@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/kinde.js

@@ -1,333 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.decryptKindeExport = decryptKindeExport;
-exports.exportKinde = exportKinde;
-exports.mapKindeUser = mapKindeUser;
-exports.kindePasswordHash = kindePasswordHash;
-exports.m2mToken = m2mToken;
-const node_crypto_1 = require("node:crypto");
-const record_set_1 = require("./record-set");
-const vendor_http_1 = require("./vendor-http");
-const zip_1 = require("./zip");
-/** AES-256-CTR, the scheme of Kinde's `.dat` export (`openssl aes-256-ctr -d -nosalt -K <key> -iv <iv>`). */
-function decryptKindeExport(data, keyHex, ivHex) {
-    const key = Buffer.from(keyHex.trim(), 'hex');
-    const iv = Buffer.from(ivHex.trim(), 'hex');
-    if (key.length !== 32)
-        throw new Error('The Kinde export Key must be 64 hex characters (AES-256).');
-    if (iv.length !== 16)
-        throw new Error('The Kinde export Initialization Vector must be 32 hex characters.');
-    const d = (0, node_crypto_1.createDecipheriv)('aes-256-ctr', key, iv);
-    return Buffer.concat([d.update(data), d.final()]);
-}
-async function exportKinde(opts) {
-    const set = new record_set_1.RecordSet();
-    const progress = opts.onProgress ?? (() => undefined);
-    // ── the data export (users + passwords) ──
-    let usersText = opts.usersNdjson;
-    let orgsText = opts.organizationsNdjson;
-    if (opts.encryptedExport || opts.zip) {
-        const zip = opts.zip ?? decryptKindeExport(opts.encryptedExport.data, opts.encryptedExport.key, opts.encryptedExport.iv);
-        if (zip.readUInt32LE(0) !== 0x04034b50)
-            throw new Error('The decrypted Kinde export is not a zip: check the Key and IV.');
-        const files = (0, zip_1.readZip)(zip);
-        usersText ??= (0, zip_1.zipFile)(files, 'users.ndjson')?.toString('utf8');
-        orgsText ??= (0, zip_1.zipFile)(files, 'organizations.ndjson')?.toString('utf8');
-        if (usersText === undefined)
-            throw new Error('The Kinde export has no users.ndjson.');
-    }
-    const exported = usersText !== undefined ? ndjson(usersText) : [];
-    const online = Boolean(opts.domain && opts.clientId && opts.clientSecret);
-    if (!online && usersText === undefined) {
-        throw new Error('Kinde export needs the data export file (with its Key and IV) and/or a machine-to-machine application (domain, client id, secret).');
-    }
-    const base = opts.domain ? `https://${opts.domain.replace(/^https?:\/\//, '').replace(/\/+$/, '')}` : '';
-    let token;
-    const http = new vendor_http_1.VendorHttp({
-        vendor: 'Kinde',
-        baseUrl: `${base}/api/v1`,
-        headers: async () => ({ authorization: `Bearer ${(token ??= await m2mToken(base, opts))}` }),
-        fetchImpl: opts.fetchImpl,
-        sleep: opts.sleep,
-    });
-    // ── organizations ──
-    progress('organizations');
-    const orgCodes = new Set();
-    let defaultOrg;
-    const orgRows = online ? await tokenAll(http, '/organizations?page_size=500', 'organizations') : orgsText ? ndjson(orgsText) : [];
-    for (const o of orgRows) {
-        const code = (0, record_set_1.str)(o.code) ?? (0, record_set_1.str)(o.organization_code);
-        const name = (0, record_set_1.str)(o.name);
-        if (!code || !name)
-            continue;
-        // The API flags it; the export file does not, so it is known there by Kinde's default name.
-        if (o.is_default === true || (o.is_default === undefined && name === 'Default Organization'))
-            defaultOrg = code;
-        if (code === defaultOrg && !opts.includeDefaultOrganization)
-            continue;
-        orgCodes.add(code);
-        set.add('organization', (0, record_set_1.compact)({ id: code, name, slug: (0, record_set_1.str)(o.handle), created_at: (0, record_set_1.str)(o.created_on) }));
-    }
-    if (defaultOrg && !opts.includeDefaultOrganization) {
-        set.warn(`Kinde's default organization (${defaultOrg}) holds every user and was not exported as an organization (pass --kinde-include-default-org to keep it).`);
-    }
-    // ── roles ──
-    const roleById = new Map();
-    if (online) {
-        progress('roles');
-        for (const r of await tokenAll(http, '/roles?page_size=500', 'roles')) {
-            const id = (0, record_set_1.str)(r.id);
-            const key = (0, record_set_1.str)(r.key);
-            if (!id || !key)
-                continue;
-            roleById.set(id, key);
-            const permissions = (await tokenAll(http, `/roles/${id}/permissions?page_size=500`, 'permissions')).map((p) => (0, record_set_1.str)(p.key)).filter((p) => !!p);
-            set.add('role', (0, record_set_1.compact)({ key, name: (0, record_set_1.str)(r.name), description: (0, record_set_1.str)(r.description), scope: 'organization', permissions }), key);
-        }
-    }
-    // ── users: the export (with passwords) first, the API fills the rest ──
-    progress('users');
-    const users = new Map();
-    for (const u of exported)
-        if ((0, record_set_1.str)(u.id))
-            users.set(u.id, u);
-    if (online) {
-        for (const u of await tokenAll(http, '/users?page_size=500&expand=organizations,identities', 'users')) {
-            const id = (0, record_set_1.str)(u.id);
-            if (!id)
-                continue;
-            users.set(id, { ...u, ...(users.get(id) ?? {}) });
-        }
-    }
-    let withPassword = 0;
-    for (const u of users.values()) {
-        const user = mapKindeUser(u, set);
-        if (!user) {
-            set.omit('user', 'no email, phone number or username');
-            continue;
-        }
-        if (user.password)
-            withPassword++;
-        set.add('user', user);
-        // Without API access, memberships come from the export's organization codes.
-        if (!online) {
-            for (const code of (0, record_set_1.strs)(u.organizations)) {
-                if (orgCodes.has(code))
-                    set.add('membership', { organization_id: code, user_id: user.id, role: 'member' }, `${code}:${user.id}`);
-            }
-        }
-    }
-    if (exported.length === 0) {
-        set.warn('No data export given: password hashes come only from Kinde\'s data export ("All data"). Without them users set a new password (Kinde has no API to verify one).');
-    }
-    else if (withPassword === 0) {
-        set.warn('The data export has no passwords: request "All data" (not "All data except passwords") to carry them.');
-    }
-    // ── memberships with roles ──
-    if (online) {
-        progress('organization members');
-        const userIds = new Set(set.list('user').map((u) => u.id));
-        for (const code of orgCodes) {
-            for (const m of await tokenAll(http, `/organizations/${code}/users?page_size=500`, 'organization_users')) {
-                const uid = (0, record_set_1.str)(m.id);
-                if (!uid || !userIds.has(uid))
-                    continue;
-                const role = (0, record_set_1.strs)(m.roles)[0] ?? 'member';
-                set.add('membership', (0, record_set_1.compact)({ organization_id: code, user_id: uid, role, created_at: (0, record_set_1.str)(m.joined_on) }), `${code}:${uid}`);
-                if ((0, record_set_1.strs)(m.roles).length > 1)
-                    set.warn('Some organization members hold several Kinde roles; Atlas seats each member with one role (the first).');
-            }
-        }
-        progress('connections');
-        await addConnections(set, http);
-    }
-    set.warn('Kinde does not export second-factor secrets or passkeys: those users re-enrol in Atlas.');
-    set.manifest = { origin: base || null, providers: [...new Set(set.list('identity').map((i) => i.provider))].sort() };
-    return set;
-}
-/** One Kinde user (export row and/or API row) → a user record. */
-function mapKindeUser(u, set) {
-    const id = (0, record_set_1.str)(u.id);
-    if (!id)
-        return null;
-    const identities = (0, record_set_1.objs)(u.identities);
-    const email = ((0, record_set_1.str)(u.email) ?? (0, record_set_1.str)(u.preferred_email))?.toLowerCase();
-    const emailIdentity = identities.find((i) => (0, record_set_1.str)(i.type) === 'email' && (0, record_set_1.str)(i.identity)?.toLowerCase() === email);
-    const phone = (0, record_set_1.e164)(u.phone) ?? (0, record_set_1.e164)(identities.find((i) => (0, record_set_1.str)(i.type) === 'phone')?.identity);
-    const username = (0, record_set_1.str)(u.username) ?? (0, record_set_1.str)(identities.find((i) => (0, record_set_1.str)(i.type) === 'username')?.identity);
-    const user = (0, record_set_1.compact)({
-        id,
-        emails: email
-            ? [{ email, verified: u.email_verified === true || emailIdentity?.is_confirmed === true || (u.email_verified === undefined && identities.some((i) => (0, record_set_1.str)(i.type)?.startsWith('oauth2:'))), primary: true }]
-            : [],
-        phones: phone ? [{ phone, verified: false, primary: !email }] : [],
-        username,
-        first_name: (0, record_set_1.str)(u.first_name),
-        last_name: (0, record_set_1.str)(u.last_name),
-        image_url: (0, record_set_1.str)(u.picture),
-        banned: u.is_suspended === true ? true : undefined,
-        private_metadata: (0, record_set_1.bag)((0, record_set_1.compact)({ kinde_external_id: (0, record_set_1.str)(u.external_id) ?? (0, record_set_1.str)(u.provided_id) })),
-        created_at: (0, record_set_1.str)(u.created_on),
-        last_sign_in_at: (0, record_set_1.str)(u.last_signed_in),
-    });
-    if ((0, record_set_1.isObj)(u.password)) {
-        const mapped = kindePasswordHash(u.password);
-        if ('reason' in mapped)
-            set?.omit('password', mapped.reason);
-        else
-            user.password = mapped;
-    }
-    const social = identities.filter((i) => (0, record_set_1.str)(i.type)?.startsWith('oauth2:'));
-    if (social.length)
-        set?.omit('identity', "Kinde does not export social accounts' provider user ids: they relink by verified email on first social sign-in", social.length);
-    return user.emails?.length || user.phones?.length || user.username ? user : null;
-}
-/**
- * Kinde's exported `password` object → the bundle's password hash. Kinde
- * stores bcrypt; users imported into Kinde keep the algorithm they came with
- * (crypt, md5, sha256, wordpress, pbkdf2, firebase-scrypt, aspnet-identity-v2).
- */
-function kindePasswordHash(p) {
-    const hash = (0, record_set_1.str)(p.hashed_password);
-    if (!hash)
-        return { reason: 'empty Kinde password hash' };
-    const algorithm = ((0, record_set_1.str)(p.hashing_algorithm) ?? '').toLowerCase().replace(/_/g, '-');
-    const config = (0, record_set_1.isObj)(p.hashing_config) ? p.hashing_config : {};
-    const salt = (0, record_set_1.str)(config.salt);
-    const position = ((0, record_set_1.str)(config.salt_position) ?? (0, record_set_1.str)(config.salt_location) ?? (0, record_set_1.str)(config.position) ?? 'suffix').toLowerCase();
-    switch (algorithm) {
-        case '':
-        case 'bcrypt':
-            return { algorithm: 'bcrypt', hash };
-        case 'crypt':
-        case 'wordpress':
-        case 'phpass':
-            // Self-describing ($1$, $5$, $6$, $2y$, $P$): the registry recognises them.
-            return { algorithm: 'auto', hash };
-        case 'md5':
-        case 'sha256':
-            if (!salt)
-                return { algorithm, hash, params: { encoding: /^[0-9a-f]+$/i.test(hash) ? 'hex' : 'base64' } };
-            return {
-                algorithm: `${algorithm}_salted`,
-                hash,
-                salt,
-                params: { encoding: /^[0-9a-f]+$/i.test(hash) ? 'hex' : 'base64', salt_position: position === 'prefix' ? 'prefix' : 'suffix' },
-            };
-        case 'pbkdf2': {
-            if (hash.includes('$'))
-                return { algorithm: 'auto', hash };
-            const iterations = Number(config.iterations ?? config.rounds);
-            if (!salt || !Number.isInteger(iterations))
-                return { reason: 'Kinde pbkdf2 hash without salt or iterations' };
-            return {
-                algorithm: 'pbkdf2',
-                hash,
-                salt,
-                params: { digest: (0, record_set_1.str)(config.digest)?.toLowerCase() ?? 'sha256', iterations, ...((0, record_set_1.str)(config.salt_encoding) ? { salt_encoding: (0, record_set_1.str)(config.salt_encoding) } : {}) },
-            };
-        }
-        case 'firebase-scrypt': {
-            const signer = (0, record_set_1.str)(config.signer_key) ?? (0, record_set_1.str)(config.base64_signer_key);
-            if (!signer)
-                return { reason: 'Kinde firebase-scrypt hash without the project signer key' };
-            return {
-                algorithm: 'scrypt_firebase',
-                hash,
-                salt: salt ?? '',
-                params: {
-                    signer_key: signer,
-                    salt_separator: (0, record_set_1.str)(config.salt_separator) ?? (0, record_set_1.str)(config.base64_salt_separator) ?? 'Bw==',
-                    rounds: Number(config.rounds ?? 8),
-                    mem_cost: Number(config.mem_cost ?? config.memory_cost ?? 14),
-                },
-            };
-        }
-        case 'aspnet-identity-v2':
-        case 'aspnet-identity-v3':
-            return { algorithm: 'aspnet_identity', hash };
-        default:
-            return { reason: `Kinde password algorithm "${algorithm}" is not supported` };
-    }
-}
-async function addConnections(set, http) {
-    let conns;
-    try {
-        conns = await tokenAll(http, '/connections?page_size=500', 'connections');
-    }
-    catch (err) {
-        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 404))
-            return;
-        throw err;
-    }
-    for (const c of conns) {
-        const id = (0, record_set_1.str)(c.id);
-        const strategy = (0, record_set_1.str)(c.strategy) ?? '';
-        if (!id || !/^(saml|wsfed|oidc|oauth2:(azure_ad|microsoft_entra|okta|google_workspace))/.test(strategy))
-            continue;
-        let detail = c;
-        try {
-            const { body } = await http.get(`/connections/${id}`);
-            detail = (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.connection) ? body.connection : (0, record_set_1.isObj)(body) ? body : c;
-        }
-        catch (err) {
-            if (!(err instanceof vendor_http_1.VendorApiError))
-                throw err;
-        }
-        const o = (0, record_set_1.isObj)(detail.options) ? detail.options : {};
-        const domains = (0, record_set_1.strs)(o.home_realm_domains);
-        const name = (0, record_set_1.str)(c.display_name) ?? (0, record_set_1.str)(c.name);
-        if (strategy.startsWith('saml')) {
-            set.add('sso_connection', (0, record_set_1.compact)({
-                id,
-                name,
-                protocol: 'saml',
-                domains,
-                saml: (0, record_set_1.compact)({
-                    idp_entity_id: (0, record_set_1.str)(o.saml_entity_id),
-                    idp_metadata_url: (0, record_set_1.str)(o.saml_idp_metadata_url),
-                    idp_sso_url: (0, record_set_1.str)(o.saml_sign_in_url) ?? (0, record_set_1.str)(o.saml_sso_url),
-                    idp_certificate: (0, record_set_1.str)(o.saml_signing_certificate) ?? (0, record_set_1.str)(o.saml_certificate),
-                    sp_acs_url: (0, record_set_1.str)(o.saml_acs_url),
-                }),
-            }));
-        }
-        else {
-            set.add('sso_connection', (0, record_set_1.compact)({ id, name, protocol: 'oidc', domains, oidc: (0, record_set_1.compact)({ issuer: (0, record_set_1.str)(o.issuer) ?? (0, record_set_1.str)(o.entra_id_domain), client_id: (0, record_set_1.str)(o.client_id) }) }));
-            set.warn(`Enterprise connection ${name ?? id}: Kinde does not return its client secret; enter it in Atlas after the import.`);
-        }
-    }
-}
-async function m2mToken(base, opts) {
-    const res = await (opts.fetchImpl ?? fetch)(`${base}/oauth2/token`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
-        body: new URLSearchParams({ grant_type: 'client_credentials', client_id: opts.clientId, client_secret: opts.clientSecret, audience: `${base}/api` }).toString(),
-    });
-    const body = (await res.json().catch(() => ({})));
-    if (!res.ok || !body.access_token)
-        throw new vendor_http_1.VendorApiError('Kinde', res.status, '/oauth2/token', body.error_description ?? 'could not get a Management API token');
-    return body.access_token;
-}
-/** Kinde's `next_token` paging. */
-async function tokenAll(http, path, key) {
-    const out = [];
-    let next;
-    do {
-        const { body } = await http.get(`${path}${next ? `&next_token=${encodeURIComponent(next)}` : ''}`);
-        const rows = (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
-        out.push(...rows);
-        next = (0, record_set_1.isObj)(body) ? (0, record_set_1.str)(body.next_token) : undefined;
-        if (rows.length === 0)
-            break;
-    } while (next);
-    return out;
-}
-function ndjson(text) {
-    return text
-        .split(/\r?\n/)
-        .filter((l) => l.trim())
-        .map((l) => JSON.parse(l))
-        .filter(record_set_1.isObj);
-}
-//# sourceMappingURL=kinde.js.map

package/dist/migrate/export/kinde.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kinde.js","sourceRoot":"","sources":["../../../src/migrate/export/kinde.ts"],"names":[],"mappings":";;AA8CA,gDAOC;AAED,kCAqHC;AAGD,oCA+BC;AAOD,8CAyDC;AAmDD,4BASC;AA1UD,6CAA+C;AAE/C,6CAA+F;AAC/F,+CAA2D;AAC3D,+BAAyC;AAyCzC,6GAA6G;AAC7G,SAAgB,kBAAkB,CAAC,IAAY,EAAE,MAAc,EAAE,KAAa;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACpG,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC3G,MAAM,CAAC,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEtD,4CAA4C;IAC5C,IAAI,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC;IACjC,IAAI,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACxC,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,eAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,eAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAgB,CAAC,EAAE,CAAC,CAAC;QAC5H,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAC1H,MAAM,KAAK,GAAG,IAAA,aAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,SAAS,KAAK,IAAA,aAAO,EAAC,KAAK,EAAE,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,QAAQ,KAAK,IAAA,aAAO,EAAC,KAAK,EAAE,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,oIAAoI,CAAC,CAAC;IACxJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzG,IAAI,KAAyB,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,GAAG,IAAI,SAAS;QACzB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,KAAK,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QAC5F,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,sBAAsB;IACtB,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,UAA8B,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,8BAA8B,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClI,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,SAAS;QAC7B,4FAA4F;QAC5F,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,KAAK,sBAAsB,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;QAChH,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,0BAA0B;YAAE,SAAS;QACtE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC,iCAAiC,UAAU,2GAA2G,CAAC,CAAC;IACnK,CAAC;IAED,cAAc;IACd,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;gBAAE,SAAS;YAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACtB,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,4BAA4B,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3J,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,cAAuB,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1I,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAe,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,sDAAsD,EAAE,OAAO,CAAC,EAAE,CAAC;YACtG,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,YAAY,EAAE,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtB,6EAA6E;QAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,iKAAiK,CAAC,CAAC;IAC9K,CAAC;SAAM,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,uGAAuG,CAAC,CAAC;IACpH,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,kBAAkB,IAAI,sBAAsB,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBACzG,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtB,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACxC,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;gBAC1C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC9H,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,wGAAwG,CAAC,CAAC;YACnJ,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,aAAa,CAAC,CAAC;QACxB,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;IACpG,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,SAAgB,YAAY,CAAC,CAAM,EAAE,GAAe;IAClD,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,UAAU,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACtE,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAA,iBAAI,EAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAA,gBAAG,EAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtG,MAAM,IAAI,GAAe,IAAA,oBAAO,EAAC;QAC/B,EAAE;QACF,MAAM,EAAE,KAAK;YACX,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,aAAa,EAAE,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3M,CAAC,CAAC,EAAE;QACN,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAClE,QAAQ;QACR,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC3B,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAClD,gBAAgB,EAAE,IAAA,gBAAG,EAAC,IAAA,oBAAO,EAAC,EAAE,iBAAiB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/F,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,QAAQ,IAAI,MAAM;YAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;;YACxD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM;QAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,iHAAiH,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3K,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,CAAM;IACtC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,CAAC,IAAA,gBAAG,EAAC,MAAM,CAAC,aAAa,CAAC,IAAI,IAAA,gBAAG,EAAC,MAAM,CAAC,aAAa,CAAC,IAAI,IAAA,gBAAG,EAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5H,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,EAAE,CAAC;QACR,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvC,KAAK,OAAO,CAAC;QACb,KAAK,WAAW,CAAC;QACjB,KAAK,QAAQ;YACX,4EAA4E;YAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrC,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACX,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1G,OAAO;gBACL,SAAS,EAAE,GAAG,SAAS,SAAS;gBAChC,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;aAC/H,CAAC;QACJ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;YAC9G,OAAO;gBACL,SAAS,EAAE,QAAQ;gBACnB,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,IAAA,gBAAG,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,aAAa,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACnK,CAAC;QACJ,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,CAAC,UAAU,CAAC,IAAI,IAAA,gBAAG,EAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;YAC5F,OAAO;gBACL,SAAS,EAAE,iBAAiB;gBAC5B,IAAI;gBACJ,IAAI,EAAE,IAAI,IAAI,EAAE;gBAChB,MAAM,EAAE;oBACN,UAAU,EAAE,MAAM;oBAClB,cAAc,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,cAAc,CAAC,IAAI,IAAA,gBAAG,EAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,MAAM;oBACzF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;oBAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;iBAC9D;aACF,CAAC;QACJ,CAAC;QACD,KAAK,oBAAoB,CAAC;QAC1B,KAAK,oBAAoB;YACvB,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;QAChD;YACE,OAAO,EAAE,MAAM,EAAE,6BAA6B,SAAS,oBAAoB,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAc,EAAE,IAAgB;IAC5D,IAAI,KAAY,CAAC;IACjB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,4BAA4B,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;YAAE,OAAO;QACxF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,EAAE,IAAI,CAAC,4EAA4E,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QAClH,IAAI,MAAM,GAAQ,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC;gBAAE,MAAM,GAAG,CAAC;QAClD,CAAC;QACD,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC;gBACN,EAAE;gBACF,IAAI;gBACJ,QAAQ,EAAE,MAAe;gBACzB,OAAO;gBACP,IAAI,EAAE,IAAA,oBAAO,EAAC;oBACZ,aAAa,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC;oBACpC,gBAAgB,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,qBAAqB,CAAC;oBAC9C,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;oBAC3D,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC;oBAC3E,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC;iBAChC,CAAC;aACH,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAe,EAAE,OAAO,EAAE,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAC3J,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,yBAAyB,IAAI,IAAI,EAAE,gFAAgF,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAwB;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,eAAe,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,CAAC,QAAS,EAAE,aAAa,EAAE,IAAI,CAAC,YAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAClK,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0D,CAAC;IAC3G,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,4BAAc,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,iBAAiB,IAAI,sCAAsC,CAAC,CAAC;IACpK,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC;AAED,mCAAmC;AACnC,KAAK,UAAU,QAAQ,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IACjE,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,IAAwB,CAAC;IAC7B,GAAG,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAClB,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;IAC/B,CAAC,QAAQ,IAAI,EAAE;IACf,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI;SACR,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;SACpC,MAAM,CAAC,kBAAK,CAAC,CAAC;AACnB,CAAC"}

package/dist/migrate/export/ldap.d.ts

@@ -1,53 +0,0 @@
-import { RecordSet } from './record-set';
-/**
- * `atlas migrate ldap export` — a directory's users and groups from an LDIF
- * export (RFC 2849), as the directory's own tools write it:
- *
- *   OpenLDAP      slapcat -n 1 > dir.ldif   (or ldapsearch -LLL … '*' '+')
- *   389 DS        dsctl <instance> db2ldif userroot
- *   PingDirectory export-ldif --backendID userRoot --ldifFile dir.ldif
- *   Oracle / Sun  export-ldif / db2ldif
- *   Active Dir.   ldifde -f dir.ldif -d "dc=corp,dc=example" -p subtree
- *
- * Users keep their password when `userPassword` holds a hash Atlas verifies
- * (`{SSHA*}`, `{PBKDF2-*}`, `{CRYPT}$6$…`, bcrypt, …). Active Directory never
- * exports one (unicodePwd is write-only), and pass-through schemes (`{SASL}`)
- * or DES `{CRYPT}` cannot be checked: those users move with lazy migration
- * (the `ldap` preset binds to the directory on their first sign-in).
- *
- * Groups (groupOfNames, groupOfUniqueNames, posixGroup, AD group) become app
- * roles, or organizations with members (`--set ldap-groups=organizations`).
- */
-export interface LdifEntry {
-    dn: string;
-    /** Lower-cased attribute name (options such as `;binary` dropped) → values. Binary values are base64 strings. */
-    attrs: Map<string, string[]>;
-    /** The line the entry starts on (1-based), for messages. */
-    line: number;
-}
-/**
- * Parse LDIF content records. Change records other than `add` are skipped;
- * comments and folded lines are handled; a malformed line is reported, not fatal.
- */
-export declare function parseLdif(text: string): {
-    entries: LdifEntry[];
-    problems: string[];
-};
-export interface LdapExportOptions {
-    /** `roles` (default) or `organizations`. */
-    groups?: 'roles' | 'organizations' | 'none';
-    /** The attribute used as the user id (default: entryUUID, nsUniqueId, objectGUID, ibm-entryUUID, orclGUID, then the DN). */
-    idAttribute?: string;
-    /** Directory addresses are set by administrators: mark them verified (default false). */
-    trustEmails?: boolean;
-    /** Where the LDIF came from (shown in the dashboard). */
-    origin?: string;
-}
-/** Canonical DN for matching member values (case and spacing around `,`/`=` vary). */
-export declare function normalizeDn(dn: string): string;
-/** AD objectGUID (base64 of the little-endian GUID) → the textual GUID. */
-export declare function guidFromBase64(b64: string): string | undefined;
-/** LDAP GeneralizedTime (`20240102030405Z`, `20240102030405.0Z`, `…+0100`) → ISO-8601. */
-export declare function generalizedTime(v: string | undefined): string | undefined;
-/** Map a parsed LDIF onto canonical records. */
-export declare function mapLdif(entries: LdifEntry[], options?: LdapExportOptions): RecordSet;