@atlasauth/cli 0.25.0 → 0.25.1

package/dist/migrate/export/appwrite.js

@@ -0,0 +1,288 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APPWRITE_CLOUD = void 0;
+exports.exportAppwrite = exportAppwrite;
+exports.appwriteTeamRole = appwriteTeamRole;
+exports.appwritePasswordHash = appwritePasswordHash;
+exports.appwriteQuery = appwriteQuery;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+exports.APPWRITE_CLOUD = 'https://cloud.appwrite.io/v1';
+const PAGE = 100;
+async function exportAppwrite(opts) {
+    const set = new record_set_1.RecordSet();
+    const endpoint = (opts.endpoint ?? exports.APPWRITE_CLOUD).replace(/\/+$/, '');
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'Appwrite',
+        baseUrl: endpoint,
+        headers: { 'x-appwrite-project': opts.projectId, 'x-appwrite-key': opts.apiKey },
+        fetchImpl: opts.fetchImpl,
+        sleep: opts.sleep,
+    });
+    const progress = opts.onProgress ?? (() => undefined);
+    progress('users');
+    const users = await listAll(http, '/users', 'users');
+    const ids = new Set();
+    const labels = new Set();
+    let shaGuessed = 0;
+    for (const u of users) {
+        const id = (0, record_set_1.str)(u.$id);
+        if (!id)
+            continue;
+        ids.add(id);
+        const user = mapUser(u);
+        const pw = appwritePasswordHash(u);
+        if (pw.hash)
+            user.password = pw.hash;
+        if (pw.guessed)
+            shaGuessed++;
+        if (pw.problem)
+            set.warn(pw.problem);
+        for (const l of user.roles ?? [])
+            labels.add(l);
+        set.add('user', (0, record_set_1.compact)(user));
+    }
+    for (const l of [...labels].sort())
+        set.add('role', { key: l, name: l, scope: 'app' }, `app:${l}`);
+    if (shaGuessed) {
+        set.warn(`${shaGuessed} SHA hash(es) were imported without a version: Appwrite 1.x checks those as SHA3-512 and 2.x as SHA-256. The export picked by digest length; a user whose hash still fails signs in through lazy migration or a reset.`);
+    }
+    progress('identities');
+    try {
+        for (const i of await listAll(http, '/users/identities', 'identities')) {
+            const userId = (0, record_set_1.str)(i.userId);
+            const provider = (0, record_set_1.str)(i.provider);
+            const providerUid = (0, record_set_1.str)(i.providerUid);
+            if (!userId || !provider || !providerUid || !ids.has(userId))
+                continue;
+            set.add('identity', (0, record_set_1.compact)({ id: (0, record_set_1.str)(i.$id), user_id: userId, provider, provider_user_id: providerUid, kind: 'oauth', email: (0, record_set_1.str)(i.providerEmail)?.toLowerCase() }), `${provider}:${providerUid}`);
+        }
+    }
+    catch (err) {
+        // `GET /users/identities` exists from 1.5; older servers only list per user.
+        if (!(err instanceof vendor_http_1.VendorApiError && [404, 400].includes(err.status)))
+            throw err;
+        set.warn('This Appwrite server has no identities listing (before 1.5): OAuth links are not exported; users relink by email on first social sign-in.');
+    }
+    progress('two-factor');
+    let totp = 0;
+    for (const u of users) {
+        const id = (0, record_set_1.str)(u.$id);
+        if (!id || u.mfa !== true)
+            continue;
+        const factors = await optionalGet(http, `/users/${id}/mfa/factors`);
+        if (!factors)
+            continue;
+        if (factors.totp === true)
+            totp++;
+        const phone = (0, record_set_1.e164)(u.phone);
+        if (factors.phone === true && phone)
+            set.add('mfa_factor', { user_id: id, type: 'phone', phone, verified: u.phoneVerification === true });
+        if (factors.email === true && (0, record_set_1.str)(u.email))
+            set.add('mfa_factor', { user_id: id, type: 'email', verified: u.emailVerification === true });
+        if (factors.recoveryCode === true && opts.recoveryCodes) {
+            const codes = await optionalGet(http, `/users/${id}/mfa/recovery-codes`);
+            const list = (0, record_set_1.strs)(codes?.recoveryCodes);
+            if (list.length)
+                set.add('mfa_factor', { user_id: id, type: 'backup_codes', backup_codes: list, verified: true });
+        }
+    }
+    if (totp)
+        set.omit('mfa_factor', 'Appwrite keeps TOTP secrets encrypted with no API to read them: those users enrol an authenticator app again', totp);
+    if (!opts.recoveryCodes && users.some((u) => u.mfa === true)) {
+        set.warn('Recovery codes were not read: pass --set appwrite-recovery-codes=true (the API key needs users.read, or users.write on Appwrite 2.x).');
+    }
+    if (!opts.skipTeams) {
+        progress('teams');
+        const teams = await optionalList(http, '/teams', 'teams');
+        const orgRoles = new Set();
+        for (const t of teams) {
+            const teamId = (0, record_set_1.str)(t.$id);
+            const name = (0, record_set_1.str)(t.name);
+            if (!teamId || !name)
+                continue;
+            set.add('organization', (0, record_set_1.compact)({ id: teamId, name, public_metadata: (0, record_set_1.bag)(t.prefs), created_at: (0, record_set_1.str)(t.$createdAt) }));
+            for (const m of await optionalList(http, `/teams/${teamId}/memberships`, 'memberships')) {
+                const role = appwriteTeamRole((0, record_set_1.strs)(m.roles));
+                orgRoles.add(role);
+                const userId = (0, record_set_1.str)(m.userId);
+                if (m.confirm === true && userId && ids.has(userId)) {
+                    set.add('membership', (0, record_set_1.compact)({ id: (0, record_set_1.str)(m.$id), organization_id: teamId, user_id: userId, role, created_at: (0, record_set_1.str)(m.joined) ?? (0, record_set_1.str)(m.$createdAt) }), `${teamId}:${userId}`);
+                }
+                else if (m.confirm !== true) {
+                    const email = (0, record_set_1.str)(m.userEmail);
+                    const id = (0, record_set_1.str)(m.$id);
+                    if (!email || !id) {
+                        set.omit('invitation', 'unconfirmed membership whose email is hidden by the project\'s membership privacy settings');
+                        continue;
+                    }
+                    set.add('invitation', (0, record_set_1.compact)({ id, organization_id: teamId, email: email.toLowerCase(), role, status: 'pending', created_at: (0, record_set_1.str)(m.invited) }));
+                }
+            }
+        }
+        for (const r of [...orgRoles].sort())
+            if (r !== 'admin' && r !== 'member')
+                set.add('role', { key: r, name: r, scope: 'organization' }, `org:${r}`);
+    }
+    const providers = new Set(set.list('identity').map((i) => i.provider));
+    set.manifest = { ...set.manifest, origin: `${endpoint} project ${opts.projectId}`, providers: [...providers].sort() };
+    set.warn('Appwrite sessions are stored as hashes and cannot be exported: enable the appwrite bridge preset so signed-in users move without a new sign-in.');
+    return set;
+}
+// ── users ───────────────────────────────────────────────────────────────────
+function mapUser(u) {
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(u.phone);
+    const labels = (0, record_set_1.strs)(u.labels).map(translate_kit_1.keyOf);
+    const user = {
+        id: (0, record_set_1.str)(u.$id),
+        emails: email ? [{ email, verified: u.emailVerification === true, primary: true }] : undefined,
+        phones: phone ? [{ phone, verified: u.phoneVerification === true, primary: !email }] : undefined,
+        name: (0, record_set_1.str)(u.name),
+        roles: labels.length ? labels : undefined,
+        banned: u.status === false ? true : undefined,
+        public_metadata: (0, record_set_1.bag)(u.prefs),
+        created_at: (0, record_set_1.str)(u.registration) ?? (0, record_set_1.str)(u.$createdAt),
+        last_sign_in_at: (0, record_set_1.str)(u.accessedAt),
+    };
+    if (!email && !phone)
+        user.anonymous = true;
+    return user;
+}
+/** Appwrite team roles → one Atlas membership role: `owner` is the org admin, else the first custom role. */
+function appwriteTeamRole(roles) {
+    if (roles.includes('owner'))
+        return 'admin';
+    const first = roles.find((r) => r.trim());
+    return first ? (0, translate_kit_1.keyOf)(first) : 'member';
+}
+const SHA_VERSIONS = {
+    sha1: 'sha1',
+    sha224: 'sha224',
+    sha256: 'sha256',
+    sha384: 'sha384',
+    sha512: 'sha512',
+    'sha512/224': 'sha512_224',
+    'sha512/256': 'sha512_256',
+    'sha3-224': 'sha3_224',
+    'sha3-256': 'sha3_256',
+    'sha3-384': 'sha3_384',
+    'sha3-512': 'sha3_512',
+};
+/**
+ * One Appwrite user's hash in the bundle's terms (see the module comment).
+ * `guessed` marks a SHA hash stored without a version; `problem` is a warning
+ * for a hash that cannot be carried.
+ */
+function appwritePasswordHash(u) {
+    const digest = (0, record_set_1.str)(u.password);
+    if (!digest)
+        return {};
+    const options = (0, record_set_1.isObj)(u.hashOptions) ? u.hashOptions : {};
+    const type = ((0, record_set_1.str)(u.hash) ?? (0, record_set_1.str)(options.type) ?? '').toLowerCase();
+    switch (type) {
+        case 'argon2':
+        case 'bcrypt':
+            return { hash: { algorithm: 'auto', hash: digest } };
+        case 'md5':
+            return { hash: { algorithm: 'md5', hash: digest.toLowerCase(), params: { encoding: 'hex' } } };
+        case 'sha': {
+            const version = (0, record_set_1.str)(options.version)?.toLowerCase();
+            if (version) {
+                const algorithm = SHA_VERSIONS[version];
+                return algorithm
+                    ? { hash: { algorithm, hash: digest.toLowerCase(), params: { encoding: 'hex' } } }
+                    : { problem: `A SHA hash with the unknown version "${version}" was left out.` };
+            }
+            // No version: 1.x defaults to sha3-512 (128 hex), 2.x to sha256 (64 hex).
+            if (digest.length === 128)
+                return { hash: { algorithm: 'sha3_512', hash: digest.toLowerCase(), params: { encoding: 'hex' } }, guessed: true };
+            if (digest.length === 64)
+                return { hash: { algorithm: 'sha256', hash: digest.toLowerCase(), params: { encoding: 'hex' } }, guessed: true };
+            return { problem: 'A SHA hash without a version and of an unexpected length was left out.' };
+        }
+        case 'phpass':
+            // Appwrite's phpass falls back to crypt() for bcrypt-style digests.
+            return { hash: { algorithm: /^\$2[aby]\$/.test(digest) ? 'auto' : 'phpass', hash: digest } };
+        case 'scrypt': {
+            const salt = (0, record_set_1.str)(options.salt);
+            if (salt === undefined)
+                return { problem: 'A scrypt hash came back without its salt (the server did not return hashOptions.salt) and was left out; those users move by lazy migration.' };
+            return {
+                hash: {
+                    algorithm: 'scrypt',
+                    hash: digest.toLowerCase(),
+                    salt,
+                    params: {
+                        // php-scrypt: N is the literal cost (not log2), the salt string is used as is, the output is hex.
+                        n: num(options.costCpu, 8),
+                        r: num(options.costMemory, 14),
+                        p: num(options.costParallel, 1),
+                        key_length: num(options.length, 64),
+                        salt_encoding: 'utf8',
+                        encoding: 'hex',
+                    },
+                },
+            };
+        }
+        case 'scryptmod': {
+            const signer = (0, record_set_1.str)(options.signerKey);
+            if (!signer)
+                return { problem: 'A scryptMod hash came back without its signer key and was left out.' };
+            return {
+                hash: {
+                    algorithm: 'scrypt_firebase',
+                    hash: digest,
+                    salt: (0, record_set_1.str)(options.salt) ?? '',
+                    // Appwrite hard-codes N=16384 (mem_cost 14), r=8, p=1.
+                    params: { signer_key: signer, salt_separator: (0, record_set_1.str)(options.saltSeparator) ?? '', rounds: 8, mem_cost: 14 },
+                },
+            };
+        }
+        default:
+            return { problem: `A password hash of the unknown type "${type || 'none'}" was left out.` };
+    }
+}
+const num = (v, fallback) => (typeof v === 'number' && Number.isFinite(v) ? v : typeof v === 'string' && v.trim() && Number.isFinite(Number(v)) ? Number(v) : fallback);
+// ── paging ──────────────────────────────────────────────────────────────────
+/** An Appwrite 1.5+ query (JSON form) for the `queries[]` parameter. */
+function appwriteQuery(method, values) {
+    return `queries[]=${encodeURIComponent(JSON.stringify({ method, values }))}`;
+}
+/** Every row of a list endpoint, by cursor (`cursorAfter` the last `$id`, ordered by `$id`). */
+async function listAll(http, path, key) {
+    const out = [];
+    let cursor;
+    for (;;) {
+        const q = [appwriteQuery('limit', [PAGE]), ...(cursor ? [appwriteQuery('cursorAfter', [cursor])] : [])].join('&');
+        const { body } = await http.get(`${path}${path.includes('?') ? '&' : '?'}${q}`);
+        const rows = (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
+        out.push(...rows);
+        const last = rows.length ? (0, record_set_1.str)(rows[rows.length - 1].$id) : undefined;
+        if (rows.length < PAGE || !last)
+            return out;
+        cursor = last;
+    }
+}
+async function optionalList(http, path, key) {
+    try {
+        return await listAll(http, path, key);
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [401, 403, 404].includes(err.status))
+            return [];
+        throw err;
+    }
+}
+async function optionalGet(http, path) {
+    try {
+        return (await http.get(path)).body;
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 401, 403, 404].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+//# sourceMappingURL=appwrite.js.map

package/dist/migrate/export/appwrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appwrite.js","sourceRoot":"","sources":["../../../src/migrate/export/appwrite.ts"],"names":[],"mappings":";;;AA2CA,wCA0GC;AAwBD,4CAIC;AAqBD,oDA+DC;AAOD,sCAEC;AA7QD,6CAA+F;AAC/F,mDAAwC;AACxC,+CAA2D;AAqC9C,QAAA,cAAc,GAAG,8BAA8B,CAAC;AAC7D,MAAM,IAAI,GAAG,GAAG,CAAC;AAEV,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,sBAAc,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;QAC1B,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE;QAChF,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEtD,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,IAAI;YAAE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC;QACrC,IAAI,EAAE,CAAC,OAAO;YAAE,UAAU,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CACN,GAAG,UAAU,wNAAwN,CACtO,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvB,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,YAAY,CAAC,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,SAAS;YACvE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,OAAgB,EAAE,KAAK,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;QAC/M,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC;QACnF,GAAG,CAAC,IAAI,CAAC,2IAA2I,CAAC,CAAC;IACxJ,CAAC;IAED,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI;YAAE,SAAS;QACpC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAM,IAAI,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;YAAE,IAAI,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1I,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1I,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAM,IAAI,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,8GAA8G,EAAE,IAAI,CAAC,CAAC;IACvJ,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,uIAAuI,CAAC,CAAC;IACpJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;gBAAE,SAAS;YAC/B,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACrH,KAAK,MAAM,CAAC,IAAI,MAAM,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC7B,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;gBAC5K,CAAC;qBAAM,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;oBAC/B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBACtB,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;wBAClB,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,4FAA4F,CAAC,CAAC;wBACrH,SAAS;oBACX,CAAC;oBACD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAkB,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5J,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACrJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,YAAY,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACtH,GAAG,CAAC,IAAI,CAAC,iJAAiJ,CAAC,CAAC;IAC5J,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAE/E,SAAS,OAAO,CAAC,CAAM;IACrB,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,qBAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAE;QACf,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9F,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAChG,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACzC,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7C,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC;QAC7B,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;QACpD,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC;KACnC,CAAC;IACF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6GAA6G;AAC7G,SAAgB,gBAAgB,CAAC,KAAe;IAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,IAAA,qBAAK,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzC,CAAC;AAED,MAAM,YAAY,GAA2B;IAC3C,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,YAAY;IAC1B,YAAY,EAAE,YAAY;IAC1B,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,UAAU;CACvB,CAAC;AAEF;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,CAAM;IACzC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;QACvD,KAAK,KAAK;YACR,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACjG,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,OAAO,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;YACpD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;gBACxC,OAAO,SAAS;oBACd,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;oBAClF,CAAC,CAAC,EAAE,OAAO,EAAE,wCAAwC,OAAO,iBAAiB,EAAE,CAAC;YACpF,CAAC;YACD,0EAA0E;YAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9I,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3I,OAAO,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;QAC/F,CAAC;QACD,KAAK,QAAQ;YACX,oEAAoE;YACpE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;QAC/F,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,OAAO,EAAE,6IAA6I,EAAE,CAAC;YAC1L,OAAO;gBACL,IAAI,EAAE;oBACJ,SAAS,EAAE,QAAQ;oBACnB,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE;oBAC1B,IAAI;oBACJ,MAAM,EAAE;wBACN,kGAAkG;wBAClG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC1B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;wBAC9B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;wBAC/B,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;wBACnC,aAAa,EAAE,MAAM;wBACrB,QAAQ,EAAE,KAAK;qBAChB;iBACF;aACF,CAAC;QACJ,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,qEAAqE,EAAE,CAAC;YACvG,OAAO;gBACL,IAAI,EAAE;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;oBAC7B,uDAAuD;oBACvD,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;iBAC1G;aACF,CAAC;QACJ,CAAC;QACD;YACE,OAAO,EAAE,OAAO,EAAE,wCAAwC,IAAI,IAAI,MAAM,iBAAiB,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,QAAgB,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAEjM,+EAA+E;AAE/E,wEAAwE;AACxE,SAAgB,aAAa,CAAC,MAAc,EAAE,MAAiB;IAC7D,OAAO,aAAa,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IAChE,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,MAA0B,CAAC;IAC/B,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC;QAC5C,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAgB,EAAE,IAAY,EAAE,GAAW;IACrE,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACrF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAI,IAAgB,EAAE,IAAY;IAC1D,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/migrate/export/auth0-config.d.ts

@@ -0,0 +1,29 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate auth0 config` — an Auth0 tenant's settings → Atlas config,
+ * read with the Management API on this machine: tenant settings (session
+ * lifetimes), database connections (password policy, username, sign-up,
+ * passkeys), passwordless and social connections, MFA factors and policy,
+ * breached-password detection, applications (callback URLs, web origins),
+ * APIs, roles and permissions. Actions, Rules, Hooks and branding are code
+ * or design: reported as manual.
+ */
+export interface Auth0ConfigSnapshot {
+    domain: string;
+    tenant: Obj;
+    connections: Obj[];
+    guardianFactors: Obj[];
+    guardianPolicies: string[];
+    breachedPassword: Obj | null;
+    clients: Obj[];
+    resourceServers: Obj[];
+    roles: Array<Obj & {
+        permissions?: Obj[];
+    }>;
+    actions: Obj[];
+    rules: Obj[];
+}
+export declare function fetchAuth0Config(http: VendorHttp, domain: string): Promise<Auth0ConfigSnapshot>;
+export declare function translateAuth0Config(snap: Auth0ConfigSnapshot): TranslationResult;

package/dist/migrate/export/auth0-config.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchAuth0Config = fetchAuth0Config;
+exports.translateAuth0Config = translateAuth0Config;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function fetchAuth0Config(http, domain) {
+    const get = async (path, fallback) => {
+        try {
+            return (await http.get(path)).body ?? fallback;
+        }
+        catch (err) {
+            if (err instanceof vendor_http_1.VendorApiError && [403, 404].includes(err.status))
+                return fallback;
+            throw err;
+        }
+    };
+    const list = async (path, key) => {
+        const body = await get(path, []);
+        return Array.isArray(body) ? (0, record_set_1.objs)(body) : (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
+    };
+    const roles = (await list('/roles?per_page=100', 'roles'));
+    for (const r of roles)
+        r.permissions = await list(`/roles/${(0, record_set_1.str)(r.id)}/permissions?per_page=100`, 'permissions');
+    return {
+        domain,
+        tenant: await get('/tenants/settings', {}),
+        connections: await list('/connections?per_page=100', 'connections'),
+        guardianFactors: await list('/guardian/factors', 'factors'),
+        guardianPolicies: (0, record_set_1.strs)(await get('/guardian/policies', [])),
+        breachedPassword: await get('/attack-protection/breached-password-detection', null),
+        clients: await list('/clients?per_page=100&is_global=false', 'clients'),
+        resourceServers: await list('/resource-servers?per_page=100', 'resource_servers'),
+        roles,
+        actions: await list('/actions/actions?per_page=100', 'actions'),
+        rules: await list('/rules?per_page=100', 'rules'),
+    };
+}
+const HOUR = 3600_000;
+function translateAuth0Config(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    // ── sessions ──
+    const t = snap.tenant;
+    if (typeof t.session_lifetime === 'number') {
+        const ms = (0, translate_kit_1.clampSessionMs)(t.session_lifetime * HOUR);
+        b.set('session.absoluteMs', ms);
+        b.add(ms === t.session_lifetime * HOUR ? 'mapped' : 'differs', 'tenant settings', 'session_lifetime', `${t.session_lifetime} hour(s)${ms !== t.session_lifetime * HOUR ? ' (clamped to Atlas\'s 90-day maximum)' : ''}.`, 'auth_config.session.absoluteMs');
+    }
+    if (typeof t.idle_session_lifetime === 'number') {
+        const ms = (0, translate_kit_1.clampSessionMs)(t.idle_session_lifetime * HOUR);
+        b.set('session.idleMs', ms);
+        b.add('mapped', 'tenant settings', 'idle_session_lifetime', `${t.idle_session_lifetime} hour(s) of inactivity.`, 'auth_config.session.idleMs');
+    }
+    // ── database connections ──
+    const dbs = snap.connections.filter((c) => (0, record_set_1.str)(c.strategy) === 'auth0');
+    if (dbs.length > 1)
+        b.add('differs', 'connections', 'database connections', `${dbs.length} database connections: Atlas has one user store per instance; their users are imported together (an email in two connections becomes one user).`, 'users');
+    const db = dbs.find((c) => (0, record_set_1.str)(c.name) === 'Username-Password-Authentication') ?? dbs[0];
+    b.set('strategies.password', Boolean(db));
+    if (db) {
+        const o = (0, record_set_1.isObj)(db.options) ? db.options : {};
+        const name = (0, record_set_1.str)(db.name);
+        const area = `connections ${name}`;
+        b.add('mapped', area, 'strategy auth0', 'Email + password sign-in. Imported password hashes (support export) verify as-is; lazy migration covers the rest.', 'auth_config.strategies.password');
+        const complexity = (0, record_set_1.isObj)(o.password_complexity_options) ? o.password_complexity_options : {};
+        const policyMin = { none: 1, low: 6, fair: 8, good: 8, excellent: 10 };
+        const policy = (0, record_set_1.str)(o.passwordPolicy) ?? 'good';
+        const min = typeof complexity.min_length === 'number' ? complexity.min_length : policyMin[policy] ?? 8;
+        b.set('passwordPolicy.minLength', Math.max(8, min));
+        b.add(min < 8 ? 'differs' : 'mapped', area, 'options.password_complexity_options.min_length', min < 8 ? `Auth0 allows ${min}; Atlas requires at least 8 (existing passwords still sign in).` : `${min}.`, 'auth_config.passwordPolicy.minLength');
+        if (policy === 'fair' || policy === 'good' || policy === 'excellent')
+            b.add('differs', area, `options.passwordPolicy "${policy}"`, 'Atlas follows NIST 800-63B (length and breached-password checks, no character-class rules).', 'auth_config.passwordPolicy');
+        if (o.password_history && (0, record_set_1.isObj)(o.password_history) && o.password_history.enable === true)
+            b.add('manual', area, 'options.password_history', 'Atlas does not keep a password history.');
+        if (o.password_dictionary && (0, record_set_1.isObj)(o.password_dictionary) && o.password_dictionary.enable === true)
+            b.add('differs', area, 'options.password_dictionary', 'Atlas checks breached-password corpora instead of a custom dictionary.', 'auth_config.passwordPolicy.checkBreaches');
+        if (o.requires_username === true) {
+            b.set('strategies.username', true);
+            const v = (0, record_set_1.isObj)(o.validation) && (0, record_set_1.isObj)(o.validation.username) ? o.validation.username : {};
+            if (typeof v.min === 'number')
+                b.set('accountUx.username.minLength', v.min);
+            if (typeof v.max === 'number')
+                b.set('accountUx.username.maxLength', v.max);
+            b.add('mapped', area, 'options.requires_username', 'Usernames (with the same length limits).', 'auth_config.strategies.username');
+        }
+        if (o.disable_signup === true) {
+            b.set('signUpMode', 'restricted');
+            b.add('mapped', area, 'options.disable_signup', 'Self sign-up is closed (invitations and the allowlist still work).', 'auth_config.signUpMode');
+        }
+        if (o.brute_force_protection !== false)
+            b.add('mapped', area, 'options.brute_force_protection', 'Atlas locks out repeated failed sign-ins per account and IP.', 'auth_config.rateLimit');
+        const methods = (0, record_set_1.isObj)(o.authentication_methods) ? o.authentication_methods : {};
+        if ((0, record_set_1.isObj)(methods.passkey) && methods.passkey.enabled === true) {
+            b.set('strategies.passkey', true);
+            b.add('mapped', area, 'options.authentication_methods.passkey', 'Passkeys. Existing Auth0 passkeys move with --authentication-methods when the RP id stays the same.', 'auth_config.strategies.passkey');
+        }
+        if (o.customScripts && (0, record_set_1.isObj)(o.customScripts) && o.enabledDatabaseCustomization === true) {
+            b.add('manual', area, 'options.customScripts', 'A custom database (Login / Get User scripts): point an Atlas legacy-auth connection at your user store instead (lazy migration webhook).', 'legacy_auth_connection');
+        }
+    }
+    // ── passwordless ──
+    for (const c of snap.connections) {
+        const strategy = (0, record_set_1.str)(c.strategy);
+        const o = (0, record_set_1.isObj)(c.options) ? c.options : {};
+        if (strategy === 'email') {
+            const link = (0, record_set_1.str)(o.authParams && (0, record_set_1.isObj)(o.authParams) ? o.authParams.response_type : undefined) === 'code' ? false : (0, record_set_1.str)(o.email && (0, record_set_1.isObj)(o.email) ? o.email.body : undefined)?.includes('@@link@@');
+            b.set(link ? 'strategies.emailLink' : 'strategies.emailCode', true);
+            b.add('mapped', 'connections email', 'strategy email', link ? 'Passwordless magic link.' : 'Passwordless email code.', link ? 'auth_config.strategies.emailLink' : 'auth_config.strategies.emailCode');
+            if (typeof o.totp === 'object' && (0, record_set_1.isObj)(o.totp) && typeof o.totp.time_step === 'number')
+                b.add('differs', 'connections email', 'options.totp.time_step', `Auth0 codes live ${o.totp.time_step}s; set Atlas's verification.emailCode.ttlMinutes.`, 'auth_config.verification.emailCode.ttlMinutes');
+        }
+        else if (strategy === 'sms') {
+            b.set('strategies.phoneCode', true);
+            b.add('mapped', 'connections sms', 'strategy sms', 'Passwordless SMS code (Atlas sends through its own SMS provider settings).', 'auth_config.strategies.phoneCode');
+        }
+    }
+    // ── social connections ──
+    const ENTERPRISE = new Set(['samlp', 'oidc', 'waad', 'adfs', 'okta', 'pingfederate', 'google-apps', 'ad', 'auth0-adldap', 'office365']);
+    for (const c of snap.connections) {
+        const strategy = (0, record_set_1.str)(c.strategy);
+        const name = (0, record_set_1.str)(c.name) ?? strategy ?? '';
+        if (!strategy || strategy === 'auth0' || strategy === 'email' || strategy === 'sms')
+            continue;
+        const o = (0, record_set_1.isObj)(c.options) ? c.options : {};
+        if (ENTERPRISE.has(strategy)) {
+            b.add(strategy === 'ad' || strategy === 'auth0-adldap' ? 'manual' : 'mapped', `connections ${name}`, `strategy ${strategy}`, strategy === 'ad' || strategy === 'auth0-adldap' ? 'AD/LDAP connector: no Atlas counterpart; use a lazy-migration webhook against your directory, or an enterprise IdP in front of it.' : 'Enterprise connection: moves with the data export as an Atlas SSO connection. Update the IdP with Atlas\'s ACS URL / redirect URI.', 'sso_connections');
+            continue;
+        }
+        if (strategy === 'oauth2') {
+            b.add('manual', `connections ${name}`, 'strategy oauth2', `Custom social connection "${name}": recreate it as an Atlas custom OAuth provider (authorization ${(0, record_set_1.str)(o.authorizationURL) ?? '?'}, token ${(0, record_set_1.str)(o.tokenURL) ?? '?'}); its fetchUserProfile script becomes a claim mapping.`, 'custom_oauth_providers');
+            continue;
+        }
+        const key = (0, translate_kit_1.socialKey)(strategy);
+        if (!key) {
+            b.add('manual', `connections ${name}`, `strategy ${strategy}`, `"${strategy}" is not a built-in Atlas provider; add it as a custom OAuth provider.`, 'custom_oauth_providers');
+            continue;
+        }
+        // Auth0's developer keys (no client_id) never work outside Auth0.
+        const clientId = (0, record_set_1.str)(o.client_id);
+        b.socialProvider({ atlasKey: key, vendorName: strategy, area: `connections ${name}`, setting: `strategy ${strategy}`, clientId, scopes: (0, record_set_1.strs)(o.scope ?? o.scopes) });
+        if (!clientId)
+            b.add('manual', `connections ${name}`, 'options.client_id', 'This connection uses Auth0\'s shared developer keys, which only work inside Auth0: create your own OAuth app (provider user ids change, so these users relink by email).', `oauth_providers ${key}`);
+    }
+    // ── MFA ──
+    const factors = new Map(snap.guardianFactors.map((f) => [(0, record_set_1.str)(f.name) ?? '', f.enabled === true]));
+    if (factors.get('otp')) {
+        b.set('mfa.factors.totp', true);
+        b.add('mapped', 'multi-factor', 'guardian factor otp', 'Authenticator apps. TOTP secrets move only with Auth0 support\'s secrets export.', 'auth_config.mfa.factors.totp');
+    }
+    if (factors.get('webauthn-roaming') || factors.get('webauthn-platform')) {
+        b.set('mfa.factors.passkey', true);
+        b.add('mapped', 'multi-factor', 'guardian factor webauthn', 'Security keys / device biometrics as a second factor.', 'auth_config.mfa.factors.passkey');
+    }
+    if (factors.get('email')) {
+        b.set('mfa.factors.emailCode', true);
+        b.add('mapped', 'multi-factor', 'guardian factor email', 'Email code second factor.', 'auth_config.mfa.factors.emailCode');
+    }
+    if (factors.get('sms') || factors.get('phone-message'))
+        b.add('differs', 'multi-factor', 'guardian factor sms', 'SMS second factor: phone factors move with --authentication-methods; Atlas recommends TOTP or passkeys.', 'auth_config.mfa');
+    if (factors.get('push-notification'))
+        b.add('manual', 'multi-factor', 'guardian factor push-notification', 'Auth0 Guardian push has no Atlas counterpart: those users enrol TOTP or a passkey.');
+    if (factors.get('recovery-code'))
+        b.add('mapped', 'multi-factor', 'guardian factor recovery-code', 'Backup codes (new ones are generated in Atlas).', 'auth_config.mfa.backupCodes');
+    if (snap.guardianPolicies.includes('all-applications')) {
+        b.set('mfaPolicy', 'required');
+        b.add('mapped', 'multi-factor', 'guardian policies all-applications', 'MFA always required.', 'auth_config.mfaPolicy');
+    }
+    else if (snap.guardianPolicies.includes('confidence-score')) {
+        b.add('differs', 'multi-factor', 'guardian policies confidence-score', 'Adaptive MFA: Atlas uses step-up and risk policies instead; review auth_config.stepUp.', 'auth_config.stepUp');
+    }
+    if (snap.breachedPassword) {
+        const on = snap.breachedPassword.enabled === true;
+        b.set('passwordPolicy.checkBreaches', on);
+        b.add('mapped', 'attack protection', 'breached-password-detection.enabled', on ? 'Breached passwords are refused.' : 'Breached-password check off.', 'auth_config.passwordPolicy.checkBreaches');
+    }
+    // ── applications ──
+    const origins = new Set();
+    const redirects = new Set();
+    for (const c of snap.clients) {
+        const app = (0, record_set_1.str)(c.name) ?? (0, record_set_1.str)(c.client_id) ?? 'application';
+        const type = (0, record_set_1.str)(c.app_type);
+        if (type === 'non_interactive') {
+            b.add('manual', `applications ${app}`, 'app_type non_interactive', 'A machine-to-machine application: create an Atlas M2M client (client credentials) for it.', 'oauth_clients');
+            continue;
+        }
+        for (const u of (0, record_set_1.strs)(c.callbacks))
+            redirects.add(u);
+        for (const u of [...(0, record_set_1.strs)(c.web_origins), ...(0, record_set_1.strs)(c.allowed_origins)])
+            origins.add(u);
+        if (c.is_first_party === false)
+            b.add('manual', `applications ${app}`, 'is_first_party false', 'A third-party application: register it as an Atlas OAuth client.', 'oauth_clients');
+    }
+    let exact = 0;
+    for (const url of redirects) {
+        if (url.includes('*')) {
+            b.add('differs', 'applications', `callbacks ${url}`, 'Atlas redirect URLs are exact (no wildcards); list each URL.', 'redirect_urls');
+            continue;
+        }
+        b.push('redirect_urls', { url });
+        exact++;
+    }
+    if (exact)
+        b.add('mapped', 'applications', 'callbacks', `${exact} callback URL(s) become redirect URLs.`, 'redirect_urls');
+    if (origins.size) {
+        b.instance.allowed_origins = [...origins].filter((o) => !o.includes('*'));
+        b.add('mapped', 'applications', 'web_origins / allowed_origins', 'Allowed origins for the browser SDK.', 'instance.allowed_origins');
+    }
+    // ── APIs, roles, permissions ──
+    for (const rs of snap.resourceServers) {
+        const identifier = (0, record_set_1.str)(rs.identifier);
+        if (!identifier || rs.is_system === true)
+            continue;
+        b.push('resource_servers', { identifier, name: (0, record_set_1.str)(rs.name) ?? identifier, scopes: (0, record_set_1.objs)(rs.scopes).map((s) => (0, record_set_1.str)(s.value)).filter((s) => !!s) });
+        b.add('mapped', 'APIs', `resource-servers ${identifier}`, `API with ${(0, record_set_1.objs)(rs.scopes).length} scope(s); access tokens for it keep "aud": "${identifier}".`, `resource_servers ${identifier}`);
+    }
+    const perms = new Map();
+    for (const r of snap.roles) {
+        const name = (0, record_set_1.str)(r.name);
+        if (!name)
+            continue;
+        const key = (0, translate_kit_1.keyOf)(name);
+        b.roles[name] = key;
+        const rp = (r.permissions ?? []).map((p) => (0, record_set_1.str)(p.permission_name)).filter((p) => !!p);
+        for (const p of r.permissions ?? []) {
+            const n = (0, record_set_1.str)(p.permission_name);
+            if (n)
+                perms.set(n, (0, record_set_1.str)(p.description) ?? '');
+        }
+        b.push('roles', { key, name, description: (0, record_set_1.str)(r.description) ?? '', permissions: rp });
+    }
+    for (const [key, description] of [...perms.entries()].sort())
+        b.push('permissions', { key, name: key, description });
+    if (snap.roles.length)
+        b.add('mapped', 'roles', 'roles', `${snap.roles.length} role(s) with their permissions; assignments move with the data export.`, 'roles');
+    // ── code ──
+    for (const a of snap.actions) {
+        const triggers = (0, record_set_1.objs)(a.supported_triggers).map((tr) => (0, record_set_1.str)(tr.id)).filter(Boolean).join(', ');
+        b.add('manual', 'actions', `actions ${(0, record_set_1.str)(a.name) ?? '?'}`, `Auth0 Action (${triggers || 'trigger unknown'}): port it to an Atlas action or webhook; token claims it adds become a JWT template or session claims.`, 'actions');
+    }
+    for (const r of snap.rules)
+        if (r.enabled !== false)
+            b.add('manual', 'rules', `rules ${(0, record_set_1.str)(r.name) ?? '?'}`, 'Auth0 Rule: port it to an Atlas action.', 'actions');
+    return b.result(`Auth0 tenant ${snap.domain}`, {
+        bridge: { preset: 'auth0', vars: { domain: snap.domain } },
+        lazy: db ? { preset: 'auth0', config: { domain: snap.domain, connection: (0, record_set_1.str)(db.name) ?? 'Username-Password-Authentication' } } : undefined,
+    });
+}
+//# sourceMappingURL=auth0-config.js.map

package/dist/migrate/export/auth0-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0-config.js","sourceRoot":"","sources":["../../../src/migrate/export/auth0-config.ts"],"names":[],"mappings":";;AA6BA,4CA4BC;AAID,oDA8LC;AAzPD,6CAAgE;AAChE,mDAAkF;AAClF,+CAA2D;AAyBpD,KAAK,UAAU,gBAAgB,CAAC,IAAgB,EAAE,MAAc;IACrE,MAAM,GAAG,GAAG,KAAK,EAAK,IAAY,EAAE,QAAW,EAAc,EAAE;QAC7D,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAI,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,QAAQ,CAAC;YACtF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,GAAW,EAAkB,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAU,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAiC,CAAC;IAC3F,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAC;IACjH,OAAO;QACL,MAAM;QACN,MAAM,EAAE,MAAM,GAAG,CAAM,mBAAmB,EAAE,EAAE,CAAC;QAC/C,WAAW,EAAE,MAAM,IAAI,CAAC,2BAA2B,EAAE,aAAa,CAAC;QACnE,eAAe,EAAE,MAAM,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC;QAC3D,gBAAgB,EAAE,IAAA,iBAAI,EAAC,MAAM,GAAG,CAAU,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACpE,gBAAgB,EAAE,MAAM,GAAG,CAAa,gDAAgD,EAAE,IAAI,CAAC;QAC/F,OAAO,EAAE,MAAM,IAAI,CAAC,uCAAuC,EAAE,SAAS,CAAC;QACvE,eAAe,EAAE,MAAM,IAAI,CAAC,gCAAgC,EAAE,kBAAkB,CAAC;QACjF,KAAK;QACL,OAAO,EAAE,MAAM,IAAI,CAAC,+BAA+B,EAAE,SAAS,CAAC;QAC/D,KAAK,EAAE,MAAM,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,QAAQ,CAAC;AAEtB,SAAgB,oBAAoB,CAAC,IAAyB;IAC5D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAE9B,iBAAiB;IACjB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,IAAA,8BAAc,EAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;QACrD,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC,gBAAgB,WAAW,EAAE,KAAK,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;IAC9P,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,EAAE,GAAG,IAAA,8BAAc,EAAC,CAAC,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC,qBAAqB,yBAAyB,EAAE,4BAA4B,CAAC,CAAC;IACjJ,CAAC;IAED,6BAA6B;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,sBAAsB,EAAE,GAAG,GAAG,CAAC,MAAM,iJAAiJ,EAAE,OAAO,CAAC,CAAC;IACrP,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,kCAAkC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,eAAe,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,mHAAmH,EAAE,iCAAiC,CAAC,CAAC;QAChM,MAAM,UAAU,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,SAAS,GAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC/F,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC;QAC/C,MAAM,GAAG,GAAG,OAAO,UAAU,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvG,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,gDAAgD,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,GAAG,iEAAiE,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,sCAAsC,CAAC,CAAC;QAClP,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,WAAW;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,2BAA2B,MAAM,GAAG,EAAE,6FAA6F,EAAE,4BAA4B,CAAC,CAAC;QAChQ,IAAI,CAAC,CAAC,gBAAgB,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,0BAA0B,EAAE,yCAAyC,CAAC,CAAC;QACxL,IAAI,CAAC,CAAC,mBAAmB,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC,MAAM,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,6BAA6B,EAAE,wEAAwE,EAAE,0CAA0C,CAAC,CAAC;QAChR,IAAI,CAAC,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACjC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5E,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5E,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,0CAA0C,EAAE,iCAAiC,CAAC,CAAC;QACpI,CAAC;QACD,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,wBAAwB,EAAE,oEAAoE,EAAE,wBAAwB,CAAC,CAAC;QAClJ,CAAC;QACD,IAAI,CAAC,CAAC,sBAAsB,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,gCAAgC,EAAE,8DAA8D,EAAE,uBAAuB,CAAC,CAAC;QACzL,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,IAAA,kBAAK,EAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC/D,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,wCAAwC,EAAE,qGAAqG,EAAE,gCAAgC,CAAC,CAAC;QAC3M,CAAC;QACD,IAAI,CAAC,CAAC,aAAa,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,4BAA4B,KAAK,IAAI,EAAE,CAAC;YACzF,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,EAAE,0IAA0I,EAAE,wBAAwB,CAAC,CAAC;QACvN,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACpM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACpE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC;YACvM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAAC,SAAS,mDAAmD,EAAE,+CAA+C,CAAC,CAAC;QACrS,CAAC;aAAM,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,cAAc,EAAE,4EAA4E,EAAE,kCAAkC,CAAC,CAAC;QACvK,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;IACxI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK;YAAE,SAAS;QAC9F,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,YAAY,QAAQ,EAAE,EAAE,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,oIAAoI,CAAC,CAAC,CAAC,oIAAoI,EAAE,iBAAiB,CAAC,CAAC;YAChd,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,iBAAiB,EAAE,6BAA6B,IAAI,mEAAmE,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,GAAG,WAAW,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,yDAAyD,EAAE,wBAAwB,CAAC,CAAC;YAClT,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,YAAY,QAAQ,EAAE,EAAE,IAAI,QAAQ,wEAAwE,EAAE,wBAAwB,CAAC,CAAC;YAC/K,SAAS;QACX,CAAC;QACD,kEAAkE;QAClE,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAI,EAAE,EAAE,OAAO,EAAE,YAAY,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrK,IAAI,CAAC,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,mBAAmB,EAAE,0KAA0K,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;IACnR,CAAC;IAED,YAAY;IACZ,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,qBAAqB,EAAE,kFAAkF,EAAE,8BAA8B,CAAC,CAAC;IAC7K,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACxE,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,0BAA0B,EAAE,uDAAuD,EAAE,iCAAiC,CAAC,CAAC;IAC1J,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,mCAAmC,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,qBAAqB,EAAE,yGAAyG,EAAE,iBAAiB,CAAC,CAAC;IAC9O,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,mCAAmC,EAAE,oFAAoF,CAAC,CAAC;IACjM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,+BAA+B,EAAE,iDAAiD,EAAE,6BAA6B,CAAC,CAAC;IACrL,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,oCAAoC,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IACzH,CAAC;SAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC9D,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,oCAAoC,EAAE,wFAAwF,EAAE,oBAAoB,CAAC,CAAC;IACzL,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,KAAK,IAAI,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,qCAAqC,EAAE,EAAE,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,8BAA8B,EAAE,0CAA0C,CAAC,CAAC;IACnM,CAAC;IAED,qBAAqB;IACrB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,GAAG,EAAE,EAAE,0BAA0B,EAAE,2FAA2F,EAAE,eAAe,CAAC,CAAC;YACjL,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,cAAc,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,GAAG,EAAE,EAAE,sBAAsB,EAAE,kEAAkE,EAAE,eAAe,CAAC,CAAC;IACtL,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,GAAG,EAAE,EAAE,8DAA8D,EAAE,eAAe,CAAC,CAAC;YACtI,SAAS;QACX,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,KAAK,wCAAwC,EAAE,eAAe,CAAC,CAAC;IAC3H,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,eAAe,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,+BAA+B,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC;IACvI,CAAC;IAED,iCAAiC;IACjC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACnD,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAU,CAAC,CAAC;QACvK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,UAAU,EAAE,EAAE,YAAY,IAAA,iBAAI,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,gDAAgD,UAAU,IAAI,EAAE,oBAAoB,UAAU,EAAE,CAAC,CAAC;IAChM,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACjC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAU,CAAC,CAAC;IAC7H,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,yEAAyE,EAAE,OAAO,CAAC,CAAC;IAEjK,aAAa;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,EAAE,iBAAiB,QAAQ,IAAI,iBAAiB,yGAAyG,EAAE,SAAS,CAAC,CAAC;IAClO,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,EAAE,yCAAyC,EAAE,SAAS,CAAC,CAAC;IAEnK,OAAO,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,MAAM,EAAE,EAAE;QAC7C,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;QAC1D,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;KAC5I,CAAC,CAAC;AACL,CAAC"}