@atlasauth/cli 0.25.0 → 0.25.1

package/dist/migrate/export/cognito-config.js

@@ -0,0 +1,273 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchCognitoConfig = fetchCognitoConfig;
+exports.validityMs = validityMs;
+exports.translateCognitoConfig = translateCognitoConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function fetchCognitoConfig(api, poolId, region) {
+    const soft = async (fn, fallback) => {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            if (err instanceof vendor_http_1.VendorApiError && (err.status === 400 || err.status === 403) && !/ResourceNotFound/.test(err.message))
+                return fallback;
+            throw err;
+        }
+    };
+    const described = await api.call('DescribeUserPool', { UserPoolId: poolId });
+    const pool = (0, record_set_1.isObj)(described.UserPool) ? described.UserPool : {};
+    const clients = [];
+    for (const c of await soft(() => api.all('ListUserPoolClients', { UserPoolId: poolId, MaxResults: 60 }, 'UserPoolClients', 'NextToken'), [])) {
+        const id = (0, record_set_1.str)(c.ClientId);
+        if (!id)
+            continue;
+        const res = await api.call('DescribeUserPoolClient', { UserPoolId: poolId, ClientId: id });
+        if ((0, record_set_1.isObj)(res.UserPoolClient))
+            clients.push(res.UserPoolClient);
+    }
+    const idps = [];
+    for (const p of await soft(() => api.all('ListIdentityProviders', { UserPoolId: poolId, MaxResults: 60 }, 'Providers', 'NextToken'), [])) {
+        const name = (0, record_set_1.str)(p.ProviderName);
+        if (!name)
+            continue;
+        const res = await api.call('DescribeIdentityProvider', { UserPoolId: poolId, ProviderName: name });
+        if ((0, record_set_1.isObj)(res.IdentityProvider))
+            idps.push(res.IdentityProvider);
+    }
+    return {
+        poolId,
+        region,
+        pool,
+        clients,
+        idps,
+        resourceServers: await soft(() => api.all('ListResourceServers', { UserPoolId: poolId, MaxResults: 50 }, 'ResourceServers', 'NextToken'), []),
+        groups: await soft(() => api.all('ListGroups', { UserPoolId: poolId, Limit: 60 }, 'Groups', 'NextToken'), []),
+    };
+}
+/** Cognito social provider types → Atlas built-in provider keys. */
+const SOCIAL = { Google: 'google', Facebook: 'facebook', SignInWithApple: 'apple', LoginWithAmazon: 'amazon' };
+const UNIT_MS = { seconds: 1000, minutes: 60_000, hours: 3_600_000, days: 86_400_000 };
+/** A client's token validity in ms (`RefreshTokenValidity` with `TokenValidityUnits.RefreshToken`). */
+function validityMs(client, field) {
+    const value = client[`${field}Validity`];
+    if (typeof value !== 'number' || value <= 0)
+        return undefined;
+    const units = (0, record_set_1.isObj)(client.TokenValidityUnits) ? (0, record_set_1.str)(client.TokenValidityUnits[field]) : undefined;
+    return value * (UNIT_MS[units ?? (field === 'RefreshToken' ? 'days' : 'hours')] ?? UNIT_MS.hours);
+}
+/** Lambda trigger → the Atlas place its logic moves to. */
+const TRIGGERS = {
+    PreSignUp: 'the pre_user_registration action',
+    PostConfirmation: 'the post_user_registration action',
+    PreAuthentication: 'a post_login action (deny there)',
+    PostAuthentication: 'a post_login action',
+    PreTokenGeneration: 'session claims / a JWT template',
+    PreTokenGenerationConfig: 'session claims / a JWT template',
+    UserMigration: 'nothing: Atlas lazy migration replaces it (it checks passwords against Cognito itself)',
+    CustomMessage: 'Atlas email and SMS templates',
+    DefineAuthChallenge: 'Atlas sign-in strategies (custom challenges have no counterpart)',
+    CreateAuthChallenge: 'Atlas sign-in strategies (custom challenges have no counterpart)',
+    VerifyAuthChallengeResponse: 'Atlas sign-in strategies (custom challenges have no counterpart)',
+    CustomEmailSender: 'Atlas email delivery settings (your own SMTP / provider)',
+    CustomSMSSender: 'Atlas SMS delivery settings',
+    InboundFederation: 'an SSO connection attribute mapping / a post_login action',
+};
+function translateCognitoConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const pool = snap.pool;
+    const area = `user pool ${snap.poolId}`;
+    // ── sign-in identifiers ──
+    const usernameAttrs = (0, record_set_1.strs)(pool.UsernameAttributes);
+    const aliasAttrs = (0, record_set_1.strs)(pool.AliasAttributes);
+    const signInAttrs = new Set([...usernameAttrs, ...aliasAttrs]);
+    const firstFactors = (0, record_set_1.isObj)(pool.Policies) && (0, record_set_1.isObj)(pool.Policies.SignInPolicy) ? (0, record_set_1.strs)(pool.Policies.SignInPolicy.AllowedFirstAuthFactors) : [];
+    const passwordOn = !firstFactors.length || firstFactors.includes('PASSWORD');
+    if (passwordOn) {
+        b.set('strategies.password', true);
+        b.add('differs', area, 'Policies.SignInPolicy (PASSWORD)', 'Password sign-in. Cognito never exports password hashes: the cognito lazy-migration preset checks each password against Cognito on first sign-in.', 'auth_config.strategies.password');
+    }
+    if (!usernameAttrs.length || aliasAttrs.includes('preferred_username')) {
+        b.set('strategies.username', true);
+        b.add(usernameAttrs.length ? 'mapped' : 'differs', area, usernameAttrs.length ? 'AliasAttributes preferred_username' : 'UsernameAttributes (none: username pool)', usernameAttrs.length ? 'Sign-in with a preferred username.' : 'Users sign in with a username. Cognito usernames that are not the generated id move as Atlas usernames.', 'auth_config.strategies.username');
+    }
+    if (signInAttrs.has('email'))
+        b.add('mapped', area, usernameAttrs.includes('email') ? 'UsernameAttributes email' : 'AliasAttributes email', 'Sign-in with an email address.', 'auth_config.strategies.password');
+    if (signInAttrs.has('phone_number'))
+        b.add('differs', area, usernameAttrs.includes('phone_number') ? 'UsernameAttributes phone_number' : 'AliasAttributes phone_number', 'Phone numbers are a sign-in identifier: enable phone sign-in in Atlas (SMS code); a password with a phone number signs in through lazy migration.', 'auth_config.strategies.phoneCode');
+    if (firstFactors.includes('EMAIL_OTP')) {
+        b.set('strategies.emailCode', true);
+        b.add('mapped', area, 'Policies.SignInPolicy.AllowedFirstAuthFactors EMAIL_OTP', 'Passwordless email code.', 'auth_config.strategies.emailCode');
+    }
+    if (firstFactors.includes('SMS_OTP')) {
+        b.set('strategies.phoneCode', true);
+        b.add('mapped', area, 'Policies.SignInPolicy.AllowedFirstAuthFactors SMS_OTP', 'Passwordless SMS code.', 'auth_config.strategies.phoneCode');
+    }
+    if (firstFactors.includes('WEB_AUTHN')) {
+        b.set('strategies.passkey', true);
+        b.add('differs', area, 'Policies.SignInPolicy.AllowedFirstAuthFactors WEB_AUTHN', 'Passkeys. Cognito does not export credentials (and they are bound to the Cognito domain): users register a passkey again.', 'auth_config.strategies.passkey');
+    }
+    const caseSensitive = (0, record_set_1.isObj)(pool.UsernameConfiguration) ? pool.UsernameConfiguration.CaseSensitive : undefined;
+    if (caseSensitive === true)
+        b.add('differs', area, 'UsernameConfiguration.CaseSensitive', 'Cognito usernames are case sensitive; Atlas usernames and emails are case insensitive (two usernames differing only in case would collide).');
+    // ── verification ──
+    const autoVerified = (0, record_set_1.strs)(pool.AutoVerifiedAttributes);
+    if (autoVerified.includes('email')) {
+        b.set('requireEmailVerification', true);
+        b.add('mapped', area, 'AutoVerifiedAttributes email', 'Emails are verified by code at sign-up.', 'auth_config.requireEmailVerification');
+    }
+    if (autoVerified.includes('phone_number'))
+        b.add('mapped', area, 'AutoVerifiedAttributes phone_number', 'Phone numbers are verified by SMS code.', 'auth_config.strategies.phoneCode');
+    // ── self sign-up ──
+    const adminOnly = (0, record_set_1.isObj)(pool.AdminCreateUserConfig) && pool.AdminCreateUserConfig.AllowAdminCreateUserOnly === true;
+    if (adminOnly) {
+        b.set('signUpMode', 'restricted');
+        b.add('mapped', area, 'AdminCreateUserConfig.AllowAdminCreateUserOnly', 'Self sign-up is closed: users are created by an admin or invited.', 'auth_config.signUpMode');
+    }
+    // ── password policy ──
+    const pw = (0, record_set_1.isObj)(pool.Policies) && (0, record_set_1.isObj)(pool.Policies.PasswordPolicy) ? pool.Policies.PasswordPolicy : undefined;
+    if (pw) {
+        const min = typeof pw.MinimumLength === 'number' ? pw.MinimumLength : 8;
+        b.set('passwordPolicy.minLength', Math.max(8, min));
+        b.add(min < 8 ? 'differs' : 'mapped', area, 'Policies.PasswordPolicy.MinimumLength', `${min}${min < 8 ? ' (Atlas requires at least 8; existing passwords still sign in)' : ''}.`, 'auth_config.passwordPolicy.minLength');
+        if (['RequireUppercase', 'RequireLowercase', 'RequireNumbers', 'RequireSymbols'].some((k) => pw[k] === true)) {
+            b.set('passwordPolicy.checkBreaches', true);
+            b.add('differs', area, 'Policies.PasswordPolicy (character classes)', 'Atlas follows NIST 800-63B: length and breached-password checks instead of character-class rules.', 'auth_config.passwordPolicy');
+        }
+        if (typeof pw.TemporaryPasswordValidityDays === 'number')
+            b.add('manual', area, 'Policies.PasswordPolicy.TemporaryPasswordValidityDays', 'Atlas does not issue temporary passwords: invite users instead (invitations expire on their own).', 'invitations');
+        if (typeof pw.PasswordHistorySize === 'number' && pw.PasswordHistorySize > 0)
+            b.add('manual', area, 'Policies.PasswordPolicy.PasswordHistorySize', 'Atlas does not keep a password history.');
+    }
+    // ── MFA ──
+    const mfa = (0, record_set_1.str)(pool.MfaConfiguration);
+    const smsMfa = (0, record_set_1.isObj)(pool.SmsConfiguration);
+    if (mfa === 'ON') {
+        b.set('mfaPolicy', 'required');
+        b.add('mapped', area, 'MfaConfiguration ON', 'A second factor on every sign-in.', 'auth_config.mfaPolicy');
+    }
+    else if (mfa === 'OPTIONAL') {
+        b.set('mfaPolicy', 'optional');
+        b.add('mapped', area, 'MfaConfiguration OPTIONAL', 'Users may enrol a second factor.', 'auth_config.mfaPolicy');
+    }
+    if (mfa === 'ON' || mfa === 'OPTIONAL') {
+        b.set('mfa.factors.totp', true);
+        b.add('differs', area, 'SoftwareTokenMfaConfiguration', 'Authenticator apps. Cognito never exports TOTP secrets: users with one enrol again.', 'auth_config.mfa.factors.totp');
+        if (smsMfa)
+            b.add('differs', area, 'SmsMfaConfiguration', 'SMS second factors move with the export (the verified phone number); Atlas recommends TOTP or passkeys.', 'auth_config.mfa');
+    }
+    // ── advanced security ──
+    const security = (0, record_set_1.isObj)(pool.UserPoolAddOns) ? (0, record_set_1.str)(pool.UserPoolAddOns.AdvancedSecurityMode) : undefined;
+    if (security && security !== 'OFF')
+        b.add('differs', area, `UserPoolAddOns.AdvancedSecurityMode ${security}`, 'Cognito threat protection (compromised credentials, adaptive authentication): Atlas checks breached passwords and rate-limits sign-ins; review risk rules by hand.', 'auth_config.passwordPolicy.checkBreaches');
+    if ((0, record_set_1.str)(pool.DeletionProtection) === 'ACTIVE')
+        b.add('manual', area, 'DeletionProtection', 'Turn deletion protection off before you delete the pool after the cutover.');
+    // ── custom attributes ──
+    const custom = (0, record_set_1.objs)(pool.SchemaAttributes).filter((a) => (0, record_set_1.str)(a.Name)?.startsWith('custom:'));
+    if (custom.length)
+        b.add('differs', area, 'SchemaAttributes custom:*', `${custom.length} custom attribute(s) (${custom.map((a) => (0, record_set_1.str)(a.Name)).join(', ')}) move to each user's public_metadata without the custom: prefix. Atlas does not enforce their types; mutability per app client is not translated.`, 'users public_metadata');
+    // ── Lambda triggers ──
+    const lambdas = (0, record_set_1.isObj)(pool.LambdaConfig) ? pool.LambdaConfig : {};
+    for (const [trigger, value] of Object.entries(lambdas)) {
+        if (trigger === 'KMSKeyID' || (!(0, record_set_1.str)(value) && !(0, record_set_1.isObj)(value)))
+            continue;
+        const target = TRIGGERS[trigger];
+        b.add(trigger === 'UserMigration' ? 'differs' : 'manual', area, `LambdaConfig.${trigger}`, `Lambda trigger: port its logic to ${target ?? 'an Atlas action or webhook'}.`, trigger === 'UserMigration' ? 'legacy_auth_connection' : 'actions');
+    }
+    // ── app clients ──
+    const redirects = new Set();
+    let refreshMs;
+    let lazyClient;
+    let bridgeClient;
+    for (const c of snap.clients) {
+        const name = (0, record_set_1.str)(c.ClientName) ?? (0, record_set_1.str)(c.ClientId) ?? '?';
+        const carea = `app client ${name}`;
+        for (const u of (0, record_set_1.strs)(c.CallbackURLs))
+            redirects.add(u);
+        for (const u of (0, record_set_1.strs)(c.LogoutURLs))
+            redirects.add(u);
+        const r = validityMs(c, 'RefreshToken');
+        if (r !== undefined)
+            refreshMs = Math.max(refreshMs ?? 0, r);
+        const flows = (0, record_set_1.strs)(c.ExplicitAuthFlows);
+        const secret = !!(0, record_set_1.str)(c.ClientSecret);
+        // The bridge audience: the first public (browser / mobile) client, else the first one.
+        if (!secret)
+            bridgeClient ??= (0, record_set_1.str)(c.ClientId);
+        if (!secret && (flows.includes('ALLOW_USER_PASSWORD_AUTH') || flows.includes('USER_PASSWORD_AUTH')))
+            lazyClient ??= (0, record_set_1.str)(c.ClientId);
+        if ((0, record_set_1.strs)(c.AllowedOAuthFlows).includes('client_credentials'))
+            b.add('manual', carea, 'AllowedOAuthFlows client_credentials', 'A machine-to-machine client: create an Atlas M2M client for it.', 'oauth_clients');
+        if (flows.includes('ALLOW_CUSTOM_AUTH') || flows.includes('CUSTOM_AUTH_FLOW_ONLY'))
+            b.add('manual', carea, 'ExplicitAuthFlows ALLOW_CUSTOM_AUTH', 'Custom auth challenges (Lambda) have no Atlas counterpart: use passwordless email / SMS codes or passkeys.');
+        const idTtl = validityMs(c, 'IdToken');
+        if (idTtl !== undefined && idTtl !== 3_600_000)
+            b.add('differs', carea, 'IdTokenValidity', `ID tokens lived ${Math.round(idTtl / 60_000)} minutes. Atlas session tokens are short-lived (refreshed by the SDK) and the session lifetime is set instance-wide.`, 'auth_config.session');
+        for (const p of (0, record_set_1.strs)(c.SupportedIdentityProviders))
+            if (p !== 'COGNITO' && !snap.idps.some((i) => (0, record_set_1.str)(i.ProviderName) === p))
+                b.add('manual', carea, `SupportedIdentityProviders ${p}`, 'An identity provider the client allows that the pool does not describe.');
+    }
+    bridgeClient ??= (0, record_set_1.str)(snap.clients[0]?.ClientId);
+    if (snap.clients.length > 1)
+        b.add('differs', 'app clients', `${snap.clients.length} app clients`, `The bridge accepts ID tokens for one audience (${bridgeClient}); run it once per client whose users must move silently.`, 'migration bridge');
+    if (refreshMs !== undefined) {
+        b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(refreshMs));
+        b.add(refreshMs > 90 * 86_400_000 ? 'differs' : 'mapped', 'app clients', 'RefreshTokenValidity', `Users stayed signed in ${Math.round(refreshMs / 86_400_000)} day(s) (the longest client)${refreshMs > 90 * 86_400_000 ? '; Atlas sessions last at most 90 days' : ''}.`, 'auth_config.session.absoluteMs');
+    }
+    for (const url of redirects) {
+        if (url.includes('*'))
+            b.add('differs', 'app clients', `CallbackURLs ${url}`, 'Atlas redirect URLs are exact (no wildcards).', 'redirect_urls');
+        else
+            b.push('redirect_urls', { url });
+    }
+    if (redirects.size)
+        b.add('mapped', 'app clients', 'CallbackURLs / LogoutURLs', `${redirects.size} callback / sign-out URL(s).`, 'redirect_urls');
+    if (snap.clients.length && !lazyClient) {
+        b.add('manual', 'app clients', 'ExplicitAuthFlows ALLOW_USER_PASSWORD_AUTH', 'Lazy migration needs an app client WITHOUT a client secret that allows ALLOW_USER_PASSWORD_AUTH: create one (it is only used to check passwords) and pass its id to the lazy step.', 'legacy_auth_connection');
+    }
+    // ── identity providers ──
+    for (const idp of snap.idps) {
+        const name = (0, record_set_1.str)(idp.ProviderName) ?? '?';
+        const type = (0, record_set_1.str)(idp.ProviderType) ?? '';
+        const details = (0, record_set_1.isObj)(idp.ProviderDetails) ? idp.ProviderDetails : {};
+        if (type === 'SAML' || type === 'OIDC') {
+            b.add('mapped', 'identity providers', `${name} (${type})`, `Enterprise IdP: moves with the data export as an Atlas SSO connection; give the IdP Atlas's ${type === 'SAML' ? 'ACS URL and entity id' : 'redirect URI'}, and map its IdpIdentifiers to the connection's domains.`, 'sso_connections');
+            continue;
+        }
+        const key = SOCIAL[type];
+        if (!key) {
+            b.add('manual', 'identity providers', `${name} (${type})`, 'No built-in Atlas provider: add it as a custom OAuth provider.', 'custom_oauth_providers');
+            continue;
+        }
+        b.socialProvider({ atlasKey: key, vendorName: name, area: 'identity providers', setting: `${name} (${type})`, clientId: (0, record_set_1.str)(details.client_id), scopes: (0, record_set_1.str)(details.authorize_scopes)?.split(/[\s,]+/).filter(Boolean) });
+    }
+    // ── resource servers → APIs ──
+    for (const rs of snap.resourceServers) {
+        const identifier = (0, record_set_1.str)(rs.Identifier);
+        if (!identifier)
+            continue;
+        const scopes = (0, record_set_1.objs)(rs.Scopes).map((s) => (0, record_set_1.str)(s.ScopeName)).filter((s) => !!s);
+        b.push('resource_servers', { identifier, name: (0, record_set_1.str)(rs.Name) ?? identifier, scopes });
+        b.add('differs', `resource servers ${(0, record_set_1.str)(rs.Name) ?? identifier}`, `Identifier ${identifier}`, `An API with ${scopes.length} scope(s). Cognito scopes are "${identifier}/<scope>"; Atlas tokens carry the bare scope with "aud": "${identifier}".`, `resource_servers ${identifier}`);
+    }
+    // ── groups → roles ──
+    for (const g of snap.groups) {
+        const name = (0, record_set_1.str)(g.GroupName);
+        if (!name)
+            continue;
+        const key = (0, translate_kit_1.keyOf)(name);
+        b.roles[name] = key;
+        b.push('roles', { key, name, description: (0, record_set_1.str)(g.Description) ?? '', permissions: [] });
+        if ((0, record_set_1.str)(g.RoleArn))
+            b.add('manual', `groups ${name}`, 'RoleArn', 'The group grants an IAM role through an identity pool: Atlas does not issue AWS credentials; keep the identity pool with Atlas as an OIDC provider, or call STS from your backend.');
+    }
+    if (snap.groups.length)
+        b.add('differs', 'groups', 'groups', `${snap.groups.length} group(s) become Atlas app roles (memberships move with the data export); cognito:groups becomes the roles claim. Precedence is not translated.`, 'roles');
+    return b.result(`Cognito user pool ${snap.poolId}`, {
+        bridge: { preset: 'cognito', vars: { region: snap.region, user_pool_id: snap.poolId, ...(bridgeClient ? { client_id: bridgeClient } : {}) } },
+        lazy: { preset: 'cognito', config: { region: snap.region, user_pool_id: snap.poolId, ...(lazyClient ? { client_id: lazyClient } : {}) } },
+    });
+}
+//# sourceMappingURL=cognito-config.js.map

package/dist/migrate/export/cognito-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-config.js","sourceRoot":"","sources":["../../../src/migrate/export/cognito-config.ts"],"names":[],"mappings":";;AA0BA,gDAkCC;AAQD,gCAKC;AAoBD,wDAuLC;AAjRD,6CAAgE;AAChE,mDAAuE;AACvE,+CAA+C;AAqBxC,KAAK,UAAU,kBAAkB,CAAC,GAAe,EAAE,MAAc,EAAE,MAAc;IACtF,MAAM,IAAI,GAAG,KAAK,EAAK,EAAoB,EAAE,QAAW,EAAc,EAAE;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC1I,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAM,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,OAAO,GAAU,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7I,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAM,wBAAwB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAChG,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,cAAc,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACzI,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAM,0BAA0B,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxG,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,MAAM;QACN,MAAM;QACN,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,eAAe,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;QAC7I,MAAM,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;AAEvI,MAAM,OAAO,GAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAE/G,uGAAuG;AACvG,SAAgB,UAAU,CAAC,MAAW,EAAE,KAAiD;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,OAAO,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,KAAM,CAAC,CAAC;AACrG,CAAC;AAED,2DAA2D;AAC3D,MAAM,QAAQ,GAA2B;IACvC,SAAS,EAAE,kCAAkC;IAC7C,gBAAgB,EAAE,mCAAmC;IACrD,iBAAiB,EAAE,kCAAkC;IACrD,kBAAkB,EAAE,qBAAqB;IACzC,kBAAkB,EAAE,iCAAiC;IACrD,wBAAwB,EAAE,iCAAiC;IAC3D,aAAa,EAAE,wFAAwF;IACvG,aAAa,EAAE,+BAA+B;IAC9C,mBAAmB,EAAE,kEAAkE;IACvF,mBAAmB,EAAE,kEAAkE;IACvF,2BAA2B,EAAE,kEAAkE;IAC/F,iBAAiB,EAAE,0DAA0D;IAC7E,eAAe,EAAE,6BAA6B;IAC9C,iBAAiB,EAAE,2DAA2D;CAC/E,CAAC;AAEF,SAAgB,sBAAsB,CAAC,IAA2B;IAChE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC;IAExC,4BAA4B;IAC5B,MAAM,aAAa,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/I,MAAM,UAAU,GAAG,CAAC,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,kCAAkC,EAAE,mJAAmJ,EAAE,iCAAiC,CAAC,CAAC;IACrP,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CACH,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAC3C,IAAI,EACJ,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,0CAA0C,EACxG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,yGAAyG,EACvK,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB,EAAE,gCAAgC,EAAE,iCAAiC,CAAC,CAAC;IACjN,IAAI,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,8BAA8B,EAAE,mJAAmJ,EAAE,kCAAkC,CAAC,CAAC;IAClW,IAAI,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,yDAAyD,EAAE,0BAA0B,EAAE,kCAAkC,CAAC,CAAC;IACnJ,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,uDAAuD,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IAC/I,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,yDAAyD,EAAE,2HAA2H,EAAE,gCAAgC,CAAC,CAAC;IACnP,CAAC;IACD,MAAM,aAAa,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,IAAI,aAAa,KAAK,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,qCAAqC,EAAE,6IAA6I,CAAC,CAAC;IAEzO,qBAAqB;IACrB,MAAM,YAAY,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,yCAAyC,EAAE,sCAAsC,CAAC,CAAC;IAC3I,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,qCAAqC,EAAE,yCAAyC,EAAE,kCAAkC,CAAC,CAAC;IAEvL,qBAAqB;IACrB,MAAM,SAAS,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,wBAAwB,KAAK,IAAI,CAAC;IACpH,IAAI,SAAS,EAAE,CAAC;QACd,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,gDAAgD,EAAE,mEAAmE,EAAE,wBAAwB,CAAC,CAAC;IACzK,CAAC;IAED,wBAAwB;IACxB,MAAM,EAAE,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAClH,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,uCAAuC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;QAC1N,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7G,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,6CAA6C,EAAE,mGAAmG,EAAE,4BAA4B,CAAC,CAAC;QAC3M,CAAC;QACD,IAAI,OAAO,EAAE,CAAC,6BAA6B,KAAK,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,uDAAuD,EAAE,mGAAmG,EAAE,aAAa,CAAC,CAAC;QAC7P,IAAI,OAAO,EAAE,CAAC,mBAAmB,KAAK,QAAQ,IAAI,EAAE,CAAC,mBAAmB,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,6CAA6C,EAAE,yCAAyC,CAAC,CAAC;IAChM,CAAC;IAED,YAAY;IACZ,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,mCAAmC,EAAE,uBAAuB,CAAC,CAAC;IAC7G,CAAC;SAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,uBAAuB,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,+BAA+B,EAAE,qFAAqF,EAAE,8BAA8B,CAAC,CAAC;QAC/K,IAAI,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE,yGAAyG,EAAE,iBAAiB,CAAC,CAAC;IAC1L,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,uCAAuC,QAAQ,EAAE,EAAE,oKAAoK,EAAE,0CAA0C,CAAC,CAAC;IAChU,IAAI,IAAA,gBAAG,EAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,QAAQ;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE,4EAA4E,CAAC,CAAC;IAEzK,0BAA0B;IAC1B,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,MAAM,CAAC,MAAM,yBAAyB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oJAAoJ,EAAE,uBAAuB,CAAC,CAAC;IAExU,wBAAwB;IACxB,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,KAAK,UAAU,IAAI,CAAC,CAAC,IAAA,gBAAG,EAAC,KAAK,CAAC,IAAI,CAAC,IAAA,kBAAK,EAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,gBAAgB,OAAO,EAAE,EAAE,qCAAqC,MAAM,IAAI,4BAA4B,GAAG,EAAE,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjP,CAAC;IAED,oBAAoB;IACpB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,SAA6B,CAAC;IAClC,IAAI,UAA8B,CAAC;IACnC,IAAI,YAAgC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;QACzD,MAAM,KAAK,GAAG,cAAc,IAAI,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,YAAY,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACrC,uFAAuF;QACvF,IAAI,CAAC,MAAM;YAAE,YAAY,KAAK,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YAAE,UAAU,KAAK,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACpI,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,sCAAsC,EAAE,iEAAiE,EAAE,eAAe,CAAC,CAAC;QACjN,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,qCAAqC,EAAE,4GAA4G,CAAC,CAAC;QAChQ,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,sHAAsH,EAAE,qBAAqB,CAAC,CAAC;QACvR,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,0BAA0B,CAAC;YAAE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,8BAA8B,CAAC,EAAE,EAAE,yEAAyE,CAAC,CAAC;IACrQ,CAAC;IACD,YAAY,KAAK,IAAA,gBAAG,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,cAAc,EAAE,kDAAkD,YAAY,2DAA2D,EAAE,kBAAkB,CAAC,CAAC;IAClP,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,sBAAsB,EAAE,0BAA0B,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,UAAU,CAAC,+BAA+B,SAAS,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;IAC/S,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,gBAAgB,GAAG,EAAE,EAAE,+CAA+C,EAAE,eAAe,CAAC,CAAC;;YAC3I,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,2BAA2B,EAAE,GAAG,SAAS,CAAC,IAAI,8BAA8B,EAAE,eAAe,CAAC,CAAC;IAClJ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,4CAA4C,EAAE,oLAAoL,EAAE,wBAAwB,CAAC,CAAC;IAC/R,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,+FAA+F,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,2DAA2D,EAAE,iBAAiB,CAAC,CAAC;YACpS,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,gEAAgE,EAAE,wBAAwB,CAAC,CAAC;YACvJ,SAAS;QACX,CAAC;QACD,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5N,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,EAAU,CAAC,CAAC;QAC7F,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,EAAE,cAAc,UAAU,EAAE,EAAE,eAAe,MAAM,CAAC,MAAM,kCAAkC,UAAU,6DAA6D,UAAU,IAAI,EAAE,oBAAoB,UAAU,EAAE,CAAC,CAAC;IACxR,CAAC;IAED,uBAAuB;IACvB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;QAC/F,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,EAAE,SAAS,EAAE,oLAAoL,CAAC,CAAC;IACzP,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,iJAAiJ,EAAE,OAAO,CAAC,CAAC;IAE9O,OAAO,CAAC,CAAC,MAAM,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,EAAE;QAClD,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC7I,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;KAC1I,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/cognito.d.ts

@@ -0,0 +1,103 @@
+import type { IdentityRecord, MfaFactorRecord, SsoConnectionRecord, UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export cognito` — an Amazon Cognito user pool onto the
+ * canonical bundle models, read on this machine with the owner's AWS
+ * credentials (SigV4-signed calls to the cognito-idp JSON API; the keys are
+ * sent to AWS only, as a signature).
+ *
+ *   - users (ListUsers), keyed by `sub` — the subject Cognito tokens carry,
+ *     so the bridge and lazy migration land on the same Atlas user; standard
+ *     attributes map onto the user, `custom:*` attributes become public
+ *     metadata, the Cognito username and status are kept privately;
+ *   - federated and linked accounts from the `identities` attribute;
+ *   - groups as app roles (ListGroups + ListUsersInGroup);
+ *   - SAML / OIDC identity providers as enterprise connections;
+ *   - SMS / email second factors (legacy MFAOptions, or every user's
+ *     UserMFASettingList with `mfa`, which costs one AdminGetUser per user);
+ *   - the pool's public signing keys, so old ID tokens keep verifying during
+ *     the cutover.
+ *
+ * Cognito NEVER exports password hashes, TOTP secrets or passkeys. Passwords
+ * move with the `cognito` lazy-migration preset (InitiateAuth with
+ * USER_PASSWORD_AUTH on the user's first Atlas sign-in).
+ *
+ * Instead of the API, users can come from `aws cognito-idp list-users`
+ * output (the CLI follows the pagination): no groups or connections then.
+ */
+export interface AwsCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+}
+export interface CognitoExportOptions {
+    userPoolId: string;
+    /** Default: the region prefix of the pool id. */
+    region?: string;
+    credentials?: AwsCredentials;
+    /** `aws cognito-idp list-users --output json` output, instead of calling ListUsers. */
+    usersText?: string;
+    /** Read every user's MFA settings (AdminGetUser per user — billed and rate limited). */
+    mfa?: boolean;
+    /** How groups move (default roles). */
+    groups?: 'roles' | 'skip';
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => Date;
+    onProgress?: (message: string) => void;
+}
+/** The region of a user pool id (`us-east-1_AbC123` → `us-east-1`), or undefined. */
+export declare function regionOfPool(poolId: string): string | undefined;
+/** `20150830T123600Z`. */
+export declare function amzDate(d: Date): string;
+/** The SigV4 signing key: HMAC chain over date, region, service. */
+export declare function sigV4Key(secret: string, date: string, region: string, service: string): Buffer;
+/**
+ * Sign a request with AWS Signature Version 4 (header form). `headers` must
+ * not yet carry `authorization`; the result adds `host`, `x-amz-date`, the
+ * session token when there is one, and `authorization`. Only a path without
+ * a query string is signed (every Cognito call is `POST /`).
+ */
+export declare function signAwsRequest(o: {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body: string;
+    region: string;
+    service: string;
+    credentials: AwsCredentials;
+    now: Date;
+}): Record<string, string>;
+export declare class CognitoApi {
+    private readonly o;
+    readonly endpoint: string;
+    constructor(o: {
+        region: string;
+        credentials: AwsCredentials;
+        fetchImpl?: typeof fetch;
+        sleep?: (ms: number) => Promise<void>;
+        now?: () => Date;
+        attempts?: number;
+    });
+    /** One API call (`ListUsers`, `DescribeUserPool` …). Throttling and 5xx are retried. */
+    call<T = Obj>(action: string, input: Obj): Promise<T>;
+    /** Every page of a token-paged list. */
+    all(action: string, input: Obj, listKey: string, tokenKey: 'PaginationToken' | 'NextToken'): Promise<Obj[]>;
+}
+export declare function attributesOf(u: Obj): Record<string, string>;
+/** The `identities` attribute (a JSON string; `primary` / `dateCreated` typed loosely). */
+export declare function parseIdentities(raw: string | undefined): Obj[];
+/** Map one Cognito UserType onto a user record (null when it has no sub or no identifier). */
+export declare function mapCognitoUser(u: Obj): UserRecord | null;
+/** The identity records of one user's `identities` attribute. */
+export declare function cognitoIdentities(userId: string, raw: string | undefined): IdentityRecord[];
+/** SMS / email factors from legacy MFAOptions or a UserMFASettingList. */
+export declare function cognitoFactors(userId: string, u: Obj, attrs: Record<string, string>): {
+    factors: MfaFactorRecord[];
+    totp: boolean;
+};
+/** The users of `aws cognito-idp list-users` output (`{ "Users": [...] }`, or a bare array). */
+export declare function parseListUsersOutput(text: string): Obj[];
+/** A SAML / OIDC identity provider → an SSO connection record (social providers are null). */
+export declare function cognitoSsoConnection(idp: Obj): SsoConnectionRecord | null;
+export declare function exportCognito(opts: CognitoExportOptions): Promise<RecordSet>;