@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/cognito-config.js

@@ -1,273 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchCognitoConfig = fetchCognitoConfig;
-exports.validityMs = validityMs;
-exports.translateCognitoConfig = translateCognitoConfig;
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-async function fetchCognitoConfig(api, poolId, region) {
-    const soft = async (fn, fallback) => {
-        try {
-            return await fn();
-        }
-        catch (err) {
-            if (err instanceof vendor_http_1.VendorApiError && (err.status === 400 || err.status === 403) && !/ResourceNotFound/.test(err.message))
-                return fallback;
-            throw err;
-        }
-    };
-    const described = await api.call('DescribeUserPool', { UserPoolId: poolId });
-    const pool = (0, record_set_1.isObj)(described.UserPool) ? described.UserPool : {};
-    const clients = [];
-    for (const c of await soft(() => api.all('ListUserPoolClients', { UserPoolId: poolId, MaxResults: 60 }, 'UserPoolClients', 'NextToken'), [])) {
-        const id = (0, record_set_1.str)(c.ClientId);
-        if (!id)
-            continue;
-        const res = await api.call('DescribeUserPoolClient', { UserPoolId: poolId, ClientId: id });
-        if ((0, record_set_1.isObj)(res.UserPoolClient))
-            clients.push(res.UserPoolClient);
-    }
-    const idps = [];
-    for (const p of await soft(() => api.all('ListIdentityProviders', { UserPoolId: poolId, MaxResults: 60 }, 'Providers', 'NextToken'), [])) {
-        const name = (0, record_set_1.str)(p.ProviderName);
-        if (!name)
-            continue;
-        const res = await api.call('DescribeIdentityProvider', { UserPoolId: poolId, ProviderName: name });
-        if ((0, record_set_1.isObj)(res.IdentityProvider))
-            idps.push(res.IdentityProvider);
-    }
-    return {
-        poolId,
-        region,
-        pool,
-        clients,
-        idps,
-        resourceServers: await soft(() => api.all('ListResourceServers', { UserPoolId: poolId, MaxResults: 50 }, 'ResourceServers', 'NextToken'), []),
-        groups: await soft(() => api.all('ListGroups', { UserPoolId: poolId, Limit: 60 }, 'Groups', 'NextToken'), []),
-    };
-}
-/** Cognito social provider types → Atlas built-in provider keys. */
-const SOCIAL = { Google: 'google', Facebook: 'facebook', SignInWithApple: 'apple', LoginWithAmazon: 'amazon' };
-const UNIT_MS = { seconds: 1000, minutes: 60_000, hours: 3_600_000, days: 86_400_000 };
-/** A client's token validity in ms (`RefreshTokenValidity` with `TokenValidityUnits.RefreshToken`). */
-function validityMs(client, field) {
-    const value = client[`${field}Validity`];
-    if (typeof value !== 'number' || value <= 0)
-        return undefined;
-    const units = (0, record_set_1.isObj)(client.TokenValidityUnits) ? (0, record_set_1.str)(client.TokenValidityUnits[field]) : undefined;
-    return value * (UNIT_MS[units ?? (field === 'RefreshToken' ? 'days' : 'hours')] ?? UNIT_MS.hours);
-}
-/** Lambda trigger → the Atlas place its logic moves to. */
-const TRIGGERS = {
-    PreSignUp: 'the pre_user_registration action',
-    PostConfirmation: 'the post_user_registration action',
-    PreAuthentication: 'a post_login action (deny there)',
-    PostAuthentication: 'a post_login action',
-    PreTokenGeneration: 'session claims / a JWT template',
-    PreTokenGenerationConfig: 'session claims / a JWT template',
-    UserMigration: 'nothing: Atlas lazy migration replaces it (it checks passwords against Cognito itself)',
-    CustomMessage: 'Atlas email and SMS templates',
-    DefineAuthChallenge: 'Atlas sign-in strategies (custom challenges have no counterpart)',
-    CreateAuthChallenge: 'Atlas sign-in strategies (custom challenges have no counterpart)',
-    VerifyAuthChallengeResponse: 'Atlas sign-in strategies (custom challenges have no counterpart)',
-    CustomEmailSender: 'Atlas email delivery settings (your own SMTP / provider)',
-    CustomSMSSender: 'Atlas SMS delivery settings',
-    InboundFederation: 'an SSO connection attribute mapping / a post_login action',
-};
-function translateCognitoConfig(snap) {
-    const b = new translate_kit_1.ConfigBuilder();
-    const pool = snap.pool;
-    const area = `user pool ${snap.poolId}`;
-    // ── sign-in identifiers ──
-    const usernameAttrs = (0, record_set_1.strs)(pool.UsernameAttributes);
-    const aliasAttrs = (0, record_set_1.strs)(pool.AliasAttributes);
-    const signInAttrs = new Set([...usernameAttrs, ...aliasAttrs]);
-    const firstFactors = (0, record_set_1.isObj)(pool.Policies) && (0, record_set_1.isObj)(pool.Policies.SignInPolicy) ? (0, record_set_1.strs)(pool.Policies.SignInPolicy.AllowedFirstAuthFactors) : [];
-    const passwordOn = !firstFactors.length || firstFactors.includes('PASSWORD');
-    if (passwordOn) {
-        b.set('strategies.password', true);
-        b.add('differs', area, 'Policies.SignInPolicy (PASSWORD)', 'Password sign-in. Cognito never exports password hashes: the cognito lazy-migration preset checks each password against Cognito on first sign-in.', 'auth_config.strategies.password');
-    }
-    if (!usernameAttrs.length || aliasAttrs.includes('preferred_username')) {
-        b.set('strategies.username', true);
-        b.add(usernameAttrs.length ? 'mapped' : 'differs', area, usernameAttrs.length ? 'AliasAttributes preferred_username' : 'UsernameAttributes (none: username pool)', usernameAttrs.length ? 'Sign-in with a preferred username.' : 'Users sign in with a username. Cognito usernames that are not the generated id move as Atlas usernames.', 'auth_config.strategies.username');
-    }
-    if (signInAttrs.has('email'))
-        b.add('mapped', area, usernameAttrs.includes('email') ? 'UsernameAttributes email' : 'AliasAttributes email', 'Sign-in with an email address.', 'auth_config.strategies.password');
-    if (signInAttrs.has('phone_number'))
-        b.add('differs', area, usernameAttrs.includes('phone_number') ? 'UsernameAttributes phone_number' : 'AliasAttributes phone_number', 'Phone numbers are a sign-in identifier: enable phone sign-in in Atlas (SMS code); a password with a phone number signs in through lazy migration.', 'auth_config.strategies.phoneCode');
-    if (firstFactors.includes('EMAIL_OTP')) {
-        b.set('strategies.emailCode', true);
-        b.add('mapped', area, 'Policies.SignInPolicy.AllowedFirstAuthFactors EMAIL_OTP', 'Passwordless email code.', 'auth_config.strategies.emailCode');
-    }
-    if (firstFactors.includes('SMS_OTP')) {
-        b.set('strategies.phoneCode', true);
-        b.add('mapped', area, 'Policies.SignInPolicy.AllowedFirstAuthFactors SMS_OTP', 'Passwordless SMS code.', 'auth_config.strategies.phoneCode');
-    }
-    if (firstFactors.includes('WEB_AUTHN')) {
-        b.set('strategies.passkey', true);
-        b.add('differs', area, 'Policies.SignInPolicy.AllowedFirstAuthFactors WEB_AUTHN', 'Passkeys. Cognito does not export credentials (and they are bound to the Cognito domain): users register a passkey again.', 'auth_config.strategies.passkey');
-    }
-    const caseSensitive = (0, record_set_1.isObj)(pool.UsernameConfiguration) ? pool.UsernameConfiguration.CaseSensitive : undefined;
-    if (caseSensitive === true)
-        b.add('differs', area, 'UsernameConfiguration.CaseSensitive', 'Cognito usernames are case sensitive; Atlas usernames and emails are case insensitive (two usernames differing only in case would collide).');
-    // ── verification ──
-    const autoVerified = (0, record_set_1.strs)(pool.AutoVerifiedAttributes);
-    if (autoVerified.includes('email')) {
-        b.set('requireEmailVerification', true);
-        b.add('mapped', area, 'AutoVerifiedAttributes email', 'Emails are verified by code at sign-up.', 'auth_config.requireEmailVerification');
-    }
-    if (autoVerified.includes('phone_number'))
-        b.add('mapped', area, 'AutoVerifiedAttributes phone_number', 'Phone numbers are verified by SMS code.', 'auth_config.strategies.phoneCode');
-    // ── self sign-up ──
-    const adminOnly = (0, record_set_1.isObj)(pool.AdminCreateUserConfig) && pool.AdminCreateUserConfig.AllowAdminCreateUserOnly === true;
-    if (adminOnly) {
-        b.set('signUpMode', 'restricted');
-        b.add('mapped', area, 'AdminCreateUserConfig.AllowAdminCreateUserOnly', 'Self sign-up is closed: users are created by an admin or invited.', 'auth_config.signUpMode');
-    }
-    // ── password policy ──
-    const pw = (0, record_set_1.isObj)(pool.Policies) && (0, record_set_1.isObj)(pool.Policies.PasswordPolicy) ? pool.Policies.PasswordPolicy : undefined;
-    if (pw) {
-        const min = typeof pw.MinimumLength === 'number' ? pw.MinimumLength : 8;
-        b.set('passwordPolicy.minLength', Math.max(8, min));
-        b.add(min < 8 ? 'differs' : 'mapped', area, 'Policies.PasswordPolicy.MinimumLength', `${min}${min < 8 ? ' (Atlas requires at least 8; existing passwords still sign in)' : ''}.`, 'auth_config.passwordPolicy.minLength');
-        if (['RequireUppercase', 'RequireLowercase', 'RequireNumbers', 'RequireSymbols'].some((k) => pw[k] === true)) {
-            b.set('passwordPolicy.checkBreaches', true);
-            b.add('differs', area, 'Policies.PasswordPolicy (character classes)', 'Atlas follows NIST 800-63B: length and breached-password checks instead of character-class rules.', 'auth_config.passwordPolicy');
-        }
-        if (typeof pw.TemporaryPasswordValidityDays === 'number')
-            b.add('manual', area, 'Policies.PasswordPolicy.TemporaryPasswordValidityDays', 'Atlas does not issue temporary passwords: invite users instead (invitations expire on their own).', 'invitations');
-        if (typeof pw.PasswordHistorySize === 'number' && pw.PasswordHistorySize > 0)
-            b.add('manual', area, 'Policies.PasswordPolicy.PasswordHistorySize', 'Atlas does not keep a password history.');
-    }
-    // ── MFA ──
-    const mfa = (0, record_set_1.str)(pool.MfaConfiguration);
-    const smsMfa = (0, record_set_1.isObj)(pool.SmsConfiguration);
-    if (mfa === 'ON') {
-        b.set('mfaPolicy', 'required');
-        b.add('mapped', area, 'MfaConfiguration ON', 'A second factor on every sign-in.', 'auth_config.mfaPolicy');
-    }
-    else if (mfa === 'OPTIONAL') {
-        b.set('mfaPolicy', 'optional');
-        b.add('mapped', area, 'MfaConfiguration OPTIONAL', 'Users may enrol a second factor.', 'auth_config.mfaPolicy');
-    }
-    if (mfa === 'ON' || mfa === 'OPTIONAL') {
-        b.set('mfa.factors.totp', true);
-        b.add('differs', area, 'SoftwareTokenMfaConfiguration', 'Authenticator apps. Cognito never exports TOTP secrets: users with one enrol again.', 'auth_config.mfa.factors.totp');
-        if (smsMfa)
-            b.add('differs', area, 'SmsMfaConfiguration', 'SMS second factors move with the export (the verified phone number); Atlas recommends TOTP or passkeys.', 'auth_config.mfa');
-    }
-    // ── advanced security ──
-    const security = (0, record_set_1.isObj)(pool.UserPoolAddOns) ? (0, record_set_1.str)(pool.UserPoolAddOns.AdvancedSecurityMode) : undefined;
-    if (security && security !== 'OFF')
-        b.add('differs', area, `UserPoolAddOns.AdvancedSecurityMode ${security}`, 'Cognito threat protection (compromised credentials, adaptive authentication): Atlas checks breached passwords and rate-limits sign-ins; review risk rules by hand.', 'auth_config.passwordPolicy.checkBreaches');
-    if ((0, record_set_1.str)(pool.DeletionProtection) === 'ACTIVE')
-        b.add('manual', area, 'DeletionProtection', 'Turn deletion protection off before you delete the pool after the cutover.');
-    // ── custom attributes ──
-    const custom = (0, record_set_1.objs)(pool.SchemaAttributes).filter((a) => (0, record_set_1.str)(a.Name)?.startsWith('custom:'));
-    if (custom.length)
-        b.add('differs', area, 'SchemaAttributes custom:*', `${custom.length} custom attribute(s) (${custom.map((a) => (0, record_set_1.str)(a.Name)).join(', ')}) move to each user's public_metadata without the custom: prefix. Atlas does not enforce their types; mutability per app client is not translated.`, 'users public_metadata');
-    // ── Lambda triggers ──
-    const lambdas = (0, record_set_1.isObj)(pool.LambdaConfig) ? pool.LambdaConfig : {};
-    for (const [trigger, value] of Object.entries(lambdas)) {
-        if (trigger === 'KMSKeyID' || (!(0, record_set_1.str)(value) && !(0, record_set_1.isObj)(value)))
-            continue;
-        const target = TRIGGERS[trigger];
-        b.add(trigger === 'UserMigration' ? 'differs' : 'manual', area, `LambdaConfig.${trigger}`, `Lambda trigger: port its logic to ${target ?? 'an Atlas action or webhook'}.`, trigger === 'UserMigration' ? 'legacy_auth_connection' : 'actions');
-    }
-    // ── app clients ──
-    const redirects = new Set();
-    let refreshMs;
-    let lazyClient;
-    let bridgeClient;
-    for (const c of snap.clients) {
-        const name = (0, record_set_1.str)(c.ClientName) ?? (0, record_set_1.str)(c.ClientId) ?? '?';
-        const carea = `app client ${name}`;
-        for (const u of (0, record_set_1.strs)(c.CallbackURLs))
-            redirects.add(u);
-        for (const u of (0, record_set_1.strs)(c.LogoutURLs))
-            redirects.add(u);
-        const r = validityMs(c, 'RefreshToken');
-        if (r !== undefined)
-            refreshMs = Math.max(refreshMs ?? 0, r);
-        const flows = (0, record_set_1.strs)(c.ExplicitAuthFlows);
-        const secret = !!(0, record_set_1.str)(c.ClientSecret);
-        // The bridge audience: the first public (browser / mobile) client, else the first one.
-        if (!secret)
-            bridgeClient ??= (0, record_set_1.str)(c.ClientId);
-        if (!secret && (flows.includes('ALLOW_USER_PASSWORD_AUTH') || flows.includes('USER_PASSWORD_AUTH')))
-            lazyClient ??= (0, record_set_1.str)(c.ClientId);
-        if ((0, record_set_1.strs)(c.AllowedOAuthFlows).includes('client_credentials'))
-            b.add('manual', carea, 'AllowedOAuthFlows client_credentials', 'A machine-to-machine client: create an Atlas M2M client for it.', 'oauth_clients');
-        if (flows.includes('ALLOW_CUSTOM_AUTH') || flows.includes('CUSTOM_AUTH_FLOW_ONLY'))
-            b.add('manual', carea, 'ExplicitAuthFlows ALLOW_CUSTOM_AUTH', 'Custom auth challenges (Lambda) have no Atlas counterpart: use passwordless email / SMS codes or passkeys.');
-        const idTtl = validityMs(c, 'IdToken');
-        if (idTtl !== undefined && idTtl !== 3_600_000)
-            b.add('differs', carea, 'IdTokenValidity', `ID tokens lived ${Math.round(idTtl / 60_000)} minutes. Atlas session tokens are short-lived (refreshed by the SDK) and the session lifetime is set instance-wide.`, 'auth_config.session');
-        for (const p of (0, record_set_1.strs)(c.SupportedIdentityProviders))
-            if (p !== 'COGNITO' && !snap.idps.some((i) => (0, record_set_1.str)(i.ProviderName) === p))
-                b.add('manual', carea, `SupportedIdentityProviders ${p}`, 'An identity provider the client allows that the pool does not describe.');
-    }
-    bridgeClient ??= (0, record_set_1.str)(snap.clients[0]?.ClientId);
-    if (snap.clients.length > 1)
-        b.add('differs', 'app clients', `${snap.clients.length} app clients`, `The bridge accepts ID tokens for one audience (${bridgeClient}); run it once per client whose users must move silently.`, 'migration bridge');
-    if (refreshMs !== undefined) {
-        b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(refreshMs));
-        b.add(refreshMs > 90 * 86_400_000 ? 'differs' : 'mapped', 'app clients', 'RefreshTokenValidity', `Users stayed signed in ${Math.round(refreshMs / 86_400_000)} day(s) (the longest client)${refreshMs > 90 * 86_400_000 ? '; Atlas sessions last at most 90 days' : ''}.`, 'auth_config.session.absoluteMs');
-    }
-    for (const url of redirects) {
-        if (url.includes('*'))
-            b.add('differs', 'app clients', `CallbackURLs ${url}`, 'Atlas redirect URLs are exact (no wildcards).', 'redirect_urls');
-        else
-            b.push('redirect_urls', { url });
-    }
-    if (redirects.size)
-        b.add('mapped', 'app clients', 'CallbackURLs / LogoutURLs', `${redirects.size} callback / sign-out URL(s).`, 'redirect_urls');
-    if (snap.clients.length && !lazyClient) {
-        b.add('manual', 'app clients', 'ExplicitAuthFlows ALLOW_USER_PASSWORD_AUTH', 'Lazy migration needs an app client WITHOUT a client secret that allows ALLOW_USER_PASSWORD_AUTH: create one (it is only used to check passwords) and pass its id to the lazy step.', 'legacy_auth_connection');
-    }
-    // ── identity providers ──
-    for (const idp of snap.idps) {
-        const name = (0, record_set_1.str)(idp.ProviderName) ?? '?';
-        const type = (0, record_set_1.str)(idp.ProviderType) ?? '';
-        const details = (0, record_set_1.isObj)(idp.ProviderDetails) ? idp.ProviderDetails : {};
-        if (type === 'SAML' || type === 'OIDC') {
-            b.add('mapped', 'identity providers', `${name} (${type})`, `Enterprise IdP: moves with the data export as an Atlas SSO connection; give the IdP Atlas's ${type === 'SAML' ? 'ACS URL and entity id' : 'redirect URI'}, and map its IdpIdentifiers to the connection's domains.`, 'sso_connections');
-            continue;
-        }
-        const key = SOCIAL[type];
-        if (!key) {
-            b.add('manual', 'identity providers', `${name} (${type})`, 'No built-in Atlas provider: add it as a custom OAuth provider.', 'custom_oauth_providers');
-            continue;
-        }
-        b.socialProvider({ atlasKey: key, vendorName: name, area: 'identity providers', setting: `${name} (${type})`, clientId: (0, record_set_1.str)(details.client_id), scopes: (0, record_set_1.str)(details.authorize_scopes)?.split(/[\s,]+/).filter(Boolean) });
-    }
-    // ── resource servers → APIs ──
-    for (const rs of snap.resourceServers) {
-        const identifier = (0, record_set_1.str)(rs.Identifier);
-        if (!identifier)
-            continue;
-        const scopes = (0, record_set_1.objs)(rs.Scopes).map((s) => (0, record_set_1.str)(s.ScopeName)).filter((s) => !!s);
-        b.push('resource_servers', { identifier, name: (0, record_set_1.str)(rs.Name) ?? identifier, scopes });
-        b.add('differs', `resource servers ${(0, record_set_1.str)(rs.Name) ?? identifier}`, `Identifier ${identifier}`, `An API with ${scopes.length} scope(s). Cognito scopes are "${identifier}/<scope>"; Atlas tokens carry the bare scope with "aud": "${identifier}".`, `resource_servers ${identifier}`);
-    }
-    // ── groups → roles ──
-    for (const g of snap.groups) {
-        const name = (0, record_set_1.str)(g.GroupName);
-        if (!name)
-            continue;
-        const key = (0, translate_kit_1.keyOf)(name);
-        b.roles[name] = key;
-        b.push('roles', { key, name, description: (0, record_set_1.str)(g.Description) ?? '', permissions: [] });
-        if ((0, record_set_1.str)(g.RoleArn))
-            b.add('manual', `groups ${name}`, 'RoleArn', 'The group grants an IAM role through an identity pool: Atlas does not issue AWS credentials; keep the identity pool with Atlas as an OIDC provider, or call STS from your backend.');
-    }
-    if (snap.groups.length)
-        b.add('differs', 'groups', 'groups', `${snap.groups.length} group(s) become Atlas app roles (memberships move with the data export); cognito:groups becomes the roles claim. Precedence is not translated.`, 'roles');
-    return b.result(`Cognito user pool ${snap.poolId}`, {
-        bridge: { preset: 'cognito', vars: { region: snap.region, user_pool_id: snap.poolId, ...(bridgeClient ? { client_id: bridgeClient } : {}) } },
-        lazy: { preset: 'cognito', config: { region: snap.region, user_pool_id: snap.poolId, ...(lazyClient ? { client_id: lazyClient } : {}) } },
-    });
-}
-//# sourceMappingURL=cognito-config.js.map

package/dist/migrate/export/cognito-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cognito-config.js","sourceRoot":"","sources":["../../../src/migrate/export/cognito-config.ts"],"names":[],"mappings":";;AA0BA,gDAkCC;AAQD,gCAKC;AAoBD,wDAuLC;AAjRD,6CAAgE;AAChE,mDAAuE;AACvE,+CAA+C;AAqBxC,KAAK,UAAU,kBAAkB,CAAC,GAAe,EAAE,MAAc,EAAE,MAAc;IACtF,MAAM,IAAI,GAAG,KAAK,EAAK,EAAoB,EAAE,QAAW,EAAc,EAAE;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC1I,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAM,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,OAAO,GAAU,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7I,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAM,wBAAwB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAChG,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,cAAc,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACzI,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAM,0BAA0B,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxG,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,MAAM;QACN,MAAM;QACN,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,eAAe,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;QAC7I,MAAM,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;AAEvI,MAAM,OAAO,GAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAE/G,uGAAuG;AACvG,SAAgB,UAAU,CAAC,MAAW,EAAE,KAAiD;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,OAAO,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,KAAM,CAAC,CAAC;AACrG,CAAC;AAED,2DAA2D;AAC3D,MAAM,QAAQ,GAA2B;IACvC,SAAS,EAAE,kCAAkC;IAC7C,gBAAgB,EAAE,mCAAmC;IACrD,iBAAiB,EAAE,kCAAkC;IACrD,kBAAkB,EAAE,qBAAqB;IACzC,kBAAkB,EAAE,iCAAiC;IACrD,wBAAwB,EAAE,iCAAiC;IAC3D,aAAa,EAAE,wFAAwF;IACvG,aAAa,EAAE,+BAA+B;IAC9C,mBAAmB,EAAE,kEAAkE;IACvF,mBAAmB,EAAE,kEAAkE;IACvF,2BAA2B,EAAE,kEAAkE;IAC/F,iBAAiB,EAAE,0DAA0D;IAC7E,eAAe,EAAE,6BAA6B;IAC9C,iBAAiB,EAAE,2DAA2D;CAC/E,CAAC;AAEF,SAAgB,sBAAsB,CAAC,IAA2B;IAChE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC;IAExC,4BAA4B;IAC5B,MAAM,aAAa,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/I,MAAM,UAAU,GAAG,CAAC,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,kCAAkC,EAAE,mJAAmJ,EAAE,iCAAiC,CAAC,CAAC;IACrP,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CACH,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAC3C,IAAI,EACJ,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,0CAA0C,EACxG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,yGAAyG,EACvK,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB,EAAE,gCAAgC,EAAE,iCAAiC,CAAC,CAAC;IACjN,IAAI,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,8BAA8B,EAAE,mJAAmJ,EAAE,kCAAkC,CAAC,CAAC;IAClW,IAAI,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,yDAAyD,EAAE,0BAA0B,EAAE,kCAAkC,CAAC,CAAC;IACnJ,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,uDAAuD,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IAC/I,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,yDAAyD,EAAE,2HAA2H,EAAE,gCAAgC,CAAC,CAAC;IACnP,CAAC;IACD,MAAM,aAAa,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,IAAI,aAAa,KAAK,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,qCAAqC,EAAE,6IAA6I,CAAC,CAAC;IAEzO,qBAAqB;IACrB,MAAM,YAAY,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,yCAAyC,EAAE,sCAAsC,CAAC,CAAC;IAC3I,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,qCAAqC,EAAE,yCAAyC,EAAE,kCAAkC,CAAC,CAAC;IAEvL,qBAAqB;IACrB,MAAM,SAAS,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,wBAAwB,KAAK,IAAI,CAAC;IACpH,IAAI,SAAS,EAAE,CAAC;QACd,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,gDAAgD,EAAE,mEAAmE,EAAE,wBAAwB,CAAC,CAAC;IACzK,CAAC;IAED,wBAAwB;IACxB,MAAM,EAAE,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAClH,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,uCAAuC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;QAC1N,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7G,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,6CAA6C,EAAE,mGAAmG,EAAE,4BAA4B,CAAC,CAAC;QAC3M,CAAC;QACD,IAAI,OAAO,EAAE,CAAC,6BAA6B,KAAK,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,uDAAuD,EAAE,mGAAmG,EAAE,aAAa,CAAC,CAAC;QAC7P,IAAI,OAAO,EAAE,CAAC,mBAAmB,KAAK,QAAQ,IAAI,EAAE,CAAC,mBAAmB,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,6CAA6C,EAAE,yCAAyC,CAAC,CAAC;IAChM,CAAC;IAED,YAAY;IACZ,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,mCAAmC,EAAE,uBAAuB,CAAC,CAAC;IAC7G,CAAC;SAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,uBAAuB,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,+BAA+B,EAAE,qFAAqF,EAAE,8BAA8B,CAAC,CAAC;QAC/K,IAAI,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE,yGAAyG,EAAE,iBAAiB,CAAC,CAAC;IAC1L,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,uCAAuC,QAAQ,EAAE,EAAE,oKAAoK,EAAE,0CAA0C,CAAC,CAAC;IAChU,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,QAAQ;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE,4EAA4E,CAAC,CAAC;IAEzK,0BAA0B;IAC1B,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,MAAM,CAAC,MAAM,yBAAyB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oJAAoJ,EAAE,uBAAuB,CAAC,CAAC;IAExU,wBAAwB;IACxB,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,KAAK,UAAU,IAAI,CAAC,CAAC,IAAA,gBAAG,EAAC,KAAK,CAAC,IAAI,CAAC,IAAA,kBAAK,EAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,gBAAgB,OAAO,EAAE,EAAE,qCAAqC,MAAM,IAAI,4BAA4B,GAAG,EAAE,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjP,CAAC;IAED,oBAAoB;IACpB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,SAA6B,CAAC;IAClC,IAAI,UAA8B,CAAC;IACnC,IAAI,YAAgC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;QACzD,MAAM,KAAK,GAAG,cAAc,IAAI,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,YAAY,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACrC,uFAAuF;QACvF,IAAI,CAAC,MAAM;YAAE,YAAY,KAAK,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YAAE,UAAU,KAAK,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACpI,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,sCAAsC,EAAE,iEAAiE,EAAE,eAAe,CAAC,CAAC;QACjN,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,qCAAqC,EAAE,4GAA4G,CAAC,CAAC;QAChQ,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,sHAAsH,EAAE,qBAAqB,CAAC,CAAC;QACvR,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,0BAA0B,CAAC;YAAE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,8BAA8B,CAAC,EAAE,EAAE,yEAAyE,CAAC,CAAC;IACrQ,CAAC;IACD,YAAY,KAAK,IAAA,gBAAG,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,cAAc,EAAE,kDAAkD,YAAY,2DAA2D,EAAE,kBAAkB,CAAC,CAAC;IAClP,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,sBAAsB,EAAE,0BAA0B,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,UAAU,CAAC,+BAA+B,SAAS,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;IAC/S,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,gBAAgB,GAAG,EAAE,EAAE,+CAA+C,EAAE,eAAe,CAAC,CAAC;;YAC3I,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,2BAA2B,EAAE,GAAG,SAAS,CAAC,IAAI,8BAA8B,EAAE,eAAe,CAAC,CAAC;IAClJ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,4CAA4C,EAAE,oLAAoL,EAAE,wBAAwB,CAAC,CAAC;IAC/R,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,+FAA+F,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,2DAA2D,EAAE,iBAAiB,CAAC,CAAC;YACpS,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,gEAAgE,EAAE,wBAAwB,CAAC,CAAC;YACvJ,SAAS;QACX,CAAC;QACD,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5N,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,EAAU,CAAC,CAAC;QAC7F,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,EAAE,cAAc,UAAU,EAAE,EAAE,eAAe,MAAM,CAAC,MAAM,kCAAkC,UAAU,6DAA6D,UAAU,IAAI,EAAE,oBAAoB,UAAU,EAAE,CAAC,CAAC;IACxR,CAAC;IAED,uBAAuB;IACvB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;QAC/F,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,EAAE,SAAS,EAAE,oLAAoL,CAAC,CAAC;IACzP,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,iJAAiJ,EAAE,OAAO,CAAC,CAAC;IAE9O,OAAO,CAAC,CAAC,MAAM,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,EAAE;QAClD,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC7I,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;KAC1I,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/cognito.d.ts

@@ -1,103 +0,0 @@
-import type { IdentityRecord, MfaFactorRecord, SsoConnectionRecord, UserRecord } from '@atlasauth/migrate';
-import { RecordSet, type Obj } from './record-set';
-/**
- * `atlas migrate export cognito` — an Amazon Cognito user pool onto the
- * canonical bundle models, read on this machine with the owner's AWS
- * credentials (SigV4-signed calls to the cognito-idp JSON API; the keys are
- * sent to AWS only, as a signature).
- *
- *   - users (ListUsers), keyed by `sub` — the subject Cognito tokens carry,
- *     so the bridge and lazy migration land on the same Atlas user; standard
- *     attributes map onto the user, `custom:*` attributes become public
- *     metadata, the Cognito username and status are kept privately;
- *   - federated and linked accounts from the `identities` attribute;
- *   - groups as app roles (ListGroups + ListUsersInGroup);
- *   - SAML / OIDC identity providers as enterprise connections;
- *   - SMS / email second factors (legacy MFAOptions, or every user's
- *     UserMFASettingList with `mfa`, which costs one AdminGetUser per user);
- *   - the pool's public signing keys, so old ID tokens keep verifying during
- *     the cutover.
- *
- * Cognito NEVER exports password hashes, TOTP secrets or passkeys. Passwords
- * move with the `cognito` lazy-migration preset (InitiateAuth with
- * USER_PASSWORD_AUTH on the user's first Atlas sign-in).
- *
- * Instead of the API, users can come from `aws cognito-idp list-users`
- * output (the CLI follows the pagination): no groups or connections then.
- */
-export interface AwsCredentials {
-    accessKeyId: string;
-    secretAccessKey: string;
-    sessionToken?: string;
-}
-export interface CognitoExportOptions {
-    userPoolId: string;
-    /** Default: the region prefix of the pool id. */
-    region?: string;
-    credentials?: AwsCredentials;
-    /** `aws cognito-idp list-users --output json` output, instead of calling ListUsers. */
-    usersText?: string;
-    /** Read every user's MFA settings (AdminGetUser per user — billed and rate limited). */
-    mfa?: boolean;
-    /** How groups move (default roles). */
-    groups?: 'roles' | 'skip';
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    now?: () => Date;
-    onProgress?: (message: string) => void;
-}
-/** The region of a user pool id (`us-east-1_AbC123` → `us-east-1`), or undefined. */
-export declare function regionOfPool(poolId: string): string | undefined;
-/** `20150830T123600Z`. */
-export declare function amzDate(d: Date): string;
-/** The SigV4 signing key: HMAC chain over date, region, service. */
-export declare function sigV4Key(secret: string, date: string, region: string, service: string): Buffer;
-/**
- * Sign a request with AWS Signature Version 4 (header form). `headers` must
- * not yet carry `authorization`; the result adds `host`, `x-amz-date`, the
- * session token when there is one, and `authorization`. Only a path without
- * a query string is signed (every Cognito call is `POST /`).
- */
-export declare function signAwsRequest(o: {
-    method: string;
-    url: string;
-    headers: Record<string, string>;
-    body: string;
-    region: string;
-    service: string;
-    credentials: AwsCredentials;
-    now: Date;
-}): Record<string, string>;
-export declare class CognitoApi {
-    private readonly o;
-    readonly endpoint: string;
-    constructor(o: {
-        region: string;
-        credentials: AwsCredentials;
-        fetchImpl?: typeof fetch;
-        sleep?: (ms: number) => Promise<void>;
-        now?: () => Date;
-        attempts?: number;
-    });
-    /** One API call (`ListUsers`, `DescribeUserPool` …). Throttling and 5xx are retried. */
-    call<T = Obj>(action: string, input: Obj): Promise<T>;
-    /** Every page of a token-paged list. */
-    all(action: string, input: Obj, listKey: string, tokenKey: 'PaginationToken' | 'NextToken'): Promise<Obj[]>;
-}
-export declare function attributesOf(u: Obj): Record<string, string>;
-/** The `identities` attribute (a JSON string; `primary` / `dateCreated` typed loosely). */
-export declare function parseIdentities(raw: string | undefined): Obj[];
-/** Map one Cognito UserType onto a user record (null when it has no sub or no identifier). */
-export declare function mapCognitoUser(u: Obj): UserRecord | null;
-/** The identity records of one user's `identities` attribute. */
-export declare function cognitoIdentities(userId: string, raw: string | undefined): IdentityRecord[];
-/** SMS / email factors from legacy MFAOptions or a UserMFASettingList. */
-export declare function cognitoFactors(userId: string, u: Obj, attrs: Record<string, string>): {
-    factors: MfaFactorRecord[];
-    totp: boolean;
-};
-/** The users of `aws cognito-idp list-users` output (`{ "Users": [...] }`, or a bare array). */
-export declare function parseListUsersOutput(text: string): Obj[];
-/** A SAML / OIDC identity provider → an SSO connection record (social providers are null). */
-export declare function cognitoSsoConnection(idp: Obj): SsoConnectionRecord | null;
-export declare function exportCognito(opts: CognitoExportOptions): Promise<RecordSet>;