@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/cognito.js

@@ -1,441 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CognitoApi = void 0;
-exports.regionOfPool = regionOfPool;
-exports.amzDate = amzDate;
-exports.sigV4Key = sigV4Key;
-exports.signAwsRequest = signAwsRequest;
-exports.attributesOf = attributesOf;
-exports.parseIdentities = parseIdentities;
-exports.mapCognitoUser = mapCognitoUser;
-exports.cognitoIdentities = cognitoIdentities;
-exports.cognitoFactors = cognitoFactors;
-exports.parseListUsersOutput = parseListUsersOutput;
-exports.cognitoSsoConnection = cognitoSsoConnection;
-exports.exportCognito = exportCognito;
-const node_crypto_1 = require("node:crypto");
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-const POOL_ID = /^([a-z]{2}(?:-[a-z]+)+-\d)_[0-9A-Za-z]+$/;
-/** The region of a user pool id (`us-east-1_AbC123` → `us-east-1`), or undefined. */
-function regionOfPool(poolId) {
-    return POOL_ID.exec(poolId.trim())?.[1];
-}
-// ── AWS Signature Version 4 ─────────────────────────────────────────────────
-const sha256Hex = (data) => (0, node_crypto_1.createHash)('sha256').update(data).digest('hex');
-const hmac = (key, data) => (0, node_crypto_1.createHmac)('sha256', key).update(data, 'utf8').digest();
-/** `20150830T123600Z`. */
-function amzDate(d) {
-    return d.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '');
-}
-/** The SigV4 signing key: HMAC chain over date, region, service. */
-function sigV4Key(secret, date, region, service) {
-    return hmac(hmac(hmac(hmac(`AWS4${secret}`, date), region), service), 'aws4_request');
-}
-/**
- * Sign a request with AWS Signature Version 4 (header form). `headers` must
- * not yet carry `authorization`; the result adds `host`, `x-amz-date`, the
- * session token when there is one, and `authorization`. Only a path without
- * a query string is signed (every Cognito call is `POST /`).
- */
-function signAwsRequest(o) {
-    const url = new URL(o.url);
-    const stamp = amzDate(o.now);
-    const date = stamp.slice(0, 8);
-    const headers = {};
-    for (const [k, v] of Object.entries(o.headers))
-        headers[k.toLowerCase()] = v;
-    headers.host = url.host;
-    headers['x-amz-date'] = stamp;
-    if (o.credentials.sessionToken)
-        headers['x-amz-security-token'] = o.credentials.sessionToken;
-    const names = Object.keys(headers).sort();
-    const canonicalHeaders = names.map((n) => `${n}:${headers[n].trim().replace(/\s+/g, ' ')}\n`).join('');
-    const signedHeaders = names.join(';');
-    const canonical = [o.method.toUpperCase(), url.pathname || '/', url.search.slice(1), canonicalHeaders, signedHeaders, sha256Hex(o.body)].join('\n');
-    const scope = `${date}/${o.region}/${o.service}/aws4_request`;
-    const toSign = ['AWS4-HMAC-SHA256', stamp, scope, sha256Hex(canonical)].join('\n');
-    const signature = (0, node_crypto_1.createHmac)('sha256', sigV4Key(o.credentials.secretAccessKey, date, o.region, o.service)).update(toSign, 'utf8').digest('hex');
-    headers.authorization = `AWS4-HMAC-SHA256 Credential=${o.credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
-    return headers;
-}
-// ── the cognito-idp JSON API ────────────────────────────────────────────────
-const RETRYABLE = new Set(['TooManyRequestsException', 'LimitExceededException', 'InternalErrorException', 'ThrottlingException']);
-class CognitoApi {
-    o;
-    endpoint;
-    constructor(o) {
-        this.o = o;
-        this.endpoint = `https://cognito-idp.${o.region}.amazonaws.com/`;
-    }
-    /** One API call (`ListUsers`, `DescribeUserPool` …). Throttling and 5xx are retried. */
-    async call(action, input) {
-        const fetchImpl = this.o.fetchImpl ?? fetch;
-        const sleep = this.o.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-        const attempts = Math.max(1, this.o.attempts ?? 6);
-        const body = JSON.stringify(input);
-        for (let attempt = 1;; attempt++) {
-            const headers = signAwsRequest({
-                method: 'POST',
-                url: this.endpoint,
-                headers: { 'content-type': 'application/x-amz-json-1.1', 'x-amz-target': `AWSCognitoIdentityProviderService.${action}` },
-                body,
-                region: this.o.region,
-                service: 'cognito-idp',
-                credentials: this.o.credentials,
-                now: (this.o.now ?? (() => new Date()))(),
-            });
-            delete headers.host; // fetch sets it (and refuses a manual one)
-            let res;
-            try {
-                res = await fetchImpl(this.endpoint, { method: 'POST', headers, body });
-            }
-            catch (err) {
-                if (attempt < attempts) {
-                    await sleep(backoff(attempt));
-                    continue;
-                }
-                throw new vendor_http_1.VendorApiError('Cognito', 0, action, err instanceof Error ? err.message : String(err));
-            }
-            const text = await res.text();
-            let parsed = {};
-            try {
-                parsed = text ? JSON.parse(text) : {};
-            }
-            catch {
-                parsed = { message: text.slice(0, 200) };
-            }
-            if (res.ok)
-                return parsed;
-            const o = (0, record_set_1.isObj)(parsed) ? parsed : {};
-            const type = ((0, record_set_1.str)(o.__type) ?? '').split('#').pop() ?? '';
-            if ((res.status >= 500 || RETRYABLE.has(type)) && attempt < attempts) {
-                await sleep(backoff(attempt));
-                continue;
-            }
-            throw new vendor_http_1.VendorApiError('Cognito', res.status, action, [type, (0, record_set_1.str)(o.message) ?? (0, record_set_1.str)(o.Message)].filter(Boolean).join(': '));
-        }
-    }
-    /** Every page of a token-paged list. */
-    async all(action, input, listKey, tokenKey) {
-        const out = [];
-        let token;
-        do {
-            const page = await this.call(action, { ...input, ...(token ? { [tokenKey]: token } : {}) });
-            out.push(...(0, record_set_1.objs)(page[listKey]));
-            token = (0, record_set_1.str)(page[tokenKey]);
-        } while (token);
-        return out;
-    }
-}
-exports.CognitoApi = CognitoApi;
-function backoff(attempt) {
-    return Math.min(250 * 2 ** (attempt - 1), 20_000);
-}
-// ── mapping ─────────────────────────────────────────────────────────────────
-/** Attributes the user record carries itself (the rest of the standard ones go to private metadata). */
-const MAPPED = new Set(['sub', 'email', 'email_verified', 'phone_number', 'phone_number_verified', 'given_name', 'family_name', 'name', 'picture', 'preferred_username', 'identities']);
-/** Cognito provider names → the provider an identity record carries. */
-const SOCIAL = { Google: 'google', Facebook: 'facebook', SignInWithApple: 'apple', LoginWithAmazon: 'amazon' };
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function attributesOf(u) {
-    const out = {};
-    // ListUsers says Attributes, AdminGetUser says UserAttributes.
-    for (const a of [...(0, record_set_1.objs)(u.Attributes), ...(0, record_set_1.objs)(u.UserAttributes)]) {
-        const name = (0, record_set_1.str)(a.Name);
-        if (name && typeof a.Value === 'string')
-            out[name] = a.Value;
-    }
-    return out;
-}
-/** Epoch seconds (the API) or an ISO string (the AWS CLI) → a bundle timestamp. */
-function cognitoTime(v) {
-    if (typeof v === 'number' && Number.isFinite(v))
-        return Math.round(v * 1000);
-    return (0, record_set_1.str)(v);
-}
-/** The `identities` attribute (a JSON string; `primary` / `dateCreated` typed loosely). */
-function parseIdentities(raw) {
-    if (!raw)
-        return [];
-    try {
-        const parsed = JSON.parse(raw);
-        return (0, record_set_1.objs)(parsed);
-    }
-    catch {
-        return [];
-    }
-}
-/** Map one Cognito UserType onto a user record (null when it has no sub or no identifier). */
-function mapCognitoUser(u) {
-    const a = attributesOf(u);
-    const sub = (0, record_set_1.str)(a.sub);
-    if (!sub)
-        return null;
-    const cognitoUsername = (0, record_set_1.str)(u.Username);
-    const federated = (0, record_set_1.str)(u.UserStatus) === 'EXTERNAL_PROVIDER';
-    const email = (0, record_set_1.str)(a.email)?.toLowerCase();
-    const phone = (0, record_set_1.e164)(a.phone_number);
-    // A username Cognito users typed (not the generated sub / UUID, an email or a federated `Google_…` id).
-    const typed = cognitoUsername && !UUID.test(cognitoUsername) && !cognitoUsername.includes('@') && !federated && !/^\+\d+$/.test(cognitoUsername) ? cognitoUsername : undefined;
-    const username = (0, record_set_1.str)(a.preferred_username) ?? typed;
-    const custom = {};
-    const standard = {};
-    for (const [k, v] of Object.entries(a)) {
-        if (k.startsWith('custom:'))
-            custom[k.slice(7)] = v;
-        else if (k.startsWith('dev:'))
-            continue;
-        else if (!MAPPED.has(k))
-            standard[k] = v;
-    }
-    const user = (0, record_set_1.compact)({
-        id: sub,
-        emails: email ? [{ email, verified: a.email_verified === 'true', primary: true }] : undefined,
-        phones: phone ? [{ phone, verified: a.phone_number_verified === 'true', primary: !email }] : undefined,
-        username,
-        first_name: (0, record_set_1.str)(a.given_name),
-        last_name: (0, record_set_1.str)(a.family_name),
-        name: (0, record_set_1.str)(a.name),
-        image_url: (0, record_set_1.str)(a.picture),
-        banned: u.Enabled === false ? true : undefined,
-        public_metadata: Object.keys(custom).length ? custom : undefined,
-        private_metadata: (0, record_set_1.compact)({ cognito_username: cognitoUsername, cognito_status: (0, record_set_1.str)(u.UserStatus), cognito_attributes: Object.keys(standard).length ? standard : undefined }),
-        created_at: cognitoTime(u.UserCreateDate),
-    });
-    if (!user.emails && !user.phones && !user.username) {
-        // A pool keyed on a bare username nobody typed (federated users without an email): keep the Cognito username.
-        if (!cognitoUsername)
-            return null;
-        user.username = cognitoUsername;
-    }
-    return user;
-}
-/** The identity records of one user's `identities` attribute. */
-function cognitoIdentities(userId, raw) {
-    const out = [];
-    for (const i of parseIdentities(raw)) {
-        const providerName = (0, record_set_1.str)(i.providerName);
-        const providerUserId = (0, record_set_1.str)(i.userId);
-        if (!providerName || !providerUserId)
-            continue;
-        const type = (0, record_set_1.str)(i.providerType) ?? providerName;
-        const kind = type === 'SAML' ? 'saml' : type === 'OIDC' ? 'oidc' : 'oauth';
-        out.push((0, record_set_1.compact)({
-            user_id: userId,
-            provider: SOCIAL[providerName] ?? providerName,
-            provider_user_id: providerUserId,
-            kind: kind,
-            sso_connection_id: kind === 'saml' || kind === 'oidc' ? providerName : undefined,
-        }));
-    }
-    return out;
-}
-/** SMS / email factors from legacy MFAOptions or a UserMFASettingList. */
-function cognitoFactors(userId, u, attrs) {
-    const settings = new Set((0, record_set_1.strs)(u.UserMFASettingList));
-    for (const o of (0, record_set_1.objs)(u.MFAOptions))
-        if ((0, record_set_1.str)(o.DeliveryMedium) === 'SMS')
-            settings.add('SMS_MFA');
-    const factors = [];
-    const phone = (0, record_set_1.e164)(attrs.phone_number);
-    if (settings.has('SMS_MFA') && phone)
-        factors.push({ user_id: userId, type: 'phone', phone, verified: true });
-    if (settings.has('EMAIL_OTP') && attrs.email)
-        factors.push({ user_id: userId, type: 'email', verified: true });
-    return { factors, totp: settings.has('SOFTWARE_TOKEN_MFA') };
-}
-/** The users of `aws cognito-idp list-users` output (`{ "Users": [...] }`, or a bare array). */
-function parseListUsersOutput(text) {
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        throw new Error('The users file is not `aws cognito-idp list-users --output json` output.');
-    }
-    if (Array.isArray(parsed))
-        return (0, record_set_1.objs)(parsed);
-    if ((0, record_set_1.isObj)(parsed) && Array.isArray(parsed.Users))
-        return (0, record_set_1.objs)(parsed.Users);
-    throw new Error('The users file has no "Users" list (expected `aws cognito-idp list-users --output json` output).');
-}
-/** A SAML / OIDC identity provider → an SSO connection record (social providers are null). */
-function cognitoSsoConnection(idp) {
-    const name = (0, record_set_1.str)(idp.ProviderName);
-    const type = (0, record_set_1.str)(idp.ProviderType);
-    if (!name || (type !== 'SAML' && type !== 'OIDC'))
-        return null;
-    const d = (0, record_set_1.isObj)(idp.ProviderDetails) ? idp.ProviderDetails : {};
-    const mapping = {};
-    if ((0, record_set_1.isObj)(idp.AttributeMapping))
-        for (const [k, v] of Object.entries(idp.AttributeMapping))
-            if (typeof v === 'string')
-                mapping[k] = v;
-    const domains = (0, record_set_1.strs)(idp.IdpIdentifiers).filter((x) => /^[a-z0-9-]+(\.[a-z0-9-]+)+$/i.test(x));
-    if (type === 'SAML') {
-        return (0, record_set_1.compact)({
-            id: name,
-            name,
-            protocol: 'saml',
-            domains,
-            saml: (0, record_set_1.compact)({ idp_metadata_url: (0, record_set_1.str)(d.MetadataURL), idp_metadata_xml: (0, record_set_1.str)(d.MetadataFile), attribute_mapping: Object.keys(mapping).length ? mapping : undefined }),
-            enabled: true,
-        });
-    }
-    const issuer = (0, record_set_1.str)(d.oidc_issuer);
-    return (0, record_set_1.compact)({
-        id: name,
-        name,
-        protocol: 'oidc',
-        domains,
-        oidc: (0, record_set_1.compact)({
-            issuer,
-            discovery_url: issuer ? `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration` : undefined,
-            client_id: (0, record_set_1.str)(d.client_id),
-            client_secret: (0, record_set_1.str)(d.client_secret),
-            scopes: (0, record_set_1.str)(d.authorize_scopes)?.split(/[\s,]+/).filter(Boolean),
-        }),
-        enabled: true,
-    });
-}
-// ── the export ──────────────────────────────────────────────────────────────
-async function exportCognito(opts) {
-    const set = new record_set_1.RecordSet();
-    const poolId = opts.userPoolId.trim();
-    const region = opts.region ?? regionOfPool(poolId);
-    if (!region)
-        throw new Error(`Not a Cognito user pool id: ${opts.userPoolId} (expected <region>_<id>, e.g. us-east-1_AbC123xyz).`);
-    if (!opts.usersText && !opts.credentials)
-        throw new Error('Cognito export needs AWS credentials (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) or a list-users output file.');
-    const progress = opts.onProgress ?? (() => undefined);
-    const api = opts.credentials ? new CognitoApi({ region, credentials: opts.credentials, fetchImpl: opts.fetchImpl, sleep: opts.sleep, now: opts.now }) : undefined;
-    set.manifest.origin = `Cognito user pool ${poolId}`;
-    // Groups → app roles.
-    const groupKeys = new Map();
-    if (api && opts.groups !== 'skip') {
-        progress('groups');
-        for (const g of await api.all('ListGroups', { UserPoolId: poolId, Limit: 60 }, 'Groups', 'NextToken')) {
-            const name = (0, record_set_1.str)(g.GroupName);
-            if (!name)
-                continue;
-            const key = (0, translate_kit_1.keyOf)(name);
-            groupKeys.set(name, key);
-            set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(g.Description), scope: 'app' }), key);
-        }
-    }
-    // Identity providers → SSO connections.
-    const providers = new Set();
-    if (api) {
-        progress('identity providers');
-        let idps = [];
-        try {
-            idps = await api.all('ListIdentityProviders', { UserPoolId: poolId, MaxResults: 60 }, 'Providers', 'NextToken');
-        }
-        catch (err) {
-            if (!(err instanceof vendor_http_1.VendorApiError && (err.status === 400 || err.status === 403)))
-                throw err;
-            set.warn(`Could not list identity providers (${err.message}); enterprise connections were not exported.`);
-        }
-        for (const summary of idps) {
-            const name = (0, record_set_1.str)(summary.ProviderName);
-            if (!name)
-                continue;
-            providers.add(SOCIAL[name] ?? name);
-            if ((0, record_set_1.str)(summary.ProviderType) !== 'SAML' && (0, record_set_1.str)(summary.ProviderType) !== 'OIDC')
-                continue;
-            const res = await api.call('DescribeIdentityProvider', { UserPoolId: poolId, ProviderName: name });
-            const conn = cognitoSsoConnection((0, record_set_1.isObj)(res.IdentityProvider) ? res.IdentityProvider : {});
-            if (conn)
-                set.add('sso_connection', conn, conn.id);
-        }
-    }
-    // Users.
-    progress('users');
-    const raw = opts.usersText !== undefined ? parseListUsersOutput(opts.usersText) : await api.all('ListUsers', { UserPoolId: poolId, Limit: 60 }, 'Users', 'PaginationToken');
-    const byUsername = new Map();
-    const status = {};
-    let totpUsers = 0;
-    for (const u of raw) {
-        const user = mapCognitoUser(u);
-        if (!user) {
-            set.omit('user', 'no sub, or no email, phone number or username');
-            continue;
-        }
-        const username = (0, record_set_1.str)(u.Username);
-        if (username)
-            byUsername.set(username, user.id);
-        const st = (0, record_set_1.str)(u.UserStatus) ?? 'UNKNOWN';
-        status[st] = (status[st] ?? 0) + 1;
-        set.add('user', user, user.id);
-        const attrs = attributesOf(u);
-        for (const identity of cognitoIdentities(user.id, attrs.identities)) {
-            set.add('identity', identity, `${identity.provider}:${identity.provider_user_id}`);
-            providers.add(identity.provider);
-        }
-        let detail = u;
-        if (opts.mfa && api && username && st !== 'EXTERNAL_PROVIDER') {
-            detail = { ...u, ...(await api.call('AdminGetUser', { UserPoolId: poolId, Username: username })) };
-        }
-        const { factors, totp } = cognitoFactors(user.id, detail, attrs);
-        for (const f of factors)
-            set.add('mfa_factor', f);
-        if (totp)
-            totpUsers++;
-    }
-    if (totpUsers)
-        set.omit('mfa_factor', 'Cognito never exports TOTP secrets: these users enrol an authenticator app again in Atlas', totpUsers);
-    if (!opts.mfa && api && raw.length) {
-        set.warn('Only legacy SMS MFA settings were read. Pass the mfa option (one AdminGetUser per user, billed by AWS) to export every user\'s SMS and email factors and count TOTP users.');
-    }
-    // Group members → user roles.
-    if (api && groupKeys.size) {
-        progress('group members');
-        const rolesOf = new Map();
-        for (const [name, key] of groupKeys) {
-            for (const m of await api.all('ListUsersInGroup', { UserPoolId: poolId, GroupName: name, Limit: 60 }, 'Users', 'NextToken')) {
-                const id = (0, record_set_1.str)(attributesOf(m).sub) ?? byUsername.get((0, record_set_1.str)(m.Username) ?? '');
-                if (!id)
-                    continue;
-                const list = rolesOf.get(id) ?? [];
-                list.push(key);
-                rolesOf.set(id, list);
-            }
-        }
-        for (const user of set.list('user')) {
-            const roles = rolesOf.get(user.id);
-            if (roles?.length)
-                user.roles = [...new Set(roles)];
-        }
-    }
-    // The pool's public signing keys (no credentials needed).
-    try {
-        const res = await (opts.fetchImpl ?? fetch)(`https://cognito-idp.${region}.amazonaws.com/${poolId}/.well-known/jwks.json`);
-        if (res.ok) {
-            const body = await res.json();
-            for (const jwk of (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.keys : undefined)) {
-                const kid = (0, record_set_1.str)(jwk.kid);
-                if (kid)
-                    set.add('jwks', { kid, jwk }, kid);
-            }
-        }
-    }
-    catch {
-        set.warn('Could not read the user pool\'s JWKS; old tokens verify through the bridge only.');
-    }
-    if (set.count('user')) {
-        set.warn('Cognito never exports password hashes. Turn on the cognito lazy-migration preset: each password is checked against Cognito (InitiateAuth, USER_PASSWORD_AUTH) on its first Atlas sign-in, then stored as Argon2id.');
-        set.omit('password', 'Cognito does not export password hashes (lazy migration moves them)', set.count('user') - (status.EXTERNAL_PROVIDER ?? 0));
-    }
-    if (status.FORCE_CHANGE_PASSWORD)
-        set.warn(`${status.FORCE_CHANGE_PASSWORD} user(s) still have an admin-set temporary password (FORCE_CHANGE_PASSWORD): Cognito answers lazy migration with a new-password challenge, so they reset their password in Atlas.`);
-    if (status.RESET_REQUIRED)
-        set.warn(`${status.RESET_REQUIRED} user(s) must reset their password (RESET_REQUIRED): they cannot move by lazy migration and reset it in Atlas.`);
-    if (status.UNCONFIRMED)
-        set.warn(`${status.UNCONFIRMED} user(s) never confirmed their sign-up (UNCONFIRMED): imported with unverified addresses.`);
-    set.manifest.providers = [...providers].sort();
-    set.manifest.settings = { user_pool_id: poolId, region, user_status: status };
-    return set;
-}
-//# sourceMappingURL=cognito.js.map

package/dist/migrate/export/cognito.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cognito.js","sourceRoot":"","sources":["../../../src/migrate/export/cognito.ts"],"names":[],"mappings":";;;AA0DA,oCAEC;AAQD,0BAEC;AAGD,4BAEC;AAQD,wCA2BC;AAwFD,oCAQC;AASD,0CAQC;AAGD,wCAsCC;AAGD,8CAmBC;AAGD,wCAQC;AAGD,oDAUC;AAGD,oDAiCC;AAID,sCA2HC;AAzdD,6CAAqD;AAErD,6CAA0F;AAC1F,mDAAwC;AACxC,+CAA+C;AAmD/C,MAAM,OAAO,GAAG,0CAA0C,CAAC;AAE3D,qFAAqF;AACrF,SAAgB,YAAY,CAAC,MAAc;IACzC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,MAAM,SAAS,GAAG,CAAC,IAAqB,EAAE,EAAE,CAAC,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7F,MAAM,IAAI,GAAG,CAAC,GAAoB,EAAE,IAAY,EAAE,EAAE,CAAC,IAAA,wBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAE7G,0BAA0B;AAC1B,SAAgB,OAAO,CAAC,CAAO;IAC7B,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,oEAAoE;AACpE,SAAgB,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc,EAAE,OAAe;IACpF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,CAS9B;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7E,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACxB,OAAO,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;IAC9B,IAAI,CAAC,CAAC,WAAW,CAAC,YAAY;QAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC;IAC7F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpJ,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,eAAe,CAAC;IAC9D,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChJ,OAAO,CAAC,aAAa,GAAG,+BAA+B,CAAC,CAAC,WAAW,CAAC,WAAW,IAAI,KAAK,mBAAmB,aAAa,eAAe,SAAS,EAAE,CAAC;IACpJ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAE/E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAEnI,MAAa,UAAU;IAIF;IAHV,QAAQ,CAAS;IAE1B,YACmB,CAAwJ;QAAxJ,MAAC,GAAD,CAAC,CAAuJ;QAEzK,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CAAC,CAAC,MAAM,iBAAiB,CAAC;IACnE,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,IAAI,CAAU,MAAc,EAAE,KAAU;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,cAAc,CAAC;gBAC7B,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,OAAO,EAAE,EAAE,cAAc,EAAE,4BAA4B,EAAE,cAAc,EAAE,qCAAqC,MAAM,EAAE,EAAE;gBACxH,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;gBACrB,OAAO,EAAE,aAAa;gBACtB,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW;gBAC/B,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,2CAA2C;YAChE,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;oBACvB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,4BAAc,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,MAAM,GAAY,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3C,CAAC;YACD,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,MAAW,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;gBACrE,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,IAAI,4BAAc,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,KAAU,EAAE,OAAe,EAAE,QAAyC;QAC9F,MAAM,GAAG,GAAU,EAAE,CAAC;QACtB,IAAI,KAAyB,CAAC;QAC9B,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACjC,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9B,CAAC,QAAQ,KAAK,EAAE;QAChB,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAlED,gCAkEC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,+EAA+E;AAE/E,wGAAwG;AACxG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,uBAAuB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC;AAExL,wEAAwE;AACxE,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;AAEvI,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,SAAgB,YAAY,CAAC,CAAM;IACjC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7E,OAAO,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,SAAgB,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAgB,cAAc,CAAC,CAAM;IACnC,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,eAAe,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,KAAK,mBAAmB,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACnC,wGAAwG;IACxG,MAAM,KAAK,GAAG,eAAe,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/K,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC;IACpD,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAQ,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;aAC/C,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;aACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE,EAAE,GAAG;QACP,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7F,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,qBAAqB,KAAK,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ;QACR,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;QAC7B,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;QACjB,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC9C,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAChE,gBAAgB,EAAE,IAAA,oBAAO,EAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAQ;QACnL,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnD,8GAA8G;QAC9G,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iEAAiE;AACjE,SAAgB,iBAAiB,CAAC,MAAc,EAAE,GAAuB;IACvE,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc;YAAE,SAAS;QAC/C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3E,GAAG,CAAC,IAAI,CACN,IAAA,oBAAO,EAAC;YACN,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,YAAY;YAC9C,gBAAgB,EAAE,cAAc;YAChC,IAAI,EAAE,IAA8B;YACpC,iBAAiB,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,SAAgB,cAAc,CAAC,MAAc,EAAE,CAAM,EAAE,KAA6B;IAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC;QAAE,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC,KAAK,KAAK;YAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjG,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9G,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,gGAAgG;AAChG,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,IAAA,kBAAK,EAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;AACtH,CAAC;AAED,8FAA8F;AAC9F,SAAgB,oBAAoB,CAAC,GAAQ;IAC3C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,gBAAgB,CAAC;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtI,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,IAAA,oBAAO,EAAC;YACb,EAAE,EAAE,IAAI;YACR,IAAI;YACJ,QAAQ,EAAE,MAAe;YACzB,OAAO;YACP,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACpK,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAClC,OAAO,IAAA,oBAAO,EAAC;QACb,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,QAAQ,EAAE,MAAe;QACzB,OAAO;QACP,IAAI,EAAE,IAAA,oBAAO,EAAC;YACZ,MAAM;YACN,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC,CAAC,CAAC,SAAS;YACpG,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;YAC3B,aAAa,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,aAAa,CAAC;YACnC,MAAM,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SACjE,CAAC;QACF,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAExE,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,UAAU,sDAAsD,CAAC,CAAC;IACnI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC,CAAC;IAC3K,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClK,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,qBAAqB,MAAM,EAAE,CAAC;IAEpD,sBAAsB;IACtB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;YACxB,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,GAAG,EAAE,CAAC;QACR,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAU,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAClH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC9F,GAAG,CAAC,IAAI,CAAC,sCAAsC,GAAG,CAAC,OAAO,8CAA8C,CAAC,CAAC;QAC5G,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACpC,IAAI,IAAA,gBAAG,EAAC,OAAO,CAAC,YAAY,CAAC,KAAK,MAAM,IAAI,IAAA,gBAAG,EAAC,OAAO,CAAC,YAAY,CAAC,KAAK,MAAM;gBAAE,SAAS;YAC3F,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAM,0BAA0B,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACxG,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3F,IAAI,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,SAAS;IACT,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,GAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC7K,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,QAAQ;YAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,KAAK,MAAM,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACnF,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,QAAQ,IAAI,EAAE,KAAK,mBAAmB,EAAE,CAAC;YAC9D,MAAM,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAM,cAAc,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAClD,IAAI,IAAI;YAAE,SAAS,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,2FAA2F,EAAE,SAAS,CAAC,CAAC;IAC9I,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,4KAA4K,CAAC,CAAC;IACzL,CAAC;IAED,8BAA8B;IAC9B,IAAI,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1B,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC5H,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7E,IAAI,CAAC,EAAE;oBAAE,SAAS;gBAClB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,MAAM;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,uBAAuB,MAAM,kBAAkB,MAAM,wBAAwB,CAAC,CAAC;QAC3H,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACzB,IAAI,GAAG;oBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,oNAAoN,CAAC,CAAC;QAC/N,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,qEAAqE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,CAAC;IACnJ,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,qBAAqB,mLAAmL,CAAC,CAAC;IAC/P,IAAI,MAAM,CAAC,cAAc;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,cAAc,gHAAgH,CAAC,CAAC;IAC9K,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,2FAA2F,CAAC,CAAC;IACnJ,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/corbado-config.d.ts

@@ -1,20 +0,0 @@
-import type { TranslationResult } from '../framework/plugin';
-import { type VendorHttp } from './vendor-http';
-/**
- * `atlas migrate corbado config` — Corbado exposes no settings API worth
- * reading, so the sign-in methods are inferred from what the project's users
- * actually have (login identifiers by type, from the Backend API) and the
- * rest is reported by where it lives in the Corbado console.
- */
-export interface CorbadoConfigSnapshot {
-    projectId: string;
-    rpId?: string;
-    /** Number of login identifiers by type; null when the count could not be read. */
-    identifiers: {
-        email: number | null;
-        phone: number | null;
-        username: number | null;
-    };
-}
-export declare function fetchCorbadoConfig(http: VendorHttp, projectId: string, rpId?: string): Promise<CorbadoConfigSnapshot>;
-export declare function translateCorbadoConfig(snap: CorbadoConfigSnapshot): TranslationResult;

package/dist/migrate/export/corbado-config.js

@@ -1,63 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchCorbadoConfig = fetchCorbadoConfig;
-exports.translateCorbadoConfig = translateCorbadoConfig;
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-async function count(http, type) {
-    try {
-        const { body } = await http.get(`/v2/identifiers?page=1&pageSize=1&filter%5B%5D=${encodeURIComponent(`identifierType:eq:${type}`)}`);
-        const total = (0, record_set_1.isObj)(body?.paging) ? body.paging.totalItems : undefined;
-        return typeof total === 'number' ? total : null;
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
-            return null;
-        throw err;
-    }
-}
-async function fetchCorbadoConfig(http, projectId, rpId) {
-    return {
-        projectId,
-        ...(rpId ? { rpId } : {}),
-        identifiers: { email: await count(http, 'email'), phone: await count(http, 'phone'), username: await count(http, 'username') },
-    };
-}
-function translateCorbadoConfig(snap) {
-    const b = new translate_kit_1.ConfigBuilder();
-    b.set('strategies.passkey', true);
-    b.add('mapped', 'authentication', 'passkeys', 'Passkey sign-in stays on; exported credentials keep working while Atlas is served from the same relying-party domain.', 'auth_config.strategies.passkey');
-    b.set('accountUx.passkeySignUp.enabled', true);
-    b.add('mapped', 'authentication', 'passkey-first sign-up', 'Corbado accounts start from a passkey: Atlas offers passkey sign-up.', 'auth_config.accountUx.passkeySignUp');
-    const { email, phone, username } = snap.identifiers;
-    if (email) {
-        b.set('strategies.emailCode', true);
-        b.add('mapped', 'identifiers', 'email', `${email} email identifier(s): email code sign-in (the fallback when a passkey is not available).`, 'auth_config.strategies.emailCode');
-    }
-    if (phone) {
-        b.set('strategies.phoneCode', true);
-        b.add('mapped', 'identifiers', 'phone', `${phone} phone identifier(s): SMS code sign-in.`, 'auth_config.strategies.phoneCode');
-    }
-    if (username) {
-        b.set('strategies.username', true);
-        b.add('mapped', 'identifiers', 'username', `${username} username identifier(s).`, 'auth_config.strategies.username');
-    }
-    if (email === null && phone === null && username === null) {
-        b.add('manual', 'identifiers', 'login identifiers', 'Corbado did not list your identifiers; turn on the matching Atlas sign-in methods (emailCode, phoneCode, username) yourself.', 'auth_config.strategies');
-    }
-    if (snap.rpId)
-        b.add('differs', 'passkeys', 'relying party', `Passkeys are bound to ${snap.rpId}: serve Atlas from that domain or a subdomain (a custom domain) so exported passkeys keep working.`);
-    else
-        b.add('manual', 'passkeys', 'relying party', 'Corbado does not return the relying-party id: pass it with --corbado-rp-id so passkeys can be exported, and serve Atlas from that domain.');
-    for (const [setting, where] of [
-        ['allowed origins and redirect URLs', 'Developer panel → Application URLs'],
-        ['session lifetimes (short and long session)', 'Developer panel → Sessions'],
-        ['social login', 'Developer panel → Authentication methods'],
-        ['webhooks and email / SMS templates', 'Developer panel → Webhooks, Communication'],
-    ]) {
-        b.add('manual', 'settings not in the API', setting, `Corbado does not expose this by API; copy it from the Corbado console (${where}). Atlas: dashboard → Sessions / Redirect URLs / Providers / Webhooks.`);
-    }
-    return b.result(`Corbado project ${snap.projectId}`, { bridge: { preset: 'corbado', vars: { project_id: snap.projectId } } });
-}
-//# sourceMappingURL=corbado-config.js.map

package/dist/migrate/export/corbado-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"corbado-config.js","sourceRoot":"","sources":["../../../src/migrate/export/corbado-config.ts"],"names":[],"mappings":";;AA6BA,gDAMC;AAED,wDAiCC;AArED,6CAA+C;AAC/C,mDAAgD;AAChD,+CAAgE;AAehE,KAAK,UAAU,KAAK,CAAC,IAAgB,EAAE,IAAoC;IACzE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,kDAAkD,kBAAkB,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1I,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,IAAgB,EAAE,SAAiB,EAAE,IAAa;IACzF,OAAO;QACL,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE;KAC/H,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,IAA2B;IAChE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,uHAAuH,EAAE,gCAAgC,CAAC,CAAC;IACzM,CAAC,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sEAAsE,EAAE,qCAAqC,CAAC,CAAC;IAC1K,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;IACpD,IAAI,KAAK,EAAE,CAAC;QACV,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,KAAK,0FAA0F,EAAE,kCAAkC,CAAC,CAAC;IAClL,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,KAAK,yCAAyC,EAAE,kCAAkC,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,QAAQ,0BAA0B,EAAE,iCAAiC,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,mBAAmB,EAAE,8HAA8H,EAAE,wBAAwB,CAAC,CAAC;IAChN,CAAC;IACD,IAAI,IAAI,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,yBAAyB,IAAI,CAAC,IAAI,oGAAoG,CAAC,CAAC;;QAChM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,2IAA2I,CAAC,CAAC;IAC/L,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,mCAAmC,EAAE,oCAAoC,CAAC;QAC3E,CAAC,4CAA4C,EAAE,4BAA4B,CAAC;QAC5E,CAAC,cAAc,EAAE,0CAA0C,CAAC;QAC5D,CAAC,oCAAoC,EAAE,2CAA2C,CAAC;KAC3E,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,OAAO,EAAE,0EAA0E,KAAK,wEAAwE,CAAC,CAAC;IAC/M,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;AAChI,CAAC"}

package/dist/migrate/export/corbado.d.ts

@@ -1,37 +0,0 @@
-import type { UserRecord } from '@atlasauth/migrate';
-import { RecordSet, type Obj } from './record-set';
-import { VendorHttp } from './vendor-http';
-/**
- * `atlas migrate export corbado` — a Corbado project onto the canonical bundle
- * models, read with the project id and API secret (Backend API v2, HTTP Basic)
- * on this machine.
- *
- *   - users (`GET /v2/users`, with their email, phone and username
- *     identifiers; a `pending` identifier is unverified, `verified` and
- *     `primary` are verified); deleted users skipped, disabled users banned;
- *   - passkeys: `GET /v2/users/{id}/fullCredentials` returns each credential id
- *     AND its public key (base64url), so passkeys move and keep working. A
- *     passkey is bound to its relying-party id, which the API does not return:
- *     pass it with --corbado-rp-id (your Corbado relying party / domain), and
- *     Atlas must be served from that domain (or a subdomain of it) for the
- *     passkeys to keep working;
- *   - Corbado holds no passwords, TOTP seeds, organizations or API keys.
- *
- * Sessions are Corbado short-session JWTs, bridged by the `corbado` preset.
- */
-export interface CorbadoExportOptions {
-    projectId: string;
-    apiSecret: string;
-    /** Backend API origin (default https://backendapi.cloud.corbado.io). */
-    baseUrl?: string;
-    /** The passkeys' relying-party id; without it passkeys are not exported. */
-    rpId?: string;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-export declare const CORBADO_BACKEND = "https://backendapi.cloud.corbado.io";
-export declare function corbadoHttp(o: Pick<CorbadoExportOptions, 'projectId' | 'apiSecret' | 'baseUrl' | 'fetchImpl' | 'sleep'>): VendorHttp;
-export declare function exportCorbado(opts: CorbadoExportOptions): Promise<RecordSet>;
-/** One Corbado `userAggregate` → a user record; 'deleted' for removed users. */
-export declare function mapCorbadoUser(u: Obj): UserRecord | 'deleted' | null;