1.str)(body.error_description) ?? (0, record_set_1.str)(body.error) ?? text.slice(0, 200)).split(/\r?\n/)[0];
+        throw new vendor_http_1.VendorApiError('Microsoft Entra', res.status, '/oauth2/v2.0/token', detail ?? '');
+    }
+    return token;
+}
+/** Graph over {@link VendorHttp}: a bearer from a token or client credentials, fetched once. */
+function graphHttp(o) {
+    if (!o.accessToken && !(o.clientId && o.clientSecret))
+        throw new Error('Microsoft Graph needs an app registration\'s client id and secret (or an access token).');
+    let bearer = o.accessToken;
+    return new vendor_http_1.VendorHttp({
+        vendor: 'Microsoft Graph',
+        baseUrl: exports.GRAPH,
+        headers: async () => ({ authorization: `Bearer ${(bearer ??= await graphToken(o.tenant, o.clientId, o.clientSecret, o.fetchImpl))}` }),
+        fetchImpl: o.fetchImpl,
+        sleep: o.sleep,
+    });
+}
+/** Every page of a Graph collection (`@odata.nextLink`). */
+async function graphAll(http, path) {
+    const out = [];
+    let next = path;
+    while (next) {
+        const res = await http.get(next);
+        const body = (0, record_set_1.isObj)(res.body) ? res.body : {};
+        out.push(...(0, record_set_1.objs)(body.value));
+        next = (0, record_set_1.str)(body['@odata.nextLink']);
+    }
+    return out;
+}
+const USER_FIELDS = [
+    'id',
+    'displayName',
+    'givenName',
+    'surname',
+    'mail',
+    'otherMails',
+    'mobilePhone',
+    'identities',
+    'accountEnabled',
+    'createdDateTime',
+    'userPrincipalName',
+    'userType',
+    'creationType',
+    'passwordPolicies',
+    'lastPasswordChangeDateTime',
+    'preferredLanguage',
+    'city',
+    'country',
+    'jobTitle',
+];
+/** Federated identity issuers → the provider an identity record carries. */
+const ISSUERS = [
+    [/^(https?:\/\/)?(accounts\.)?google\.com\/?$/i, 'google'],
+    [/^(https?:\/\/)?(www\.)?facebook\.com\/?$/i, 'facebook'],
+    [/^(https?:\/\/)?appleid\.apple\.com\/?$/i, 'apple'],
+    [/^(https?:\/\/)?(www\.)?amazon\.com\/?$/i, 'amazon'],
+    [/^(https?:\/\/)?(www\.)?linkedin\.com\/?$/i, 'linkedin'],
+    [/^(https?:\/\/)?(www\.)?(twitter|x)\.com\/?$/i, 'x'],
+    [/^(https?:\/\/)?(www\.)?github\.com\/?$/i, 'github'],
+    [/^(MicrosoftAccount|live\.com|https:\/\/login\.live\.com)\/?$/i, 'microsoft'],
+    [/^https:\/\/login\.microsoftonline\.com\/9188040d-6c67-4c5b-b112-36a304b66dad\/v2\.0\/?$/i, 'microsoft'],
+];
+/** The provider name for a federated identity's issuer (a social key, or the issuer itself for an OIDC / enterprise IdP). */
+function providerOfIssuer(issuer) {
+    for (const [re, key] of ISSUERS)
+        if (re.test(issuer))
+            return { provider: key, kind: 'oauth' };
+    return { provider: issuer, kind: /^https:\/\//.test(issuer) ? 'oidc' : 'oauth' };
+}
+/** The extension attributes on a user (`extension_<appId>_<name>`) by bare name. */
+function extensionAttributes(u) {
+    const out = {};
+    for (const [k, v] of Object.entries(u)) {
+        const m = /^extension_[0-9a-f]{32}_(.+)$/i.exec(k);
+        if (m && v !== null && v !== undefined)
+            out[m[1]] = v;
+    }
+    return out;
+}
+/** True for directory (admin / work) accounts: no consumer sign-in identity, only a userPrincipalName. */
+function isDirectoryUser(u) {
+    const ids = (0, record_set_1.objs)(u.identities);
+    if ((0, record_set_1.str)(u.creationType) === 'LocalAccount')
+        return false;
+    return !ids.some((i) => (0, record_set_1.str)(i.signInType) !== 'userPrincipalName');
+}
+/** Map one Graph user onto a user record and its federated identities. */
+function mapAzureUser(u) {
+    const id = (0, record_set_1.str)(u.id);
+    if (!id)
+        return null;
+    const emails = [];
+    const phones = [];
+    const identities = [];
+    let username;
+    let skippedIdentities = 0;
+    const addEmail = (raw, verified) => {
+        const e = (0, record_set_1.str)(raw)?.toLowerCase();
+        if (!e || !e.includes('@'))
+            return;
+        const existing = emails.find((x) => x.email === e);
+        if (existing)
+            existing.verified ||= verified;
+        else
+            emails.push({ email: e, verified, primary: false });
+    };
+    const addPhone = (raw, verified) => {
+        const p = (0, record_set_1.e164)(raw);
+        if (!p)
+            return;
+        const existing = phones.find((x) => x.phone === p);
+        if (existing)
+            existing.verified ||= verified;
+        else
+            phones.push({ phone: p, verified, primary: false });
+    };
+    for (const ident of (0, record_set_1.objs)(u.identities)) {
+        const type = (0, record_set_1.str)(ident.signInType) ?? '';
+        const value = (0, record_set_1.str)(ident.issuerAssignedId);
+        // Local sign-in names were verified by the user flow when the account was created (email / SMS code).
+        if (/^emailAddress\d*$/.test(type))
+            addEmail(value, true);
+        else if (type === 'userName')
+            username ??= value;
+        else if (type === 'phoneNumber')
+            addPhone(value, true);
+        else if (type === 'federated') {
+            const issuer = (0, record_set_1.str)(ident.issuer);
+            if (!issuer || !value) {
+                skippedIdentities++;
+                continue;
+            }
+            const { provider, kind } = providerOfIssuer(issuer);
+            identities.push((0, record_set_1.compact)({ user_id: id, provider, provider_user_id: value, kind, profile: { issuer } }));
+        }
+    }
+    addEmail(u.mail, false);
+    for (const m of (0, record_set_1.strs)(u.otherMails))
+        addEmail(m, false);
+    addPhone(u.mobilePhone, false);
+    if (emails[0])
+        emails[0].primary = true;
+    if (phones[0] && !emails.length)
+        phones[0].primary = true;
+    const custom = extensionAttributes(u);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails: emails.length ? emails : undefined,
+        phones: phones.length ? phones : undefined,
+        username,
+        first_name: (0, record_set_1.str)(u.givenName),
+        last_name: (0, record_set_1.str)(u.surname),
+        name: (0, record_set_1.str)(u.displayName) === 'unknown' ? undefined : (0, record_set_1.str)(u.displayName),
+        banned: u.accountEnabled === false ? true : undefined,
+        public_metadata: Object.keys(custom).length ? custom : undefined,
+        private_metadata: (0, record_set_1.compact)({
+            azure_user_principal_name: (0, record_set_1.str)(u.userPrincipalName),
+            azure_creation_type: (0, record_set_1.str)(u.creationType),
+            azure_password_policies: (0, record_set_1.str)(u.passwordPolicies),
+            azure_profile: (0, record_set_1.compact)({ preferredLanguage: (0, record_set_1.str)(u.preferredLanguage), city: (0, record_set_1.str)(u.city), country: (0, record_set_1.str)(u.country), jobTitle: (0, record_set_1.str)(u.jobTitle) }),
+        }),
+        created_at: (0, record_set_1.str)(u.createdDateTime),
+    });
+    if (user.private_metadata && !Object.keys(user.private_metadata.azure_profile).length)
+        delete user.private_metadata.azure_profile;
+    if (!user.emails && !user.phones && !user.username) {
+        // A directory account (included on request) signs in by its userPrincipalName.
+        const upn = (0, record_set_1.str)(u.userPrincipalName) ?? (0, record_set_1.str)((0, record_set_1.objs)(u.identities).find((i) => (0, record_set_1.str)(i.signInType) === 'userPrincipalName')?.issuerAssignedId);
+        if (upn)
+            user.username = upn;
+    }
+    if (!user.emails && !user.phones && !user.username) {
+        // A federated-only account without an email claim: keep the object id reachable as a username-less user through its identity.
+        if (!identities.length)
+            return null;
+        user.username = `user_${id.replace(/-/g, '').slice(0, 20)}`;
+    }
+    return { user, identities, skippedIdentities };
+}
+/** Second factors from a user's authentication methods. */
+function azureFactors(userId, phoneMethods, emailMethods) {
+    const out = [];
+    for (const m of phoneMethods) {
+        const phone = (0, record_set_1.e164)(m.phoneNumber);
+        if (phone && (0, record_set_1.str)(m.phoneType) !== 'office')
+            out.push({ user_id: userId, type: 'phone', phone, verified: true });
+    }
+    if (emailMethods.some((m) => (0, record_set_1.str)(m.emailAddress)))
+        out.push({ user_id: userId, type: 'email', verified: true });
+    return out;
+}
+/** Tenant id and initial domain (needs Organization.Read.All or Directory.Read.All; empty when not granted). */
+async function azureTenantInfo(http) {
+    try {
+        const orgs = await graphAll(http, '/organization?$select=id,verifiedDomains');
+        const org = orgs[0];
+        if (!org)
+            return {};
+        const initial = (0, record_set_1.objs)(org.verifiedDomains).find((d) => d.isInitial === true);
+        return { tenantId: (0, record_set_1.str)(org.id), tenantName: (0, record_set_1.str)(initial?.name)?.replace(/\.onmicrosoft\.com$/i, '').toLowerCase() };
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && err.status === 403)
+            return {};
+        throw err;
+    }
+}
+/** The extension attribute names registered for users (`extension_<app>_<name>`), for `$select`. */
+async function userExtensionNames(http) {
+    try {
+        const res = await http.post('/directoryObjects/getAvailableExtensionProperties', { isSyncedFromOnPremises: false });
+        return (0, record_set_1.objs)((0, record_set_1.isObj)(res.body) ? res.body.value : undefined)
+            .filter((p) => (0, record_set_1.strs)(p.targetObjects).includes('User'))
+            .map((p) => (0, record_set_1.str)(p.name))
+            .filter((n) => !!n && /^extension_[0-9a-f]{32}_/i.test(n));
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 401, 403, 404].includes(err.status))
+            return [];
+        throw err;
+    }
+}
+async function exportAzure(opts) {
+    const set = new record_set_1.RecordSet();
+    const label = opts.kind === 'b2c' ? 'Azure AD B2C' : 'Entra External ID';
+    const progress = opts.onProgress ?? (() => undefined);
+    const http = graphHttp(opts);
+    const info = await azureTenantInfo(http);
+    set.manifest.origin = `${label} tenant ${info.tenantName ? `${info.tenantName}.onmicrosoft.com` : opts.tenant}`;
+    // Groups → app roles.
+    const groups = [];
+    if (opts.groups !== 'skip') {
+        progress('groups');
+        try {
+            for (const g of await graphAll(http, '/groups?$select=id,displayName,description&$top=999')) {
+                const id = (0, record_set_1.str)(g.id);
+                const name = (0, record_set_1.str)(g.displayName);
+                if (!id || !name)
+                    continue;
+                const key = (0, translate_kit_1.keyOf)(name);
+                groups.push({ id, key });
+                set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(g.description), scope: 'app' }), key);
+            }
+        }
+        catch (err) {
+            if (!(err instanceof vendor_http_1.VendorApiError && err.status === 403))
+                throw err;
+            set.warn('Groups were not exported: the app registration lacks GroupMember.Read.All (or Group.Read.All).');
+        }
+    }
+    // Users.
+    progress('users');
+    const extensions = await userExtensionNames(http);
+    const select = [...USER_FIELDS, ...extensions].join(',');
+    const raw = await graphAll(http, `/users?$select=${select}&$top=999`);
+    const providers = new Set();
+    let directory = 0;
+    let skippedIdentities = 0;
+    let totpUsers = 0;
+    let fido2Users = 0;
+    let methodsDenied = false;
+    for (const u of raw) {
+        if (!opts.includeDirectoryUsers && isDirectoryUser(u)) {
+            directory++;
+            continue;
+        }
+        const mapped = mapAzureUser(u);
+        if (!mapped) {
+            set.omit('user', 'no email, phone number, username or federated identity');
+            continue;
+        }
+        set.add('user', mapped.user, mapped.user.id);
+        for (const i of mapped.identities) {
+            set.add('identity', i, `${i.provider}:${i.provider_user_id}`);
+            providers.add(i.provider);
+        }
+        skippedIdentities += mapped.skippedIdentities;
+        if (opts.authMethods && !methodsDenied) {
+            const uid = encodeURIComponent(mapped.user.id);
+            try {
+                const phone = await graphAll(http, `/users/${uid}/authentication/phoneMethods`);
+                const email = await graphAll(http, `/users/${uid}/authentication/emailMethods`);
+                for (const f of azureFactors(mapped.user.id, phone, email))
+                    set.add('mfa_factor', f);
+                if ((await graphAll(http, `/users/${uid}/authentication/softwareOathMethods`)).length)
+                    totpUsers++;
+                if ((await graphAll(http, `/users/${uid}/authentication/fido2Methods`)).length)
+                    fido2Users++;
+            }
+            catch (err) {
+                if (!(err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 401)))
+                    throw err;
+                methodsDenied = true;
+                set.warn('Authentication methods were not exported: grant the app registration UserAuthenticationMethod.Read.All.');
+            }
+        }
+    }
+    if (directory)
+        set.omit('user', 'directory (admin / work) account that signs in with a userPrincipalName only', directory);
+    if (skippedIdentities)
+        set.omit('identity', 'federated identity without an issuer-assigned id (Graph keeps only an alternativeSecurityId); relinks by verified email on first sign-in', skippedIdentities);
+    if (totpUsers)
+        set.omit('mfa_factor', 'Microsoft never exports authenticator-app (software OATH) secrets: these users enrol again', totpUsers);
+    if (fido2Users)
+        set.omit('passkey', 'FIDO2 keys are bound to the Microsoft sign-in domain and never exported: these users register again', fido2Users);
+    // Group members → user roles.
+    if (groups.length) {
+        progress('group members');
+        const ids = new Set(set.list('user').map((u) => u.id));
+        const rolesOf = new Map();
+        for (const g of groups) {
+            for (const m of await graphAll(http, `/groups/${encodeURIComponent(g.id)}/members?$select=id&$top=999`)) {
+                const id = (0, record_set_1.str)(m.id);
+                if (!id || !ids.has(id))
+                    continue;
+                rolesOf.set(id, [...(rolesOf.get(id) ?? []), g.key]);
+            }
+        }
+        for (const user of set.list('user')) {
+            const roles = rolesOf.get(user.id);
+            if (roles?.length)
+                user.roles = [...new Set(roles)];
+        }
+    }
+    if (set.count('user')) {
+        set.warn(opts.kind === 'b2c'
+            ? 'Azure AD B2C never exports passwords. Turn on the azure_ad_b2c lazy-migration preset with a ROPC user flow: each password is checked against B2C on its first Atlas sign-in, then stored as Argon2id. Accounts with MFA enforced in that flow, and federated accounts, cannot use ROPC.'
+            : 'Entra External ID never exports passwords. Turn on the entra_external_id lazy-migration preset (native authentication): each password is checked against External ID on its first Atlas sign-in, then stored as Argon2id.');
+        set.warn(opts.kind === 'b2c'
+            ? 'Users are keyed by their object id, the sub claim of default B2C user flows. If a custom policy issues another value as sub, map the bridge subject to the claim that carries the object id (oid).'
+            : 'Users are keyed by their object id (the oid claim); the entra_external_id bridge preset matches on oid.');
+    }
+    set.manifest.providers = [...providers].sort();
+    set.manifest.settings = (0, record_set_1.compact)({ kind: opts.kind, tenant_id: info.tenantId, tenant_name: info.tenantName, extension_attributes: extensions.length ? extensions : undefined });
+    return set;
+}
+//# sourceMappingURL=azure.js.map

package/dist/migrate/export/azure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure.js","sourceRoot":"","sources":["../../../src/migrate/export/azure.ts"],"names":[],"mappings":";;;AAoDA,gCAmBC;AAGD,8BAUC;AAGD,4BAUC;AAsCD,4CAGC;AAGD,kDAOC;AAGD,0CAIC;AAGD,oCA2EC;AAGD,oCAQC;AASD,0CAWC;AAGD,gDAWC;AAED,kCA4GC;AAnYD,6CAA0F;AAC1F,mDAAwC;AACxC,+CAA2D;AA8C9C,QAAA,KAAK,GAAG,kCAAkC,CAAC;AAExD,iGAAiG;AAC1F,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,QAAgB,EAAE,YAAoB,EAAE,YAA0B,KAAK;IACtH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,qCAAqC,kBAAkB,CAAC,MAAM,CAAC,oBAAoB,EAAE;QAC/G,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC5K,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,GAAQ,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAQ,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,IAAI,4BAAc,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gGAAgG;AAChG,SAAgB,SAAS,CAAC,CAAsJ;IAC9K,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAClK,IAAI,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3B,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,aAAK;QACd,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,MAAM,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAS,EAAE,CAAC,CAAC,YAAa,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;QACxI,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAED,4DAA4D;AACrD,KAAK,UAAU,QAAQ,CAAC,IAAgB,EAAE,IAAY;IAC3D,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,GAAsB,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,IAAI;IACJ,aAAa;IACb,WAAW;IACX,SAAS;IACT,MAAM;IACN,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,UAAU;IACV,cAAc;IACd,kBAAkB;IAClB,4BAA4B;IAC5B,mBAAmB;IACnB,MAAM;IACN,SAAS;IACT,UAAU;CACX,CAAC;AAEF,4EAA4E;AAC5E,MAAM,OAAO,GAA4B;IACvC,CAAC,8CAA8C,EAAE,QAAQ,CAAC;IAC1D,CAAC,2CAA2C,EAAE,UAAU,CAAC;IACzD,CAAC,yCAAyC,EAAE,OAAO,CAAC;IACpD,CAAC,yCAAyC,EAAE,QAAQ,CAAC;IACrD,CAAC,2CAA2C,EAAE,UAAU,CAAC;IACzD,CAAC,8CAA8C,EAAE,GAAG,CAAC;IACrD,CAAC,yCAAyC,EAAE,QAAQ,CAAC;IACrD,CAAC,+DAA+D,EAAE,WAAW,CAAC;IAC9E,CAAC,0FAA0F,EAAE,WAAW,CAAC;CAC1G,CAAC;AAEF,6HAA6H;AAC7H,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,OAAO;QAAE,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9F,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AACnF,CAAC;AAED,oFAAoF;AACpF,SAAgB,mBAAmB,CAAC,CAAM;IACxC,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0GAA0G;AAC1G,SAAgB,eAAe,CAAC,CAAM;IACpC,MAAM,GAAG,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,KAAK,mBAAmB,CAAC,CAAC;AACrE,CAAC;AAED,0EAA0E;AAC1E,SAAgB,YAAY,CAAC,CAAM;IACjC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,IAAI,QAA4B,CAAC;IACjC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,QAAiB,EAAE,EAAE;QACnD,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,QAAiB,EAAE,EAAE;QACnD,MAAM,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC1C,sGAAsG;QACtG,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;aACrD,IAAI,IAAI,KAAK,UAAU;YAAE,QAAQ,KAAK,KAAK,CAAC;aAC5C,IAAI,IAAI,KAAK,aAAa;YAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;aAClD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,iBAAiB,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpD,UAAU,CAAC,IAAI,CAAC,IAAA,oBAAO,EAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC;QAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;IAC1D,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC1C,QAAQ;QACR,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;QACvE,MAAM,EAAE,CAAC,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACrD,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAChE,gBAAgB,EAAE,IAAA,oBAAO,EAAC;YACxB,yBAAyB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC;YACnD,mBAAmB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;YACxC,uBAAuB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC;YAChD,aAAa,EAAE,IAAA,oBAAO,EAAC,EAAE,iBAAiB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;SAC/I,CAAQ;QACT,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAoB,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;IACzI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnD,+EAA+E;QAC/E,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,KAAK,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACzI,IAAI,GAAG;YAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnD,8HAA8H;QAC9H,IAAI,CAAC,UAAU,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;AACjD,CAAC;AAED,2DAA2D;AAC3D,SAAgB,YAAY,CAAC,MAAc,EAAE,YAAmB,EAAE,YAAmB;IACnF,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,KAAK,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChH,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,gHAAgH;AACzG,KAAK,UAAU,eAAe,CAAC,IAAgB;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,0CAA0C,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;QAC5E,OAAO,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IACtH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oGAAoG;AAC7F,KAAK,UAAU,kBAAkB,CAAC,IAAgB;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,mDAAmD,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC;QACzH,OAAO,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;aACtD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,KAAK,WAAW,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAEhH,sBAAsB;IACtB,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,qDAAqD,CAAC,EAAE,CAAC;gBAC5F,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBAChC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAC3B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,SAAS;IACT,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,kBAAkB,MAAM,WAAW,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,qBAAqB,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,wDAAwD,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC9D,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,iBAAiB,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAC9C,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,8BAA8B,CAAC,CAAC;gBAChF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,8BAA8B,CAAC,CAAC;gBAChF,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;gBACrF,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,qCAAqC,CAAC,CAAC,CAAC,MAAM;oBAAE,SAAS,EAAE,CAAC;gBACnG,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,8BAA8B,CAAC,CAAC,CAAC,MAAM;oBAAE,UAAU,EAAE,CAAC;YAC/F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;oBAAE,MAAM,GAAG,CAAC;gBAC9F,aAAa,GAAG,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,8EAA8E,EAAE,SAAS,CAAC,CAAC;IAC3H,IAAI,iBAAiB;QAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,0IAA0I,EAAE,iBAAiB,CAAC,CAAC;IAC3M,IAAI,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,4FAA4F,EAAE,SAAS,CAAC,CAAC;IAC/I,IAAI,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,qGAAqG,EAAE,UAAU,CAAC,CAAC;IAEvJ,8BAA8B;IAC9B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,WAAW,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,8BAA8B,CAAC,EAAE,CAAC;gBACxG,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAS;gBAClC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,MAAM;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CACN,IAAI,CAAC,IAAI,KAAK,KAAK;YACjB,CAAC,CAAC,yRAAyR;YAC3R,CAAC,CAAC,2NAA2N,CAChO,CAAC;QACF,GAAG,CAAC,IAAI,CACN,IAAI,CAAC,IAAI,KAAK,KAAK;YACjB,CAAC,CAAC,oMAAoM;YACtM,CAAC,CAAC,yGAAyG,CAC9G,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAA,oBAAO,EAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,oBAAoB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAQ,CAAC;IACtL,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/cognito-config.d.ts

@@ -0,0 +1,25 @@
+import type { TranslationResult } from '../framework/plugin';
+import type { CognitoApi } from './cognito';
+import { type Obj } from './record-set';
+/**
+ * `atlas migrate cognito config` — a user pool's settings → Atlas config,
+ * read with the owner's AWS credentials on this machine: DescribeUserPool
+ * (password policy, MFA, sign-in identifiers, verification, self sign-up,
+ * Lambda triggers), every app client (callback URLs, OAuth scopes, token
+ * lifetimes, auth flows), identity providers (social → Atlas providers,
+ * SAML / OIDC → SSO connections), resource servers (APIs and scopes) and
+ * groups (roles).
+ */
+export interface CognitoConfigSnapshot {
+    poolId: string;
+    region: string;
+    pool: Obj;
+    clients: Obj[];
+    idps: Obj[];
+    resourceServers: Obj[];
+    groups: Obj[];
+}
+export declare function fetchCognitoConfig(api: CognitoApi, poolId: string, region: string): Promise<CognitoConfigSnapshot>;
+/** A client's token validity in ms (`RefreshTokenValidity` with `TokenValidityUnits.RefreshToken`). */
+export declare function validityMs(client: Obj, field: 'AccessToken' | 'IdToken' | 'RefreshToken'): number | undefined;
+export declare function translateCognitoConfig(snap: CognitoConfigSnapshot): TranslationResult;