@atlasauth/cli 0.12.0 → 0.14.0

package/dist/migrate/export/supabase.js

@@ -0,0 +1,524 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readTableDump = readTableDump;
+exports.parseTableText = parseTableText;
+exports.supabasePassword = supabasePassword;
+exports.decryptGotrueColumn = decryptGotrueColumn;
+exports.exportSupabase = exportSupabase;
+exports.mapSupabaseTables = mapSupabaseTables;
+exports.mapSupabaseUser = mapSupabaseUser;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const migrate_1 = require("@atlasauth/migrate");
+const csv_1 = require("../../import/csv");
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+const SIGN_IN_METHODS = new Set(['email', 'phone', 'anonymous']);
+const DAY = 24 * 3600_000;
+// ── table dumps ────────────────────────────────────────────────────────────
+/** Read every table file in a dump folder: `{ users: [...], identities: [...] }` (schema prefix dropped, lowercase). */
+function readTableDump(dir) {
+    const out = {};
+    for (const file of (0, node_fs_1.readdirSync)(dir).sort()) {
+        const path = (0, node_path_1.join)(dir, file);
+        if (!(0, node_fs_1.statSync)(path).isFile())
+            continue;
+        const ext = (0, node_path_1.extname)(file).toLowerCase();
+        if (!['.json', '.ndjson', '.jsonl', '.csv'].includes(ext))
+            continue;
+        const name = (0, node_path_1.basename)(file, (0, node_path_1.extname)(file)).toLowerCase().replace(/^auth[._]/, '');
+        out[name] = parseTableText((0, node_fs_1.readFileSync)(path, 'utf8'), ext);
+    }
+    return out;
+}
+function parseTableText(text, ext) {
+    const t = text.trim();
+    if (!t)
+        return [];
+    if (ext === '.csv')
+        return (0, csv_1.parseCsv)(text).map((r) => Object.fromEntries(Object.entries(r).map(([k, v]) => [k, v === '' ? null : v])));
+    if (ext === '.json') {
+        const doc = JSON.parse(t);
+        if (Array.isArray(doc))
+            return (0, record_set_1.objs)(doc);
+        if ((0, record_set_1.isObj)(doc) && Array.isArray(doc.rows))
+            return (0, record_set_1.objs)(doc.rows);
+        throw new Error('A JSON table dump must be an array of rows.');
+    }
+    return t
+        .split(/\r?\n/)
+        .filter((l) => l.trim().startsWith('{'))
+        .map((l) => JSON.parse(l));
+}
+/** A jsonb column: an object from JSON dumps, JSON text from CSV. */
+function json(v) {
+    if ((0, record_set_1.isObj)(v))
+        return v;
+    const s = (0, record_set_1.str)(v);
+    if (!s || !s.startsWith('{'))
+        return undefined;
+    try {
+        const o = JSON.parse(s);
+        return (0, record_set_1.isObj)(o) ? o : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A jsonb array column: an array from JSON dumps, JSON text from CSV. */
+function jsonArray(v) {
+    if (Array.isArray(v))
+        return v;
+    const s = (0, record_set_1.str)(v);
+    if (!s?.startsWith('['))
+        return [];
+    try {
+        const a = JSON.parse(s);
+        return Array.isArray(a) ? a : [];
+    }
+    catch {
+        return [];
+    }
+}
+/** Postgres booleans: true / 't' / 'true'. */
+const bool = (v) => v === true || (typeof v === 'string' && ['t', 'true', '1'].includes(v.trim().toLowerCase()));
+/** A timestamptz as Unix ms (psql writes `2024-05-01 10:00:00.123+00`). */
+function ts(v) {
+    const s = (0, record_set_1.str)(v);
+    if (!s)
+        return undefined;
+    let iso = s.replace(' ', 'T').replace(/([+-]\d\d)$/, '$1:00');
+    // `timestamp without time zone` columns (sessions.refreshed_at) hold UTC.
+    if (/T\d\d:\d\d(:\d\d(\.\d+)?)?$/.test(iso))
+        iso += 'Z';
+    const t = Date.parse(iso);
+    return Number.isFinite(t) ? t : undefined;
+}
+/** bytea (`\x…` hex from psql, or base64) → base64url. */
+function bytesB64url(v) {
+    const s = (0, record_set_1.str)(v);
+    if (!s)
+        return undefined;
+    if (/^\\x[0-9a-f]*$/i.test(s))
+        return Buffer.from(s.slice(2), 'hex').toString('base64url');
+    return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('base64url');
+}
+// ── passwords ──────────────────────────────────────────────────────────────
+const FBSCRYPT = /^\$fbscrypt\$v=1,n=(\d+),r=(\d+),p=(\d+)(?:,ss=([^,$]+))?(?:,sk=([^$]+))?\$([^$]+)\$(.+)$/;
+/**
+ * `auth.users.encrypted_password` → a bundle password: bcrypt and argon2 are
+ * self-describing; `$fbscrypt$` (Firebase users imported into Supabase) is
+ * unpacked into the registry's scrypt_firebase fields. A value encrypted with
+ * GoTrue's column encryption (JSON `aes-gcm-hkdf`) cannot be read here.
+ */
+function supabasePassword(raw) {
+    const s = (0, record_set_1.str)(raw);
+    if (!s)
+        return {};
+    if (s.startsWith('{'))
+        return { problem: 'encrypted' };
+    if (/^\$2[aby]\$/.test(s) || /^\$argon2(id|i|d)\$/.test(s))
+        return { password: { algorithm: 'auto', hash: s } };
+    const m = FBSCRYPT.exec(s);
+    if (m) {
+        if (!m[5])
+            return { problem: 'no_signer_key' };
+        return {
+            password: {
+                algorithm: 'scrypt_firebase',
+                hash: m[7],
+                salt: m[6],
+                // Supabase's n is the exponent: Firebase mem_cost.
+                params: { rounds: Number(m[2]), mem_cost: Number(m[1]), salt_separator: m[4] ?? '', signer_key: m[5] },
+            },
+        };
+    }
+    return { problem: 'unknown' };
+}
+/**
+ * GoTrue's column encryption (`crypto.EncryptedString`): a JSON
+ * `{"key_id","alg":"aes-gcm-hkdf","data","nonce"}` (std base64), the AES-256-GCM
+ * key derived as HKDF-SHA256(ikm = base64url key, no salt, info = the row id —
+ * the user id for a password hash, the factor id for a TOTP secret). Keys
+ * given as `key_id:key` are tried for their key id only; bare keys for any.
+ * Undefined when the value is not an EncryptedString or no key opens it.
+ */
+function decryptGotrueColumn(raw, rowId, keys) {
+    let es;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!(0, record_set_1.isObj)(parsed))
+            return undefined;
+        es = parsed;
+    }
+    catch {
+        return undefined;
+    }
+    if ((0, record_set_1.str)(es.alg) !== 'aes-gcm-hkdf' || !(0, record_set_1.str)(es.data) || !(0, record_set_1.str)(es.nonce))
+        return undefined;
+    const keyId = (0, record_set_1.str)(es.key_id);
+    const data = Buffer.from((0, record_set_1.str)(es.data), 'base64');
+    const nonce = Buffer.from((0, record_set_1.str)(es.nonce), 'base64');
+    if (data.length < 17 || nonce.length !== 12)
+        return undefined;
+    for (const entry of keys) {
+        const sep = entry.indexOf(':');
+        const id = sep > 0 ? entry.slice(0, sep) : undefined;
+        if (id && keyId && id !== keyId)
+            continue;
+        const ikm = Buffer.from((sep > 0 ? entry.slice(sep + 1) : entry).trim(), 'base64url');
+        if (!ikm.length)
+            continue;
+        try {
+            const key = Buffer.from((0, node_crypto_1.hkdfSync)('sha256', ikm, Buffer.alloc(0), Buffer.from(rowId, 'utf8'), 32));
+            const d = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', key, nonce);
+            d.setAuthTag(data.subarray(data.length - 16));
+            return Buffer.concat([d.update(data.subarray(0, data.length - 16)), d.final()]).toString('utf8');
+        }
+        catch {
+            // wrong key: try the next one
+        }
+    }
+    return undefined;
+}
+// ── export ─────────────────────────────────────────────────────────────────
+async function exportSupabase(opts) {
+    const progress = opts.onProgress ?? (() => undefined);
+    const now = (opts.now ?? Date.now)();
+    if (opts.tables || opts.dumpDir) {
+        progress('auth schema dump');
+        const tables = opts.tables ?? readTableDump(opts.dumpDir);
+        return mapSupabaseTables(tables, { ...opts, now });
+    }
+    if (!opts.url || !opts.serviceRoleKey) {
+        throw new Error('Supabase export needs a dump of the auth schema (supabase-dump=<folder>), or the project URL and service_role key for the Admin API.');
+    }
+    progress('users (Admin API)');
+    const users = await adminUsers(opts);
+    const set = mapSupabaseTables({ users, identities: users.flatMap((u) => (0, record_set_1.objs)(u.identities).map((i) => ({ ...i, user_id: i.user_id ?? u.id }))), mfa_factors: users.flatMap((u) => (0, record_set_1.objs)(u.factors).map((f) => ({ ...f, user_id: u.id }))) }, { ...opts, now });
+    set.warn('Exported through the Admin API, which never returns password hashes or TOTP secrets. Turn on the supabase lazy-migration preset (passwords are checked against Supabase on first sign-in), or export from a dump of the auth schema to move the hashes.');
+    return set;
+}
+async function adminUsers(opts) {
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'Supabase',
+        baseUrl: `${opts.url.replace(/\/+$/, '')}/auth/v1`,
+        headers: { apikey: opts.serviceRoleKey, authorization: `Bearer ${opts.serviceRoleKey}` },
+        fetchImpl: opts.fetchImpl,
+        sleep: opts.sleep,
+    });
+    const out = [];
+    for (let page = 1; page < 100_000; page++) {
+        const { body } = await http.get(`/admin/users?page=${page}&per_page=1000`);
+        const users = (0, record_set_1.objs)(body?.users);
+        out.push(...users);
+        if (users.length < 1000)
+            break;
+    }
+    return out;
+}
+function mapSupabaseTables(tables, opts) {
+    const set = new record_set_1.RecordSet();
+    const t = (name) => tables[name] ?? [];
+    if (!tables.users)
+        throw new Error('The Supabase dump has no users table (users.csv / users.json / auth.users.csv).');
+    if (opts.url)
+        set.manifest.origin = `supabase ${opts.url.replace(/^https?:\/\//, '').replace(/\/.*$/, '')}`;
+    if (opts.rpId)
+        set.manifest.rpId = opts.rpId;
+    // ── SSO connections ──
+    const saml = new Map(t('saml_providers').map((r) => [(0, record_set_1.str)(r.sso_provider_id), r]));
+    const domainsOf = new Map();
+    for (const d of t('sso_domains')) {
+        const id = (0, record_set_1.str)(d.sso_provider_id);
+        const domain = (0, record_set_1.str)(d.domain)?.toLowerCase();
+        if (id && domain)
+            domainsOf.set(id, [...(domainsOf.get(id) ?? []), domain]);
+    }
+    const connections = new Set();
+    for (const p of t('sso_providers')) {
+        const id = (0, record_set_1.str)(p.id);
+        if (!id)
+            continue;
+        const s = saml.get(id);
+        connections.add(id);
+        set.add('sso_connection', (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(s?.name) ?? (0, record_set_1.str)(p.resource_id) ?? id,
+            protocol: 'saml',
+            domains: domainsOf.get(id),
+            enabled: !bool(p.disabled),
+            saml: s ? (0, record_set_1.compact)({ idp_entity_id: (0, record_set_1.str)(s.entity_id), idp_metadata_xml: (0, record_set_1.str)(s.metadata_xml), idp_metadata_url: (0, record_set_1.str)(s.metadata_url), attribute_mapping: attributeMapping(json(s.attribute_mapping)) }) : undefined,
+        }));
+    }
+    if (connections.size)
+        set.warn('SAML connections keep their IdP settings, but Atlas has its own ACS URL and entity id: update each IdP before turning the connection on.');
+    // ── users ──
+    const users = new Set();
+    let encrypted = 0;
+    let unknownHash = 0;
+    let noSignerKey = 0;
+    for (const u of t('users')) {
+        const id = (0, record_set_1.str)(u.id);
+        if (!id)
+            continue;
+        if ((0, record_set_1.str)(u.deleted_at)) {
+            set.omit('user', 'deleted (soft-deleted in Supabase)');
+            continue;
+        }
+        const anonymous = bool(u.is_anonymous);
+        if (anonymous && !opts.includeAnonymous) {
+            set.omit('user', 'anonymous user (left out unless supabase-anonymous=include)');
+            continue;
+        }
+        let stored = u.encrypted_password;
+        const keys = opts.dbEncryptionKeys ?? [];
+        if (keys.length && typeof stored === 'string' && stored.startsWith('{'))
+            stored = decryptGotrueColumn(stored, id, keys) ?? stored;
+        const { password, problem } = supabasePassword(stored);
+        if (problem === 'encrypted')
+            encrypted++;
+        if (problem === 'unknown')
+            unknownHash++;
+        if (problem === 'no_signer_key')
+            noSignerKey++;
+        const user = mapSupabaseUser(u, password, opts.now);
+        if (!user) {
+            set.omit('user', 'no email, phone number or identity');
+            continue;
+        }
+        users.add(id);
+        set.add('user', user, id);
+    }
+    if (encrypted) {
+        const how = opts.dbEncryptionKeys?.length ? 'did not decrypt with the keys given' : 'are encrypted with GoTrue column encryption (pass --set supabase-db-encryption-keys=<key_id>:<key> to decrypt them here)';
+        set.warn(`${encrypted} password hash(es) ${how} and were left out: those passwords move by lazy migration.`);
+    }
+    if (unknownHash)
+        set.warn(`${unknownHash} password hash(es) are in a format Supabase does not issue and were left out.`);
+    if (noSignerKey)
+        set.warn(`${noSignerKey} Firebase-scrypt hash(es) have no signer key (sk=) and were left out: those passwords move by lazy migration.`);
+    // ── identities ──
+    for (const i of t('identities')) {
+        const userId = (0, record_set_1.str)(i.user_id);
+        const provider = (0, record_set_1.str)(i.provider);
+        if (!userId || !provider || !users.has(userId) || SIGN_IN_METHODS.has(provider))
+            continue;
+        const data = json(i.identity_data) ?? {};
+        const subject = (0, record_set_1.str)(i.provider_id) ?? ((0, record_set_1.str)(i.identity_id) ? (0, record_set_1.str)(i.id) : undefined) ?? (0, record_set_1.str)(data.sub) ?? (0, record_set_1.str)(data.provider_id);
+        if (!subject)
+            continue;
+        const sso = provider.startsWith('sso:') ? provider.slice(4) : undefined;
+        set.add('identity', (0, record_set_1.compact)({
+            // The dump's row id; the Admin API calls it identity_id (its `id` is the provider subject).
+            id: (0, record_set_1.str)(i.identity_id) ?? ((0, record_set_1.str)(i.provider_id) ? (0, record_set_1.str)(i.id) : undefined),
+            user_id: userId,
+            provider: sso ? 'saml' : provider,
+            provider_user_id: subject,
+            kind: sso ? 'saml' : 'oauth',
+            sso_connection_id: sso && connections.has(sso) ? sso : undefined,
+            email: (0, record_set_1.str)(i.email ?? data.email)?.toLowerCase(),
+            email_verified: data.email_verified === true ? true : undefined,
+            profile: (0, record_set_1.bag)(data),
+        }), `${provider}:${subject}`);
+    }
+    // ── second factors and passkeys ──
+    let totpEncrypted = 0;
+    let webauthnNoRp = 0;
+    for (const f of t('mfa_factors')) {
+        const userId = (0, record_set_1.str)(f.user_id);
+        if (!userId || !users.has(userId))
+            continue;
+        if ((0, record_set_1.str)(f.status) !== 'verified') {
+            set.omit('mfa_factor', 'unverified factor (enrollment never finished)');
+            continue;
+        }
+        const type = (0, record_set_1.str)(f.factor_type);
+        const created = ts(f.created_at);
+        if (type === 'totp') {
+            const secret = (0, record_set_1.str)(f.secret);
+            if (!secret) {
+                set.omit('mfa_factor', 'TOTP secret not in the export (the Admin API never returns it; export from a dump)');
+                continue;
+            }
+            let plain = secret;
+            if (secret.startsWith('{')) {
+                const opened = opts.dbEncryptionKeys?.length && (0, record_set_1.str)(f.id) ? decryptGotrueColumn(secret, (0, record_set_1.str)(f.id), opts.dbEncryptionKeys) : undefined;
+                if (!opened) {
+                    totpEncrypted++;
+                    continue;
+                }
+                plain = opened;
+            }
+            set.add('mfa_factor', (0, record_set_1.compact)({ id: (0, record_set_1.str)(f.id), user_id: userId, type: 'totp', secret_base32: plain.replace(/=+$/, '').toUpperCase(), digits: 6, period: 30, algorithm: 'SHA1', verified: true, created_at: created }));
+        }
+        else if (type === 'phone') {
+            const phone = (0, record_set_1.e164)(f.phone);
+            if (phone)
+                set.add('mfa_factor', (0, record_set_1.compact)({ id: (0, record_set_1.str)(f.id), user_id: userId, type: 'phone', phone, verified: true, created_at: created }));
+            else
+                set.omit('mfa_factor', 'phone factor without a valid number');
+        }
+        else if (type === 'webauthn') {
+            const cred = json(f.web_authn_credential);
+            const pk = cred ? webauthnFactorPasskey(cred, userId, f, opts.rpId) : null;
+            if (pk)
+                set.add('passkey', pk, pk.credential_id);
+            else if (cred && !opts.rpId)
+                webauthnNoRp++;
+            else
+                set.omit('passkey', 'WebAuthn factor without its credential');
+        }
+    }
+    if (totpEncrypted)
+        set.omit('mfa_factor', opts.dbEncryptionKeys?.length ? 'TOTP secret that does not decrypt with the GoTrue column-encryption keys given (the user enrols again)' : 'TOTP secret encrypted with GoTrue column encryption: pass --set supabase-db-encryption-keys=<key_id>:<key>, else the user enrols again', totpEncrypted);
+    for (const c of t('webauthn_credentials')) {
+        const userId = (0, record_set_1.str)(c.user_id);
+        if (!userId || !users.has(userId))
+            continue;
+        if (!opts.rpId) {
+            webauthnNoRp++;
+            continue;
+        }
+        const credentialId = bytesB64url(c.credential_id);
+        const publicKey = bytesB64url(c.public_key);
+        if (!credentialId || !publicKey)
+            continue;
+        const transports = (0, record_set_1.strs)(jsonArray(c.transports));
+        set.add('passkey', (0, record_set_1.compact)({
+            id: (0, record_set_1.str)(c.id),
+            user_id: userId,
+            credential_id: credentialId,
+            public_key: publicKey,
+            sign_count: Number((0, record_set_1.str)(c.sign_count) ?? 0) || 0,
+            rp_id: opts.rpId,
+            transports,
+            aaguid: (0, record_set_1.str)(c.aaguid),
+            backed_up: bool(c.backed_up),
+            name: (0, record_set_1.str)(c.friendly_name),
+            created_at: ts(c.created_at),
+        }), credentialId);
+    }
+    if (webauthnNoRp)
+        set.omit('passkey', 'no relying-party id given (pass --rp-id with the domain the passkeys were registered on)', webauthnNoRp);
+    // Recovery codes: argon2id hashes, verified as they are.
+    const codeSets = new Map(t('mfa_recovery_code_sets').map((s) => [(0, record_set_1.str)(s.id), (0, record_set_1.str)(s.user_id)]));
+    const codesOf = new Map();
+    for (const c of t('mfa_recovery_codes')) {
+        const userId = codeSets.get((0, record_set_1.str)(c.mfa_recovery_code_set_id));
+        const hash = (0, record_set_1.str)(c.code_hash);
+        if (!userId || !users.has(userId) || !hash || (0, record_set_1.str)(c.consumed_at))
+            continue;
+        codesOf.set(userId, [...(codesOf.get(userId) ?? []), { algorithm: 'auto', hash }]);
+    }
+    for (const [userId, hashes] of codesOf)
+        set.add('mfa_factor', { user_id: userId, type: 'backup_codes', backup_code_hashes: hashes, verified: true });
+    // ── sessions ──
+    const days = opts.sessionDays ?? 30;
+    const sessions = new Map(t('sessions').map((s) => [(0, record_set_1.str)(s.id), s]));
+    let expired = 0;
+    for (const r of t('refresh_tokens')) {
+        const token = (0, record_set_1.str)(r.token);
+        const userId = (0, record_set_1.str)(r.user_id);
+        if (!token || !userId || !users.has(userId) || bool(r.revoked))
+            continue;
+        const s = sessions.get((0, record_set_1.str)(r.session_id));
+        const notAfter = ts(s?.not_after);
+        const expiresAt = notAfter ?? (ts(s?.refreshed_at ?? s?.updated_at ?? r.updated_at) ?? opts.now) + days * DAY;
+        if (expiresAt <= opts.now) {
+            expired++;
+            continue;
+        }
+        set.add('session', (0, record_set_1.compact)({
+            id: (0, record_set_1.str)(r.id) ?? token.slice(0, 4),
+            user_id: userId,
+            // The SSR cookie holds this refresh token: the supabase_refresh_token bridge preset hashes it the same way.
+            token_hash: (0, migrate_1.sessionTokenHash)(token),
+            expires_at: expiresAt,
+            mfa_verified: (0, record_set_1.str)(s?.aal) === 'aal2' || (0, record_set_1.str)(s?.aal) === 'aal3' || undefined,
+            created_at: ts(r.created_at),
+            ip: (0, record_set_1.str)(s?.ip),
+            user_agent: (0, record_set_1.str)(s?.user_agent),
+        }), token);
+    }
+    if (expired)
+        set.omit('session', 'expired or past the session time-box', expired);
+    if (t('sessions').length && !t('refresh_tokens').length) {
+        set.warn('The dump has sessions but no refresh_tokens table, so no session was exported; the supabase bridge still exchanges Supabase access tokens.');
+    }
+    set.manifest.providers = [...new Set(set.list('identity').map((i) => i.provider))].sort();
+    return set;
+}
+function mapSupabaseUser(u, password, now) {
+    const id = (0, record_set_1.str)(u.id);
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(u.phone);
+    const meta = json(u.raw_user_meta_data ?? u.user_metadata) ?? {};
+    const app = { ...(json(u.raw_app_meta_data ?? u.app_metadata) ?? {}) };
+    const providers = (0, record_set_1.strs)(app.providers);
+    delete app.provider;
+    delete app.providers;
+    const anonymous = bool(u.is_anonymous);
+    if (!email && !phone && !anonymous && !providers.some((p) => !SIGN_IN_METHODS.has(p)))
+        return null;
+    const bannedUntil = ts(u.banned_until);
+    const role = (0, record_set_1.str)(u.role);
+    return (0, record_set_1.compact)({
+        id,
+        emails: email ? [{ email, verified: !!(0, record_set_1.str)(u.email_confirmed_at), primary: true }] : undefined,
+        phones: phone ? [{ phone, verified: !!(0, record_set_1.str)(u.phone_confirmed_at), primary: true }] : undefined,
+        name: (0, record_set_1.str)(meta.full_name) ?? (0, record_set_1.str)(meta.name),
+        image_url: (0, record_set_1.str)(meta.avatar_url) ?? (0, record_set_1.str)(meta.picture),
+        password,
+        banned: bannedUntil !== undefined && bannedUntil > now ? true : undefined,
+        // Supabase writes "infinity"-like far dates for a permanent ban; Atlas keeps an expiry only when it is real.
+        ban_expires_at: bannedUntil !== undefined && bannedUntil > now && bannedUntil < now + 50 * 365 * DAY ? bannedUntil : undefined,
+        anonymous: anonymous || undefined,
+        // app_metadata is server-written and rides in the JWT; user_metadata is editable by the user.
+        public_metadata: (0, record_set_1.bag)(app),
+        unsafe_metadata: (0, record_set_1.bag)(meta),
+        private_metadata: (0, record_set_1.bag)((0, record_set_1.compact)({ supabase_role: role && role !== 'authenticated' ? role : undefined, supabase_sso_user: bool(u.is_sso_user) || undefined, supabase_providers: providers.length ? providers : undefined })),
+        created_at: ts(u.created_at),
+        last_sign_in_at: ts(u.last_sign_in_at),
+    });
+}
+/** GoTrue's `attribute_mapping` (`{ keys: { email: { name: "…" } } }`) → attribute → SAML attribute name. */
+function attributeMapping(m) {
+    const keys = m && (0, record_set_1.isObj)(m.keys) ? m.keys : undefined;
+    if (!keys)
+        return undefined;
+    const out = {};
+    for (const [k, v] of Object.entries(keys)) {
+        const name = (0, record_set_1.isObj)(v) ? (0, record_set_1.str)(v.name) ?? (0, record_set_1.strs)(v.names)[0] : undefined;
+        if (name)
+            out[k] = name;
+    }
+    return Object.keys(out).length ? out : undefined;
+}
+/** A WebAuthn MFA factor's go-webauthn credential → a passkey record. */
+function webauthnFactorPasskey(cred, userId, f, rpId) {
+    if (!rpId)
+        return null;
+    const credentialId = bytesB64url(cred.id ?? cred.ID);
+    const publicKey = bytesB64url(cred.publicKey ?? cred.PublicKey);
+    if (!credentialId || !publicKey)
+        return null;
+    const auth = (0, record_set_1.isObj)(cred.authenticator) ? cred.authenticator : (0, record_set_1.isObj)(cred.Authenticator) ? cred.Authenticator : {};
+    const flags = (0, record_set_1.isObj)(cred.flags) ? cred.flags : {};
+    const aaguidRaw = (0, record_set_1.str)(f.web_authn_aaguid);
+    return (0, record_set_1.compact)({
+        id: (0, record_set_1.str)(f.id),
+        user_id: userId,
+        credential_id: credentialId,
+        public_key: publicKey,
+        sign_count: typeof auth.signCount === 'number' ? auth.signCount : 0,
+        rp_id: rpId,
+        transports: (0, record_set_1.strs)(cred.transport ?? cred.Transport),
+        aaguid: aaguidRaw,
+        backed_up: flags.backupState === true ? true : undefined,
+        name: (0, record_set_1.str)(f.friendly_name),
+        created_at: ts(f.created_at),
+    });
+}
+//# sourceMappingURL=supabase.js.map

package/dist/migrate/export/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../../src/migrate/export/supabase.ts"],"names":[],"mappings":";;AA0EA,sCAWC;AAED,wCAcC;AAwDD,4CAmBC;AAUD,kDA8BC;AAID,wCAgBC;AAoBD,8CA+MC;AAED,0CA+BC;AAhfD,6CAAyD;AACzD,qCAA8D;AAC9D,yCAAoD;AAEpD,gDAAsD;AACtD,0CAA4C;AAC5C,6CAA+F;AAC/F,+CAA2C;AA6D3C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AACjE,MAAM,GAAG,GAAG,EAAE,GAAG,QAAQ,CAAC;AAE1B,8EAA8E;AAE9E,wHAAwH;AACxH,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,SAAS;QACvC,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACpE,MAAM,IAAI,GAAG,IAAA,oBAAQ,EAAC,IAAI,EAAE,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClF,GAAG,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,cAAc,CAAC,IAAY,EAAE,GAAW;IACtD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAA,cAAQ,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtI,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAA,iBAAI,EAAC,GAAG,CAAC,CAAC;QACzC,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAA,iBAAI,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC;SACL,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAQ,CAAC,CAAC;AACtC,CAAC;AAED,qEAAqE;AACrE,SAAS,IAAI,CAAC,CAAU;IACtB,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AACD,0EAA0E;AAC1E,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AACD,8CAA8C;AAC9C,MAAM,IAAI,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACnI,2EAA2E;AAC3E,SAAS,EAAE,CAAC,CAAU;IACpB,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC9D,0EAA0E;IAC1E,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,IAAI,GAAG,CAAC;IACxD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AACD,0DAA0D;AAC1D,SAAS,WAAW,CAAC,CAAU;IAC7B,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9F,CAAC;AAED,8EAA8E;AAE9E,MAAM,QAAQ,GAAG,2FAA2F,CAAC;AAE7G;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,GAAY;IAC3C,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACvD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;IAChH,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE,CAAC;QACN,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC/C,OAAO;YACL,QAAQ,EAAE;gBACR,SAAS,EAAE,iBAAiB;gBAC5B,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE;gBACX,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE;gBACX,mDAAmD;gBACnD,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;aACvG;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,GAAW,EAAE,KAAa,EAAE,IAAuB;IACrF,IAAI,EAAO,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAA,kBAAK,EAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACrC,EAAE,GAAG,MAAM,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAA,gBAAG,EAAC,EAAE,CAAC,GAAG,CAAC,KAAK,cAAc,IAAI,CAAC,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,EAAE,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAE,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,EAAE,CAAC,KAAK,CAAE,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,KAAK,KAAK;YAAE,SAAS;QAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,SAAS;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,sBAAQ,EAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAClG,MAAM,CAAC,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnG,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAEvE,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,OAAQ,CAAC,CAAC;QAC3D,OAAO,iBAAiB,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,sIAAsI,CAAC,CAAC;IAC1J,CAAC;IACD,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9P,GAAG,CAAC,IAAI,CAAC,yPAAyP,CAAC,CAAC;IACpQ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAA2B;IACnD,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,GAAG,IAAI,CAAC,GAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU;QACnD,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,cAAe,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,cAAc,EAAE,EAAE;QACzF,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,qBAAqB,IAAI,gBAAgB,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACnB,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;YAAE,MAAM;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,iBAAiB,CAAC,MAA6B,EAAE,IAA0D;IACzH,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,CAAC,IAAY,EAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACtH,IAAI,IAAI,CAAC,GAAG;QAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,YAAY,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;IAC5G,IAAI,IAAI,CAAC,IAAI;QAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAE7C,wBAAwB;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAU,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;QAC5C,IAAI,EAAE,IAAI,MAAM;YAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAA,oBAAO,EAAC;YAChC,EAAE;YACF,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;YAC9C,QAAQ,EAAE,MAAe;YACzB,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1B,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,oBAAO,EAAC,EAAE,aAAa,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;SACjN,CAAwB,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,WAAW,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,0IAA0I,CAAC,CAAC;IAE3K,cAAc;IACd,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,6DAA6D,CAAC,CAAC;YAChF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC,kBAAkB,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC;QAClI,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,OAAO,KAAK,WAAW;YAAE,SAAS,EAAE,CAAC;QACzC,IAAI,OAAO,KAAK,SAAS;YAAE,WAAW,EAAE,CAAC;QACzC,IAAI,OAAO,KAAK,eAAe;YAAE,WAAW,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,0HAA0H,CAAC;QAC/M,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,sBAAsB,GAAG,6DAA6D,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,+EAA+E,CAAC,CAAC;IACzH,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,+GAA+G,CAAC,CAAC;IAEzJ,mBAAmB;IACnB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7H,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,oBAAO,EAAC;YAC1B,4FAA4F;YAC5F,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YACjC,gBAAgB,EAAE,OAAO;YACzB,IAAI,EAAE,GAAG,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,OAAiB;YAClD,iBAAiB,EAAE,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YAChE,KAAK,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE;YAChD,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC/D,OAAO,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC;SACnB,CAAmB,EAAE,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,oCAAoC;IACpC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC5C,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,oFAAoF,CAAC,CAAC;gBAC7G,SAAS;YACX,CAAC;YACD,IAAI,KAAK,GAAG,MAAM,CAAC;YACnB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,aAAa,EAAE,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,KAAK,GAAG,MAAM,CAAC;YACjB,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAe,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAoB,CAAC,CAAC;QAC9P,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAoB,CAAC,CAAC;;gBAChK,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,qCAAqC,CAAC,CAAC;QACrE,CAAC;aAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3E,IAAI,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC;iBAC5C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,YAAY,EAAE,CAAC;;gBACvC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,IAAI,aAAa;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,wGAAwG,CAAC,CAAC,CAAC,wIAAwI,EAAE,aAAa,CAAC,CAAC;IAC9U,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,YAAY,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;YAAE,SAAS;QAC1C,MAAM,UAAU,GAAG,IAAA,iBAAI,EAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAA,oBAAO,EAAC;YACzB,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC;YACb,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,MAAM,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;YAC/C,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,UAAU;YACV,MAAM,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC;YACrB,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5B,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,aAAa,CAAC;YAC1B,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;SAC7B,CAAkB,EAAE,YAAY,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,YAAY;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,0FAA0F,EAAE,YAAY,CAAC,CAAC;IAEhJ,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAU,CAAC,CAAC,CAAC;IACvG,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;YAAE,SAAS;QAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAErJ,iBAAiB;IACjB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAU,CAAC,CAAC,CAAC;IAC5E,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,SAAS;QACzE,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,EAAE,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC;QAC9G,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAA,oBAAO,EAAC;YACzB,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,MAAM;YACf,4GAA4G;YAC5G,UAAU,EAAE,IAAA,0BAAgB,EAAC,KAAK,CAAC;YACnC,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,IAAA,gBAAG,EAAC,CAAC,EAAE,GAAG,CAAC,KAAK,MAAM,IAAI,IAAA,gBAAG,EAAC,CAAC,EAAE,GAAG,CAAC,KAAK,MAAM,IAAI,SAAS;YAC3E,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;YAC5B,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,EAAE,EAAE,CAAC;YACd,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,EAAE,UAAU,CAAC;SAC/B,CAAkB,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,sCAAsC,EAAE,OAAO,CAAC,CAAC;IAClF,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,4IAA4I,CAAC,CAAC;IACzJ,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,eAAe,CAAC,CAAM,EAAE,QAAkC,EAAE,GAAW;IACrF,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAE,CAAC;IACtB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IACvE,MAAM,SAAS,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACpB,OAAO,GAAG,CAAC,SAAS,CAAC;IACrB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,IAAA,oBAAO,EAAC;QACb,EAAE;QACF,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7F,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7F,IAAI,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,IAAI,CAAC;QAC3C,SAAS,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,OAAO,CAAC;QACpD,QAAQ;QACR,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACzE,6GAA6G;QAC7G,cAAc,EAAE,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,GAAG,IAAI,WAAW,GAAG,GAAG,GAAG,EAAE,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC9H,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,8FAA8F;QAC9F,eAAe,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC;QACzB,eAAe,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC;QAC1B,gBAAgB,EAAE,IAAA,gBAAG,EAAC,IAAA,oBAAO,EAAC,EAAE,aAAa,EAAE,IAAI,IAAI,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,SAAS,EAAE,kBAAkB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACzN,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;QAC5B,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;KACvC,CAAe,CAAC;AACnB,CAAC;AAED,6GAA6G;AAC7G,SAAS,gBAAgB,CAAC,CAAkB;IAC1C,MAAM,IAAI,GAAG,CAAC,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,IAAI,IAAI;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAS,qBAAqB,CAAC,IAAS,EAAE,MAAc,EAAE,CAAM,EAAE,IAAwB;IACxF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAC1C,OAAO,IAAA,oBAAO,EAAC;QACb,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACnE,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,IAAA,iBAAI,EAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAClD,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACxD,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,aAAa,CAAC;QAC1B,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;KAC7B,CAAkB,CAAC;AACtB,CAAC"}

package/dist/migrate/export/supertokens-config.d.ts

@@ -0,0 +1,20 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { type VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate supertokens config` — the core's multitenancy settings →
+ * Atlas config, read from the core API with its API key on this machine: which
+ * recipes the public tenant enables (email/password, third-party, passwordless),
+ * its first and required secondary factors, third-party providers (client ids
+ * only; secrets become placeholders), and the core configuration (token and
+ * code lifetimes). Everything that lives in your backend's `supertokens.init`
+ * (override functions, custom claims, email delivery) is reported as manual:
+ * the core never sees it.
+ */
+export interface SupertokensConfigSnapshot {
+    origin: string;
+    appId: string;
+    tenants: Obj[];
+}
+export declare function fetchSupertokensConfig(http: VendorHttp, origin: string, appId: string): Promise<SupertokensConfigSnapshot>;
+export declare function translateSupertokensConfig(snap: SupertokensConfigSnapshot): TranslationResult;