@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/fusionauth-config.js

@@ -1,226 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchFusionAuthConfig = fetchFusionAuthConfig;
-exports.translateFusionAuthConfig = translateFusionAuthConfig;
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-async function fetchFusionAuthConfig(http, baseUrl, warn = () => undefined) {
-    const list = async (path, key, what) => {
-        try {
-            const { body } = await http.get(path);
-            return (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
-        }
-        catch (err) {
-            if (!(err instanceof vendor_http_1.VendorApiError) || ![401, 403, 404].includes(err.status))
-                throw err;
-            if (err.status !== 404)
-                warn(`${what} could not be read with this API key (${err.status}) and were skipped.`);
-            return [];
-        }
-    };
-    return {
-        baseUrl,
-        tenants: await list('/api/tenant', 'tenants', 'Tenants'),
-        applications: await list('/api/application', 'applications', 'Applications'),
-        identityProviders: await list('/api/identity-provider', 'identityProviders', 'Identity providers'),
-        lambdas: await list('/api/lambda', 'lambdas', 'Lambdas'),
-        webhooks: await list('/api/webhook', 'webhooks', 'Webhooks'),
-        themes: await list('/api/theme', 'themes', 'Themes'),
-    };
-}
-const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
-function translateFusionAuthConfig(snap, opts = {}) {
-    const b = new translate_kit_1.ConfigBuilder();
-    const tenant = (opts.tenantId ? snap.tenants.find((t) => (0, record_set_1.str)(t.id) === opts.tenantId) : snap.tenants.find((t) => t.name === 'Default') ?? snap.tenants[0]) ?? {};
-    const tName = (0, record_set_1.str)(tenant.name) ?? 'tenant';
-    const area = `tenant ${tName}`;
-    b.set('strategies.password', true);
-    b.add('differs', 'authentication', 'password', 'Password sign-in. A database export carries the hashes (FusionAuth schemes verify as they are and re-hash on first sign-in); with the API alone, use the fusionauth lazy-migration preset.', 'auth_config.strategies.password');
-    if (snap.tenants.length > 1)
-        b.add('differs', 'tenants', 'tenants', `${snap.tenants.length} tenants: this report covers "${tName}". One Atlas instance per tenant, or one instance with tenants as organizations (data export tenantsAs).`, 'organizations');
-    // ── password rules ──
-    const rules = (0, record_set_1.isObj)(tenant.passwordValidationRules) ? tenant.passwordValidationRules : {};
-    const min = num(rules.minLength);
-    b.set('passwordPolicy.minLength', Math.max(8, min || 8));
-    if (min)
-        b.add(min < 8 ? 'differs' : 'mapped', area, 'passwordValidationRules.minLength', `${min}${min < 8 ? ' (Atlas requires at least 8; existing passwords still sign in)' : ''}.`, 'auth_config.passwordPolicy.minLength');
-    if (num(rules.maxLength)) {
-        b.set('passwordPolicy.maxLength', Math.min(num(rules.maxLength), 4096));
-        b.add('mapped', area, 'passwordValidationRules.maxLength', `${rules.maxLength}.`, 'auth_config.passwordPolicy.maxLength');
-    }
-    if (rules.requireMixedCase === true) {
-        b.set('passwordPolicy.requireUppercase', true);
-        b.set('passwordPolicy.requireLowercase', true);
-        b.add('mapped', area, 'passwordValidationRules.requireMixedCase', 'Upper and lower case required.', 'auth_config.passwordPolicy');
-    }
-    if (rules.requireNumber === true) {
-        b.set('passwordPolicy.requireNumber', true);
-        b.add('mapped', area, 'passwordValidationRules.requireNumber', 'A number required.', 'auth_config.passwordPolicy.requireNumber');
-    }
-    if (rules.requireNonAlpha === true) {
-        b.set('passwordPolicy.requireSymbol', true);
-        b.add('mapped', area, 'passwordValidationRules.requireNonAlpha', 'A non-alphanumeric character required.', 'auth_config.passwordPolicy.requireSymbol');
-    }
-    const history = (0, record_set_1.isObj)(rules.rememberPreviousPasswords) ? rules.rememberPreviousPasswords : {};
-    if (history.enabled === true && num(history.count)) {
-        b.set('passwordPolicy.historyCount', num(history.count));
-        b.add('mapped', area, 'passwordValidationRules.rememberPreviousPasswords', `Last ${history.count} passwords. Atlas starts the history at the first password set in Atlas.`, 'auth_config.passwordPolicy.historyCount');
-    }
-    const breach = (0, record_set_1.isObj)(rules.breachDetection) ? rules.breachDetection : {};
-    if (breach.enabled === true) {
-        b.set('passwordPolicy.checkBreaches', true);
-        b.add('mapped', area, 'passwordValidationRules.breachDetection', 'Breached passwords are refused.', 'auth_config.passwordPolicy.checkBreaches');
-    }
-    const pw = (0, record_set_1.isObj)(tenant.passwordEncryptionConfiguration) ? tenant.passwordEncryptionConfiguration : {};
-    if ((0, record_set_1.str)(pw.encryptionScheme))
-        b.add('differs', area, `passwordEncryptionConfiguration ${pw.encryptionScheme}`, 'Atlas stores Argon2id; imported FusionAuth hashes verify as they are and re-hash on first sign-in.', 'auth_config.passwordPolicy');
-    // ── multi-factor ──
-    const mfa = (0, record_set_1.isObj)(tenant.multiFactorConfiguration) ? tenant.multiFactorConfiguration : {};
-    const policy = (0, record_set_1.str)(mfa.loginPolicy);
-    if (policy === 'Required') {
-        b.set('mfaPolicy', 'required');
-        b.add('mapped', area, 'multiFactorConfiguration.loginPolicy', 'A second factor on every sign-in.', 'auth_config.mfaPolicy');
-    }
-    else if (policy === 'Enabled') {
-        b.set('mfaPolicy', 'optional');
-        b.add('mapped', area, 'multiFactorConfiguration.loginPolicy', 'Second factor optional (users who enrolled are challenged).', 'auth_config.mfaPolicy');
-    }
-    if ((0, record_set_1.isObj)(mfa.authenticator) && mfa.authenticator.enabled !== false) {
-        b.set('mfa.factors.totp', true);
-        b.add('mapped', area, 'multiFactorConfiguration.authenticator', 'Authenticator apps. Secrets move with a database export; with the API alone users enrol again.', 'auth_config.mfa.factors.totp');
-    }
-    if ((0, record_set_1.isObj)(mfa.email) && mfa.email.enabled === true) {
-        b.set('mfa.factors.emailCode', true);
-        b.add('mapped', area, 'multiFactorConfiguration.email', 'Email code as a second factor.', 'auth_config.mfa.factors.emailCode');
-    }
-    if ((0, record_set_1.isObj)(mfa.sms) && mfa.sms.enabled === true) {
-        b.set('mfa.factors.sms', true);
-        b.add('differs', area, 'multiFactorConfiguration.sms', 'SMS second factor: the phone numbers move with the data export; Atlas sends through your own messaging provider (bring your own keys), and recommends TOTP or passkeys.', 'auth_config.mfa.factors.sms');
-    }
-    const webauthn = (0, record_set_1.isObj)(tenant.webAuthnConfiguration) ? tenant.webAuthnConfiguration : {};
-    if (webauthn.enabled === true) {
-        b.set('strategies.passkey', true);
-        b.set('mfa.factors.passkey', true);
-        b.add('differs', area, 'webAuthnConfiguration', `Passkeys. FusionAuth does not export WebAuthn credentials: users register again${(0, record_set_1.str)(webauthn.relyingPartyId) ? ` (relying party ${webauthn.relyingPartyId})` : ''}.`, 'auth_config.mfa.factors.passkey');
-    }
-    // ── tokens and sessions ──
-    const jwt = (0, record_set_1.isObj)(tenant.jwtConfiguration) ? tenant.jwtConfiguration : {};
-    if (num(jwt.timeToLiveInSeconds)) {
-        b.set('session.jwtTtlSeconds', Math.min(Math.max(num(jwt.timeToLiveInSeconds), 60), 3600));
-        b.add('mapped', area, 'jwtConfiguration.timeToLiveInSeconds', `${jwt.timeToLiveInSeconds} seconds (Atlas allows 60 to 3600).`, 'auth_config.session.jwtTtlSeconds');
-    }
-    if (num(jwt.refreshTokenTimeToLiveInMinutes)) {
-        b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(num(jwt.refreshTokenTimeToLiveInMinutes) * 60_000));
-        b.add('mapped', area, 'jwtConfiguration.refreshTokenTimeToLiveInMinutes', `${jwt.refreshTokenTimeToLiveInMinutes} minutes.`, 'auth_config.session.absoluteMs');
-    }
-    if ((0, record_set_1.str)(jwt.refreshTokenExpirationPolicy) === 'SlidingWindow' && num(jwt.refreshTokenTimeToLiveInMinutes)) {
-        b.set('session.idleMs', (0, translate_kit_1.clampSessionMs)(num(jwt.refreshTokenTimeToLiveInMinutes) * 60_000));
-        b.add('mapped', area, 'jwtConfiguration.refreshTokenExpirationPolicy', 'Sliding window: an idle limit of the same length.', 'auth_config.session.idleMs');
-    }
-    const failed = (0, record_set_1.isObj)(tenant.failedAuthenticationConfiguration) ? tenant.failedAuthenticationConfiguration : {};
-    if (num(failed.tooManyAttempts))
-        b.add('mapped', area, 'failedAuthenticationConfiguration', `Lockout after ${failed.tooManyAttempts} failures: Atlas throttles failed sign-ins per account and IP (a locked user can be banned by an administrator).`, 'auth_config.rateLimit');
-    // ── applications: sign-up, redirect URLs, roles ──
-    const redirects = new Set();
-    let roleCount = 0;
-    for (const app of snap.applications) {
-        if (app.active === false)
-            continue;
-        const name = (0, record_set_1.str)(app.name) ?? (0, record_set_1.str)(app.id) ?? 'application';
-        const reg = (0, record_set_1.isObj)(app.registrationConfiguration) ? app.registrationConfiguration : {};
-        if (reg.enabled !== true && !b.auth.signUpMode) {
-            b.set('signUpMode', 'restricted');
-            b.add('mapped', `applications ${name}`, 'registrationConfiguration.enabled', 'Self-registration is off: Atlas sign-up is restricted (invitations still work).', 'auth_config.signUpMode');
-        }
-        if (app.verifyRegistration === true) {
-            b.set('requireEmailVerification', true);
-            b.add('mapped', `applications ${name}`, 'verifyRegistration', 'Email verification required.', 'auth_config.requireEmailVerification');
-        }
-        const oauth = (0, record_set_1.isObj)(app.oauthConfiguration) ? app.oauthConfiguration : {};
-        for (const u of (0, record_set_1.strs)(oauth.authorizedRedirectURLs))
-            redirects.add(u);
-        if ((0, record_set_1.strs)(oauth.enabledGrants).includes('client_credentials'))
-            b.add('manual', `applications ${name}`, 'oauthConfiguration.enabledGrants client_credentials', 'A machine-to-machine application: create an Atlas M2M client for it.', 'oauth_clients');
-        if ((0, record_set_1.strs)(oauth.enabledGrants).includes('password'))
-            b.add('manual', `applications ${name}`, 'oauthConfiguration.enabledGrants password', 'Resource-owner password grant: Atlas does not offer it; move the app to the authorization-code flow with PKCE.');
-        if ((0, record_set_1.isObj)(app.samlv2Configuration) && app.samlv2Configuration.enabled === true)
-            b.add('manual', `applications ${name}`, 'samlv2Configuration', 'FusionAuth acting as a SAML identity provider for this application: Atlas can act as one, configure it per service provider.', 'saml_idp');
-        for (const r of (0, record_set_1.objs)(app.roles)) {
-            const rn = (0, record_set_1.str)(r.name);
-            if (!rn)
-                continue;
-            const key = (0, translate_kit_1.keyOf)(rn);
-            if (b.roles[rn])
-                continue;
-            b.roles[rn] = key;
-            roleCount++;
-            b.push('roles', { key, name: rn, description: (0, record_set_1.str)(r.description) ?? '', permissions: [] });
-        }
-    }
-    if (roleCount)
-        b.add('differs', 'applications', 'roles', `${roleCount} application role(s) become Atlas app roles (roles of the same name in different applications share one key).`, 'roles');
-    let exact = 0;
-    for (const url of redirects) {
-        if (url.includes('*') || !/^https?:\/\//.test(url)) {
-            b.add('differs', 'applications', `authorizedRedirectURLs ${url}`, 'Atlas redirect URLs are exact absolute URLs (no wildcards or custom schemes).', 'redirect_urls');
-            continue;
-        }
-        b.push('redirect_urls', { url });
-        exact++;
-    }
-    if (exact)
-        b.add('mapped', 'applications', 'authorizedRedirectURLs', `${exact} redirect URL(s).`, 'redirect_urls');
-    // ── identity providers ──
-    for (const idp of snap.identityProviders) {
-        if (idp.enabled === false)
-            continue;
-        const type = (0, record_set_1.str)(idp.type) ?? '';
-        const name = (0, record_set_1.str)(idp.name) ?? type;
-        if (type === 'SAMLv2' || type === 'OpenIDConnect') {
-            b.add('mapped', 'identity providers', `${name} (${type})`, 'Enterprise IdP: moves with the data export as an Atlas SSO connection; point it at Atlas\'s ACS URL / redirect URI at cutover.', 'sso_connections');
-            continue;
-        }
-        if (type === 'SAMLv2IdPInitiated') {
-            b.add('manual', 'identity providers', `${name} (${type})`, 'IdP-initiated SAML: Atlas SAML connections are SP-initiated.');
-            continue;
-        }
-        if (type === 'ExternalJWT' || type === 'SonyPSN' || type === 'Nintendo' || type === 'HYPR') {
-            b.add('manual', 'identity providers', `${name} (${type})`, 'No built-in Atlas provider: add it as a custom OAuth provider.', 'custom_oauth_providers');
-            continue;
-        }
-        const key = (0, translate_kit_1.socialKey)(type);
-        if (!key) {
-            b.add('manual', 'identity providers', `${name} (${type})`, 'No built-in Atlas provider: add it as a custom OAuth provider.', 'custom_oauth_providers');
-            continue;
-        }
-        const first = Object.values((0, record_set_1.isObj)(idp.applicationConfiguration) ? idp.applicationConfiguration : {}).find(record_set_1.isObj);
-        const clientId = (0, record_set_1.str)(idp.client_id) ?? (0, record_set_1.str)(first?.client_id);
-        b.socialProvider({ atlasKey: key, vendorName: name, area: 'identity providers', setting: `${name} (${type})`, clientId, scopes: (0, record_set_1.str)(idp.scope)?.split(/[\s,]+/).filter(Boolean) });
-    }
-    // ── what has no counterpart ──
-    const email = (0, record_set_1.isObj)(tenant.emailConfiguration) ? tenant.emailConfiguration : {};
-    if ((0, record_set_1.str)(email.host))
-        b.add('manual', area, 'emailConfiguration', `Mail goes through your own provider in Atlas (bring your own keys): configure ${(0, record_set_1.str)(email.host)} or an email API in the email provider settings; the SMTP password is never returned by FusionAuth.`, 'email_provider');
-    const activeLambdas = snap.lambdas.filter((l) => l.enabled !== false);
-    if (activeLambdas.length)
-        b.add('manual', 'lambdas', `${activeLambdas.length} lambda(s)`, 'JWT populate, reconcile and SAML lambdas: port the claims logic to an Atlas JWT template / action.', 'jwt_templates');
-    for (const w of snap.webhooks)
-        if (w.enabled !== false)
-            b.add('manual', 'webhooks', (0, record_set_1.str)(w.url) ?? (0, record_set_1.str)(w.id) ?? '?', 'FusionAuth webhook: recreate it as an Atlas webhook (event names differ).', 'webhooks');
-    if (snap.themes.filter((t) => (0, record_set_1.str)(t.name) !== 'FusionAuth Default').length)
-        b.add('manual', 'themes', 'custom themes', 'FusionAuth (FreeMarker) themes: rebuild the look in Atlas branding or the embeddable components.', 'branding');
-    if (snap.baseUrl)
-        b.add('differs', area, 'issuer', `Tokens carry iss "${(0, record_set_1.str)(tenant.issuer) ?? '(tenant issuer)'}"; Atlas tokens carry your Atlas issuer. Resource servers that pin the old issuer accept both during the bridge window (legacy issuers).`, 'legacy_issuers');
-    const vars = {};
-    if (snap.baseUrl)
-        vars.base_url = snap.baseUrl;
-    const issuer = (0, record_set_1.str)(tenant.issuer);
-    const urlIssuer = issuer && /^https:\/\//.test(issuer);
-    const bridgeVars = { ...vars, ...(issuer && !urlIssuer ? { issuer_name: issuer } : {}) };
-    return b.result(`FusionAuth ${area}`, {
-        bridge: { preset: urlIssuer ? 'fusionauth_url_issuer' : 'fusionauth', vars: bridgeVars },
-        lazy: { preset: 'fusionauth', config: vars },
-    });
-}
-//# sourceMappingURL=fusionauth-config.js.map

package/dist/migrate/export/fusionauth-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fusionauth-config.js","sourceRoot":"","sources":["../../../src/migrate/export/fusionauth-config.ts"],"names":[],"mappings":";;AA0BA,sDAoBC;AAID,8DAkLC;AAlOD,6CAAgE;AAChE,mDAAkF;AAClF,+CAAgE;AAsBzD,KAAK,UAAU,qBAAqB,CAAC,IAAgB,EAAE,OAAgB,EAAE,OAA4B,GAAG,EAAE,CAAC,SAAS;IACzH,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,GAAW,EAAE,IAAY,EAAkB,EAAE;QAC7E,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;YAC/C,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,CAAC;YACzF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,IAAI,CAAC,GAAG,IAAI,yCAAyC,GAAG,CAAC,MAAM,qBAAqB,CAAC,CAAC;YAC9G,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,OAAO;QACP,OAAO,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC;QACxD,YAAY,EAAE,MAAM,IAAI,CAAC,kBAAkB,EAAE,cAAc,EAAE,cAAc,CAAC;QAC5E,iBAAiB,EAAE,MAAM,IAAI,CAAC,wBAAwB,EAAE,mBAAmB,EAAE,oBAAoB,CAAC;QAClG,OAAO,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC;QACxD,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC;QAC5D,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1F,SAAgB,yBAAyB,CAAC,IAA8B,EAAE,OAA8B,EAAE;IACxG,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjK,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC3C,MAAM,IAAI,GAAG,UAAU,KAAK,EAAE,CAAC;IAE/B,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,4LAA4L,EAAE,iCAAiC,CAAC,CAAC;IAChR,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,iCAAiC,KAAK,0GAA0G,EAAE,eAAe,CAAC,CAAC;IAE7P,uBAAuB;IACvB,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,GAAG;QAAE,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAC/N,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,0CAA0C,EAAE,gCAAgC,EAAE,4BAA4B,CAAC,CAAC;IACpI,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,uCAAuC,EAAE,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;IACnI,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,yCAAyC,EAAE,wCAAwC,EAAE,0CAA0C,CAAC,CAAC;IACzJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,mDAAmD,EAAE,QAAQ,OAAO,CAAC,KAAK,0EAA0E,EAAE,yCAAyC,CAAC,CAAC;IACzN,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,yCAAyC,EAAE,iCAAiC,EAAE,0CAA0C,CAAC,CAAC;IAClJ,CAAC;IACD,MAAM,EAAE,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,IAAI,IAAA,gBAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,gBAAgB,EAAE,EAAE,oGAAoG,EAAE,4BAA4B,CAAC,CAAC;IAEnP,qBAAqB;IACrB,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,mCAAmC,EAAE,uBAAuB,CAAC,CAAC;IAC9H,CAAC;SAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,6DAA6D,EAAE,uBAAuB,CAAC,CAAC;IACxJ,CAAC;IACD,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,wCAAwC,EAAE,gGAAgG,EAAE,8BAA8B,CAAC,CAAC;IACpM,CAAC;IACD,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACnD,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,gCAAgC,EAAE,gCAAgC,EAAE,mCAAmC,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/C,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,8BAA8B,EAAE,yKAAyK,EAAE,6BAA6B,CAAC,CAAC;IACnQ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,uBAAuB,EAAE,kFAAkF,IAAA,gBAAG,EAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAmB,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAC7P,CAAC;IAED,4BAA4B;IAC5B,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACjC,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,GAAG,GAAG,CAAC,mBAAmB,qCAAqC,EAAE,mCAAmC,CAAC,CAAC;IACtK,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,CAAC;QAC7C,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,kDAAkD,EAAE,GAAG,GAAG,CAAC,+BAA+B,WAAW,EAAE,gCAAgC,CAAC,CAAC;IACjK,CAAC;IACD,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,4BAA4B,CAAC,KAAK,eAAe,IAAI,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,CAAC;QAC1G,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAA,8BAAc,EAAC,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;QAC3F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,+CAA+C,EAAE,mDAAmD,EAAE,4BAA4B,CAAC,CAAC;IAC5J,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/G,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,iBAAiB,MAAM,CAAC,eAAe,kHAAkH,EAAE,uBAAuB,CAAC,CAAC;IAEhR,oDAAoD;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,mCAAmC,EAAE,iFAAiF,EAAE,wBAAwB,CAAC,CAAC;QAC5L,CAAC;QACD,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,sCAAsC,CAAC,CAAC;QACxI,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,KAAK,CAAC,sBAAsB,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,IAAA,iBAAI,EAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,qDAAqD,EAAE,sEAAsE,EAAE,eAAe,CAAC,CAAC;QACtP,IAAI,IAAA,iBAAI,EAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,2CAA2C,EAAE,gHAAgH,CAAC,CAAC;QAC3P,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,OAAO,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,qBAAqB,EAAE,8HAA8H,EAAE,UAAU,CAAC,CAAC;QAC3R,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,EAAE,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC1B,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC;YAClB,SAAS,EAAE,CAAC;YACZ,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,IAAI,SAAS;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,SAAS,+GAA+G,EAAE,OAAO,CAAC,CAAC;IAC/L,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,0BAA0B,GAAG,EAAE,EAAE,+EAA+E,EAAE,eAAe,CAAC,CAAC;YACpK,SAAS;QACX,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,wBAAwB,EAAE,GAAG,KAAK,mBAAmB,EAAE,eAAe,CAAC,CAAC;IAEnH,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzC,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACnC,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAClD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,gIAAgI,EAAE,iBAAiB,CAAC,CAAC;YAChN,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,8DAA8D,CAAC,CAAC;YAC3H,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,gEAAgE,EAAE,wBAAwB,CAAC,CAAC;YACvJ,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,gEAAgE,EAAE,wBAAwB,CAAC,CAAC;YACvJ,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAK,CAAC,CAAC;QACjH,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAA,gBAAG,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrL,CAAC;IAED,gCAAgC;IAChC,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAI,IAAA,gBAAG,EAAC,KAAK,CAAC,IAAI,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE,iFAAiF,IAAA,gBAAG,EAAC,KAAK,CAAC,IAAI,CAAC,qGAAqG,EAAE,gBAAgB,CAAC,CAAC;IAC1R,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACtE,IAAI,aAAa,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,MAAM,YAAY,EAAE,oGAAoG,EAAE,eAAe,CAAC,CAAC;IACjN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,2EAA2E,EAAE,UAAU,CAAC,CAAC;IAC7M,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,oBAAoB,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,kGAAkG,EAAE,UAAU,CAAC,CAAC;IACvO,IAAI,IAAI,CAAC,OAAO;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,qBAAqB,IAAA,gBAAG,EAAC,MAAM,CAAC,MAAM,CAAC,IAAI,iBAAiB,0IAA0I,EAAE,gBAAgB,CAAC,CAAC;IAE7Q,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACzF,OAAO,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE;QACpC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE;QACxF,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/fusionauth.d.ts

@@ -1,99 +0,0 @@
-import type { PasswordHash } from '@atlasauth/migrate';
-import { type Tables } from './frameworks/tables';
-import { RecordSet, type Obj } from './record-set';
-import { VendorHttp } from './vendor-http';
-/**
- * `atlas migrate export fusionauth` — a FusionAuth tenant (self-hosted or
- * FusionAuth Cloud) onto the canonical bundle models. Two ways in, both on the
- * owner's machine:
- *
- *   - the API with an API key (read-only is enough): users with their
- *     registrations, roles, groups, linked identity providers, two-factor
- *     methods (SMS, email) and recovery codes, identity providers (SAML v2 /
- *     OpenID Connect as SSO connections), applications and API keys. The API
- *     NEVER returns password hashes or authenticator secrets.
- *   - a DATABASE DUMP of a self-hosted install (one file per table, see
- *     {@link fusionAuthSnapshotFromTables}): the only path with the hashes
- *     (`password`, `salt`, `factor`, `encryption_scheme`) and authenticator
- *     secrets. FusionAuth Cloud has no database access: ask FusionAuth support
- *     for the export, or use the `fusionauth` lazy-migration preset.
- *
- * Both paths build one {@link FusionAuthSnapshot}; {@link mapFusionAuth} maps it.
- * The FusionAuth user id is the `sub` of every FusionAuth JWT, so it is the user id.
- */
-export interface FusionAuthSnapshot {
-    baseUrl?: string;
-    tenants: Obj[];
-    /** Applications with their `roles` ([{ name, isDefault, isSuperRole }]). */
-    applications: Obj[];
-    /** Groups with `roles` ({ <applicationId>: [role names] }). */
-    groups: Obj[];
-    identityProviders: Obj[];
-    /** Public keys by key id (PEM), for SAML identity providers. */
-    keys: Record<string, string>;
-    apiKeys: Obj[];
-    /**
-     * Users in the API shape (`registrations`, `memberships`, `twoFactor.methods`) plus what the API
-     * cannot return: `password`, `salt`, `factor`, `encryptionScheme`, `links` (identity provider links) and `recoveryCodes`.
-     */
-    users: Obj[];
-    source: 'api' | 'database';
-}
-export interface FusionAuthMapOptions {
-    /** Groups move as organizations (default), as app roles, or not at all. */
-    groupsAs?: 'organizations' | 'roles' | 'skip';
-    /** Several tenants: each tenant becomes an organization its users belong to. */
-    tenantsAs?: 'organizations' | 'skip';
-}
-/**
- * A FusionAuth password (`password`, `salt`, `factor`, `encryption_scheme`) →
- * an Atlas hash. Schemes and their registry ids are documented in core's
- * fusionauth-hashes.ts; salts are base64 except bcrypt's 22-character salt.
- */
-export declare function fusionAuthPassword(u: {
-    password?: unknown;
-    salt?: unknown;
-    factor?: unknown;
-    encryptionScheme?: unknown;
-}): {
-    hash: PasswordHash;
-} | {
-    problem: string;
-} | null;
-export interface FusionAuthApiOptions {
-    /** `https://auth.example.com` or `https://acme.fusionauth.io`. */
-    baseUrl: string;
-    apiKey: string;
-    /** Required by FusionAuth when the API key is not tenant-locked and there are several tenants. */
-    tenantId?: string;
-    pageSize?: number;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (m: string) => void;
-}
-export declare function fusionAuthBase(raw: string): string;
-export declare function fusionAuthHttp(o: FusionAuthApiOptions): VendorHttp;
-/** Read a tenant through the API into a snapshot. */
-export declare function fetchFusionAuth(http: VendorHttp, o: Pick<FusionAuthApiOptions, 'baseUrl' | 'pageSize' | 'onProgress'> & {
-    warn?: (m: string) => void;
-}): Promise<FusionAuthSnapshot>;
-/**
- * A snapshot from a dump of a self-hosted FusionAuth database: one file per
- * table (`psql \copy users TO 'users.csv' CSV HEADER`, or `mysql … --batch`
- * converted, or a JSON array), named as in FusionAuth's schema: `users`,
- * `identities` (1.59+), `tenants`, `applications`, `application_roles`,
- * `user_registrations`, `user_registrations_application_roles`, `groups`,
- * `group_members`, `group_application_roles`, `identity_providers`,
- * `identity_provider_links`, `twofactor_methods`, `twofactor_recovery_codes`,
- * `api_keys`, `keys`.
- */
-export declare function fusionAuthSnapshotFromTables(t: Tables): FusionAuthSnapshot;
-/** Map a snapshot (API or database) onto canonical records. */
-export declare function mapFusionAuth(snap: FusionAuthSnapshot, opts?: FusionAuthMapOptions): RecordSet;
-export interface ExportFusionAuthOptions extends FusionAuthMapOptions {
-    /** A database dump of a self-hosted install (hashes and authenticator secrets included). */
-    tables?: Tables;
-    /** The API, when exporting live (no hashes, no authenticator secrets). */
-    api?: FusionAuthApiOptions;
-}
-export declare function exportFusionAuth(o: ExportFusionAuthOptions): Promise<RecordSet>;