@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/zitadel-config.js

@@ -1,279 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.configSnapshotFromExport = configSnapshotFromExport;
-exports.fetchZitadelPolicies = fetchZitadelPolicies;
-exports.fetchZitadelConfig = fetchZitadelConfig;
-exports.translateZitadelConfig = translateZitadelConfig;
-const zitadel_1 = require("./zitadel");
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-const num = (v) => {
-    const n = typeof v === 'number' ? v : typeof v === 'string' && v.trim() ? Number(v) : NaN;
-    return Number.isFinite(n) ? n : undefined;
-};
-const sub = (o, camel) => {
-    const v = (0, zitadel_1.g)(o, camel);
-    return (0, record_set_1.isObj)(v) ? v : undefined;
-};
-const flag = (o, camel) => {
-    const v = (0, zitadel_1.g)(o, camel);
-    return typeof v === 'boolean' ? v : undefined;
-};
-// ── reading ─────────────────────────────────────────────────────────────────
-/** An export document (`{ orgs }`) as a config snapshot; no instance defaults. */
-function configSnapshotFromExport(doc, origin, instance) {
-    const snap = (0, zitadel_1.readZitadelExport)(doc);
-    return { origin, orgs: snap.orgs, idpTemplates: [], defaults: {}, instance };
-}
-/** The instance's default policies, best effort (a narrow role or an old version answers 4xx for some). */
-async function fetchZitadelPolicies(http) {
-    const policy = async (path) => {
-        try {
-            const { body } = await http.get(path);
-            return (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.policy) ? body.policy : undefined;
-        }
-        catch (err) {
-            if (err instanceof vendor_http_1.VendorApiError && err.status > 0 && err.status < 500)
-                return undefined;
-            throw err;
-        }
-    };
-    const factors = async (path) => {
-        try {
-            const { body } = await http.get(path);
-            return (0, record_set_1.isObj)(body) ? (0, record_set_1.strs)(body.result) : undefined;
-        }
-        catch (err) {
-            if (err instanceof vendor_http_1.VendorApiError && err.status > 0 && err.status < 500)
-                return undefined;
-            throw err;
-        }
-    };
-    return {
-        login: await policy('/admin/v1/policies/login'),
-        passwordComplexity: await policy('/admin/v1/policies/password/complexity'),
-        lockout: await policy('/admin/v1/policies/lockout'),
-        secondFactors: await factors('/admin/v1/policies/login/second_factors'),
-        multiFactors: await factors('/admin/v1/policies/login/multi_factors'),
-    };
-}
-/** Read the instance through the Admin API (an IAM_OWNER token): the export WITHOUT secrets, plus the default policies. */
-async function fetchZitadelConfig(o) {
-    const http = (0, zitadel_1.zitadelHttp)(o);
-    const instance = (0, zitadel_1.zitadelBase)(o.instance);
-    const { body } = await http.post('/admin/v1/export', { withPasswords: false, withOtp: false, responseOutput: true });
-    const snap = (0, zitadel_1.readZitadelExport)(body);
-    return { origin: `ZITADEL ${instance.replace(/^https?:\/\//, '')}`, orgs: snap.orgs, idpTemplates: await (0, zitadel_1.fetchIdpTemplates)(http), defaults: await fetchZitadelPolicies(http), instance };
-}
-// ── translation ─────────────────────────────────────────────────────────────
-/** The first organization that overrides a policy, or the instance default; notes when organizations disagree. */
-function pick(snap, camel, fallback) {
-    const found = snap.orgs.map((o) => sub(o, camel)).filter((p) => p !== undefined);
-    const distinct = new Set(found.map((p) => JSON.stringify(p)));
-    return { value: fallback ?? found[0], overridden: fallback ? found.length : distinct.size > 1 ? distinct.size : 0 };
-}
-const SECOND_FACTORS = {
-    SECOND_FACTOR_TYPE_OTP: { atlas: 'totp', label: 'Authenticator apps' },
-    SECOND_FACTOR_TYPE_U2F: { atlas: 'passkey', label: 'Security keys' },
-    SECOND_FACTOR_TYPE_OTP_EMAIL: { atlas: 'emailCode', label: 'Email code' },
-    SECOND_FACTOR_TYPE_OTP_SMS: { atlas: 'sms', label: 'SMS code' },
-};
-function translateZitadelConfig(snap) {
-    const b = new translate_kit_1.ConfigBuilder();
-    const add = (status, area, setting, note, atlas) => b.add(status, area, setting, note, atlas);
-    // ── login policy ──
-    const login = pick(snap, 'loginPolicy', snap.defaults.login);
-    const lp = login.value;
-    if (login.overridden)
-        add('differs', 'login policy', 'loginPolicy', `${login.overridden} organization(s) override the instance login policy; Atlas settings are instance-wide, so the ${snap.defaults.login ? 'instance default' : 'first organization\'s policy'} is used. Check the others by hand.`);
-    if (lp) {
-        if (flag(lp, 'allowRegister') !== undefined) {
-            const open = flag(lp, 'allowRegister') === true;
-            b.set('signUpMode', open ? 'public' : 'restricted');
-            add('mapped', 'login policy', 'loginPolicy.allowRegister', open ? 'Public sign-up.' : 'Sign-up closed (invitations and the allowlist still work).', 'auth_config.signUpMode');
-        }
-        if (flag(lp, 'allowUsernamePassword') !== undefined) {
-            const on = flag(lp, 'allowUsernamePassword') === true;
-            b.set('strategies.password', on);
-            add('mapped', 'login policy', 'loginPolicy.allowUsernamePassword', on ? 'Password sign-in on.' : 'Password sign-in off.', 'auth_config.strategies.password');
-        }
-        if (flag(lp, 'allowExternalIdp') === false)
-            add('differs', 'login policy', 'loginPolicy.allowExternalIdp', 'External sign-in is off in ZITADEL: leave the social providers below disabled in Atlas.');
-        if ((0, record_set_1.str)((0, zitadel_1.g)(lp, 'passwordlessType')) === 'PASSWORDLESS_TYPE_ALLOWED') {
-            b.set('strategies.passkey', true);
-            add('mapped', 'login policy', 'loginPolicy.passwordlessType', 'Passwordless (passkey) sign-in on.', 'auth_config.strategies.passkey');
-        }
-        if (flag(lp, 'forceMfa') === true) {
-            b.set('mfaPolicy', 'required');
-            add(flag(lp, 'forceMfaLocalOnly') === true ? 'differs' : 'mapped', 'login policy', 'loginPolicy.forceMfa', flag(lp, 'forceMfaLocalOnly') === true ? 'MFA is required for every user in Atlas; ZITADEL required it only for password sign-ins (forceMfaLocalOnly).' : 'MFA always required.', 'auth_config.mfaPolicy');
-        }
-        if (flag(lp, 'hidePasswordReset') === true)
-            add('differs', 'login policy', 'loginPolicy.hidePasswordReset', 'Atlas shows "Forgot password?" whenever password sign-in is on.');
-        if (flag(lp, 'ignoreUnknownUsernames') === true)
-            add('mapped', 'login policy', 'loginPolicy.ignoreUnknownUsernames', 'Atlas answers uniformly for unknown users.');
-        const redirect = (0, record_set_1.str)((0, zitadel_1.g)(lp, 'defaultRedirectUri'));
-        if (redirect) {
-            b.push('redirect_urls', { url: redirect });
-            add('mapped', 'login policy', 'loginPolicy.defaultRedirectUri', 'Becomes a redirect URL.', 'redirect_urls');
-        }
-        for (const field of ['passwordCheckLifetime', 'externalLoginCheckLifetime', 'secondFactorCheckLifetime', 'multiFactorCheckLifetime', 'mfaInitSkipLifetime']) {
-            if ((0, zitadel_1.g)(lp, field) !== undefined)
-                add('differs', 'login policy', `loginPolicy.${field}`, `ZITADEL re-checks this factor after ${String((0, zitadel_1.g)(lp, field))}; Atlas sessions have one lifetime (auth_config.session) and sensitive actions use step-up (auth_config.stepUp).`, 'auth_config.stepUp');
-        }
-    }
-    const second = snap.defaults.secondFactors ?? [...new Set(snap.orgs.flatMap((o) => (0, record_set_1.strs)((0, zitadel_1.g)(o, 'secondFactors'))))];
-    const multi = snap.defaults.multiFactors ?? [...new Set(snap.orgs.flatMap((o) => (0, record_set_1.strs)((0, zitadel_1.g)(o, 'multiFactors'))))];
-    for (const f of second) {
-        const known = SECOND_FACTORS[f];
-        if (!known) {
-            add('manual', 'login policy', `secondFactors ${f}`, 'No Atlas counterpart.');
-            continue;
-        }
-        b.set(`mfa.factors.${known.atlas}`, true);
-        add('mapped', 'login policy', `secondFactors ${f}`, `${known.label} second factor.${known.atlas === 'totp' ? ' Seeds move with the export (`withOtp`).' : known.atlas === 'passkey' ? ' ZITADEL does not export security keys: users register again.' : ''}`, `auth_config.mfa.factors.${known.atlas}`);
-    }
-    if (multi.includes('MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION')) {
-        b.set('mfa.factors.passkey', true);
-        add('mapped', 'login policy', 'multiFactors MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION', 'Passkeys with user verification.', 'auth_config.mfa.factors.passkey');
-    }
-    // ── password complexity, lockout ──
-    const complexity = pick(snap, 'passwordComplexityPolicy', snap.defaults.passwordComplexity);
-    const pc = complexity.value;
-    if (complexity.overridden)
-        add('differs', 'password policy', 'passwordComplexityPolicy', `${complexity.overridden} organization(s) override the password policy; Atlas has one instance-wide policy.`);
-    if (pc) {
-        const min = num((0, zitadel_1.g)(pc, 'minLength'));
-        if (min !== undefined) {
-            b.set('passwordPolicy.minLength', Math.max(min, 6));
-            add('mapped', 'password policy', 'passwordComplexityPolicy.minLength', `Minimum ${min} characters.`, 'auth_config.passwordPolicy.minLength');
-        }
-        for (const [field, key, label] of [['hasUppercase', 'requireUppercase', 'an uppercase letter'], ['hasLowercase', 'requireLowercase', 'a lowercase letter'], ['hasNumber', 'requireNumber', 'a digit'], ['hasSymbol', 'requireSymbol', 'a symbol']]) {
-            if (flag(pc, field) === true) {
-                b.set(`passwordPolicy.${key}`, true);
-                add('mapped', 'password policy', `passwordComplexityPolicy.${field}`, `Requires ${label}.`, `auth_config.passwordPolicy.${key}`);
-            }
-        }
-    }
-    const lock = pick(snap, 'lockoutPolicy', snap.defaults.lockout).value;
-    if (lock) {
-        if (num((0, zitadel_1.g)(lock, 'maxPasswordAttempts')))
-            add('differs', 'lockout', 'lockoutPolicy.maxPasswordAttempts', `ZITADEL locks an account after ${String((0, zitadel_1.g)(lock, 'maxPasswordAttempts'))} failed passwords; Atlas throttles failed sign-ins per account and per IP with its own thresholds.`);
-        if (num((0, zitadel_1.g)(lock, 'maxOtpAttempts')))
-            add('differs', 'lockout', 'lockoutPolicy.maxOtpAttempts', 'Atlas limits second-factor attempts with its own thresholds.');
-    }
-    const domain = pick(snap, 'domainPolicy', undefined).value;
-    if (flag(domain, 'userLoginMustBeDomain') === true)
-        add('differs', 'login policy', 'domainPolicy.userLoginMustBeDomain', 'ZITADEL login names carried the organization domain (user@org.domain); Atlas users sign in with their email address or username (kept from the export).');
-    const privacy = pick(snap, 'privacyPolicy', undefined).value;
-    if (privacy)
-        add('manual', 'privacy policy', 'privacyPolicy', `Terms of service, privacy and help links (${[(0, record_set_1.str)((0, zitadel_1.g)(privacy, 'tosLink')), (0, record_set_1.str)((0, zitadel_1.g)(privacy, 'privacyLink')), (0, record_set_1.str)((0, zitadel_1.g)(privacy, 'helpLink'))].filter(Boolean).join(', ') || 'none set'}): publish them as Atlas policies and turn on policy acceptance.`);
-    if (pick(snap, 'labelPolicy', undefined).value)
-        add('manual', 'branding', 'labelPolicy', 'Colors, logo, icon and font: recreate them in the Atlas branding designer (per organization when needed). Custom login texts are rewritten in Atlas\'s localization.');
-    // ── projects, roles, applications ──
-    const roles = new Map();
-    let roleAssertions = 0;
-    const redirects = new Set();
-    const origins = new Set();
-    for (const org of snap.orgs) {
-        for (const r of (0, record_set_1.objs)((0, zitadel_1.g)(org, 'projectRoles'))) {
-            const key = (0, record_set_1.str)((0, zitadel_1.g)(r, 'roleKey'));
-            if (key && !roles.has(key))
-                roles.set(key, r);
-        }
-        for (const p of (0, record_set_1.objs)((0, zitadel_1.g)(org, 'projects'))) {
-            if (flag(sub(p, 'project'), 'projectRoleAssertion') === true)
-                roleAssertions++;
-        }
-        for (const a of (0, record_set_1.objs)((0, zitadel_1.g)(org, 'oidcApps'))) {
-            const app = sub(a, 'app') ?? a;
-            const name = (0, record_set_1.str)((0, zitadel_1.g)(app, 'name')) ?? (0, record_set_1.str)((0, zitadel_1.g)(a, 'appId')) ?? 'application';
-            for (const u of [...(0, record_set_1.strs)((0, zitadel_1.g)(app, 'redirectUris')), ...(0, record_set_1.strs)((0, zitadel_1.g)(app, 'postLogoutRedirectUris'))])
-                redirects.add(u);
-            for (const o of (0, record_set_1.strs)((0, zitadel_1.g)(app, 'additionalOrigins')))
-                origins.add(o);
-            const type = (0, record_set_1.str)((0, zitadel_1.g)(app, 'appType'));
-            if (type === 'OIDC_APP_TYPE_NATIVE')
-                add('manual', `applications ${name}`, 'appType NATIVE', 'A native app: register its bundle id / package name under auth_config.nativeApps and use the Atlas native SDK.', 'auth_config.nativeApps');
-            if ((0, record_set_1.strs)((0, zitadel_1.g)(app, 'grantTypes')).includes('OIDC_GRANT_TYPE_CLIENT_CREDENTIALS'))
-                add('manual', `applications ${name}`, 'grantTypes client_credentials', 'A service application: create an Atlas M2M client for it.', 'oauth_clients');
-            if ((0, record_set_1.str)((0, zitadel_1.g)(app, 'authMethodType')) === 'OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT')
-                add('manual', `applications ${name}`, 'authMethodType private_key_jwt', 'Client authentication with a signed JWT: register the application\'s public key in Atlas.');
-        }
-        for (const a of (0, record_set_1.objs)((0, zitadel_1.g)(org, 'apiApps')))
-            add('manual', `applications ${(0, record_set_1.str)((0, zitadel_1.g)(sub(a, 'app') ?? a, 'name')) ?? 'api'}`, 'API application', 'A ZITADEL API application (token introspection / JWT profile): register the API as a resource server in Atlas and verify Atlas tokens with the instance JWKS.', 'resource_servers');
-        for (const action of (0, record_set_1.objs)((0, zitadel_1.g)(org, 'actions'))) {
-            const name = (0, record_set_1.str)((0, zitadel_1.g)(sub(action, 'action') ?? action, 'name')) ?? (0, record_set_1.str)((0, zitadel_1.g)(action, 'actionId')) ?? 'action';
-            add('manual', 'actions', `action ${name}`, 'A ZITADEL Action (script on a flow trigger): rebuild it as an Atlas Action or webhook.');
-        }
-    }
-    let exact = 0;
-    for (const url of redirects) {
-        if (url.includes('*')) {
-            add('differs', 'applications', `redirectUris ${url}`, 'Atlas redirect URLs are exact (no wildcards); list each URL.', 'redirect_urls');
-            continue;
-        }
-        b.push('redirect_urls', { url });
-        exact++;
-    }
-    if (exact)
-        add('mapped', 'applications', 'oidcApps redirectUris', `${exact} redirect / post-logout URL(s) become redirect URLs.`, 'redirect_urls');
-    if (origins.size) {
-        b.instance.allowed_origins = [...origins].filter((o) => !o.includes('*'));
-        add('mapped', 'applications', 'additionalOrigins', 'Allowed origins for the browser SDK.', 'instance.allowed_origins');
-    }
-    for (const [key, r] of roles) {
-        b.push('roles', { key: (0, translate_kit_1.keyOf)(key), name: (0, record_set_1.str)((0, zitadel_1.g)(r, 'displayName')) ?? key, description: (0, record_set_1.str)((0, zitadel_1.g)(r, 'group')) ?? '', permissions: [] });
-        if ((0, translate_kit_1.keyOf)(key) !== key)
-            b.roles[key] = (0, translate_kit_1.keyOf)(key);
-    }
-    if (roles.size)
-        add('mapped', 'projects', 'projectRoles', `${roles.size} project role(s) become app roles; user grants move with the data export. Roles of different projects share one namespace in Atlas.`, 'roles');
-    if (roleAssertions)
-        add('manual', 'projects', 'projectRoleAssertion', 'ZITADEL put roles in the urn:zitadel:iam:org:project:roles claim: add the roles claim your apps read as an Atlas JWT template / session claim.', 'jwt_templates');
-    // ── identity providers ──
-    for (const idp of (0, zitadel_1.collectIdps)({ orgs: snap.orgs, idpTemplates: snap.idpTemplates, source: 'api' }).values()) {
-        const where = `identity provider ${idp.name}`;
-        const social = (0, translate_kit_1.socialKey)(idp.kind);
-        const clientId = (0, record_set_1.str)((0, zitadel_1.g)(idp.config, 'clientId'));
-        if (social) {
-            b.socialProvider({ atlasKey: social, vendorName: social, area: 'identity providers', setting: where, clientId, scopes: (0, record_set_1.strs)((0, zitadel_1.g)(idp.config, 'scopes')).length ? (0, record_set_1.strs)((0, zitadel_1.g)(idp.config, 'scopes')) : undefined });
-        }
-        else if (idp.kind === 'oidc') {
-            const providerKey = (0, translate_kit_1.keyOf)(idp.name).replace(/:/g, '_').slice(0, 48) || 'oidc';
-            const upper = providerKey.toUpperCase();
-            const issuer = (0, record_set_1.str)((0, zitadel_1.g)(idp.config, 'issuer'));
-            const doc = {
-                provider_key: providerKey,
-                display_name: idp.name,
-                protocol: 'oidc',
-                client_id: clientId ?? b.placeholder(`${upper}_CLIENT_ID`, `${idp.name} client id`),
-                client_secret: b.placeholder(`${upper}_CLIENT_SECRET`, `${idp.name} client secret`),
-                enabled: true,
-                allow_sign_in: true,
-                allow_sign_up: true,
-            };
-            if (issuer) {
-                doc.issuer = issuer;
-                doc.discovery_url = `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`;
-            }
-            if ((0, record_set_1.strs)((0, zitadel_1.g)(idp.config, 'scopes')).length)
-                doc.scopes = (0, record_set_1.strs)((0, zitadel_1.g)(idp.config, 'scopes'));
-            b.push('custom_oauth_providers', doc);
-            b.providers[idp.name] = providerKey;
-            add('differs', 'identity providers', where, `Generic OIDC provider "${idp.name}"${issuer ? ` (issuer ${issuer})` : ''} moves with the data export as an SSO connection when it serves an organization, and as the custom OIDC provider "${providerKey}" for sign-in. Add Atlas's redirect URI at the provider and set ${upper}_CLIENT_SECRET.`, `custom_oauth_providers ${providerKey}`);
-        }
-        else if (idp.kind === 'saml') {
-            add('mapped', 'identity providers', where, 'SAML provider: moves with the data export as an SSO connection. Give the IdP Atlas\'s ACS URL and entity id before turning it on.', 'sso_connections');
-        }
-        else {
-            add('manual', 'identity providers', where, `A ${idp.kind} identity provider has no built-in Atlas provider: add it as a custom OAuth provider, or let those users sign in with email.`, 'custom_oauth_providers');
-        }
-    }
-    const vars = snap.instance ? { issuer: snap.instance } : {};
-    return b.result(snap.origin, {
-        bridge: { preset: 'zitadel', vars },
-        ...(snap.instance ? { lazy: { preset: 'zitadel', config: { base_url: snap.instance } } } : {}),
-    });
-}
-//# sourceMappingURL=zitadel-config.js.map

package/dist/migrate/export/zitadel-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"zitadel-config.js","sourceRoot":"","sources":["../../../src/migrate/export/zitadel-config.ts"],"names":[],"mappings":";;AAoDA,4DAGC;AAGD,oDA0BC;AAGD,gDAMC;AAkBD,wDA8KC;AA3RD,uCAAmI;AACnI,6CAAgE;AAChE,mDAAkE;AAClE,+CAA2D;AA+B3D,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE;IAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1F,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC,CAAC;AACF,MAAM,GAAG,GAAG,CAAC,CAAkB,EAAE,KAAa,EAAmB,EAAE;IACjE,MAAM,CAAC,GAAG,IAAA,WAAC,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,OAAO,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClC,CAAC,CAAC;AACF,MAAM,IAAI,GAAG,CAAC,CAAkB,EAAE,KAAa,EAAuB,EAAE;IACtE,MAAM,CAAC,GAAG,IAAA,WAAC,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC,CAAC;AAEF,+EAA+E;AAE/E,kFAAkF;AAClF,SAAgB,wBAAwB,CAAC,GAAY,EAAE,MAAc,EAAE,QAAiB;IACtF,MAAM,IAAI,GAAG,IAAA,2BAAiB,EAAC,GAAG,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC/E,CAAC;AAED,2GAA2G;AACpG,KAAK,UAAU,oBAAoB,CAAC,IAAgB;IACzD,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAA4B,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;YAC/C,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAAc,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC1F,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAiC,EAAE;QACpE,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;YAC/C,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAAc,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC1F,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,MAAM,MAAM,CAAC,0BAA0B,CAAC;QAC/C,kBAAkB,EAAE,MAAM,MAAM,CAAC,wCAAwC,CAAC;QAC1E,OAAO,EAAE,MAAM,MAAM,CAAC,4BAA4B,CAAC;QACnD,aAAa,EAAE,MAAM,OAAO,CAAC,yCAAyC,CAAC;QACvE,YAAY,EAAE,MAAM,OAAO,CAAC,wCAAwC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,2HAA2H;AACpH,KAAK,UAAU,kBAAkB,CAAC,CAAwE;IAC/G,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAU,kBAAkB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9H,MAAM,IAAI,GAAG,IAAA,2BAAiB,EAAC,IAAI,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,IAAA,2BAAiB,EAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC3L,CAAC;AAED,+EAA+E;AAE/E,kHAAkH;AAClH,SAAS,IAAI,CAAC,IAA2B,EAAE,KAAa,EAAE,QAAyB;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtH,CAAC;AAED,MAAM,cAAc,GAAqD;IACvE,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACtE,sBAAsB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE;IACpE,4BAA4B,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE;IACzE,0BAA0B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE;CAChE,CAAC;AAEF,SAAgB,sBAAsB,CAAC,IAA2B;IAChE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,MAAuC,EAAE,IAAY,EAAE,OAAe,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAEhK,qBAAqB;IACrB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC;IACvB,IAAI,KAAK,CAAC,UAAU;QAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,iGAAiG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,8BAA8B,qCAAqC,CAAC,CAAC;IACxS,IAAI,EAAE,EAAE,CAAC;QACP,IAAI,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,KAAK,IAAI,CAAC;YAChD,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACpD,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,2BAA2B,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,4DAA4D,EAAE,wBAAwB,CAAC,CAAC;QAChL,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,uBAAuB,CAAC,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,uBAAuB,CAAC,KAAK,IAAI,CAAC;YACtD,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;YACjC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,mCAAmC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,uBAAuB,EAAE,iCAAiC,CAAC,CAAC;QAC/J,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC,KAAK,KAAK;YAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,8BAA8B,EAAE,yFAAyF,CAAC,CAAC;QACtM,IAAI,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC,KAAK,2BAA2B,EAAE,CAAC;YACnE,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAClC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,gCAAgC,CAAC,CAAC;QACxI,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,8GAA8G,CAAC,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;QACxT,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,+BAA+B,EAAE,iEAAiE,CAAC,CAAC;QAC/K,IAAI,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,oCAAoC,EAAE,4CAA4C,CAAC,CAAC;QACnK,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,eAAe,CAAC,CAAC;QAC9G,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,uBAAuB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,qBAAqB,CAAC,EAAE,CAAC;YAC5J,IAAI,IAAA,WAAC,EAAC,EAAE,EAAE,KAAK,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,eAAe,KAAK,EAAE,EAAE,uCAAuC,MAAM,CAAC,IAAA,WAAC,EAAC,EAAE,EAAE,KAAK,CAAC,CAAC,kHAAkH,EAAE,oBAAoB,CAAC,CAAC;QAC9R,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,iBAAiB,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,iBAAiB,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,kBAAkB,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,2BAA2B,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1S,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;QAC9D,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,sDAAsD,EAAE,kCAAkC,EAAE,iCAAiC,CAAC,CAAC;IAC/J,CAAC;IAED,qCAAqC;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC5F,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC;IAC5B,IAAI,UAAU,CAAC,UAAU;QAAE,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,GAAG,UAAU,CAAC,UAAU,oFAAoF,CAAC,CAAC;IACvM,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,GAAG,GAAG,GAAG,CAAC,IAAA,WAAC,EAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACpD,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,oCAAoC,EAAE,WAAW,GAAG,cAAc,EAAE,sCAAsC,CAAC,CAAC;QAC/I,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,kBAAkB,EAAE,qBAAqB,CAAC,EAAE,CAAC,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,EAAE,CAAC,WAAW,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,CAAC,CAAU,EAAE,CAAC;YAC5P,IAAI,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7B,CAAC,CAAC,GAAG,CAAC,kBAAkB,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;gBACrC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,4BAA4B,KAAK,EAAE,EAAE,YAAY,KAAK,GAAG,EAAE,8BAA8B,GAAG,EAAE,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;IACtE,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,GAAG,CAAC,IAAA,WAAC,EAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,mCAAmC,EAAE,kCAAkC,MAAM,CAAC,IAAA,WAAC,EAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,oGAAoG,CAAC,CAAC;QACtR,IAAI,GAAG,CAAC,IAAA,WAAC,EAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,8BAA8B,EAAE,8DAA8D,CAAC,CAAC;IAChK,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,oCAAoC,EAAE,yJAAyJ,CAAC,CAAC;IACpR,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC;IAC7D,IAAI,OAAO;QAAE,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,eAAe,EAAE,6CAA6C,CAAC,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,kEAAkE,CAAC,CAAC;IACjT,IAAI,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,KAAK;QAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,sKAAsK,CAAC,CAAC;IAEjQ,sCAAsC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAe,CAAC;IACrC,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YACjC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,sBAAsB,CAAC,KAAK,IAAI;gBAAE,cAAc,EAAE,CAAC;QACjF,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,aAAa,CAAC;YACxE,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/G,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YACpC,IAAI,IAAI,KAAK,sBAAsB;gBAAE,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,gBAAgB,EAAE,gHAAgH,EAAE,wBAAwB,CAAC,CAAC;YACzO,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;gBAAE,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,+BAA+B,EAAE,2DAA2D,EAAE,eAAe,CAAC,CAAC;YACpO,IAAI,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,KAAK,uCAAuC;gBAAE,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,gCAAgC,EAAE,2FAA2F,CAAC,CAAC;QACtP,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,KAAK,EAAE,EAAE,iBAAiB,EAAE,+JAA+J,EAAE,kBAAkB,CAAC,CAAC;QAC9T,KAAK,MAAM,MAAM,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,QAAQ,CAAC;YACvG,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,wFAAwF,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,GAAG,EAAE,EAAE,8DAA8D,EAAE,eAAe,CAAC,CAAC;YACvI,SAAS;QACX,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,KAAK;QAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,uBAAuB,EAAE,GAAG,KAAK,sDAAsD,EAAE,eAAe,CAAC,CAAC;IACnJ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,eAAe,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC;IACzH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAA,qBAAK,EAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,aAAa,CAAC,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;QAC5I,IAAI,IAAA,qBAAK,EAAC,GAAG,CAAC,KAAK,GAAG;YAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI;QAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,IAAI,qIAAqI,EAAE,OAAO,CAAC,CAAC;IACvN,IAAI,cAAc;QAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,sBAAsB,EAAE,gJAAgJ,EAAE,eAAe,CAAC,CAAC;IAEzO,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5G,MAAM,KAAK,GAAG,qBAAqB,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7M,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,IAAA,qBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;YAC9E,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAyB;gBAChC,YAAY,EAAE,WAAW;gBACzB,YAAY,EAAE,GAAG,CAAC,IAAI;gBACtB,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,YAAY,EAAE,GAAG,GAAG,CAAC,IAAI,YAAY,CAAC;gBACnF,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,gBAAgB,EAAE,GAAG,GAAG,CAAC,IAAI,gBAAgB,CAAC;gBACnF,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,IAAI;gBACnB,aAAa,EAAE,IAAI;aACpB,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;gBACpB,GAAG,CAAC,aAAa,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC;YACvF,CAAC;YACD,IAAI,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM;gBAAE,GAAG,CAAC,MAAM,GAAG,IAAA,iBAAI,EAAC,IAAA,WAAC,EAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrF,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;YACpC,GAAG,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,0BAA0B,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,YAAY,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,qHAAqH,WAAW,mEAAmE,KAAK,iBAAiB,EAAE,0BAA0B,WAAW,EAAE,CAAC,CAAC;QAC3X,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/B,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,mIAAmI,EAAE,iBAAiB,CAAC,CAAC;QACrM,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,IAAI,8HAA8H,EAAE,wBAAwB,CAAC,CAAC;QACpN,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAA2B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;QAC3B,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/zitadel.d.ts

@@ -1,82 +0,0 @@
-import type { PasswordHash } from '@atlasauth/migrate';
-import { RecordSet, type Obj } from './record-set';
-import { VendorHttp } from './vendor-http';
-/**
- * `atlas migrate export zitadel` — a ZITADEL instance (ZITADEL Cloud or
- * self-hosted) onto the canonical bundle models. Two ways in, both on the
- * owner's machine, and both read ZITADEL's own EXPORT document (the
- * `ImportData` the `zitadel export` command and `POST /admin/v1/export` write,
- * with `withPasswords` / `withOtp` on):
- *
- *   - the FILE a `zitadel export` run (or a saved admin export response) wrote;
- *   - the ADMIN API, `POST /admin/v1/export` with a service-user token that has
- *     the IAM_OWNER role. When the export endpoint is refused or missing (older
- *     versions, a user that is only IAM_OWNER_VIEWER) the exporter falls back to
- *     listing users with the v2 user API: profile, email and phone, but no
- *     password hashes, TOTP seeds or social links.
- *
- * The export carries, per organization: the human users with their hashed
- * password (the exact `$2a$…`, `$argon2id$…`, `$scrypt$…`, `$pbkdf2-…` string
- * ZITADEL verifies), TOTP secret, social-login links, profile, verified email
- * and phone; project roles and user grants; organization members and domains;
- * identity providers. The ZITADEL user id is the `sub` of every ZITADEL token,
- * so it is the user id here.
- *
- * Not exportable: passkeys and U2F keys (ZITADEL keeps them only in its event
- * store), machine users' keys, and live sessions (ZITADEL sessions are opaque;
- * the bridge accepts ID tokens and JWT access tokens instead).
- *
- * Schemas: github.com/zitadel/zitadel proto/zitadel/admin.proto
- * (`ImportDataOrg`, `ExportDataRequest`) and management.proto
- * (`ImportHumanUserRequest`).
- */
-export interface ZitadelSnapshot {
-    /** `ImportDataOrg` objects (camelCase from the API, either case from a file). */
-    orgs: Obj[];
-    /** Identity provider templates (`POST /admin/v1/idps/templates/_search`), to type the links an export names only by id. */
-    idpTemplates: Obj[];
-    source: 'file' | 'api' | 'users';
-    /** The instance URL (`https://acme-abc123.zitadel.cloud`), when known. */
-    instance?: string;
-}
-export interface ZitadelMapOptions {
-    /** Organizations become Atlas organizations: `all`, `skip`, or `auto` (when the instance has more than one). */
-    orgs?: 'auto' | 'all' | 'skip';
-}
-/** A field by its camelCase name, falling back to snake_case (the files `zitadel export` writes use either). */
-export declare function g(o: Obj | undefined, camel: string): unknown;
-/** The orgs in an export document: `{ orgs: [...] }`, a bare array, or one org object. */
-export declare function readZitadelExport(doc: unknown): ZitadelSnapshot;
-/**
- * A ZITADEL `hashedPassword` ({ value, algorithm }) as a bundle password; null
- * when Atlas cannot verify it. ZITADEL stores the self-describing encoding its
- * hasher (passwap) verifies, so those are recognised by Atlas on their own
- * ("auto"); the one bare form (a hex MD5) is mapped by the algorithm hint.
- */
-export declare function zitadelPassword(hashed: unknown): PasswordHash | null;
-export interface Idp {
-    id: string;
-    name: string;
-    /** `google`, `github`, `oidc`, `saml`, `jwt`, `ldap` … */
-    kind: string;
-    config: Obj;
-}
-/** The identity providers an export names, keyed by config id; templates from the API fill gaps. */
-export declare function collectIdps(snap: ZitadelSnapshot): Map<string, Idp>;
-export declare function mapZitadel(snap: ZitadelSnapshot, opts?: ZitadelMapOptions): RecordSet;
-export interface ZitadelApiOptions {
-    /** `https://acme-abc123.zitadel.cloud` or your own domain; a bare host gets https. */
-    instance: string;
-    /** A service user's personal access token (IAM_OWNER, or IAM_OWNER_VIEWER for the no-secrets fallback). */
-    token: string;
-    pageSize?: number;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-export declare function zitadelBase(raw: string): string;
-export declare function zitadelHttp(o: Pick<ZitadelApiOptions, 'instance' | 'token' | 'fetchImpl' | 'sleep'>): VendorHttp;
-/** Identity provider templates, to type the links; best effort (an older instance or a narrow role answers 4xx). */
-export declare function fetchIdpTemplates(http: VendorHttp): Promise<Obj[]>;
-export declare function fetchZitadel(o: ZitadelApiOptions): Promise<ZitadelSnapshot>;
-export declare function exportZitadelApi(o: ZitadelApiOptions & ZitadelMapOptions): Promise<RecordSet>;