@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/export/fusionauth-config.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchFusionAuthConfig = fetchFusionAuthConfig;
+exports.translateFusionAuthConfig = translateFusionAuthConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function fetchFusionAuthConfig(http, baseUrl, warn = () => undefined) {
+    const list = async (path, key, what) => {
+        try {
+            const { body } = await http.get(path);
+            return (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
+        }
+        catch (err) {
+            if (!(err instanceof vendor_http_1.VendorApiError) || ![401, 403, 404].includes(err.status))
+                throw err;
+            if (err.status !== 404)
+                warn(`${what} could not be read with this API key (${err.status}) and were skipped.`);
+            return [];
+        }
+    };
+    return {
+        baseUrl,
+        tenants: await list('/api/tenant', 'tenants', 'Tenants'),
+        applications: await list('/api/application', 'applications', 'Applications'),
+        identityProviders: await list('/api/identity-provider', 'identityProviders', 'Identity providers'),
+        lambdas: await list('/api/lambda', 'lambdas', 'Lambdas'),
+        webhooks: await list('/api/webhook', 'webhooks', 'Webhooks'),
+        themes: await list('/api/theme', 'themes', 'Themes'),
+    };
+}
+const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
+function translateFusionAuthConfig(snap, opts = {}) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const tenant = (opts.tenantId ? snap.tenants.find((t) => (0, record_set_1.str)(t.id) === opts.tenantId) : snap.tenants.find((t) => t.name === 'Default') ?? snap.tenants[0]) ?? {};
+    const tName = (0, record_set_1.str)(tenant.name) ?? 'tenant';
+    const area = `tenant ${tName}`;
+    b.set('strategies.password', true);
+    b.add('differs', 'authentication', 'password', 'Password sign-in. A database export carries the hashes (FusionAuth schemes verify as they are and re-hash on first sign-in); with the API alone, use the fusionauth lazy-migration preset.', 'auth_config.strategies.password');
+    if (snap.tenants.length > 1)
+        b.add('differs', 'tenants', 'tenants', `${snap.tenants.length} tenants: this report covers "${tName}". One Atlas instance per tenant, or one instance with tenants as organizations (data export tenantsAs).`, 'organizations');
+    // ── password rules ──
+    const rules = (0, record_set_1.isObj)(tenant.passwordValidationRules) ? tenant.passwordValidationRules : {};
+    const min = num(rules.minLength);
+    b.set('passwordPolicy.minLength', Math.max(8, min || 8));
+    if (min)
+        b.add(min < 8 ? 'differs' : 'mapped', area, 'passwordValidationRules.minLength', `${min}${min < 8 ? ' (Atlas requires at least 8; existing passwords still sign in)' : ''}.`, 'auth_config.passwordPolicy.minLength');
+    if (num(rules.maxLength)) {
+        b.set('passwordPolicy.maxLength', Math.min(num(rules.maxLength), 4096));
+        b.add('mapped', area, 'passwordValidationRules.maxLength', `${rules.maxLength}.`, 'auth_config.passwordPolicy.maxLength');
+    }
+    if (rules.requireMixedCase === true) {
+        b.set('passwordPolicy.requireUppercase', true);
+        b.set('passwordPolicy.requireLowercase', true);
+        b.add('mapped', area, 'passwordValidationRules.requireMixedCase', 'Upper and lower case required.', 'auth_config.passwordPolicy');
+    }
+    if (rules.requireNumber === true) {
+        b.set('passwordPolicy.requireNumber', true);
+        b.add('mapped', area, 'passwordValidationRules.requireNumber', 'A number required.', 'auth_config.passwordPolicy.requireNumber');
+    }
+    if (rules.requireNonAlpha === true) {
+        b.set('passwordPolicy.requireSymbol', true);
+        b.add('mapped', area, 'passwordValidationRules.requireNonAlpha', 'A non-alphanumeric character required.', 'auth_config.passwordPolicy.requireSymbol');
+    }
+    const history = (0, record_set_1.isObj)(rules.rememberPreviousPasswords) ? rules.rememberPreviousPasswords : {};
+    if (history.enabled === true && num(history.count)) {
+        b.set('passwordPolicy.historyCount', num(history.count));
+        b.add('mapped', area, 'passwordValidationRules.rememberPreviousPasswords', `Last ${history.count} passwords. Atlas starts the history at the first password set in Atlas.`, 'auth_config.passwordPolicy.historyCount');
+    }
+    const breach = (0, record_set_1.isObj)(rules.breachDetection) ? rules.breachDetection : {};
+    if (breach.enabled === true) {
+        b.set('passwordPolicy.checkBreaches', true);
+        b.add('mapped', area, 'passwordValidationRules.breachDetection', 'Breached passwords are refused.', 'auth_config.passwordPolicy.checkBreaches');
+    }
+    const pw = (0, record_set_1.isObj)(tenant.passwordEncryptionConfiguration) ? tenant.passwordEncryptionConfiguration : {};
+    if ((0, record_set_1.str)(pw.encryptionScheme))
+        b.add('differs', area, `passwordEncryptionConfiguration ${pw.encryptionScheme}`, 'Atlas stores Argon2id; imported FusionAuth hashes verify as they are and re-hash on first sign-in.', 'auth_config.passwordPolicy');
+    // ── multi-factor ──
+    const mfa = (0, record_set_1.isObj)(tenant.multiFactorConfiguration) ? tenant.multiFactorConfiguration : {};
+    const policy = (0, record_set_1.str)(mfa.loginPolicy);
+    if (policy === 'Required') {
+        b.set('mfaPolicy', 'required');
+        b.add('mapped', area, 'multiFactorConfiguration.loginPolicy', 'A second factor on every sign-in.', 'auth_config.mfaPolicy');
+    }
+    else if (policy === 'Enabled') {
+        b.set('mfaPolicy', 'optional');
+        b.add('mapped', area, 'multiFactorConfiguration.loginPolicy', 'Second factor optional (users who enrolled are challenged).', 'auth_config.mfaPolicy');
+    }
+    if ((0, record_set_1.isObj)(mfa.authenticator) && mfa.authenticator.enabled !== false) {
+        b.set('mfa.factors.totp', true);
+        b.add('mapped', area, 'multiFactorConfiguration.authenticator', 'Authenticator apps. Secrets move with a database export; with the API alone users enrol again.', 'auth_config.mfa.factors.totp');
+    }
+    if ((0, record_set_1.isObj)(mfa.email) && mfa.email.enabled === true) {
+        b.set('mfa.factors.emailCode', true);
+        b.add('mapped', area, 'multiFactorConfiguration.email', 'Email code as a second factor.', 'auth_config.mfa.factors.emailCode');
+    }
+    if ((0, record_set_1.isObj)(mfa.sms) && mfa.sms.enabled === true) {
+        b.set('mfa.factors.sms', true);
+        b.add('differs', area, 'multiFactorConfiguration.sms', 'SMS second factor: the phone numbers move with the data export; Atlas sends through your own messaging provider (bring your own keys), and recommends TOTP or passkeys.', 'auth_config.mfa.factors.sms');
+    }
+    const webauthn = (0, record_set_1.isObj)(tenant.webAuthnConfiguration) ? tenant.webAuthnConfiguration : {};
+    if (webauthn.enabled === true) {
+        b.set('strategies.passkey', true);
+        b.set('mfa.factors.passkey', true);
+        b.add('differs', area, 'webAuthnConfiguration', `Passkeys. FusionAuth does not export WebAuthn credentials: users register again${(0, record_set_1.str)(webauthn.relyingPartyId) ? ` (relying party ${webauthn.relyingPartyId})` : ''}.`, 'auth_config.mfa.factors.passkey');
+    }
+    // ── tokens and sessions ──
+    const jwt = (0, record_set_1.isObj)(tenant.jwtConfiguration) ? tenant.jwtConfiguration : {};
+    if (num(jwt.timeToLiveInSeconds)) {
+        b.set('session.jwtTtlSeconds', Math.min(Math.max(num(jwt.timeToLiveInSeconds), 60), 3600));
+        b.add('mapped', area, 'jwtConfiguration.timeToLiveInSeconds', `${jwt.timeToLiveInSeconds} seconds (Atlas allows 60 to 3600).`, 'auth_config.session.jwtTtlSeconds');
+    }
+    if (num(jwt.refreshTokenTimeToLiveInMinutes)) {
+        b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(num(jwt.refreshTokenTimeToLiveInMinutes) * 60_000));
+        b.add('mapped', area, 'jwtConfiguration.refreshTokenTimeToLiveInMinutes', `${jwt.refreshTokenTimeToLiveInMinutes} minutes.`, 'auth_config.session.absoluteMs');
+    }
+    if ((0, record_set_1.str)(jwt.refreshTokenExpirationPolicy) === 'SlidingWindow' && num(jwt.refreshTokenTimeToLiveInMinutes)) {
+        b.set('session.idleMs', (0, translate_kit_1.clampSessionMs)(num(jwt.refreshTokenTimeToLiveInMinutes) * 60_000));
+        b.add('mapped', area, 'jwtConfiguration.refreshTokenExpirationPolicy', 'Sliding window: an idle limit of the same length.', 'auth_config.session.idleMs');
+    }
+    const failed = (0, record_set_1.isObj)(tenant.failedAuthenticationConfiguration) ? tenant.failedAuthenticationConfiguration : {};
+    if (num(failed.tooManyAttempts))
+        b.add('mapped', area, 'failedAuthenticationConfiguration', `Lockout after ${failed.tooManyAttempts} failures: Atlas throttles failed sign-ins per account and IP (a locked user can be banned by an administrator).`, 'auth_config.rateLimit');
+    // ── applications: sign-up, redirect URLs, roles ──
+    const redirects = new Set();
+    let roleCount = 0;
+    for (const app of snap.applications) {
+        if (app.active === false)
+            continue;
+        const name = (0, record_set_1.str)(app.name) ?? (0, record_set_1.str)(app.id) ?? 'application';
+        const reg = (0, record_set_1.isObj)(app.registrationConfiguration) ? app.registrationConfiguration : {};
+        if (reg.enabled !== true && !b.auth.signUpMode) {
+            b.set('signUpMode', 'restricted');
+            b.add('mapped', `applications ${name}`, 'registrationConfiguration.enabled', 'Self-registration is off: Atlas sign-up is restricted (invitations still work).', 'auth_config.signUpMode');
+        }
+        if (app.verifyRegistration === true) {
+            b.set('requireEmailVerification', true);
+            b.add('mapped', `applications ${name}`, 'verifyRegistration', 'Email verification required.', 'auth_config.requireEmailVerification');
+        }
+        const oauth = (0, record_set_1.isObj)(app.oauthConfiguration) ? app.oauthConfiguration : {};
+        for (const u of (0, record_set_1.strs)(oauth.authorizedRedirectURLs))
+            redirects.add(u);
+        if ((0, record_set_1.strs)(oauth.enabledGrants).includes('client_credentials'))
+            b.add('manual', `applications ${name}`, 'oauthConfiguration.enabledGrants client_credentials', 'A machine-to-machine application: create an Atlas M2M client for it.', 'oauth_clients');
+        if ((0, record_set_1.strs)(oauth.enabledGrants).includes('password'))
+            b.add('manual', `applications ${name}`, 'oauthConfiguration.enabledGrants password', 'Resource-owner password grant: Atlas does not offer it; move the app to the authorization-code flow with PKCE.');
+        if ((0, record_set_1.isObj)(app.samlv2Configuration) && app.samlv2Configuration.enabled === true)
+            b.add('manual', `applications ${name}`, 'samlv2Configuration', 'FusionAuth acting as a SAML identity provider for this application: Atlas can act as one, configure it per service provider.', 'saml_idp');
+        for (const r of (0, record_set_1.objs)(app.roles)) {
+            const rn = (0, record_set_1.str)(r.name);
+            if (!rn)
+                continue;
+            const key = (0, translate_kit_1.keyOf)(rn);
+            if (b.roles[rn])
+                continue;
+            b.roles[rn] = key;
+            roleCount++;
+            b.push('roles', { key, name: rn, description: (0, record_set_1.str)(r.description) ?? '', permissions: [] });
+        }
+    }
+    if (roleCount)
+        b.add('differs', 'applications', 'roles', `${roleCount} application role(s) become Atlas app roles (roles of the same name in different applications share one key).`, 'roles');
+    let exact = 0;
+    for (const url of redirects) {
+        if (url.includes('*') || !/^https?:\/\//.test(url)) {
+            b.add('differs', 'applications', `authorizedRedirectURLs ${url}`, 'Atlas redirect URLs are exact absolute URLs (no wildcards or custom schemes).', 'redirect_urls');
+            continue;
+        }
+        b.push('redirect_urls', { url });
+        exact++;
+    }
+    if (exact)
+        b.add('mapped', 'applications', 'authorizedRedirectURLs', `${exact} redirect URL(s).`, 'redirect_urls');
+    // ── identity providers ──
+    for (const idp of snap.identityProviders) {
+        if (idp.enabled === false)
+            continue;
+        const type = (0, record_set_1.str)(idp.type) ?? '';
+        const name = (0, record_set_1.str)(idp.name) ?? type;
+        if (type === 'SAMLv2' || type === 'OpenIDConnect') {
+            b.add('mapped', 'identity providers', `${name} (${type})`, 'Enterprise IdP: moves with the data export as an Atlas SSO connection; point it at Atlas\'s ACS URL / redirect URI at cutover.', 'sso_connections');
+            continue;
+        }
+        if (type === 'SAMLv2IdPInitiated') {
+            b.add('manual', 'identity providers', `${name} (${type})`, 'IdP-initiated SAML: Atlas SAML connections are SP-initiated.');
+            continue;
+        }
+        if (type === 'ExternalJWT' || type === 'SonyPSN' || type === 'Nintendo' || type === 'HYPR') {
+            b.add('manual', 'identity providers', `${name} (${type})`, 'No built-in Atlas provider: add it as a custom OAuth provider.', 'custom_oauth_providers');
+            continue;
+        }
+        const key = (0, translate_kit_1.socialKey)(type);
+        if (!key) {
+            b.add('manual', 'identity providers', `${name} (${type})`, 'No built-in Atlas provider: add it as a custom OAuth provider.', 'custom_oauth_providers');
+            continue;
+        }
+        const first = Object.values((0, record_set_1.isObj)(idp.applicationConfiguration) ? idp.applicationConfiguration : {}).find(record_set_1.isObj);
+        const clientId = (0, record_set_1.str)(idp.client_id) ?? (0, record_set_1.str)(first?.client_id);
+        b.socialProvider({ atlasKey: key, vendorName: name, area: 'identity providers', setting: `${name} (${type})`, clientId, scopes: (0, record_set_1.str)(idp.scope)?.split(/[\s,]+/).filter(Boolean) });
+    }
+    // ── what has no counterpart ──
+    const email = (0, record_set_1.isObj)(tenant.emailConfiguration) ? tenant.emailConfiguration : {};
+    if ((0, record_set_1.str)(email.host))
+        b.add('manual', area, 'emailConfiguration', `Mail goes through your own provider in Atlas (bring your own keys): configure ${(0, record_set_1.str)(email.host)} or an email API in the email provider settings; the SMTP password is never returned by FusionAuth.`, 'email_provider');
+    const activeLambdas = snap.lambdas.filter((l) => l.enabled !== false);
+    if (activeLambdas.length)
+        b.add('manual', 'lambdas', `${activeLambdas.length} lambda(s)`, 'JWT populate, reconcile and SAML lambdas: port the claims logic to an Atlas JWT template / action.', 'jwt_templates');
+    for (const w of snap.webhooks)
+        if (w.enabled !== false)
+            b.add('manual', 'webhooks', (0, record_set_1.str)(w.url) ?? (0, record_set_1.str)(w.id) ?? '?', 'FusionAuth webhook: recreate it as an Atlas webhook (event names differ).', 'webhooks');
+    if (snap.themes.filter((t) => (0, record_set_1.str)(t.name) !== 'FusionAuth Default').length)
+        b.add('manual', 'themes', 'custom themes', 'FusionAuth (FreeMarker) themes: rebuild the look in Atlas branding or the embeddable components.', 'branding');
+    if (snap.baseUrl)
+        b.add('differs', area, 'issuer', `Tokens carry iss "${(0, record_set_1.str)(tenant.issuer) ?? '(tenant issuer)'}"; Atlas tokens carry your Atlas issuer. Resource servers that pin the old issuer accept both during the bridge window (legacy issuers).`, 'legacy_issuers');
+    const vars = {};
+    if (snap.baseUrl)
+        vars.base_url = snap.baseUrl;
+    const issuer = (0, record_set_1.str)(tenant.issuer);
+    const urlIssuer = issuer && /^https:\/\//.test(issuer);
+    const bridgeVars = { ...vars, ...(issuer && !urlIssuer ? { issuer_name: issuer } : {}) };
+    return b.result(`FusionAuth ${area}`, {
+        bridge: { preset: urlIssuer ? 'fusionauth_url_issuer' : 'fusionauth', vars: bridgeVars },
+        lazy: { preset: 'fusionauth', config: vars },
+    });
+}
+//# sourceMappingURL=fusionauth-config.js.map

package/dist/migrate/export/fusionauth-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fusionauth-config.js","sourceRoot":"","sources":["../../../src/migrate/export/fusionauth-config.ts"],"names":[],"mappings":";;AA0BA,sDAoBC;AAID,8DAkLC;AAlOD,6CAAgE;AAChE,mDAAkF;AAClF,+CAAgE;AAsBzD,KAAK,UAAU,qBAAqB,CAAC,IAAgB,EAAE,OAAgB,EAAE,OAA4B,GAAG,EAAE,CAAC,SAAS;IACzH,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,GAAW,EAAE,IAAY,EAAkB,EAAE;QAC7E,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;YAC/C,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,CAAC;YACzF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,IAAI,CAAC,GAAG,IAAI,yCAAyC,GAAG,CAAC,MAAM,qBAAqB,CAAC,CAAC;YAC9G,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,OAAO;QACP,OAAO,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC;QACxD,YAAY,EAAE,MAAM,IAAI,CAAC,kBAAkB,EAAE,cAAc,EAAE,cAAc,CAAC;QAC5E,iBAAiB,EAAE,MAAM,IAAI,CAAC,wBAAwB,EAAE,mBAAmB,EAAE,oBAAoB,CAAC;QAClG,OAAO,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC;QACxD,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC;QAC5D,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1F,SAAgB,yBAAyB,CAAC,IAA8B,EAAE,OAA8B,EAAE;IACxG,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjK,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC3C,MAAM,IAAI,GAAG,UAAU,KAAK,EAAE,CAAC;IAE/B,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,4LAA4L,EAAE,iCAAiC,CAAC,CAAC;IAChR,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,iCAAiC,KAAK,0GAA0G,EAAE,eAAe,CAAC,CAAC;IAE7P,uBAAuB;IACvB,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,GAAG;QAAE,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAC/N,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,0CAA0C,EAAE,gCAAgC,EAAE,4BAA4B,CAAC,CAAC;IACpI,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,uCAAuC,EAAE,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;IACnI,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,yCAAyC,EAAE,wCAAwC,EAAE,0CAA0C,CAAC,CAAC;IACzJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,mDAAmD,EAAE,QAAQ,OAAO,CAAC,KAAK,0EAA0E,EAAE,yCAAyC,CAAC,CAAC;IACzN,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,yCAAyC,EAAE,iCAAiC,EAAE,0CAA0C,CAAC,CAAC;IAClJ,CAAC;IACD,MAAM,EAAE,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,IAAI,IAAA,gBAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,gBAAgB,EAAE,EAAE,oGAAoG,EAAE,4BAA4B,CAAC,CAAC;IAEnP,qBAAqB;IACrB,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,mCAAmC,EAAE,uBAAuB,CAAC,CAAC;IAC9H,CAAC;SAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,6DAA6D,EAAE,uBAAuB,CAAC,CAAC;IACxJ,CAAC;IACD,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,wCAAwC,EAAE,gGAAgG,EAAE,8BAA8B,CAAC,CAAC;IACpM,CAAC;IACD,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACnD,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,gCAAgC,EAAE,gCAAgC,EAAE,mCAAmC,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/C,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,8BAA8B,EAAE,yKAAyK,EAAE,6BAA6B,CAAC,CAAC;IACnQ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,uBAAuB,EAAE,kFAAkF,IAAA,gBAAG,EAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAmB,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAC7P,CAAC;IAED,4BAA4B;IAC5B,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACjC,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,GAAG,GAAG,CAAC,mBAAmB,qCAAqC,EAAE,mCAAmC,CAAC,CAAC;IACtK,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,CAAC;QAC7C,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,kDAAkD,EAAE,GAAG,GAAG,CAAC,+BAA+B,WAAW,EAAE,gCAAgC,CAAC,CAAC;IACjK,CAAC;IACD,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,4BAA4B,CAAC,KAAK,eAAe,IAAI,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,CAAC;QAC1G,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAA,8BAAc,EAAC,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;QAC3F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,+CAA+C,EAAE,mDAAmD,EAAE,4BAA4B,CAAC,CAAC;IAC5J,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/G,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,iBAAiB,MAAM,CAAC,eAAe,kHAAkH,EAAE,uBAAuB,CAAC,CAAC;IAEhR,oDAAoD;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,mCAAmC,EAAE,iFAAiF,EAAE,wBAAwB,CAAC,CAAC;QAC5L,CAAC;QACD,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,sCAAsC,CAAC,CAAC;QACxI,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,KAAK,CAAC,sBAAsB,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,IAAA,iBAAI,EAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,qDAAqD,EAAE,sEAAsE,EAAE,eAAe,CAAC,CAAC;QACtP,IAAI,IAAA,iBAAI,EAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,2CAA2C,EAAE,gHAAgH,CAAC,CAAC;QAC3P,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,OAAO,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE,qBAAqB,EAAE,8HAA8H,EAAE,UAAU,CAAC,CAAC;QAC3R,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,EAAE,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC1B,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC;YAClB,SAAS,EAAE,CAAC;YACZ,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,IAAI,SAAS;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,SAAS,+GAA+G,EAAE,OAAO,CAAC,CAAC;IAC/L,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,0BAA0B,GAAG,EAAE,EAAE,+EAA+E,EAAE,eAAe,CAAC,CAAC;YACpK,SAAS;QACX,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,wBAAwB,EAAE,GAAG,KAAK,mBAAmB,EAAE,eAAe,CAAC,CAAC;IAEnH,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzC,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACnC,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAClD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,gIAAgI,EAAE,iBAAiB,CAAC,CAAC;YAChN,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,8DAA8D,CAAC,CAAC;YAC3H,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,gEAAgE,EAAE,wBAAwB,CAAC,CAAC;YACvJ,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,gEAAgE,EAAE,wBAAwB,CAAC,CAAC;YACvJ,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAK,CAAC,CAAC;QACjH,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAA,gBAAG,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrL,CAAC;IAED,gCAAgC;IAChC,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAI,IAAA,gBAAG,EAAC,KAAK,CAAC,IAAI,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE,iFAAiF,IAAA,gBAAG,EAAC,KAAK,CAAC,IAAI,CAAC,qGAAqG,EAAE,gBAAgB,CAAC,CAAC;IAC1R,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACtE,IAAI,aAAa,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,MAAM,YAAY,EAAE,oGAAoG,EAAE,eAAe,CAAC,CAAC;IACjN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,2EAA2E,EAAE,UAAU,CAAC,CAAC;IAC7M,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,oBAAoB,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,kGAAkG,EAAE,UAAU,CAAC,CAAC;IACvO,IAAI,IAAI,CAAC,OAAO;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,qBAAqB,IAAA,gBAAG,EAAC,MAAM,CAAC,MAAM,CAAC,IAAI,iBAAiB,0IAA0I,EAAE,gBAAgB,CAAC,CAAC;IAE7Q,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACzF,OAAO,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE;QACpC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE;QACxF,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/fusionauth.d.ts

@@ -0,0 +1,99 @@
+import type { PasswordHash } from '@atlasauth/migrate';
+import { type Tables } from './frameworks/tables';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export fusionauth` — a FusionAuth tenant (self-hosted or
+ * FusionAuth Cloud) onto the canonical bundle models. Two ways in, both on the
+ * owner's machine:
+ *
+ *   - the API with an API key (read-only is enough): users with their
+ *     registrations, roles, groups, linked identity providers, two-factor
+ *     methods (SMS, email) and recovery codes, identity providers (SAML v2 /
+ *     OpenID Connect as SSO connections), applications and API keys. The API
+ *     NEVER returns password hashes or authenticator secrets.
+ *   - a DATABASE DUMP of a self-hosted install (one file per table, see
+ *     {@link fusionAuthSnapshotFromTables}): the only path with the hashes
+ *     (`password`, `salt`, `factor`, `encryption_scheme`) and authenticator
+ *     secrets. FusionAuth Cloud has no database access: ask FusionAuth support
+ *     for the export, or use the `fusionauth` lazy-migration preset.
+ *
+ * Both paths build one {@link FusionAuthSnapshot}; {@link mapFusionAuth} maps it.
+ * The FusionAuth user id is the `sub` of every FusionAuth JWT, so it is the user id.
+ */
+export interface FusionAuthSnapshot {
+    baseUrl?: string;
+    tenants: Obj[];
+    /** Applications with their `roles` ([{ name, isDefault, isSuperRole }]). */
+    applications: Obj[];
+    /** Groups with `roles` ({ <applicationId>: [role names] }). */
+    groups: Obj[];
+    identityProviders: Obj[];
+    /** Public keys by key id (PEM), for SAML identity providers. */
+    keys: Record<string, string>;
+    apiKeys: Obj[];
+    /**
+     * Users in the API shape (`registrations`, `memberships`, `twoFactor.methods`) plus what the API
+     * cannot return: `password`, `salt`, `factor`, `encryptionScheme`, `links` (identity provider links) and `recoveryCodes`.
+     */
+    users: Obj[];
+    source: 'api' | 'database';
+}
+export interface FusionAuthMapOptions {
+    /** Groups move as organizations (default), as app roles, or not at all. */
+    groupsAs?: 'organizations' | 'roles' | 'skip';
+    /** Several tenants: each tenant becomes an organization its users belong to. */
+    tenantsAs?: 'organizations' | 'skip';
+}
+/**
+ * A FusionAuth password (`password`, `salt`, `factor`, `encryption_scheme`) →
+ * an Atlas hash. Schemes and their registry ids are documented in core's
+ * fusionauth-hashes.ts; salts are base64 except bcrypt's 22-character salt.
+ */
+export declare function fusionAuthPassword(u: {
+    password?: unknown;
+    salt?: unknown;
+    factor?: unknown;
+    encryptionScheme?: unknown;
+}): {
+    hash: PasswordHash;
+} | {
+    problem: string;
+} | null;
+export interface FusionAuthApiOptions {
+    /** `https://auth.example.com` or `https://acme.fusionauth.io`. */
+    baseUrl: string;
+    apiKey: string;
+    /** Required by FusionAuth when the API key is not tenant-locked and there are several tenants. */
+    tenantId?: string;
+    pageSize?: number;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (m: string) => void;
+}
+export declare function fusionAuthBase(raw: string): string;
+export declare function fusionAuthHttp(o: FusionAuthApiOptions): VendorHttp;
+/** Read a tenant through the API into a snapshot. */
+export declare function fetchFusionAuth(http: VendorHttp, o: Pick<FusionAuthApiOptions, 'baseUrl' | 'pageSize' | 'onProgress'> & {
+    warn?: (m: string) => void;
+}): Promise<FusionAuthSnapshot>;
+/**
+ * A snapshot from a dump of a self-hosted FusionAuth database: one file per
+ * table (`psql \copy users TO 'users.csv' CSV HEADER`, or `mysql … --batch`
+ * converted, or a JSON array), named as in FusionAuth's schema: `users`,
+ * `identities` (1.59+), `tenants`, `applications`, `application_roles`,
+ * `user_registrations`, `user_registrations_application_roles`, `groups`,
+ * `group_members`, `group_application_roles`, `identity_providers`,
+ * `identity_provider_links`, `twofactor_methods`, `twofactor_recovery_codes`,
+ * `api_keys`, `keys`.
+ */
+export declare function fusionAuthSnapshotFromTables(t: Tables): FusionAuthSnapshot;
+/** Map a snapshot (API or database) onto canonical records. */
+export declare function mapFusionAuth(snap: FusionAuthSnapshot, opts?: FusionAuthMapOptions): RecordSet;
+export interface ExportFusionAuthOptions extends FusionAuthMapOptions {
+    /** A database dump of a self-hosted install (hashes and authenticator secrets included). */
+    tables?: Tables;
+    /** The API, when exporting live (no hashes, no authenticator secrets). */
+    api?: FusionAuthApiOptions;
+}
+export declare function exportFusionAuth(o: ExportFusionAuthOptions): Promise<RecordSet>;