@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/export/zitadel.js

@@ -0,0 +1,447 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.g = g;
+exports.readZitadelExport = readZitadelExport;
+exports.zitadelPassword = zitadelPassword;
+exports.collectIdps = collectIdps;
+exports.mapZitadel = mapZitadel;
+exports.zitadelBase = zitadelBase;
+exports.zitadelHttp = zitadelHttp;
+exports.fetchIdpTemplates = fetchIdpTemplates;
+exports.fetchZitadel = fetchZitadel;
+exports.exportZitadelApi = exportZitadelApi;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+/** A field by its camelCase name, falling back to snake_case (the files `zitadel export` writes use either). */
+function g(o, camel) {
+    if (!o)
+        return undefined;
+    if (o[camel] !== undefined)
+        return o[camel];
+    return o[camel.replace(/[A-Z]/g, (m) => `_${m.toLowerCase()}`)];
+}
+const gs = (o, camel) => (0, record_set_1.str)(g(o, camel));
+const go = (o, camel) => {
+    const v = g(o, camel);
+    return (0, record_set_1.isObj)(v) ? v : undefined;
+};
+const gl = (o, camel) => (0, record_set_1.objs)(g(o, camel));
+// ── reading an export file ──────────────────────────────────────────────────
+/** The orgs in an export document: `{ orgs: [...] }`, a bare array, or one org object. */
+function readZitadelExport(doc) {
+    let orgs = [];
+    if (Array.isArray(doc))
+        orgs = (0, record_set_1.objs)(doc);
+    else if ((0, record_set_1.isObj)(doc)) {
+        const list = g(doc, 'orgs');
+        if (Array.isArray(list))
+            orgs = (0, record_set_1.objs)(list);
+        else if (g(doc, 'humanUsers') !== undefined || g(doc, 'orgId') !== undefined)
+            orgs = [doc];
+    }
+    if (!orgs.length)
+        throw new Error('No organizations found in the ZITADEL export (expected the JSON written by `zitadel export`: { "orgs": [ … ] }).');
+    return { orgs, idpTemplates: [], source: 'file' };
+}
+// ── password hashes ─────────────────────────────────────────────────────────
+/**
+ * A ZITADEL `hashedPassword` ({ value, algorithm }) as a bundle password; null
+ * when Atlas cannot verify it. ZITADEL stores the self-describing encoding its
+ * hasher (passwap) verifies, so those are recognised by Atlas on their own
+ * ("auto"); the one bare form (a hex MD5) is mapped by the algorithm hint.
+ */
+function zitadelPassword(hashed) {
+    const h = (0, record_set_1.isObj)(hashed) ? hashed : undefined;
+    const value = (0, record_set_1.str)(h?.value) ?? (typeof hashed === 'string' ? (0, record_set_1.str)(hashed) : undefined);
+    if (!value)
+        return null;
+    const hint = ((0, record_set_1.str)(h?.algorithm) ?? '').toLowerCase().replace(/[^a-z0-9]/g, '');
+    if (/^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/.test(value))
+        return { algorithm: 'bcrypt', hash: value };
+    if (/^\$argon2(id|i|d)\$/.test(value))
+        return { algorithm: 'argon2', hash: value };
+    // $scrypt$ln=…, $pbkdf2-sha256$i=…, $1$ (md5-crypt), $5$ / $6$ (sha-crypt), $P$ / $H$ (phpass).
+    if (/^\$(scrypt|pbkdf2-sha(1|256|512))\$/.test(value) || /^\$(1|5|6)\$/.test(value) || /^\$[PH]\$/.test(value))
+        return { algorithm: 'auto', hash: value };
+    if ((hint === 'md5' || hint === 'md5plain') && /^[0-9a-f]{32}$/i.test(value))
+        return { algorithm: 'md5', hash: value.toLowerCase(), params: { encoding: 'hex' } };
+    return null;
+}
+/** `genericOidcIdps` → `oidc`, `googleIdps` → `google`, `azureAdIdps` → `microsoft`. */
+function kindOfKey(key) {
+    const k = key.toLowerCase().replace(/idps?$/, '').replace(/^generic/, '').replace(/provider$/, '');
+    if (k.startsWith('azure'))
+        return 'microsoft';
+    if (k.startsWith('gitlab'))
+        return 'gitlab';
+    if (k.startsWith('github'))
+        return 'github';
+    return k || 'oidc';
+}
+function kindOfType(type) {
+    return kindOfKey(type.replace(/^IDP_TYPE_/, '').replace(/_/g, '').toLowerCase());
+}
+/** The identity providers an export names, keyed by config id; templates from the API fill gaps. */
+function collectIdps(snap) {
+    const out = new Map();
+    for (const org of snap.orgs) {
+        for (const [key, list] of Object.entries(org)) {
+            if (!/idps$/i.test(key) || !Array.isArray(list))
+                continue;
+            for (const entry of (0, record_set_1.objs)(list)) {
+                const id = (0, record_set_1.str)(g(entry, 'idpId')) ?? (0, record_set_1.str)(entry.id);
+                if (!id)
+                    continue;
+                const config = go(entry, 'idp') ?? entry;
+                out.set(id, { id, name: gs(config, 'name') ?? id, kind: kindOfKey(key), config });
+            }
+        }
+    }
+    for (const t of snap.idpTemplates) {
+        const id = (0, record_set_1.str)(t.id);
+        if (!id || out.has(id))
+            continue;
+        const type = (0, record_set_1.str)(t.type) ?? '';
+        // The template object nests its settings under the type's own key (`oidc`, `google`, `saml` …).
+        const tail = type.replace(/^IDP_TYPE_/, '').toLowerCase().replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+        const nested = go(t, tail) ?? Object.entries(t).find(([k, v]) => k !== 'details' && (0, record_set_1.isObj)(v))?.[1];
+        out.set(id, { id, name: (0, record_set_1.str)(t.name) ?? id, kind: type ? kindOfType(type) : 'oidc', config: (0, record_set_1.isObj)(nested) ? nested : t });
+    }
+    return out;
+}
+/** An IdP as an SSO connection (OIDC or SAML); null for kinds Atlas has no connection type for. */
+function ssoConnection(idp, organizationId) {
+    if (idp.kind === 'oidc') {
+        const issuer = gs(idp.config, 'issuer');
+        return (0, record_set_1.compact)({
+            id: idp.id,
+            name: idp.name,
+            organization_id: organizationId,
+            protocol: 'oidc',
+            oidc: (0, record_set_1.compact)({ issuer, discovery_url: issuer ? `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration` : undefined, client_id: gs(idp.config, 'clientId'), scopes: (0, record_set_1.strs)(g(idp.config, 'scopes')) }),
+            enabled: true,
+        });
+    }
+    if (idp.kind === 'saml') {
+        const xml = gs(idp.config, 'metadataXml');
+        // bytes arrive base64-encoded from the API; a file may hold the XML itself.
+        const metadata = xml && !xml.trimStart().startsWith('<') ? Buffer.from(xml, 'base64').toString('utf8') : xml;
+        return (0, record_set_1.compact)({
+            id: idp.id,
+            name: idp.name,
+            organization_id: organizationId,
+            protocol: 'saml',
+            saml: (0, record_set_1.compact)({ idp_metadata_xml: metadata, idp_metadata_url: gs(idp.config, 'metadataUrl') }),
+            enabled: true,
+        });
+    }
+    return null;
+}
+// ── mapping ─────────────────────────────────────────────────────────────────
+/** ZITADEL TOTP defaults (pquerna/otp: SHA1, 6 digits, 30 seconds). */
+const TOTP = { digits: 6, period: 30, algorithm: 'SHA1' };
+const NOT_EXPORTABLE = 'ZITADEL keeps passkeys and security keys only in its event store; users register a passkey again.';
+/** Metadata values are base64 bytes; JSON when they parse, else text. */
+function decodeMetadata(value) {
+    const s = (0, record_set_1.str)(value);
+    if (!s)
+        return undefined;
+    const text = Buffer.from(s, 'base64').toString('utf8');
+    // eslint-disable-next-line no-control-regex -- intentionally detects control characters (non-text payload)
+    if (/[\u0000-\u0008\u000e-\u001f]/.test(text))
+        return s;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function mapZitadel(snap, opts = {}) {
+    const set = new record_set_1.RecordSet();
+    const idps = collectIdps(snap);
+    const providers = new Set();
+    const withOrgs = opts.orgs === 'all' || (opts.orgs !== 'skip' && snap.orgs.filter((o) => gs(go(o, 'org'), 'name')).length > 1);
+    let hashes = 0;
+    let unsupported = 0;
+    let withTotp = 0;
+    let badOtp = 0;
+    let machine = 0;
+    let unknownLinks = 0;
+    let otherOrgRoles = 0;
+    const seenUsers = new Set();
+    for (const org of snap.orgs) {
+        const orgId = gs(org, 'orgId') ?? gs(org, 'id');
+        const orgName = gs(go(org, 'org'), 'name') ?? gs(org, 'name');
+        if (withOrgs && orgId && orgName) {
+            const domains = gl(org, 'domains').flatMap((d) => (g(d, 'isVerified') === true && gs(d, 'domainName') ? [gs(d, 'domainName').toLowerCase()] : []));
+            set.add('organization', (0, record_set_1.compact)({ id: orgId, name: orgName, domains }), orgId);
+        }
+        // project roles → app roles; user grants → the roles users hold
+        for (const r of gl(org, 'projectRoles')) {
+            const key = gs(r, 'roleKey');
+            if (key)
+                set.add('role', (0, record_set_1.compact)({ key, name: gs(r, 'displayName'), description: gs(r, 'group'), scope: 'app' }), key);
+        }
+        const grants = new Map();
+        for (const grant of gl(org, 'userGrants')) {
+            const userId = gs(grant, 'userId');
+            if (!userId)
+                continue;
+            const roles = grants.get(userId) ?? new Set();
+            for (const k of (0, record_set_1.strs)(g(grant, 'roleKeys')))
+                roles.add(k);
+            grants.set(userId, roles);
+        }
+        const orgRoles = new Map();
+        for (const m of gl(org, 'orgMembers')) {
+            const userId = gs(m, 'userId');
+            if (userId)
+                orgRoles.set(userId, (0, record_set_1.strs)(g(m, 'roles')));
+        }
+        const metadata = new Map();
+        for (const entry of gl(org, 'userMetadata')) {
+            const userId = gs(entry, 'userId');
+            if (!userId)
+                continue;
+            const bag_ = metadata.get(userId) ?? {};
+            for (const item of (0, record_set_1.isObj)(g(entry, 'metadata')) ? [g(entry, 'metadata')] : gl(entry, 'metadata')) {
+                const key = gs(item, 'key');
+                const value = decodeMetadata(g(item, 'value'));
+                if (key && value !== undefined)
+                    bag_[key] = value;
+            }
+            metadata.set(userId, bag_);
+        }
+        machine += gl(org, 'machineUsers').length;
+        for (const entry of gl(org, 'humanUsers')) {
+            const id = gs(entry, 'userId');
+            const u = go(entry, 'user') ?? entry;
+            if (!id)
+                continue;
+            if (seenUsers.has(id))
+                continue;
+            const profile = go(u, 'profile');
+            const email = go(u, 'email');
+            const phone = go(u, 'phone');
+            const address = gs(email, 'email')?.toLowerCase();
+            const userName = gs(u, 'userName');
+            const number = (0, record_set_1.e164)(gs(phone, 'phone'));
+            if (!address && !number && !userName) {
+                set.omit('user', 'User with no email address, phone number or username');
+                continue;
+            }
+            seenUsers.add(id);
+            let password;
+            const hashed = g(u, 'hashedPassword');
+            if (hashed !== undefined) {
+                hashes++;
+                const mapped = zitadelPassword(hashed);
+                if (mapped)
+                    password = mapped;
+                else
+                    unsupported++;
+            }
+            const roles = [...(grants.get(id) ?? [])];
+            const meta = (0, record_set_1.bag)(metadata.get(id));
+            set.add('user', (0, record_set_1.compact)({
+                id,
+                emails: address ? [{ email: address, verified: g(email, 'isEmailVerified') === true, primary: true }] : [],
+                phones: number ? [{ phone: number, verified: g(phone, 'isPhoneVerified') === true, primary: true }] : [],
+                username: userName && userName.toLowerCase() !== address ? userName : undefined,
+                first_name: gs(profile, 'firstName'),
+                last_name: gs(profile, 'lastName'),
+                name: gs(profile, 'displayName') ?? gs(profile, 'nickName'),
+                password,
+                roles,
+                private_metadata: meta ? { zitadel_metadata: meta } : undefined,
+            }), id);
+            // TOTP secret (exported only with `withOtp`)
+            const otp = gs(u, 'otpCode');
+            if (otp) {
+                withTotp++;
+                const secret = otp.replace(/\s|=+$/g, '').toUpperCase();
+                if (/^[A-Z2-7]+$/.test(secret)) {
+                    const factor = { user_id: id, type: 'totp', secret_base32: secret, ...TOTP, verified: true };
+                    set.add('mfa_factor', factor);
+                }
+                else
+                    badOtp++;
+            }
+            // social and enterprise links
+            for (const link of gl(u, 'idps')) {
+                const configId = gs(link, 'configId');
+                const externalId = gs(link, 'externalUserId');
+                if (!configId || !externalId)
+                    continue;
+                const idp = idps.get(configId);
+                if (!idp) {
+                    unknownLinks++;
+                    continue;
+                }
+                const social = (0, translate_kit_1.socialKey)(idp.kind);
+                const sso = social ? null : ssoConnection(idp, withOrgs ? orgId : undefined);
+                const provider = social ?? idp.name;
+                providers.add(provider);
+                set.add('identity', (0, record_set_1.compact)({
+                    user_id: id,
+                    provider,
+                    provider_user_id: externalId,
+                    kind: social ? 'oauth' : idp.kind === 'saml' ? 'saml' : idp.kind === 'oidc' ? 'oidc' : undefined,
+                    sso_connection_id: sso ? idp.id : undefined,
+                    email: address,
+                }), `${configId}\u0000${externalId}`);
+            }
+            // membership in the organization
+            if (withOrgs && orgId) {
+                const orgRole = orgRoles.get(id) ?? [];
+                if (orgRole.some((r) => r !== 'ORG_OWNER'))
+                    otherOrgRoles++;
+                set.add('membership', { organization_id: orgId, user_id: id, role: orgRole.includes('ORG_OWNER') ? 'admin' : 'member' }, `${orgId}\u0000${id}`);
+            }
+        }
+        // SSO connections the organization owns
+        for (const idp of idps.values()) {
+            if (idp.kind !== 'oidc' && idp.kind !== 'saml')
+                continue;
+            const owns = Object.entries(org).some(([key, list]) => /idps$/i.test(key) && Array.isArray(list) && (0, record_set_1.objs)(list).some((e) => (gs(e, 'idpId') ?? (0, record_set_1.str)(e.id)) === idp.id));
+            if (!owns)
+                continue;
+            const record = ssoConnection(idp, withOrgs ? orgId : undefined);
+            if (record)
+                set.add('sso_connection', record, idp.id);
+        }
+    }
+    // Templates the API listed that no org file carried.
+    for (const idp of idps.values()) {
+        if (idp.kind !== 'oidc' && idp.kind !== 'saml')
+            continue;
+        const record = ssoConnection(idp, undefined);
+        if (record)
+            set.add('sso_connection', record, idp.id);
+    }
+    if (machine)
+        set.omit('machine_user', 'Machine (service) users are not exported: recreate service accounts as Atlas API keys or M2M clients', machine);
+    if (unsupported)
+        set.warn(`${unsupported} password hash(es) are in a format Atlas cannot verify: those users move by lazy migration (preset zitadel) or reset their password.`);
+    if (snap.source !== 'users') {
+        if (!hashes)
+            set.warn('The export carries no password hashes: run it with passwords included (`withPasswords`), or users move by lazy migration (preset zitadel).');
+        if (!withTotp)
+            set.warn('The export carries no TOTP secrets (run it with `withOtp`): users who use an authenticator enrol again in Atlas.');
+    }
+    else {
+        set.warn('Users were listed through the v2 user API: it never returns password hashes, TOTP secrets or social links, so passwords move by lazy migration (preset zitadel), authenticator users enrol again and social users sign in once with their provider (linked by verified email). Use an IAM_OWNER service user to export everything.');
+    }
+    if (badOtp)
+        set.warn(`${badOtp} TOTP secret(s) were not valid base32 and were left out; those users enrol an authenticator again.`);
+    if (unknownLinks)
+        set.warn(`${unknownLinks} social link(s) point at an identity provider the export does not describe and were left out: those users sign in once with their provider and are linked by verified email.`);
+    if (otherOrgRoles)
+        set.warn(`${otherOrgRoles} organization member(s) hold ZITADEL roles other than ORG_OWNER: they join as members; only owners become admins.`);
+    set.warn(NOT_EXPORTABLE);
+    set.manifest = (0, record_set_1.compact)({ origin: snap.instance ? `ZITADEL ${snap.instance.replace(/^https?:\/\//, '')}` : snap.source === 'file' ? 'ZITADEL export file' : 'ZITADEL', providers: [...providers].sort(), settings: { totp: { ...TOTP } } });
+    return set;
+}
+function zitadelBase(raw) {
+    const s = raw.trim().replace(/\/+$/, '');
+    return /^https?:\/\//.test(s) ? s : `https://${s}`;
+}
+function zitadelHttp(o) {
+    return new vendor_http_1.VendorHttp({ vendor: 'ZITADEL', baseUrl: zitadelBase(o.instance), headers: { authorization: `Bearer ${o.token}` }, fetchImpl: o.fetchImpl, sleep: o.sleep });
+}
+/** Identity provider templates, to type the links; best effort (an older instance or a narrow role answers 4xx). */
+async function fetchIdpTemplates(http) {
+    try {
+        const { body } = await http.post('/admin/v1/idps/templates/_search', {});
+        return (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body.result) : [];
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && err.status > 0 && err.status < 500)
+            return [];
+        throw err;
+    }
+}
+/** A v2 user (`POST /v2/users`) in the import shape the mapper reads. */
+function fromV2User(u) {
+    const id = (0, record_set_1.str)(u.userId);
+    const human = (0, record_set_1.isObj)(u.human) ? u.human : undefined;
+    if (!id || !human)
+        return null;
+    const profile = (0, record_set_1.isObj)(human.profile) ? human.profile : {};
+    const email = (0, record_set_1.isObj)(human.email) ? human.email : {};
+    const phone = (0, record_set_1.isObj)(human.phone) ? human.phone : {};
+    return {
+        orgId: (0, record_set_1.isObj)(u.details) ? (0, record_set_1.str)(u.details.resourceOwner) : undefined,
+        entry: {
+            userId: id,
+            user: {
+                userName: (0, record_set_1.str)(u.username),
+                profile: { firstName: (0, record_set_1.str)(profile.givenName), lastName: (0, record_set_1.str)(profile.familyName), displayName: (0, record_set_1.str)(profile.displayName), nickName: (0, record_set_1.str)(profile.nickName) },
+                email: { email: (0, record_set_1.str)(email.email), isEmailVerified: email.isVerified === true },
+                phone: { phone: (0, record_set_1.str)(phone.phone), isPhoneVerified: phone.isVerified === true },
+            },
+        },
+    };
+}
+async function fetchZitadel(o) {
+    const progress = o.onProgress ?? (() => undefined);
+    const http = zitadelHttp(o);
+    const instance = zitadelBase(o.instance);
+    progress('the instance export');
+    try {
+        const { body } = await http.post('/admin/v1/export', { withPasswords: true, withOtp: true, responseOutput: true });
+        const snap = readZitadelExport(body);
+        progress('identity providers');
+        return { ...snap, idpTemplates: await fetchIdpTemplates(http), source: 'api', instance };
+    }
+    catch (err) {
+        // The export endpoint is IAM_OWNER-only and absent from old versions: fall back to listing users.
+        if (!(err instanceof vendor_http_1.VendorApiError) || ![403, 404, 405, 501].includes(err.status))
+            throw err;
+    }
+    const size = o.pageSize ?? 100;
+    const orgsById = new Map();
+    for (let offset = 0;; offset += size) {
+        progress(`organizations (${orgsById.size} so far)`);
+        const { body } = await http.post('/admin/v1/orgs/_search', { query: { offset: String(offset), limit: size } });
+        const page = (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body.result) : [];
+        for (const org of page) {
+            const id = (0, record_set_1.str)(org.id);
+            if (id)
+                orgsById.set(id, { orgId: id, org: { name: (0, record_set_1.str)(org.name) }, humanUsers: [] });
+        }
+        if (page.length < size)
+            break;
+    }
+    const fallbackOrg = (id) => {
+        const key = id ?? '';
+        if (!orgsById.has(key))
+            orgsById.set(key, { orgId: id, humanUsers: [] });
+        return orgsById.get(key);
+    };
+    let users = 0;
+    for (let offset = 0;; offset += size) {
+        progress(`users (${users} so far)`);
+        const { body } = await http.post('/v2/users', {
+            query: { offset: String(offset), limit: size, asc: true },
+            queries: [{ typeQuery: { type: 'TYPE_HUMAN' } }],
+        });
+        const page = (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body.result) : [];
+        for (const u of page) {
+            const mapped = fromV2User(u);
+            if (!mapped)
+                continue;
+            users++;
+            fallbackOrg(mapped.orgId).humanUsers.push(mapped.entry);
+        }
+        if (page.length < size)
+            break;
+    }
+    return { orgs: [...orgsById.values()], idpTemplates: await fetchIdpTemplates(http), source: 'users', instance };
+}
+async function exportZitadelApi(o) {
+    return mapZitadel(await fetchZitadel(o), { orgs: o.orgs });
+}
+//# sourceMappingURL=zitadel.js.map

package/dist/migrate/export/zitadel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadel.js","sourceRoot":"","sources":["../../../src/migrate/export/zitadel.ts"],"names":[],"mappings":";;AAmDA,cAIC;AAWD,8CAUC;AAUD,0CAWC;AA0BD,kCAuBC;AAmDD,gCA+KC;AAeD,kCAGC;AAED,kCAEC;AAGD,8CAQC;AAwBD,oCAiDC;AAED,4CAEC;AAjeD,6CAA+F;AAC/F,mDAA4C;AAC5C,+CAA2D;AA+C3D,gHAAgH;AAChH,SAAgB,CAAC,CAAC,CAAkB,EAAE,KAAa;IACjD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC;AACD,MAAM,EAAE,GAAG,CAAC,CAAkB,EAAE,KAAa,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACnE,MAAM,EAAE,GAAG,CAAC,CAAkB,EAAE,KAAa,EAAmB,EAAE;IAChE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,OAAO,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClC,CAAC,CAAC;AACF,MAAM,EAAE,GAAG,CAAC,CAAkB,EAAE,KAAa,EAAS,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3E,+EAA+E;AAE/E,0FAA0F;AAC1F,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,IAAI,IAAI,GAAU,EAAE,CAAC;IACrB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,CAAC;SACpC,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,IAAA,iBAAI,EAAC,IAAI,CAAC,CAAC;aACtC,IAAI,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,SAAS;YAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;IACtJ,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,MAAe;IAC7C,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC/E,IAAI,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACpG,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACnF,gGAAgG;IAChG,IAAI,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1J,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IAClK,OAAO,IAAI,CAAC;AACd,CAAC;AAYD,wFAAwF;AACxF,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC;IAC9C,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,CAAC,IAAI,MAAM,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,oGAAoG;AACpG,SAAgB,WAAW,CAAC,IAAqB;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAe,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1D,KAAK,MAAM,KAAK,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,IAAA,gBAAG,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnD,IAAI,CAAC,EAAE;oBAAE,SAAS;gBAClB,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC;gBACzC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,gGAAgG;QAChG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClH,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnG,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAA,kBAAK,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AACnG,SAAS,aAAa,CAAC,GAAQ,EAAE,cAAkC;IACjE,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxC,OAAO,IAAA,oBAAO,EAAsB;YAClC,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,eAAe,EAAE,cAAc;YAC/B,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC7M,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1C,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7G,OAAO,IAAA,oBAAO,EAAsB;YAClC,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,eAAe,EAAE,cAAc;YAC/B,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAE/E,uEAAuE;AACvE,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAe,EAAE,CAAC;AACnE,MAAM,cAAc,GAAG,mGAAmG,CAAC;AAE3H,yEAAyE;AACzE,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,2GAA2G;IAC3G,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,UAAU,CAAC,IAAqB,EAAE,OAA0B,EAAE;IAC5E,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/H,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,QAAQ,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACpJ,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACjF,CAAC;QAED,gEAAgE;QAChE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAC7B,IAAI,GAAG;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACtD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC/B,IAAI,MAAM;gBAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAe,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,IAAI,GAAQ,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7C,KAAK,MAAM,IAAI,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;gBACvG,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC/C,IAAI,GAAG,IAAI,KAAK,KAAK,SAAS;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpD,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC;QAE1C,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YAC1C,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC;YACrC,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAChC,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,sDAAsD,CAAC,CAAC;gBACzE,SAAS;YACX,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAElB,IAAI,QAAkC,CAAC;YACvC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;gBACvC,IAAI,MAAM;oBAAE,QAAQ,GAAG,MAAM,CAAC;;oBACzB,WAAW,EAAE,CAAC;YACrB,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAA,oBAAO,EAAa;gBAClB,EAAE;gBACF,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC1G,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;gBACxG,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC/E,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;gBACpC,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;gBAClC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;gBAC3D,QAAQ;gBACR,KAAK;gBACL,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;aAChE,CAAC,EACF,EAAE,CACH,CAAC;YAEF,6CAA6C;YAC7C,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAC7B,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACxD,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/B,MAAM,MAAM,GAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBAC9G,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAChC,CAAC;;oBAAM,MAAM,EAAE,CAAC;YAClB,CAAC;YAED,8BAA8B;YAC9B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBACtC,MAAM,UAAU,GAAG,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBAC9C,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;oBAAE,SAAS;gBACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC;gBACpC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACxB,GAAG,CAAC,GAAG,CACL,UAAU,EACV,IAAA,oBAAO,EAAiB;oBACtB,OAAO,EAAE,EAAE;oBACX,QAAQ;oBACR,gBAAgB,EAAE,UAAU;oBAC5B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBAChG,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;oBAC3C,KAAK,EAAE,OAAO;iBACf,CAAC,EACF,GAAG,QAAQ,SAAS,UAAU,EAAE,CACjC,CAAC;YACJ,CAAC;YAED,iCAAiC;YACjC,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACvC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC;oBAAE,aAAa,EAAE,CAAC;gBAC5D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,KAAK,SAAS,EAAE,EAAE,CAAC,CAAC;YAClJ,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YACzD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACtK,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChE,IAAI,MAAM;gBAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,qDAAqD;IACrD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACzD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,sGAAsG,EAAE,OAAO,CAAC,CAAC;IACvJ,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,sIAAsI,CAAC,CAAC;IAChL,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,4IAA4I,CAAC,CAAC;QACpK,IAAI,CAAC,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,kHAAkH,CAAC,CAAC;IAC9I,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,oUAAoU,CAAC,CAAC;IACjV,CAAC;IACD,IAAI,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,oGAAoG,CAAC,CAAC;IACpI,IAAI,YAAY;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,8KAA8K,CAAC,CAAC;IAC1N,IAAI,aAAa;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,mHAAmH,CAAC,CAAC;IACjK,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACzB,GAAG,CAAC,QAAQ,GAAG,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3O,OAAO,GAAG,CAAC;AACb,CAAC;AAeD,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAgB,WAAW,CAAC,CAAwE;IAClG,OAAO,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC1K,CAAC;AAED,oHAAoH;AAC7G,KAAK,UAAU,iBAAiB,CAAC,IAAgB;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAU,kCAAkC,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,EAAE,CAAC;QACnF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,CAAM;IACxB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,OAAO;QACL,KAAK,EAAE,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;QAClE,KAAK,EAAE;YACL,MAAM,EAAE,EAAE;YACV,IAAI,EAAE;gBACJ,QAAQ,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;gBACzB,OAAO,EAAE,EAAE,SAAS,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACzJ,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,gBAAG,EAAC,KAAK,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE;gBAC9E,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,gBAAG,EAAC,KAAK,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE;aAC/E;SACF;KACF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,CAAoB;IACrD,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAU,kBAAkB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5H,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAC/B,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kGAAkG;QAClG,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,GAAG,CAAC;IAChG,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAe,CAAC;IACxC,KAAK,IAAI,MAAM,GAAG,CAAC,GAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACtC,QAAQ,CAAC,kBAAkB,QAAQ,CAAC,IAAI,UAAU,CAAC,CAAC;QACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAU,wBAAwB,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACxH,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE;gBAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;YAAE,MAAM;IAChC,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,EAAsB,EAAO,EAAE;QAClD,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,MAAM,GAAG,CAAC,GAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACtC,QAAQ,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAU,WAAW,EAAE;YACrD,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE;YACzD,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,KAAK,EAAE,CAAC;YACP,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;YAAE,MAAM;IAChC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAClH,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,CAAwC;IAC7E,OAAO,UAAU,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC"}

package/dist/migrate/firebase/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const firebasePlugin: MigrationPlugin;

package/dist/migrate/firebase/plugin.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.firebasePlugin = void 0;
+const firebase_1 = require("../export/firebase");
+const firebase_config_1 = require("../export/firebase-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate firebase` (also Google Cloud Identity Platform) — the
+ * project's sign-in settings as Atlas config, its users with their Firebase
+ * scrypt hashes, identities, SMS second factors and tenants through the
+ * Identity Toolkit Admin API (or an auth:export file), the `firebase` bridge
+ * preset (a Firebase ID token becomes an Atlas session) and the `firebase`
+ * lazy-migration preset for passwords whose hashes were not exported.
+ * The service-account key stays on this machine; only Google sees its signature.
+ */
+const PROJECT = { flag: '--firebase-project', env: 'FIREBASE_PROJECT_ID', label: 'your Firebase / Google Cloud project id', required: false };
+const SERVICE_ACCOUNT = { flag: '--firebase-service-account', env: 'GOOGLE_APPLICATION_CREDENTIALS', label: 'a service-account key file (JSON) with Firebase Authentication Admin', required: false, secret: true };
+const ACCESS_TOKEN = { flag: '--firebase-access-token', env: 'FIREBASE_ACCESS_TOKEN', label: 'an OAuth access token for the project (gcloud auth print-access-token)', required: false, secret: true };
+const USERS_FILE = { flag: '--firebase-users-file', env: 'FIREBASE_USERS_FILE', label: 'a firebase auth:export file (JSON or CSV)', required: false };
+const TENANT = { flag: '--firebase-tenant', env: 'FIREBASE_TENANT_ID', label: 'an Identity Platform tenant id, or "all" (every tenant, each as an organization)', required: false };
+const ANONYMOUS = { flag: '--firebase-anonymous', env: 'FIREBASE_ANONYMOUS', label: '"include" to export anonymous users too', required: false };
+const SIGNER_KEY = { flag: '--firebase-signer-key', env: 'FIREBASE_SIGNER_KEY', label: 'the password hash signer key (base64)', required: false, secret: true };
+const SALT_SEPARATOR = { flag: '--firebase-salt-separator', env: 'FIREBASE_SALT_SEPARATOR', label: 'the password hash salt separator (base64)', required: false };
+const ROUNDS = { flag: '--firebase-rounds', env: 'FIREBASE_ROUNDS', label: 'the password hash rounds', required: false };
+const MEM_COST = { flag: '--firebase-mem-cost', env: 'FIREBASE_MEM_COST', label: 'the password hash memory cost', required: false };
+const BRIDGE = { flag: '--firebase-bridge', env: 'FIREBASE_BRIDGE', label: 'what the bridge exchanges: id-token (default) or session-cookie (Admin SDK createSessionCookie)', required: false };
+const COOKIE_NAME = { flag: '--firebase-cookie-name', env: 'FIREBASE_SESSION_COOKIE_NAME', label: 'the session cookie name your app sets (default session; __session is always read)', required: false };
+const API_KEY = { flag: '--firebase-api-key', env: 'FIREBASE_API_KEY', label: 'the project Web API key (AIza…), for lazy migration', required: false };
+/** The project id: the flag, else the service-account file's. */
+function projectOf(p) {
+    const explicit = p.credential(PROJECT);
+    if (explicit)
+        return explicit.trim();
+    const sa = (0, plugin_kit_1.localFile)(p, SERVICE_ACCOUNT, 'text');
+    const fromKey = sa ? (0, firebase_1.parseServiceAccount)(sa).project_id : undefined;
+    if (fromKey)
+        return fromKey;
+    throw new errors_1.CliError('Firebase: pass the project id (--set firebase-project=<id> or FIREBASE_PROJECT_ID).');
+}
+function hashParams(p) {
+    const n = (spec) => {
+        const v = p.credential(spec);
+        if (v === undefined)
+            return undefined;
+        const num = Number(v);
+        if (!Number.isInteger(num))
+            throw new errors_1.CliError(`Firebase: ${spec.label} must be a whole number.`);
+        return num;
+    };
+    const out = {};
+    const signer = p.credential(SIGNER_KEY);
+    const sep = p.credential(SALT_SEPARATOR);
+    const rounds = n(ROUNDS);
+    const mem = n(MEM_COST);
+    if (signer)
+        out.signer_key = signer;
+    if (sep !== undefined)
+        out.salt_separator = sep;
+    if (rounds !== undefined)
+        out.rounds = rounds;
+    if (mem !== undefined)
+        out.mem_cost = mem;
+    return out;
+}
+function http(p, projectId) {
+    const token = p.credential(ACCESS_TOKEN);
+    const sa = (0, plugin_kit_1.localFile)(p, SERVICE_ACCOUNT, 'text');
+    if (!token && !sa) {
+        throw new errors_1.CliError('Firebase: pass a service-account key file (--set firebase-service-account=<path> or GOOGLE_APPLICATION_CREDENTIALS) or an access token (FIREBASE_ACCESS_TOKEN).');
+    }
+    return (0, firebase_1.firebaseHttp)({ accessToken: token, serviceAccount: sa ? (0, firebase_1.parseServiceAccount)(sa) : undefined, projectId, fetchImpl: p.fetch });
+}
+exports.firebasePlugin = {
+    vendor: 'firebase',
+    source: 'firebase',
+    label: 'Firebase Authentication',
+    help: 'Move a Firebase Authentication or Identity Platform project: its sign-in methods, providers, MFA and password policy as Atlas config; its users with their Firebase scrypt password hashes, social / OIDC / SAML links, SMS second factors and tenants; a zero-logout bridge for Firebase ID tokens; lazy migration for any password you could not export; and the code. The service-account key stays on this machine.',
+    config: {
+        reads: 'your Firebase project config via the Identity Toolkit admin API',
+        credentials: [PROJECT, SERVICE_ACCOUNT, ACCESS_TOKEN],
+        async translate(p) {
+            const projectId = projectOf(p);
+            const snap = await (0, plugin_kit_1.vendorStep)('Firebase', () => (0, firebase_config_1.fetchFirebaseConfig)(http(p, projectId), projectId));
+            return (0, firebase_config_1.translateFirebaseConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the Identity Toolkit admin API (accounts:batchGet, tenants, SAML providers, hash parameters) or a firebase auth:export file',
+        credentials: [PROJECT, SERVICE_ACCOUNT, ACCESS_TOKEN, USERS_FILE, TENANT, ANONYMOUS, SIGNER_KEY, SALT_SEPARATOR, ROUNDS, MEM_COST],
+        limits: [
+            'TOTP second factors cannot be exported (Firebase keeps no exportable secret): those users enrol again. SMS second factors move by phone number.',
+            'Password hashes need the project\'s hash parameters: read from the project config with an owner / Firebase Authentication Admin key, or passed as flags from Console → Authentication → Users → ⋮ → Password hash parameters. Without them, passwords move by lazy migration.',
+            'The auth:export file keeps ten social providers only, has no OIDC / SAML / phone links, cannot hold a tenant, and its CSV has no second factors: export through the API for those.',
+            'Sessions are not exported: the firebase bridge preset exchanges a Firebase ID token (and firebase_session_cookie a session cookie) instead.',
+        ],
+        async run(p, writer, resume) {
+            const projectId = projectOf(p);
+            const usersText = (0, plugin_kit_1.localFile)(p, USERS_FILE, 'text');
+            const set = await (0, plugin_kit_1.vendorStep)('Firebase', () => (0, firebase_1.exportFirebase)({
+                projectId,
+                usersText,
+                usersFileName: p.credential(USERS_FILE),
+                serviceAccountJson: usersText === undefined ? (0, plugin_kit_1.localFile)(p, SERVICE_ACCOUNT, 'text') : undefined,
+                accessToken: usersText === undefined ? p.credential(ACCESS_TOKEN) : undefined,
+                tenant: p.credential(TENANT),
+                hashParams: hashParams(p),
+                includeAnonymous: p.credential(ANONYMOUS) === 'include',
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'firebase',
+        presetFor(p) {
+            const mode = (p.credential(BRIDGE) ?? 'id-token').trim().toLowerCase();
+            if (mode === 'session-cookie')
+                return 'firebase_session_cookie';
+            if (mode !== 'id-token')
+                throw new errors_1.CliError(`Firebase: --set firebase-bridge takes id-token or session-cookie (got ${mode}).`);
+            return 'firebase';
+        },
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const project = p.credential(PROJECT);
+            if (project)
+                vars.project_id = project.trim();
+            const cookie = p.credential(COOKIE_NAME);
+            if (cookie)
+                vars.cookie_name = cookie.trim();
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'firebase',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const tenant = p.credential(TENANT);
+            if (tenant && tenant !== 'all')
+                config.tenant_id = tenant;
+            // The Web API key is public (it ships in the client config): it is preset config, not a secret.
+            const apiKey = p.credential(API_KEY);
+            if (apiKey)
+                config.api_key = apiKey;
+            return config;
+        },
+    },
+    codemod: 'firebase',
+};
+//# sourceMappingURL=plugin.js.map