@atlasauth/cli 0.25.0 → 0.25.1

package/dist/migrate/export/supabase-config.js

@@ -0,0 +1,408 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseToml = parseToml;
+exports.settingsFromToml = settingsFromToml;
+exports.fetchSupabaseAuthConfig = fetchSupabaseAuthConfig;
+exports.settingsFromApi = settingsFromApi;
+exports.durationMs = durationMs;
+exports.translateSupabaseConfig = translateSupabaseConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+// ── config.toml ────────────────────────────────────────────────────────────
+/**
+ * A TOML reader for config.toml's shape: `[a.b.c]` tables, `key = value` with
+ * basic / literal strings, numbers, booleans and (multi-line) arrays of
+ * scalars, `#` comments. Keys come back as dotted paths with their 1-based line.
+ */
+function parseToml(text) {
+    const out = new Map();
+    const lines = text.split(/\r?\n/);
+    let table = '';
+    for (let i = 0; i < lines.length; i++) {
+        const raw = stripComment(lines[i]).trim();
+        if (!raw)
+            continue;
+        const header = /^\[\s*([A-Za-z0-9_.\-"]+)\s*\]$/.exec(raw);
+        if (header) {
+            table = header[1].replace(/"/g, '');
+            continue;
+        }
+        const kv = /^([A-Za-z0-9_\-"]+)\s*=\s*(.*)$/.exec(raw);
+        if (!kv)
+            continue;
+        const line = i + 1;
+        let rhs = kv[2];
+        // A multi-line array runs until its closing bracket.
+        if (rhs.startsWith('[') && !balanced(rhs)) {
+            while (i + 1 < lines.length && !balanced(rhs))
+                rhs += ` ${stripComment(lines[++i]).trim()}`;
+        }
+        const key = kv[1].replace(/"/g, '');
+        out.set(table ? `${table}.${key}` : key, { value: tomlValue(rhs.trim()), line });
+    }
+    return out;
+}
+function stripComment(line) {
+    let quote = null;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (quote) {
+            if (c === '\\' && quote === '"')
+                i++;
+            else if (c === quote)
+                quote = null;
+        }
+        else if (c === '"' || c === "'")
+            quote = c;
+        else if (c === '#')
+            return line.slice(0, i);
+    }
+    return line;
+}
+function balanced(s) {
+    let depth = 0;
+    let quote = null;
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        if (quote) {
+            if (c === '\\' && quote === '"')
+                i++;
+            else if (c === quote)
+                quote = null;
+        }
+        else if (c === '"' || c === "'")
+            quote = c;
+        else if (c === '[')
+            depth++;
+        else if (c === ']')
+            depth--;
+    }
+    return depth <= 0;
+}
+function tomlValue(s) {
+    if (s === 'true')
+        return true;
+    if (s === 'false')
+        return false;
+    if (s.startsWith('"')) {
+        const end = s.lastIndexOf('"');
+        return JSON.parse(s.slice(0, end + 1).replace(/\\'/g, "'"));
+    }
+    if (s.startsWith("'"))
+        return s.slice(1, s.indexOf("'", 1));
+    if (s.startsWith('[')) {
+        const inner = s.slice(1, s.lastIndexOf(']'));
+        const items = [];
+        let cur = '';
+        let quote = null;
+        for (let i = 0; i < inner.length; i++) {
+            const c = inner[i];
+            if (quote) {
+                cur += c;
+                if (c === '\\' && quote === '"')
+                    cur += inner[++i] ?? '';
+                else if (c === quote)
+                    quote = null;
+            }
+            else if (c === '"' || c === "'") {
+                quote = c;
+                cur += c;
+            }
+            else if (c === ',') {
+                if (cur.trim())
+                    items.push(tomlValue(cur.trim()));
+                cur = '';
+            }
+            else
+                cur += c;
+        }
+        if (cur.trim())
+            items.push(tomlValue(cur.trim()));
+        return items;
+    }
+    const n = Number(s.replace(/_/g, ''));
+    return Number.isFinite(n) ? n : s;
+}
+function settingsFromToml(text, file = 'supabase/config.toml') {
+    const values = new Map();
+    for (const [path, v] of parseToml(text)) {
+        if (path === 'project_id' || path.startsWith('auth.') || path === 'auth')
+            values.set(path, { value: v.value, setting: path, file, line: v.line });
+    }
+    return { origin: file, values };
+}
+// ── Management API ─────────────────────────────────────────────────────────
+/** Management API field → config.toml path (`!` negates a boolean). */
+const API_FIELDS = {
+    site_url: 'auth.site_url',
+    jwt_exp: 'auth.jwt_expiry',
+    disable_signup: '!auth.enable_signup',
+    external_anonymous_users_enabled: 'auth.enable_anonymous_sign_ins',
+    security_manual_linking_enabled: 'auth.enable_manual_linking',
+    password_min_length: 'auth.minimum_password_length',
+    refresh_token_rotation_enabled: 'auth.enable_refresh_token_rotation',
+    security_refresh_token_reuse_interval: 'auth.refresh_token_reuse_interval',
+    security_update_password_require_reauthentication: 'auth.email.secure_password_change',
+    security_captcha_enabled: 'auth.captcha.enabled',
+    external_email_enabled: 'auth.email.enabled',
+    mailer_autoconfirm: '!auth.email.enable_confirmations',
+    mailer_secure_email_change_enabled: 'auth.email.double_confirm_changes',
+    mailer_otp_exp: 'auth.email.otp_expiry',
+    mailer_otp_length: 'auth.email.otp_length',
+    smtp_host: 'auth.email.smtp.host',
+    external_phone_enabled: 'auth.sms.enabled',
+    sms_autoconfirm: '!auth.sms.enable_confirmations',
+    sms_provider: 'auth.sms.provider',
+    mfa_max_enrolled_factors: 'auth.mfa.max_enrolled_factors',
+    mfa_totp_enroll_enabled: 'auth.mfa.totp.enroll_enabled',
+    mfa_phone_enroll_enabled: 'auth.mfa.phone.enroll_enabled',
+    mfa_web_authn_enroll_enabled: 'auth.mfa.web_authn.enroll_enabled',
+    passkey_enabled: 'auth.passkey.enabled',
+    webauthn_rp_id: 'auth.webauthn.rp_id',
+    sessions_timebox: 'auth.sessions.timebox',
+    sessions_inactivity_timeout: 'auth.sessions.inactivity_timeout',
+};
+async function fetchSupabaseAuthConfig(opts) {
+    if (!/^[a-z0-9]{10,40}$/.test(opts.projectRef))
+        throw new Error(`Not a Supabase project ref: ${opts.projectRef}`);
+    const http = new vendor_http_1.VendorHttp({ vendor: 'Supabase', baseUrl: opts.apiUrl ?? 'https://api.supabase.com', headers: { authorization: `Bearer ${opts.accessToken}` }, fetchImpl: opts.fetchImpl });
+    const { body } = await http.get(`/v1/projects/${opts.projectRef}/config/auth`);
+    return { ...settingsFromApi((0, record_set_1.isObj)(body) ? body : {}, `supabase project ${opts.projectRef}`), projectRef: opts.projectRef };
+}
+function settingsFromApi(api, origin) {
+    const values = new Map();
+    const put = (path, value, setting) => {
+        if (value !== null && value !== undefined)
+            values.set(path, { value, setting });
+    };
+    for (const [field, target] of Object.entries(API_FIELDS)) {
+        const v = api[field];
+        if (target.startsWith('!'))
+            put(target.slice(1), typeof v === 'boolean' ? !v : v, field);
+        else
+            put(target, v, field);
+    }
+    if (typeof api.uri_allow_list === 'string')
+        put('auth.additional_redirect_urls', api.uri_allow_list.split(',').map((s) => s.trim()).filter(Boolean), 'uri_allow_list');
+    if (typeof api.password_required_characters === 'string')
+        put('auth.password_requirements', requirementsOf(api.password_required_characters), 'password_required_characters');
+    for (const [field, v] of Object.entries(api)) {
+        let m = /^external_([a-z0-9_]+?)_(enabled|client_id|url|skip_nonce_check|email_optional)$/.exec(field);
+        if (m && !['email', 'phone', 'anonymous_users'].includes(m[1]))
+            put(`auth.external.${m[1]}.${m[2]}`, v, field);
+        m = /^hook_([a-z_]+)_(enabled|uri)$/.exec(field);
+        if (m)
+            put(`auth.hook.${m[1]}.${m[2]}`, v, field);
+        m = /^rate_limit_([a-z_]+)$/.exec(field);
+        if (m)
+            put(`auth.rate_limit.${m[1]}`, v, field);
+    }
+    return { origin, values };
+}
+/** The API's character-set string → the config.toml requirement name. */
+function requirementsOf(chars) {
+    const sets = chars.split(':');
+    if (sets.length >= 4)
+        return 'lower_upper_letters_digits_symbols';
+    if (sets.length === 3)
+        return 'lower_upper_letters_digits';
+    if (sets.length === 2)
+        return 'letters_digits';
+    return '';
+}
+// ── translation ────────────────────────────────────────────────────────────
+/** Go durations (`24h`, `1h30m`, `90s`) or seconds → ms. */
+function durationMs(v) {
+    if (typeof v === 'number')
+        return v > 0 ? v * 1000 : undefined;
+    if (typeof v !== 'string' || !v.trim())
+        return undefined;
+    let total = 0;
+    const re = /(\d+(?:\.\d+)?)(h|m|s|ms)/g;
+    let m;
+    let matched = '';
+    while ((m = re.exec(v.trim()))) {
+        matched += m[0];
+        total += Number(m[1]) * { h: 3600_000, m: 60_000, s: 1000, ms: 1 }[m[2]];
+    }
+    return matched === v.trim() && total > 0 ? total : undefined;
+}
+/** Supabase's provider names → Atlas built-in keys. */
+const PROVIDERS = { azure: 'microsoft', linkedin_oidc: 'linkedin', twitter: 'x', x: 'x' };
+/** `env(NAME)` is config.toml's way to keep a secret out of the file. */
+const fromEnv = (v) => (typeof v === 'string' ? /^env\(([A-Z0-9_]+)\)$/.exec(v.trim())?.[1] : undefined);
+function translateSupabaseConfig(s) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const get = (path) => s.values.get(path);
+    const val = (path) => s.values.get(path)?.value;
+    const add = (status, area, path, note, atlas) => {
+        const v = get(path);
+        b.report.push({ status, area, setting: v?.setting ?? path, note, ...(atlas ? { atlas } : {}), ...(v?.file ? { file: v.file, line: v.line } : {}) });
+    };
+    const has = (path) => s.values.has(path);
+    // ── general ──
+    if (has('auth.enable_signup')) {
+        const open = val('auth.enable_signup') !== false;
+        b.set('signUpMode', open ? 'public' : 'restricted');
+        add('mapped', 'general', 'auth.enable_signup', open ? 'Public sign-up.' : 'Sign-up closed (invitations and the allowlist still work).', 'auth_config.signUpMode');
+    }
+    if (has('auth.enable_anonymous_sign_ins')) {
+        b.set('strategies.anonymous', val('auth.enable_anonymous_sign_ins') === true);
+        add('mapped', 'general', 'auth.enable_anonymous_sign_ins', val('auth.enable_anonymous_sign_ins') === true ? 'Guest (anonymous) sign-in on.' : 'Anonymous sign-in off.', 'auth_config.strategies.anonymous');
+    }
+    if (val('auth.enable_manual_linking') === true)
+        add('differs', 'general', 'auth.enable_manual_linking', 'Atlas links accounts from the signed-in user (user.createExternalAccount) without a separate switch.');
+    const urls = [val('auth.site_url'), ...(Array.isArray(val('auth.additional_redirect_urls')) ? val('auth.additional_redirect_urls') : [])].filter((u) => typeof u === 'string' && !!u.trim());
+    let wildcard = false;
+    for (const url of new Set(urls)) {
+        if (url.includes('*')) {
+            wildcard = true;
+            continue;
+        }
+        b.push('redirect_urls', { url });
+    }
+    if (urls.length)
+        add(wildcard ? 'differs' : 'mapped', 'URL configuration', has('auth.additional_redirect_urls') ? 'auth.additional_redirect_urls' : 'auth.site_url', `${urls.length} site / redirect URL(s) become redirect URLs${wildcard ? '; Atlas redirect URLs are exact, so list each URL a wildcard covered' : ''}.`, 'redirect_urls');
+    // ── tokens and sessions ──
+    if (has('auth.jwt_expiry'))
+        add('differs', 'sessions', 'auth.jwt_expiry', `Supabase access tokens lived ${val('auth.jwt_expiry')}s. Atlas issues short-lived session tokens (60s by default) refreshed by its SDKs; lifetime is the session's.`, 'auth_config.session.jwtTtlSeconds');
+    if (has('auth.enable_refresh_token_rotation'))
+        add('mapped', 'sessions', 'auth.enable_refresh_token_rotation', 'Atlas always rotates refresh tokens.', 'auth_config.session');
+    if (has('auth.refresh_token_reuse_interval'))
+        add('differs', 'sessions', 'auth.refresh_token_reuse_interval', 'Atlas has its own reuse grace window for concurrent refreshes.');
+    const timebox = durationMs(val('auth.sessions.timebox'));
+    if (timebox) {
+        b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(timebox));
+        add((0, translate_kit_1.clampSessionMs)(timebox) === timebox ? 'mapped' : 'differs', 'sessions', 'auth.sessions.timebox', 'Session time-box becomes the absolute session lifetime.', 'auth_config.session.absoluteMs');
+    }
+    const idle = durationMs(val('auth.sessions.inactivity_timeout'));
+    if (idle) {
+        b.set('session.idleMs', (0, translate_kit_1.clampSessionMs)(idle));
+        add((0, translate_kit_1.clampSessionMs)(idle) === idle ? 'mapped' : 'differs', 'sessions', 'auth.sessions.inactivity_timeout', 'Inactivity timeout becomes the idle session lifetime.', 'auth_config.session.idleMs');
+    }
+    // ── passwords ──
+    const minLen = val('auth.minimum_password_length');
+    if (typeof minLen === 'number') {
+        b.set('passwordPolicy.minLength', Math.max(minLen, 6));
+        add('mapped', 'passwords', 'auth.minimum_password_length', `Minimum ${minLen} characters.`, 'auth_config.passwordPolicy.minLength');
+    }
+    const req = val('auth.password_requirements');
+    if (typeof req === 'string' && req) {
+        b.set('passwordPolicy.requireNumber', true);
+        if (req.startsWith('lower_upper')) {
+            b.set('passwordPolicy.requireLowercase', true);
+            b.set('passwordPolicy.requireUppercase', true);
+        }
+        if (req.endsWith('symbols'))
+            b.set('passwordPolicy.requireSymbol', true);
+        add(req === 'letters_digits' ? 'differs' : 'mapped', 'passwords', 'auth.password_requirements', req === 'letters_digits' ? 'Letters and digits: Atlas requires a digit (letters are not a separate rule).' : `Character requirements "${req}".`, 'auth_config.passwordPolicy');
+    }
+    if (val('auth.email.secure_password_change') === true)
+        add('mapped', 'passwords', 'auth.email.secure_password_change', 'Atlas asks for the current password (or a fresh sign-in) before a password change.');
+    // ── email ──
+    const emailOn = val('auth.email.enabled') !== false;
+    b.set('strategies.password', emailOn);
+    b.set('strategies.emailLink', emailOn);
+    b.set('strategies.emailCode', emailOn);
+    add('mapped', 'email', has('auth.email.enabled') ? 'auth.email.enabled' : 'auth.email.enable_signup', emailOn ? 'Email sign-in on: password, magic link and one-time code, as in Supabase.' : 'Email sign-in off.', 'auth_config.strategies.password / emailLink / emailCode');
+    if (has('auth.email.enable_confirmations')) {
+        const on = val('auth.email.enable_confirmations') === true;
+        b.set('requireEmailVerification', on);
+        add('mapped', 'email', 'auth.email.enable_confirmations', on ? 'Email addresses are confirmed before sign-in.' : 'Email confirmation off.', 'auth_config.requireEmailVerification');
+    }
+    if (has('auth.email.double_confirm_changes'))
+        add('differs', 'email', 'auth.email.double_confirm_changes', 'Atlas verifies the new address on an email change; it does not also mail the old one.');
+    if (has('auth.email.otp_length') || has('auth.email.otp_expiry'))
+        add('differs', 'email', has('auth.email.otp_length') ? 'auth.email.otp_length' : 'auth.email.otp_expiry', 'Atlas uses 6-digit codes with its own expiry.');
+    if (has('auth.email.smtp.host'))
+        add('manual', 'email', 'auth.email.smtp.host', 'Configure your SMTP server (or email provider) in Atlas; credentials are not copied.');
+    for (const [path] of s.values) {
+        const m = /^auth\.email\.template\.([a-z_]+)\.(subject|content_path)$/.exec(path);
+        if (m && path.endsWith('subject'))
+            add('manual', 'email', path, `Recreate the "${m[1]}" email template in Atlas (Supabase's {{ .ConfirmationURL }} variables differ).`);
+    }
+    // ── phone ──
+    if (val('auth.sms.enable_signup') === true || val('auth.sms.enabled') === true) {
+        b.set('strategies.phoneCode', true);
+        add('mapped', 'phone', has('auth.sms.enabled') ? 'auth.sms.enabled' : 'auth.sms.enable_signup', 'SMS code sign-in on.', 'auth_config.strategies.phoneCode');
+    }
+    for (const provider of ['twilio', 'twilio_verify', 'messagebird', 'textlocal', 'vonage']) {
+        if (val(`auth.sms.${provider}.enabled`) === true)
+            add('manual', 'phone', `auth.sms.${provider}.enabled`, `Connect your ${provider.replace('_', ' ')} account as Atlas's SMS provider (credentials are not copied).`);
+    }
+    if (typeof val('auth.sms.provider') === 'string')
+        add('manual', 'phone', 'auth.sms.provider', `Connect your ${String(val('auth.sms.provider'))} account as Atlas's SMS provider (credentials are not copied).`);
+    // ── MFA and passkeys ──
+    const mfa = (factor, atlas, label) => {
+        const path = `auth.mfa.${factor}.enroll_enabled`;
+        if (!has(path))
+            return;
+        const on = val(path) === true;
+        b.set(`mfa.factors.${atlas}`, on);
+        add('mapped', 'multi-factor', path, `${label} second factor ${on ? 'on' : 'off'}.${on && factor === 'totp' ? ' Enrolled authenticators move with the export (secrets included).' : ''}`, `auth_config.mfa.factors.${atlas}`);
+    };
+    mfa('totp', 'totp', 'Authenticator app');
+    mfa('phone', 'sms', 'SMS');
+    mfa('web_authn', 'passkey', 'WebAuthn');
+    if (has('auth.mfa.max_enrolled_factors'))
+        add('differs', 'multi-factor', 'auth.mfa.max_enrolled_factors', 'Atlas has no cap on enrolled factors.');
+    if (val('auth.passkey.enabled') === true) {
+        b.set('strategies.passkey', true);
+        add('mapped', 'passkeys', 'auth.passkey.enabled', 'Passkey sign-in on.', 'auth_config.strategies.passkey');
+    }
+    if (typeof val('auth.webauthn.rp_id') === 'string')
+        add('differs', 'passkeys', 'auth.webauthn.rp_id', `Passkeys were registered for "${String(val('auth.webauthn.rp_id'))}": they keep working only when Atlas serves sign-in on that domain (export with --rp-id ${String(val('auth.webauthn.rp_id'))}).`);
+    // ── providers ──
+    const providers = new Set();
+    for (const [path] of s.values) {
+        const m = /^auth\.external\.([a-z0-9_]+)\./.exec(path);
+        if (m)
+            providers.add(m[1]);
+    }
+    for (const p of [...providers].sort()) {
+        const base = `auth.external.${p}`;
+        if (val(`${base}.enabled`) !== true)
+            continue;
+        const key = PROVIDERS[p] ?? (0, translate_kit_1.socialKey)(p);
+        if (!key) {
+            add('manual', 'providers', `${base}.enabled`, `"${p}" is not a built-in Atlas provider; add it as a custom OAuth / OIDC provider${val(`${base}.url`) ? ` (issuer ${String(val(`${base}.url`))})` : ''}.`, 'custom_oauth_providers');
+            continue;
+        }
+        const raw = val(`${base}.client_id`);
+        const clientId = typeof raw === 'string' && raw && !fromEnv(raw) ? raw : undefined;
+        const v = get(`${base}.enabled`);
+        b.socialProvider({ atlasKey: key, vendorName: p, area: 'providers', setting: v?.setting ?? `${base}.enabled`, clientId });
+        const last = b.report[b.report.length - 1];
+        if (last && v?.file)
+            Object.assign(last, { file: v.file, line: v.line });
+        if (p === 'azure' && typeof val(`${base}.url`) === 'string')
+            add('differs', 'providers', `${base}.url`, `Azure tenant URL ${String(val(`${base}.url`))}: set the tenant on Atlas's microsoft provider (single-tenant apps).`, 'oauth_providers microsoft');
+        if (val(`${base}.skip_nonce_check`) === true)
+            add('differs', 'providers', `${base}.skip_nonce_check`, 'Atlas always checks the nonce on ID tokens.');
+    }
+    // ── hooks, captcha, third-party auth, rate limits ──
+    for (const [path] of s.values) {
+        const hook = /^auth\.hook\.([a-z_]+)\.enabled$/.exec(path);
+        if (hook && val(path) === true) {
+            const name = hook[1];
+            const to = name === 'custom_access_token' ? 'a JWT template (custom claims)' : name === 'send_email' || name === 'send_sms' ? 'your own delivery provider in Atlas' : name === 'before_user_created' ? 'a before-sign-up action' : 'Atlas attack protection settings';
+            add('manual', 'auth hooks', path, `The ${name} hook moves to ${to}.`);
+        }
+        const third = /^auth\.third_party\.([a-z0-9_]+)\.enabled$/.exec(path);
+        if (third && val(path) === true)
+            add('manual', 'third-party auth', path, `Supabase accepted ${third[1]} tokens: point that integration at Atlas, or migrate it too.`);
+    }
+    if (val('auth.captcha.enabled') === true)
+        add('differs', 'attack protection', 'auth.captcha.enabled', 'Atlas has its own bot protection; captcha keys are not used.');
+    if ([...s.values.keys()].some((k) => k.startsWith('auth.rate_limit.')))
+        add('differs', 'attack protection', [...s.values.keys()].find((k) => k.startsWith('auth.rate_limit.')), 'Atlas applies its own rate limits.');
+    const vars = {};
+    if (s.projectRef)
+        vars.project_ref = s.projectRef;
+    return b.result(s.origin, {
+        bridge: { preset: 'supabase', vars },
+        ...(s.projectRef ? { lazy: { preset: 'supabase', config: { url: `https://${s.projectRef}.supabase.co` } } } : {}),
+    });
+}
+//# sourceMappingURL=supabase-config.js.map

package/dist/migrate/export/supabase-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-config.js","sourceRoot":"","sources":["../../../src/migrate/export/supabase-config.ts"],"names":[],"mappings":";;AAyCA,8BAwBC;AAgED,4CAMC;AAmCD,0DAKC;AAED,0CAqBC;AAcD,gCAYC;AAQD,0DA4JC;AAnYD,6CAA+C;AAC/C,mDAA2E;AAC3E,+CAA2C;AA+B3C,8EAA8E;AAE9E;;;;GAIG;AACH,SAAgB,SAAS,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAA4C,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;QACjB,qDAAqD;QACrD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,GAAG,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/F,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;iBAChC,IAAI,CAAC,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;QACrC,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,GAAG,CAAC,CAAC;aACxC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAChB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;iBAChC,IAAI,CAAC,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;QACrC,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,GAAG,CAAC,CAAC;aACxC,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAc,EAAE,CAAC;QAC5B,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACpB,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,IAAI,CAAC,CAAC;gBACT,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;oBAAE,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpD,IAAI,CAAC,KAAK,KAAK;oBAAE,KAAK,GAAG,IAAI,CAAC;YACrC,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAClC,KAAK,GAAG,CAAC,CAAC;gBACV,GAAG,IAAI,CAAC,CAAC;YACX,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrB,IAAI,GAAG,CAAC,IAAI,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClD,GAAG,GAAG,EAAE,CAAC;YACX,CAAC;;gBAAM,GAAG,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAAY,EAAE,IAAI,GAAG,sBAAsB;IAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,UAAU,GAA2B;IACzC,QAAQ,EAAE,eAAe;IACzB,OAAO,EAAE,iBAAiB;IAC1B,cAAc,EAAE,qBAAqB;IACrC,gCAAgC,EAAE,gCAAgC;IAClE,+BAA+B,EAAE,4BAA4B;IAC7D,mBAAmB,EAAE,8BAA8B;IACnD,8BAA8B,EAAE,oCAAoC;IACpE,qCAAqC,EAAE,mCAAmC;IAC1E,iDAAiD,EAAE,mCAAmC;IACtF,wBAAwB,EAAE,sBAAsB;IAChD,sBAAsB,EAAE,oBAAoB;IAC5C,kBAAkB,EAAE,kCAAkC;IACtD,kCAAkC,EAAE,mCAAmC;IACvE,cAAc,EAAE,uBAAuB;IACvC,iBAAiB,EAAE,uBAAuB;IAC1C,SAAS,EAAE,sBAAsB;IACjC,sBAAsB,EAAE,kBAAkB;IAC1C,eAAe,EAAE,gCAAgC;IACjD,YAAY,EAAE,mBAAmB;IACjC,wBAAwB,EAAE,+BAA+B;IACzD,uBAAuB,EAAE,8BAA8B;IACvD,wBAAwB,EAAE,+BAA+B;IACzD,4BAA4B,EAAE,mCAAmC;IACjE,eAAe,EAAE,sBAAsB;IACvC,cAAc,EAAE,qBAAqB;IACrC,gBAAgB,EAAE,uBAAuB;IACzC,2BAA2B,EAAE,kCAAkC;CAChE,CAAC;AAEK,KAAK,UAAU,uBAAuB,CAAC,IAA4F;IACxI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,0BAA0B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7L,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,gBAAgB,IAAI,CAAC,UAAU,cAAc,CAAC,CAAC;IACpF,OAAO,EAAE,GAAG,eAAe,CAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,oBAAoB,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC7H,CAAC;AAED,SAAgB,eAAe,CAAC,GAAQ,EAAE,MAAc;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAc,EAAE,OAAe,EAAE,EAAE;QAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;;YACpF,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;QAAE,GAAG,CAAC,+BAA+B,EAAE,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvK,IAAI,OAAO,GAAG,CAAC,4BAA4B,KAAK,QAAQ;QAAE,GAAG,CAAC,4BAA4B,EAAE,cAAc,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,8BAA8B,CAAC,CAAC;IAC9K,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,kFAAkF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;YAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAChH,CAAC,GAAG,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC;YAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC;YAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,oCAAoC,CAAC;IAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,4BAA4B,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAE9E,4DAA4D;AAC5D,SAAgB,UAAU,CAAC,CAAU;IACnC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,EAAE,GAAG,4BAA4B,CAAC;IACxC,IAAI,CAAyB,CAAC;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAA2B,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,OAAO,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,uDAAuD;AACvD,MAAM,SAAS,GAA2B,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;AAElH,yEAAyE;AACzE,MAAM,OAAO,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAEtI,SAAgB,uBAAuB,CAAC,CAAuB;IAC7D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,MAAuC,EAAE,IAAY,EAAE,IAAY,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE;QAChH,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,IAAI,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtJ,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEjD,gBAAgB;IAChB,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,oBAAoB,CAAC,KAAK,KAAK,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACpD,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,4DAA4D,EAAE,wBAAwB,CAAC,CAAC;IACpK,CAAC;IACD,IAAI,GAAG,CAAC,gCAAgC,CAAC,EAAE,CAAC;QAC1C,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,gCAAgC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC9E,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,gCAAgC,EAAE,GAAG,CAAC,gCAAgC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IAC9M,CAAC;IACD,IAAI,GAAG,CAAC,4BAA4B,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,4BAA4B,EAAE,sGAAsG,CAAC,CAAC;IAChN,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,+BAA+B,CAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzN,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,mBAAmB,EAAE,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,MAAM,+CAA+C,QAAQ,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IAE9U,4BAA4B;IAC5B,IAAI,GAAG,CAAC,iBAAiB,CAAC;QAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE,gCAAgC,GAAG,CAAC,iBAAiB,CAAC,+GAA+G,EAAE,mCAAmC,CAAC,CAAC;IACtR,IAAI,GAAG,CAAC,oCAAoC,CAAC;QAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,oCAAoC,EAAE,sCAAsC,EAAE,qBAAqB,CAAC,CAAC;IAC9K,IAAI,GAAG,CAAC,mCAAmC,CAAC;QAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,mCAAmC,EAAE,gEAAgE,CAAC,CAAC;IAChL,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,OAAO,CAAC,CAAC,CAAC;QACrD,GAAG,CAAC,IAAA,8BAAc,EAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,uBAAuB,EAAE,yDAAyD,EAAE,gCAAgC,CAAC,CAAC;IACpM,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAA,8BAAc,EAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAA,8BAAc,EAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,kCAAkC,EAAE,uDAAuD,EAAE,4BAA4B,CAAC,CAAC;IACnM,CAAC;IAED,kBAAkB;IAClB,MAAM,MAAM,GAAG,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACnD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE,WAAW,MAAM,cAAc,EAAE,sCAAsC,CAAC,CAAC;IACtI,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,EAAE,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QACzE,GAAG,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE,GAAG,KAAK,gBAAgB,CAAC,CAAC,CAAC,+EAA+E,CAAC,CAAC,CAAC,2BAA2B,GAAG,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACjR,CAAC;IACD,IAAI,GAAG,CAAC,mCAAmC,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE,oFAAoF,CAAC,CAAC;IAE7M,cAAc;IACd,MAAM,OAAO,GAAG,GAAG,CAAC,oBAAoB,CAAC,KAAK,KAAK,CAAC;IACpD,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IACvC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAC,CAAC,2EAA2E,CAAC,CAAC,CAAC,oBAAoB,EAAE,yDAAyD,CAAC,CAAC;IAC/Q,IAAI,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,iCAAiC,CAAC,KAAK,IAAI,CAAC;QAC3D,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;QACtC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,yBAAyB,EAAE,sCAAsC,CAAC,CAAC;IACtL,CAAC;IACD,IAAI,GAAG,CAAC,mCAAmC,CAAC;QAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,mCAAmC,EAAE,uFAAuF,CAAC,CAAC;IACpM,IAAI,GAAG,CAAC,uBAAuB,CAAC,IAAI,GAAG,CAAC,uBAAuB,CAAC;QAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,uBAAuB,EAAE,+CAA+C,CAAC,CAAC;IAC7N,IAAI,GAAG,CAAC,sBAAsB,CAAC;QAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,sBAAsB,EAAE,sFAAsF,CAAC,CAAC;IACxK,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,iFAAiF,CAAC,CAAC;IAC1K,CAAC;IAED,cAAc;IACd,IAAI,GAAG,CAAC,wBAAwB,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/E,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACpC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,wBAAwB,EAAE,sBAAsB,EAAE,kCAAkC,CAAC,CAAC;IAC9J,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzF,IAAI,GAAG,CAAC,YAAY,QAAQ,UAAU,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,QAAQ,UAAU,EAAE,gBAAgB,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,gEAAgE,CAAC,CAAC;IACvN,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,gEAAgE,CAAC,CAAC;IAEhN,yBAAyB;IACzB,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,YAAY,MAAM,iBAAiB,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACvB,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,eAAe,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,KAAK,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,mEAAmE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC/N,CAAC,CAAC;IACF,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACzC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3B,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACxC,IAAI,GAAG,CAAC,+BAA+B,CAAC;QAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,+BAA+B,EAAE,uCAAuC,CAAC,CAAC;IACnJ,IAAI,GAAG,CAAC,sBAAsB,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAClC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,qBAAqB,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,iCAAiC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,2FAA2F,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC;IAE5S,kBAAkB;IAClB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,GAAG,IAAI,UAAU,CAAC,KAAK,IAAI;YAAE,SAAS;QAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,IAAA,yBAAS,EAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,UAAU,EAAE,IAAI,CAAC,+EAA+E,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;YACpO,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC;QACjC,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,IAAI,GAAG,IAAI,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1H,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,IAAI,IAAI,CAAC,EAAE,IAAI;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,OAAO,IAAI,OAAO,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,MAAM,EAAE,oBAAoB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,sEAAsE,EAAE,2BAA2B,CAAC,CAAC;QAC3P,IAAI,GAAG,CAAC,GAAG,IAAI,mBAAmB,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,mBAAmB,EAAE,6CAA6C,CAAC,CAAC;IACvJ,CAAC;IAED,sDAAsD;IACtD,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACtB,MAAM,EAAE,GAAG,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kCAAkC,CAAC;YACtQ,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,KAAK,GAAG,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,qBAAqB,KAAK,CAAC,CAAC,CAAC,8DAA8D,CAAC,CAAC;IACxK,CAAC;IACD,IAAI,GAAG,CAAC,sBAAsB,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,SAAS,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,8DAA8D,CAAC,CAAC;IACtK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;QAAE,GAAG,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAE,EAAE,oCAAoC,CAAC,CAAC;IAEvN,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,CAAC,CAAC,UAAU;QAAE,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC;IAClD,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;QACxB,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;QACpC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,UAAU,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClH,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/supabase.d.ts

@@ -0,0 +1,86 @@
+import type { PasswordHash, UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export supabase` — Supabase Auth (GoTrue), hosted or
+ * self-hosted, onto the canonical bundle models.
+ *
+ * The complete export reads the `auth` schema, which only the database
+ * exposes: dump the tables with your own tools on your machine, e.g.
+ *
+ *   for t in users identities mfa_factors sessions refresh_tokens \
+ *            sso_providers sso_domains saml_providers webauthn_credentials \
+ *            mfa_recovery_code_sets mfa_recovery_codes; do
+ *     psql "$SUPABASE_DB_URL" -c "\copy (select * from auth.$t) to '$t.csv' csv header"
+ *   done
+ *
+ * and pass the folder. Files may be `<table>.csv` (with a header), `.json`
+ * (an array) or `.ndjson`, named `users.csv` or `auth.users.csv`; missing
+ * optional tables are skipped. Nothing connects to the database.
+ *
+ *   - users with emails / phone and their confirmed state, app_metadata
+ *     (public metadata), user_metadata (unsafe metadata: users can edit it),
+ *     bans, bcrypt / argon2 / Firebase-scrypt password hashes as stored;
+ *   - social / OIDC identities and SAML SSO identities with their providers
+ *     and domains;
+ *   - TOTP factors WITH their secret (GoTrue stores it in plaintext unless
+ *     column encryption is on: pass the GOTRUE_SECURITY_DB_ENCRYPTION key and
+ *     both secrets and hashes are decrypted here), phone factors, WebAuthn factors and passkeys
+ *     (with --rp-id), recovery codes as their argon2id hashes;
+ *   - live sessions keyed by their legacy refresh tokens, for the bridge.
+ *
+ * Without a dump, the Admin API (`/auth/v1/admin/users`, service_role key)
+ * gives users, identities and factor metadata but NO password hashes or TOTP
+ * secrets: passwords then move by the supabase lazy-migration preset.
+ */
+export interface SupabaseExportOptions {
+    /** A folder of auth-schema table dumps. */
+    dumpDir?: string;
+    /** Tables already read (tests, or a caller with its own reader). */
+    tables?: Record<string, Obj[]>;
+    /** `https://<ref>.supabase.co` (or a self-hosted URL), for the Admin API and the manifest. */
+    url?: string;
+    /** The service_role / secret key, for the Admin API (only when there is no dump). */
+    serviceRoleKey?: string;
+    /** The WebAuthn relying-party id passkeys were registered for. */
+    rpId?: string;
+    includeAnonymous?: boolean;
+    /**
+     * GoTrue column-encryption keys (GOTRUE_SECURITY_DB_ENCRYPTION_ENCRYPTION_KEY
+     * and any _DECRYPTION_KEYS), each `key` or `key_id:key`: encrypted password
+     * hashes and TOTP secrets are decrypted on this machine.
+     */
+    dbEncryptionKeys?: string[];
+    /** How long an imported session stays exchangeable when Supabase set no `not_after` (default 30 days). */
+    sessionDays?: number;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    onProgress?: (message: string) => void;
+}
+/** Read every table file in a dump folder: `{ users: [...], identities: [...] }` (schema prefix dropped, lowercase). */
+export declare function readTableDump(dir: string): Record<string, Obj[]>;
+export declare function parseTableText(text: string, ext: string): Obj[];
+/**
+ * `auth.users.encrypted_password` → a bundle password: bcrypt and argon2 are
+ * self-describing; `$fbscrypt$` (Firebase users imported into Supabase) is
+ * unpacked into the registry's scrypt_firebase fields. A value encrypted with
+ * GoTrue's column encryption (JSON `aes-gcm-hkdf`) cannot be read here.
+ */
+export declare function supabasePassword(raw: unknown): {
+    password?: PasswordHash;
+    problem?: 'encrypted' | 'unknown' | 'no_signer_key';
+};
+/**
+ * GoTrue's column encryption (`crypto.EncryptedString`): a JSON
+ * `{"key_id","alg":"aes-gcm-hkdf","data","nonce"}` (std base64), the AES-256-GCM
+ * key derived as HKDF-SHA256(ikm = base64url key, no salt, info = the row id —
+ * the user id for a password hash, the factor id for a TOTP secret). Keys
+ * given as `key_id:key` are tried for their key id only; bare keys for any.
+ * Undefined when the value is not an EncryptedString or no key opens it.
+ */
+export declare function decryptGotrueColumn(raw: string, rowId: string, keys: readonly string[]): string | undefined;
+export declare function exportSupabase(opts: SupabaseExportOptions): Promise<RecordSet>;
+export declare function mapSupabaseTables(tables: Record<string, Obj[]>, opts: Omit<SupabaseExportOptions, 'now'> & {
+    now: number;
+}): RecordSet;
+export declare function mapSupabaseUser(u: Obj, password: PasswordHash | undefined, now: number): UserRecord | null;