@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/azure.js

@@ -1,373 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GRAPH = void 0;
-exports.graphToken = graphToken;
-exports.graphHttp = graphHttp;
-exports.graphAll = graphAll;
-exports.providerOfIssuer = providerOfIssuer;
-exports.extensionAttributes = extensionAttributes;
-exports.isDirectoryUser = isDirectoryUser;
-exports.mapAzureUser = mapAzureUser;
-exports.azureFactors = azureFactors;
-exports.azureTenantInfo = azureTenantInfo;
-exports.userExtensionNames = userExtensionNames;
-exports.exportAzure = exportAzure;
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-exports.GRAPH = 'https://graph.microsoft.com/v1.0';
-/** The client-credentials token for Microsoft Graph (sent to login.microsoftonline.com only). */
-async function graphToken(tenant, clientId, clientSecret, fetchImpl = fetch) {
-    const res = await fetchImpl(`https://login.microsoftonline.com/${encodeURIComponent(tenant)}/oauth2/v2.0/token`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
-        body: new URLSearchParams({ grant_type: 'client_credentials', client_id: clientId, client_secret: clientSecret, scope: 'https://graph.microsoft.com/.default' }).toString(),
-    });
-    const text = await res.text();
-    let body = {};
-    try {
-        body = JSON.parse(text);
-    }
-    catch {
-        // not JSON: reported below
-    }
-    const token = (0, record_set_1.str)(body.access_token);
-    if (!res.ok || !token) {
-        const detail = ((0, record_set_1.str)(body.error_description) ?? (0, record_set_1.str)(body.error) ?? text.slice(0, 200)).split(/\r?\n/)[0];
-        throw new vendor_http_1.VendorApiError('Microsoft Entra', res.status, '/oauth2/v2.0/token', detail ?? '');
-    }
-    return token;
-}
-/** Graph over {@link VendorHttp}: a bearer from a token or client credentials, fetched once. */
-function graphHttp(o) {
-    if (!o.accessToken && !(o.clientId && o.clientSecret))
-        throw new Error('Microsoft Graph needs an app registration\'s client id and secret (or an access token).');
-    let bearer = o.accessToken;
-    return new vendor_http_1.VendorHttp({
-        vendor: 'Microsoft Graph',
-        baseUrl: exports.GRAPH,
-        headers: async () => ({ authorization: `Bearer ${(bearer ??= await graphToken(o.tenant, o.clientId, o.clientSecret, o.fetchImpl))}` }),
-        fetchImpl: o.fetchImpl,
-        sleep: o.sleep,
-    });
-}
-/** Every page of a Graph collection (`@odata.nextLink`). */
-async function graphAll(http, path) {
-    const out = [];
-    let next = path;
-    while (next) {
-        const res = await http.get(next);
-        const body = (0, record_set_1.isObj)(res.body) ? res.body : {};
-        out.push(...(0, record_set_1.objs)(body.value));
-        next = (0, record_set_1.str)(body['@odata.nextLink']);
-    }
-    return out;
-}
-const USER_FIELDS = [
-    'id',
-    'displayName',
-    'givenName',
-    'surname',
-    'mail',
-    'otherMails',
-    'mobilePhone',
-    'identities',
-    'accountEnabled',
-    'createdDateTime',
-    'userPrincipalName',
-    'userType',
-    'creationType',
-    'passwordPolicies',
-    'lastPasswordChangeDateTime',
-    'preferredLanguage',
-    'city',
-    'country',
-    'jobTitle',
-];
-/** Federated identity issuers → the provider an identity record carries. */
-const ISSUERS = [
-    [/^(https?:\/\/)?(accounts\.)?google\.com\/?$/i, 'google'],
-    [/^(https?:\/\/)?(www\.)?facebook\.com\/?$/i, 'facebook'],
-    [/^(https?:\/\/)?appleid\.apple\.com\/?$/i, 'apple'],
-    [/^(https?:\/\/)?(www\.)?amazon\.com\/?$/i, 'amazon'],
-    [/^(https?:\/\/)?(www\.)?linkedin\.com\/?$/i, 'linkedin'],
-    [/^(https?:\/\/)?(www\.)?(twitter|x)\.com\/?$/i, 'x'],
-    [/^(https?:\/\/)?(www\.)?github\.com\/?$/i, 'github'],
-    [/^(MicrosoftAccount|live\.com|https:\/\/login\.live\.com)\/?$/i, 'microsoft'],
-    [/^https:\/\/login\.microsoftonline\.com\/9188040d-6c67-4c5b-b112-36a304b66dad\/v2\.0\/?$/i, 'microsoft'],
-];
-/** The provider name for a federated identity's issuer (a social key, or the issuer itself for an OIDC / enterprise IdP). */
-function providerOfIssuer(issuer) {
-    for (const [re, key] of ISSUERS)
-        if (re.test(issuer))
-            return { provider: key, kind: 'oauth' };
-    return { provider: issuer, kind: /^https:\/\//.test(issuer) ? 'oidc' : 'oauth' };
-}
-/** The extension attributes on a user (`extension_<appId>_<name>`) by bare name. */
-function extensionAttributes(u) {
-    const out = {};
-    for (const [k, v] of Object.entries(u)) {
-        const m = /^extension_[0-9a-f]{32}_(.+)$/i.exec(k);
-        if (m && v !== null && v !== undefined)
-            out[m[1]] = v;
-    }
-    return out;
-}
-/** True for directory (admin / work) accounts: no consumer sign-in identity, only a userPrincipalName. */
-function isDirectoryUser(u) {
-    const ids = (0, record_set_1.objs)(u.identities);
-    if ((0, record_set_1.str)(u.creationType) === 'LocalAccount')
-        return false;
-    return !ids.some((i) => (0, record_set_1.str)(i.signInType) !== 'userPrincipalName');
-}
-/** Map one Graph user onto a user record and its federated identities. */
-function mapAzureUser(u) {
-    const id = (0, record_set_1.str)(u.id);
-    if (!id)
-        return null;
-    const emails = [];
-    const phones = [];
-    const identities = [];
-    let username;
-    let skippedIdentities = 0;
-    const addEmail = (raw, verified) => {
-        const e = (0, record_set_1.str)(raw)?.toLowerCase();
-        if (!e || !e.includes('@'))
-            return;
-        const existing = emails.find((x) => x.email === e);
-        if (existing)
-            existing.verified ||= verified;
-        else
-            emails.push({ email: e, verified, primary: false });
-    };
-    const addPhone = (raw, verified) => {
-        const p = (0, record_set_1.e164)(raw);
-        if (!p)
-            return;
-        const existing = phones.find((x) => x.phone === p);
-        if (existing)
-            existing.verified ||= verified;
-        else
-            phones.push({ phone: p, verified, primary: false });
-    };
-    for (const ident of (0, record_set_1.objs)(u.identities)) {
-        const type = (0, record_set_1.str)(ident.signInType) ?? '';
-        const value = (0, record_set_1.str)(ident.issuerAssignedId);
-        // Local sign-in names were verified by the user flow when the account was created (email / SMS code).
-        if (/^emailAddress\d*$/.test(type))
-            addEmail(value, true);
-        else if (type === 'userName')
-            username ??= value;
-        else if (type === 'phoneNumber')
-            addPhone(value, true);
-        else if (type === 'federated') {
-            const issuer = (0, record_set_1.str)(ident.issuer);
-            if (!issuer || !value) {
-                skippedIdentities++;
-                continue;
-            }
-            const { provider, kind } = providerOfIssuer(issuer);
-            identities.push((0, record_set_1.compact)({ user_id: id, provider, provider_user_id: value, kind, profile: { issuer } }));
-        }
-    }
-    addEmail(u.mail, false);
-    for (const m of (0, record_set_1.strs)(u.otherMails))
-        addEmail(m, false);
-    addPhone(u.mobilePhone, false);
-    if (emails[0])
-        emails[0].primary = true;
-    if (phones[0] && !emails.length)
-        phones[0].primary = true;
-    const custom = extensionAttributes(u);
-    const user = (0, record_set_1.compact)({
-        id,
-        emails: emails.length ? emails : undefined,
-        phones: phones.length ? phones : undefined,
-        username,
-        first_name: (0, record_set_1.str)(u.givenName),
-        last_name: (0, record_set_1.str)(u.surname),
-        name: (0, record_set_1.str)(u.displayName) === 'unknown' ? undefined : (0, record_set_1.str)(u.displayName),
-        banned: u.accountEnabled === false ? true : undefined,
-        public_metadata: Object.keys(custom).length ? custom : undefined,
-        private_metadata: (0, record_set_1.compact)({
-            azure_user_principal_name: (0, record_set_1.str)(u.userPrincipalName),
-            azure_creation_type: (0, record_set_1.str)(u.creationType),
-            azure_password_policies: (0, record_set_1.str)(u.passwordPolicies),
-            azure_profile: (0, record_set_1.compact)({ preferredLanguage: (0, record_set_1.str)(u.preferredLanguage), city: (0, record_set_1.str)(u.city), country: (0, record_set_1.str)(u.country), jobTitle: (0, record_set_1.str)(u.jobTitle) }),
-        }),
-        created_at: (0, record_set_1.str)(u.createdDateTime),
-    });
-    if (user.private_metadata && !Object.keys(user.private_metadata.azure_profile).length)
-        delete user.private_metadata.azure_profile;
-    if (!user.emails && !user.phones && !user.username) {
-        // A directory account (included on request) signs in by its userPrincipalName.
-        const upn = (0, record_set_1.str)(u.userPrincipalName) ?? (0, record_set_1.str)((0, record_set_1.objs)(u.identities).find((i) => (0, record_set_1.str)(i.signInType) === 'userPrincipalName')?.issuerAssignedId);
-        if (upn)
-            user.username = upn;
-    }
-    if (!user.emails && !user.phones && !user.username) {
-        // A federated-only account without an email claim: keep the object id reachable as a username-less user through its identity.
-        if (!identities.length)
-            return null;
-        user.username = `user_${id.replace(/-/g, '').slice(0, 20)}`;
-    }
-    return { user, identities, skippedIdentities };
-}
-/** Second factors from a user's authentication methods. */
-function azureFactors(userId, phoneMethods, emailMethods) {
-    const out = [];
-    for (const m of phoneMethods) {
-        const phone = (0, record_set_1.e164)(m.phoneNumber);
-        if (phone && (0, record_set_1.str)(m.phoneType) !== 'office')
-            out.push({ user_id: userId, type: 'phone', phone, verified: true });
-    }
-    if (emailMethods.some((m) => (0, record_set_1.str)(m.emailAddress)))
-        out.push({ user_id: userId, type: 'email', verified: true });
-    return out;
-}
-/** Tenant id and initial domain (needs Organization.Read.All or Directory.Read.All; empty when not granted). */
-async function azureTenantInfo(http) {
-    try {
-        const orgs = await graphAll(http, '/organization?$select=id,verifiedDomains');
-        const org = orgs[0];
-        if (!org)
-            return {};
-        const initial = (0, record_set_1.objs)(org.verifiedDomains).find((d) => d.isInitial === true);
-        return { tenantId: (0, record_set_1.str)(org.id), tenantName: (0, record_set_1.str)(initial?.name)?.replace(/\.onmicrosoft\.com$/i, '').toLowerCase() };
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && err.status === 403)
-            return {};
-        throw err;
-    }
-}
-/** The extension attribute names registered for users (`extension_<app>_<name>`), for `$select`. */
-async function userExtensionNames(http) {
-    try {
-        const res = await http.post('/directoryObjects/getAvailableExtensionProperties', { isSyncedFromOnPremises: false });
-        return (0, record_set_1.objs)((0, record_set_1.isObj)(res.body) ? res.body.value : undefined)
-            .filter((p) => (0, record_set_1.strs)(p.targetObjects).includes('User'))
-            .map((p) => (0, record_set_1.str)(p.name))
-            .filter((n) => !!n && /^extension_[0-9a-f]{32}_/i.test(n));
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && [400, 401, 403, 404].includes(err.status))
-            return [];
-        throw err;
-    }
-}
-async function exportAzure(opts) {
-    const set = new record_set_1.RecordSet();
-    const label = opts.kind === 'b2c' ? 'Azure AD B2C' : 'Entra External ID';
-    const progress = opts.onProgress ?? (() => undefined);
-    const http = graphHttp(opts);
-    const info = await azureTenantInfo(http);
-    set.manifest.origin = `${label} tenant ${info.tenantName ? `${info.tenantName}.onmicrosoft.com` : opts.tenant}`;
-    // Groups → app roles.
-    const groups = [];
-    if (opts.groups !== 'skip') {
-        progress('groups');
-        try {
-            for (const g of await graphAll(http, '/groups?$select=id,displayName,description&$top=999')) {
-                const id = (0, record_set_1.str)(g.id);
-                const name = (0, record_set_1.str)(g.displayName);
-                if (!id || !name)
-                    continue;
-                const key = (0, translate_kit_1.keyOf)(name);
-                groups.push({ id, key });
-                set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(g.description), scope: 'app' }), key);
-            }
-        }
-        catch (err) {
-            if (!(err instanceof vendor_http_1.VendorApiError && err.status === 403))
-                throw err;
-            set.warn('Groups were not exported: the app registration lacks GroupMember.Read.All (or Group.Read.All).');
-        }
-    }
-    // Users.
-    progress('users');
-    const extensions = await userExtensionNames(http);
-    const select = [...USER_FIELDS, ...extensions].join(',');
-    const raw = await graphAll(http, `/users?$select=${select}&$top=999`);
-    const providers = new Set();
-    let directory = 0;
-    let skippedIdentities = 0;
-    let totpUsers = 0;
-    let fido2Users = 0;
-    let methodsDenied = false;
-    for (const u of raw) {
-        if (!opts.includeDirectoryUsers && isDirectoryUser(u)) {
-            directory++;
-            continue;
-        }
-        const mapped = mapAzureUser(u);
-        if (!mapped) {
-            set.omit('user', 'no email, phone number, username or federated identity');
-            continue;
-        }
-        set.add('user', mapped.user, mapped.user.id);
-        for (const i of mapped.identities) {
-            set.add('identity', i, `${i.provider}:${i.provider_user_id}`);
-            providers.add(i.provider);
-        }
-        skippedIdentities += mapped.skippedIdentities;
-        if (opts.authMethods && !methodsDenied) {
-            const uid = encodeURIComponent(mapped.user.id);
-            try {
-                const phone = await graphAll(http, `/users/${uid}/authentication/phoneMethods`);
-                const email = await graphAll(http, `/users/${uid}/authentication/emailMethods`);
-                for (const f of azureFactors(mapped.user.id, phone, email))
-                    set.add('mfa_factor', f);
-                if ((await graphAll(http, `/users/${uid}/authentication/softwareOathMethods`)).length)
-                    totpUsers++;
-                if ((await graphAll(http, `/users/${uid}/authentication/fido2Methods`)).length)
-                    fido2Users++;
-            }
-            catch (err) {
-                if (!(err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 401)))
-                    throw err;
-                methodsDenied = true;
-                set.warn('Authentication methods were not exported: grant the app registration UserAuthenticationMethod.Read.All.');
-            }
-        }
-    }
-    if (directory)
-        set.omit('user', 'directory (admin / work) account that signs in with a userPrincipalName only', directory);
-    if (skippedIdentities)
-        set.omit('identity', 'federated identity without an issuer-assigned id (Graph keeps only an alternativeSecurityId); relinks by verified email on first sign-in', skippedIdentities);
-    if (totpUsers)
-        set.omit('mfa_factor', 'Microsoft never exports authenticator-app (software OATH) secrets: these users enrol again', totpUsers);
-    if (fido2Users)
-        set.omit('passkey', 'FIDO2 keys are bound to the Microsoft sign-in domain and never exported: these users register again', fido2Users);
-    // Group members → user roles.
-    if (groups.length) {
-        progress('group members');
-        const ids = new Set(set.list('user').map((u) => u.id));
-        const rolesOf = new Map();
-        for (const g of groups) {
-            for (const m of await graphAll(http, `/groups/${encodeURIComponent(g.id)}/members?$select=id&$top=999`)) {
-                const id = (0, record_set_1.str)(m.id);
-                if (!id || !ids.has(id))
-                    continue;
-                rolesOf.set(id, [...(rolesOf.get(id) ?? []), g.key]);
-            }
-        }
-        for (const user of set.list('user')) {
-            const roles = rolesOf.get(user.id);
-            if (roles?.length)
-                user.roles = [...new Set(roles)];
-        }
-    }
-    if (set.count('user')) {
-        set.warn(opts.kind === 'b2c'
-            ? 'Azure AD B2C never exports passwords. Turn on the azure_ad_b2c lazy-migration preset with a ROPC user flow: each password is checked against B2C on its first Atlas sign-in, then stored as Argon2id. Accounts with MFA enforced in that flow, and federated accounts, cannot use ROPC.'
-            : 'Entra External ID never exports passwords. Turn on the entra_external_id lazy-migration preset (native authentication): each password is checked against External ID on its first Atlas sign-in, then stored as Argon2id.');
-        set.warn(opts.kind === 'b2c'
-            ? 'Users are keyed by their object id, the sub claim of default B2C user flows. If a custom policy issues another value as sub, map the bridge subject to the claim that carries the object id (oid).'
-            : 'Users are keyed by their object id (the oid claim); the entra_external_id bridge preset matches on oid.');
-    }
-    set.manifest.providers = [...providers].sort();
-    set.manifest.settings = (0, record_set_1.compact)({ kind: opts.kind, tenant_id: info.tenantId, tenant_name: info.tenantName, extension_attributes: extensions.length ? extensions : undefined });
-    return set;
-}
-//# sourceMappingURL=azure.js.map

package/dist/migrate/export/azure.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"azure.js","sourceRoot":"","sources":["../../../src/migrate/export/azure.ts"],"names":[],"mappings":";;;AAoDA,gCAmBC;AAGD,8BAUC;AAGD,4BAUC;AAsCD,4CAGC;AAGD,kDAOC;AAGD,0CAIC;AAGD,oCA2EC;AAGD,oCAQC;AASD,0CAWC;AAGD,gDAWC;AAED,kCA4GC;AAnYD,6CAA0F;AAC1F,mDAAwC;AACxC,+CAA2D;AA8C9C,QAAA,KAAK,GAAG,kCAAkC,CAAC;AAExD,iGAAiG;AAC1F,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,QAAgB,EAAE,YAAoB,EAAE,YAA0B,KAAK;IACtH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,qCAAqC,kBAAkB,CAAC,MAAM,CAAC,oBAAoB,EAAE;QAC/G,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC5K,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,GAAQ,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAQ,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,IAAI,4BAAc,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gGAAgG;AAChG,SAAgB,SAAS,CAAC,CAAsJ;IAC9K,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAClK,IAAI,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3B,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,aAAK;QACd,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,MAAM,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAS,EAAE,CAAC,CAAC,YAAa,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;QACxI,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAED,4DAA4D;AACrD,KAAK,UAAU,QAAQ,CAAC,IAAgB,EAAE,IAAY;IAC3D,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,GAAsB,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,IAAI;IACJ,aAAa;IACb,WAAW;IACX,SAAS;IACT,MAAM;IACN,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,UAAU;IACV,cAAc;IACd,kBAAkB;IAClB,4BAA4B;IAC5B,mBAAmB;IACnB,MAAM;IACN,SAAS;IACT,UAAU;CACX,CAAC;AAEF,4EAA4E;AAC5E,MAAM,OAAO,GAA4B;IACvC,CAAC,8CAA8C,EAAE,QAAQ,CAAC;IAC1D,CAAC,2CAA2C,EAAE,UAAU,CAAC;IACzD,CAAC,yCAAyC,EAAE,OAAO,CAAC;IACpD,CAAC,yCAAyC,EAAE,QAAQ,CAAC;IACrD,CAAC,2CAA2C,EAAE,UAAU,CAAC;IACzD,CAAC,8CAA8C,EAAE,GAAG,CAAC;IACrD,CAAC,yCAAyC,EAAE,QAAQ,CAAC;IACrD,CAAC,+DAA+D,EAAE,WAAW,CAAC;IAC9E,CAAC,0FAA0F,EAAE,WAAW,CAAC;CAC1G,CAAC;AAEF,6HAA6H;AAC7H,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,OAAO;QAAE,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9F,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AACnF,CAAC;AAED,oFAAoF;AACpF,SAAgB,mBAAmB,CAAC,CAAM;IACxC,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0GAA0G;AAC1G,SAAgB,eAAe,CAAC,CAAM;IACpC,MAAM,GAAG,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,KAAK,mBAAmB,CAAC,CAAC;AACrE,CAAC;AAED,0EAA0E;AAC1E,SAAgB,YAAY,CAAC,CAAM;IACjC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,IAAI,QAA4B,CAAC;IACjC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,QAAiB,EAAE,EAAE;QACnD,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,QAAiB,EAAE,EAAE;QACnD,MAAM,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC1C,sGAAsG;QACtG,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;aACrD,IAAI,IAAI,KAAK,UAAU;YAAE,QAAQ,KAAK,KAAK,CAAC;aAC5C,IAAI,IAAI,KAAK,aAAa;YAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;aAClD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,iBAAiB,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpD,UAAU,CAAC,IAAI,CAAC,IAAA,oBAAO,EAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC;QAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;IAC1D,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC1C,QAAQ;QACR,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;QACvE,MAAM,EAAE,CAAC,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACrD,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAChE,gBAAgB,EAAE,IAAA,oBAAO,EAAC;YACxB,yBAAyB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC;YACnD,mBAAmB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;YACxC,uBAAuB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC;YAChD,aAAa,EAAE,IAAA,oBAAO,EAAC,EAAE,iBAAiB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;SAC/I,CAAQ;QACT,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAoB,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;IACzI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnD,+EAA+E;QAC/E,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,KAAK,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACzI,IAAI,GAAG;YAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnD,8HAA8H;QAC9H,IAAI,CAAC,UAAU,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;AACjD,CAAC;AAED,2DAA2D;AAC3D,SAAgB,YAAY,CAAC,MAAc,EAAE,YAAmB,EAAE,YAAmB;IACnF,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,KAAK,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChH,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,gHAAgH;AACzG,KAAK,UAAU,eAAe,CAAC,IAAgB;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,0CAA0C,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;QAC5E,OAAO,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IACtH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oGAAoG;AAC7F,KAAK,UAAU,kBAAkB,CAAC,IAAgB;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,mDAAmD,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC;QACzH,OAAO,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;aACtD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,KAAK,WAAW,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAEhH,sBAAsB;IACtB,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,qDAAqD,CAAC,EAAE,CAAC;gBAC5F,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBAChC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAC3B,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,SAAS;IACT,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,kBAAkB,MAAM,WAAW,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,qBAAqB,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,wDAAwD,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC9D,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,iBAAiB,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAC9C,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,8BAA8B,CAAC,CAAC;gBAChF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,8BAA8B,CAAC,CAAC;gBAChF,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;gBACrF,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,qCAAqC,CAAC,CAAC,CAAC,MAAM;oBAAE,SAAS,EAAE,CAAC;gBACnG,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,8BAA8B,CAAC,CAAC,CAAC,MAAM;oBAAE,UAAU,EAAE,CAAC;YAC/F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;oBAAE,MAAM,GAAG,CAAC;gBAC9F,aAAa,GAAG,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,8EAA8E,EAAE,SAAS,CAAC,CAAC;IAC3H,IAAI,iBAAiB;QAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,0IAA0I,EAAE,iBAAiB,CAAC,CAAC;IAC3M,IAAI,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,4FAA4F,EAAE,SAAS,CAAC,CAAC;IAC/I,IAAI,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,qGAAqG,EAAE,UAAU,CAAC,CAAC;IAEvJ,8BAA8B;IAC9B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,WAAW,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,8BAA8B,CAAC,EAAE,CAAC;gBACxG,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAS;gBAClC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,MAAM;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CACN,IAAI,CAAC,IAAI,KAAK,KAAK;YACjB,CAAC,CAAC,yRAAyR;YAC3R,CAAC,CAAC,2NAA2N,CAChO,CAAC;QACF,GAAG,CAAC,IAAI,CACN,IAAI,CAAC,IAAI,KAAK,KAAK;YACjB,CAAC,CAAC,oMAAoM;YACtM,CAAC,CAAC,yGAAyG,CAC9G,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAA,oBAAO,EAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,oBAAoB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAQ,CAAC;IACtL,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/clerk-config.d.ts

@@ -1,26 +0,0 @@
-import type { TranslationResult } from '../framework/plugin';
-import { type Obj } from './record-set';
-/**
- * `atlas migrate clerk config` — a Clerk instance's settings → Atlas config.
- *
- * Read from Clerk's PUBLIC environment document (`GET https://<frontend
- * api>/v1/environment`, what clerk-js loads with the publishable key) and,
- * with the secret key, the Backend API's JWT templates, redirect URLs,
- * organization roles and permissions. Atlas mirrors Clerk's model, so most
- * settings map 1:1.
- */
-export interface ClerkConfigSnapshot {
-    frontendApi: string;
-    environment: Obj;
-    jwtTemplates?: Obj[];
-    redirectUrls?: Obj[];
-    roles?: Obj[];
-    permissions?: Obj[];
-}
-export declare function fetchClerkConfig(opts: {
-    publishableKey: string;
-    secretKey?: string;
-    fetchImpl?: typeof fetch;
-    apiUrl?: string;
-}): Promise<ClerkConfigSnapshot>;
-export declare function translateClerkConfig(snap: ClerkConfigSnapshot): TranslationResult;