@atlasauth/js 0.23.1 → 0.24.0

package/dist/mfa-factors.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.looksLikeYubicoOtp = void 0;
+exports.startHotp = startHotp;
+exports.verifyHotp = verifyHotp;
+exports.resyncHotp = resyncHotp;
+exports.enrollYubikey = enrollYubikey;
+exports.startDuoEnrollment = startDuoEnrollment;
+exports.finishDuoEnrollment = finishDuoEnrollment;
+exports.prepareDuo = prepareDuo;
+exports.pollDuo = pollDuo;
+exports.getSecurityQuestions = getSecurityQuestions;
+exports.setSecurityQuestions = setSecurityQuestions;
+exports.removeSecurityQuestions = removeSecurityQuestions;
+exports.getResetSecurityQuestions = getResetSecurityQuestions;
+exports.signInWithSmartCard = signInWithSmartCard;
+/** Start HOTP enrolment: returns the secret and URI once. Confirm with {@link verifyHotp}. */
+function startHotp(client) {
+    return client.post('/v1/client/me/mfa/hotp');
+}
+/** Confirm HOTP enrolment with the token's next code; the response carries the recovery codes once. */
+function verifyHotp(client, factorId, code) {
+    return client.post(`/v1/client/me/mfa/hotp/${encodeURIComponent(factorId)}/verify`, { code });
+}
+/** Re-synchronise a token whose counter ran far ahead, from two consecutive codes. */
+function resyncHotp(client, factorId, codes) {
+    return client.post(`/v1/client/me/mfa/hotp/${encodeURIComponent(factorId)}/resync`, { codes });
+}
+/** Enrol a YubiKey: the user touches the key into a field and you pass the typed OTP. */
+function enrollYubikey(client, otp) {
+    return client.post(`/v1/client/me/mfa/yubikey`, { otp });
+}
+/** A string a YubiKey could have typed (modhex, 32 to 48 characters). Handy to route a field's input. */
+const looksLikeYubicoOtp = (value) => /^[cbdefghijklnrtuv]{32,48}$/i.test(value.trim());
+exports.looksLikeYubicoOtp = looksLikeYubicoOtp;
+/** Begin Duo enrolment. After the redirect back, call {@link finishDuoEnrollment} with the returned `factorId`. */
+function startDuoEnrollment(client, opts = {}) {
+    return client.post('/v1/client/me/mfa/duo', opts.returnUrl ? { return_url: opts.returnUrl } : {});
+}
+/** Complete Duo enrolment after the user approved Duo's prompt. Answers 400 until Duo has confirmed. */
+function finishDuoEnrollment(client, factorId) {
+    return client.post(`/v1/client/me/mfa/duo/${encodeURIComponent(factorId)}/verify`);
+}
+/** At the second-factor step: get Duo's authorization URL for this sign-in attempt. */
+async function prepareDuo(client, attemptId, opts = {}) {
+    const response = await client.post(`/v1/client/sign_ins/${encodeURIComponent(attemptId)}/prepare_second_factor`, { strategy: 'duo', ...(opts.returnUrl ? { return_url: opts.returnUrl } : {}) });
+    return { prompt: response.ok && response.data ? { authorizationUrl: response.data.authorization_url } : null, response };
+}
+/**
+ * Poll the sign-in after sending the user to Duo. Returns the attempt as it stands: the
+ * status stays `needs_second_factor` until Duo's callback has recorded an approval for this
+ * attempt, then `complete`.
+ */
+function pollDuo(client, attemptId) {
+    return client.post(`/v1/client/sign_ins/${encodeURIComponent(attemptId)}/attempt_second_factor`, { strategy: 'duo' });
+}
+const questionsFrom = (w) => ({
+    enabled: w.enabled,
+    required: w.required,
+    availableQuestions: w.available_questions,
+    answeredQuestions: w.answered_questions,
+});
+/** The offered questions and the signed-in user's chosen ones. */
+async function getSecurityQuestions(client) {
+    const res = await client.get('/v1/client/me/security_questions');
+    return res.ok && res.data ? questionsFrom(res.data) : null;
+}
+/** Set (replace) the answers. `answers` has exactly `required` distinct questions from the offered list. */
+async function setSecurityQuestions(client, answers) {
+    const response = await client.request('/v1/client/me/security_questions', {
+        method: 'PUT',
+        body: JSON.stringify({ answers }),
+    });
+    return { questions: response.ok && response.data ? questionsFrom(response.data) : null, response };
+}
+function removeSecurityQuestions(client) {
+    return client.request('/v1/client/me/security_questions', { method: 'DELETE' });
+}
+/**
+ * During a password reset, once the emailed code (and any second factor) is accepted: the
+ * questions the user must answer before choosing a password. Send the answers as
+ * `security_answers` with `set_new_password`.
+ */
+async function getResetSecurityQuestions(client, resetId) {
+    const res = await client.get(`/v1/client/password_resets/${encodeURIComponent(resetId)}/security_questions`);
+    return res.ok && res.data ? { required: res.data.required, questions: res.data.questions } : null;
+}
+/**
+ * Smart card / PIV / CAC sign-in. The browser presents the card's certificate in the TLS
+ * handshake to a Frontend API host that requests client certificates; your proxy forwards the
+ * result and Atlas signs the user in. Resolves like a passkey sign-in: a completed attempt
+ * (`status: "complete"`, with the session set), or `needs_second_factor` when the account's
+ * MFA is still owed.
+ */
+function signInWithSmartCard(client) {
+    return client.post('/v1/client/sign_ins/smart_card');
+}
+//# sourceMappingURL=mfa-factors.js.map

package/dist/mfa-factors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-factors.js","sourceRoot":"","sources":["../src/mfa-factors.ts"],"names":[],"mappings":";;;AA2BA,8BAEC;AAGD,gCAEC;AAGD,gCAEC;AAGD,sCAEC;AAWD,gDAKC;AAGD,kDAEC;AAGD,gCAUC;AAOD,0BAEC;AA0BD,oDAGC;AAGD,oDASC;AAED,0DAEC;AAOD,8DAGC;AASD,kDAEC;AA/HD,8FAA8F;AAC9F,SAAgB,SAAS,CAAC,MAAkB;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAiB,wBAAwB,CAAC,CAAC;AAC/D,CAAC;AAED,uGAAuG;AACvG,SAAgB,UAAU,CAAC,MAAkB,EAAE,QAAgB,EAAE,IAAY;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAiB,0BAA0B,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAChH,CAAC;AAED,sFAAsF;AACtF,SAAgB,UAAU,CAAC,MAAkB,EAAE,QAAgB,EAAE,KAAuB;IACtF,OAAO,MAAM,CAAC,IAAI,CAAqB,0BAA0B,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACrH,CAAC;AAED,yFAAyF;AACzF,SAAgB,aAAa,CAAC,MAAkB,EAAE,GAAW;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,yGAAyG;AAClG,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAAnG,QAAA,kBAAkB,sBAAiF;AAOhH,mHAAmH;AACnH,SAAgB,kBAAkB,CAChC,MAAkB,EAClB,OAA+B,EAAE;IAEjC,OAAO,MAAM,CAAC,IAAI,CAAiD,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpJ,CAAC;AAED,wGAAwG;AACxG,SAAgB,mBAAmB,CAAC,MAAkB,EAAE,QAAgB;IACtE,OAAO,MAAM,CAAC,IAAI,CAAiB,yBAAyB,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACrG,CAAC;AAED,uFAAuF;AAChF,KAAK,UAAU,UAAU,CAC9B,MAAkB,EAClB,SAAiB,EACjB,OAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,wBAAwB,EAC5E,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC/E,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC3H,CAAC;AAED;;;;GAIG;AACH,SAAgB,OAAO,CAAC,MAAkB,EAAE,SAAiB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AACxH,CAAC;AAkBD,MAAM,aAAa,GAAG,CAAC,CAAwB,EAAqB,EAAE,CAAC,CAAC;IACtE,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,kBAAkB,EAAE,CAAC,CAAC,mBAAmB;IACzC,iBAAiB,EAAE,CAAC,CAAC,kBAAkB;CACxC,CAAC,CAAC;AAEH,kEAAkE;AAC3D,KAAK,UAAU,oBAAoB,CAAC,MAAkB;IAC3D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAwB,kCAAkC,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,4GAA4G;AACrG,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,OAAoD;IAEpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAwB,kCAAkC,EAAE;QAC/F,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrG,CAAC;AAED,SAAgB,uBAAuB,CAAC,MAAkB;IACxD,OAAO,MAAM,CAAC,OAAO,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,yBAAyB,CAAC,MAAkB,EAAE,OAAe;IACjF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAA6C,8BAA8B,kBAAkB,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACzJ,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,MAAkB;IACpD,OAAO,MAAM,CAAC,IAAI,CAA0B,gCAAgC,CAAC,CAAC;AAChF,CAAC"}

package/dist/migration-browser-sessions.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Moving to Atlas without signing anyone out, BROWSER SIDE, for vendors whose
+ * SDK keeps the session in browser storage rather than in a cookie a server
+ * middleware could read: Firebase (IndexedDB), AWS Amplify / Cognito
+ * (localStorage), MSAL for Azure AD B2C / Entra External ID (session or local
+ * storage), Supabase SPAs (localStorage), Appwrite (its localStorage cookie
+ * fallback), PocketBase (localStorage) and Nhost
+ * (localStorage).
+ *
+ * A reader finds the old token on this page; {@link exchangeMigrationBrowserSession}
+ * sends it ONCE to `POST /v1/client/migrations/{source}/exchange` with cookie
+ * delivery, so Atlas sets its session exactly as a sign-in does, and then
+ * clears the old storage. Atlas verifies the token (against the vendor's keys,
+ * or the sessions imported in the migration bundle) — nothing here is trusted.
+ *
+ *   const found = await readFirebaseBrowserSession();
+ *   if (found) await exchangeMigrationBrowserSession(client, { source: 'firebase', ...found });
+ *
+ * Where the vendor allows a public refresh (Firebase's securetoken endpoint
+ * with the project's web API key, Cognito's REFRESH_TOKEN_AUTH with a public
+ * client id), an expired token is refreshed first, so the exchange presents a
+ * live one.
+ */
+import type { FapiClient } from './fapi';
+/** A token found on this page, and how to remove the old session once exchanged. */
+export interface BrowserSessionToken {
+    token: string;
+    /** Remove the old vendor session from this browser. */
+    clear: () => void | Promise<void>;
+}
+export type MigrationBrowserExchangeOutcome = {
+    status: 'none';
+} | {
+    status: 'complete';
+    sessionId: string;
+    userId: string;
+    jwt: string;
+} | {
+    status: 'needs_second_factor' | 'needs_mfa_enrollment';
+    attemptId: string;
+} | {
+    status: 'refused';
+    outcome: string;
+};
+export declare function migrationBrowserExchangePath(source: string): string;
+/**
+ * Exchange an old vendor session found on this page for an Atlas session.
+ * Never throws. On success (or a final refusal) the old session is cleared.
+ */
+export declare function exchangeMigrationBrowserSession(client: FapiClient, input: {
+    source: string;
+    token?: string;
+    clear?: () => void | Promise<void>;
+    remember?: boolean;
+}): Promise<MigrationBrowserExchangeOutcome>;
+type StorageLike = Pick<Storage, 'getItem' | 'removeItem' | 'key' | 'length'> & {
+    setItem?(key: string, value: string): void;
+};
+/** The unverified payload of a JWT (only to read `exp` / `iss` before choosing to refresh). */
+export declare function peekJwtPayload(token: string): Record<string, unknown> | null;
+export interface FirebaseBrowserSessionOptions {
+    /** Only this project's web API key (default: the first signed-in Firebase app on the page). */
+    apiKey?: string;
+    /** Refresh an expired ID token with the securetoken endpoint first (default true). */
+    refresh?: boolean;
+    indexedDB?: IDBFactory;
+    storage?: StorageLike[];
+    fetchImpl?: typeof fetch;
+}
+/** Firebase's public token refresh (the web SDK's own call): a fresh ID token, or undefined. */
+export declare function refreshFirebaseIdToken(apiKey: string, refreshToken: string, fetchImpl?: typeof fetch): Promise<string | undefined>;
+/** The Firebase ID token this page is signed in with (IndexedDB, else local/session storage persistence). */
+export declare function readFirebaseBrowserSession(options?: FirebaseBrowserSessionOptions): Promise<BrowserSessionToken | undefined>;
+export interface AmplifyBrowserSessionOptions {
+    /** The app client id (default: the first one with a signed-in user). */
+    clientId?: string;
+    /** Refresh an expired ID token with REFRESH_TOKEN_AUTH first (default true; public clients only). */
+    refresh?: boolean;
+    storage?: StorageLike[];
+    fetchImpl?: typeof fetch;
+}
+/** Cognito's public refresh: a fresh ID token for a client without a secret, or undefined. */
+export declare function refreshCognitoIdToken(idToken: string, clientId: string, refreshToken: string, fetchImpl?: typeof fetch): Promise<string | undefined>;
+/** The Cognito ID token Amplify (v5/v6) or amazon-cognito-identity-js keeps for this page. */
+export declare function readAmplifyBrowserSession(options?: AmplifyBrowserSessionOptions): Promise<BrowserSessionToken | undefined>;
+/**
+ * The ID token in an msal-browser v2/v3 cache (sessionStorage by default,
+ * localStorage when the app chose it). msal-browser v4 encrypts its cache, so
+ * nothing is found there: those apps rely on lazy migration.
+ */
+export declare function readMsalBrowserSession(options?: {
+    clientId?: string;
+    storage?: StorageLike[];
+}): Promise<BrowserSessionToken | undefined>;
+/** The access token supabase-js keeps in `sb-<ref>-auth-token` (an SPA; SSR apps use the server middleware). */
+export declare function readSupabaseBrowserSession(options?: {
+    storageKey?: string;
+    storage?: StorageLike[];
+}): Promise<BrowserSessionToken | undefined>;
+/**
+ * The session the Appwrite Web SDK keeps in localStorage `cookieFallback`
+ * (`{"a_session_<projectId>": "<session>"}`) when third-party cookies are
+ * blocked. Atlas checks it with Appwrite (the `appwrite` remote bridge preset).
+ */
+export declare function readAppwriteBrowserSession(options?: {
+    projectId?: string;
+    storage?: StorageLike[];
+}): Promise<BrowserSessionToken | undefined>;
+/** The auth token the PocketBase JS SDK keeps in `pocketbase_auth`. */
+export declare function readPocketBaseBrowserSession(options?: {
+    storageKey?: string;
+    storage?: StorageLike[];
+}): Promise<BrowserSessionToken | undefined>;
+/** The refresh token nhost-js v2/v3 keeps in `nhostRefreshToken` (matched against the sessions in the bundle). */
+export declare function readNhostBrowserSession(options?: {
+    storage?: StorageLike[];
+}): Promise<BrowserSessionToken | undefined>;
+export {};

package/dist/migration-browser-sessions.js

@@ -0,0 +1,404 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrationBrowserExchangePath = migrationBrowserExchangePath;
+exports.exchangeMigrationBrowserSession = exchangeMigrationBrowserSession;
+exports.peekJwtPayload = peekJwtPayload;
+exports.refreshFirebaseIdToken = refreshFirebaseIdToken;
+exports.readFirebaseBrowserSession = readFirebaseBrowserSession;
+exports.refreshCognitoIdToken = refreshCognitoIdToken;
+exports.readAmplifyBrowserSession = readAmplifyBrowserSession;
+exports.readMsalBrowserSession = readMsalBrowserSession;
+exports.readSupabaseBrowserSession = readSupabaseBrowserSession;
+exports.readAppwriteBrowserSession = readAppwriteBrowserSession;
+exports.readPocketBaseBrowserSession = readPocketBaseBrowserSession;
+exports.readNhostBrowserSession = readNhostBrowserSession;
+function migrationBrowserExchangePath(source) {
+    return `/v1/client/migrations/${encodeURIComponent(source)}/exchange`;
+}
+/** Refusals after which the old session will never exchange: it is cleared. */
+const FINAL = new Set(['invalid', 'signature_invalid', 'expired', 'reused', 'user_unavailable', 'user_unknown']);
+/**
+ * Exchange an old vendor session found on this page for an Atlas session.
+ * Never throws. On success (or a final refusal) the old session is cleared.
+ */
+async function exchangeMigrationBrowserSession(client, input) {
+    if (!input.token)
+        return { status: 'none' };
+    const clear = async () => {
+        try {
+            await input.clear?.();
+        }
+        catch {
+            // Clearing is best-effort: the exchange already happened (or never will).
+        }
+    };
+    let response;
+    try {
+        response = await client.post(migrationBrowserExchangePath(input.source), { token: input.token, delivery: 'cookie', ...(input.remember === false ? { remember: false } : {}) });
+    }
+    catch {
+        return { status: 'refused', outcome: 'error' };
+    }
+    const data = response.data;
+    if (response.ok && data?.object === 'session' && data.id && data.jwt) {
+        await clear();
+        return { status: 'complete', sessionId: data.id, userId: data.user_id ?? '', jwt: data.jwt };
+    }
+    if (response.ok && data?.object === 'sign_in_attempt' && data.id && (data.status === 'needs_second_factor' || data.status === 'needs_mfa_enrollment')) {
+        await clear();
+        return { status: data.status, attemptId: data.id };
+    }
+    const outcome = response.errors[0]?.meta?.bridge_outcome;
+    const reason = typeof outcome === 'string' ? outcome : 'error';
+    if (FINAL.has(reason))
+        await clear();
+    return { status: 'refused', outcome: reason };
+}
+function storages(given) {
+    if (given)
+        return given;
+    const out = [];
+    try {
+        if (typeof localStorage !== 'undefined')
+            out.push(localStorage);
+    }
+    catch {
+        // Storage access can throw (privacy modes, sandboxed frames).
+    }
+    try {
+        if (typeof sessionStorage !== 'undefined')
+            out.push(sessionStorage);
+    }
+    catch {
+        // As above.
+    }
+    return out;
+}
+function keysOf(s) {
+    const keys = [];
+    for (let i = 0; i < s.length; i++) {
+        const k = s.key(i);
+        if (k !== null)
+            keys.push(k);
+    }
+    return keys;
+}
+function json(text) {
+    if (!text)
+        return null;
+    try {
+        const v = JSON.parse(text);
+        return v && typeof v === 'object' && !Array.isArray(v) ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The unverified payload of a JWT (only to read `exp` / `iss` before choosing to refresh). */
+function peekJwtPayload(token) {
+    const part = token.split('.')[1];
+    if (!part)
+        return null;
+    try {
+        const b64 = part.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(part.length / 4) * 4, '=');
+        const bytes = Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+        return json(new TextDecoder().decode(bytes));
+    }
+    catch {
+        return null;
+    }
+}
+function expired(token, skewSeconds = 30) {
+    const exp = peekJwtPayload(token)?.exp;
+    return typeof exp === 'number' && exp * 1000 <= Date.now() + skewSeconds * 1000;
+}
+const str = (v) => (typeof v === 'string' && v ? v : undefined);
+const FIREBASE_DB = 'firebaseLocalStorageDb';
+const FIREBASE_STORE = 'firebaseLocalStorage';
+const FIREBASE_KEY = /^firebase:authUser:([^:]+):/;
+function firebaseRecord(key, value) {
+    const m = FIREBASE_KEY.exec(key);
+    if (!m)
+        return null;
+    const v = (typeof value === 'string' ? json(value) : value);
+    const sts = v && typeof v.stsTokenManager === 'object' ? v.stsTokenManager : null;
+    if (!sts)
+        return null;
+    return { key, apiKey: m[1], accessToken: str(sts.accessToken), refreshToken: str(sts.refreshToken) };
+}
+function idbAll(factory) {
+    return new Promise((resolve) => {
+        let request;
+        try {
+            request = factory.open(FIREBASE_DB);
+        }
+        catch {
+            resolve([]);
+            return;
+        }
+        request.onerror = () => resolve([]);
+        request.onupgradeneeded = () => {
+            // The database did not exist: abort the creation, there is no session.
+            request.transaction?.abort();
+            resolve([]);
+        };
+        request.onsuccess = () => {
+            const db = request.result;
+            try {
+                if (!db.objectStoreNames.contains(FIREBASE_STORE)) {
+                    db.close();
+                    resolve([]);
+                    return;
+                }
+                const all = db.transaction(FIREBASE_STORE, 'readonly').objectStore(FIREBASE_STORE).getAll();
+                all.onsuccess = () => {
+                    db.close();
+                    resolve((all.result ?? []));
+                };
+                all.onerror = () => {
+                    db.close();
+                    resolve([]);
+                };
+            }
+            catch {
+                db.close();
+                resolve([]);
+            }
+        };
+    });
+}
+function idbDelete(factory, key) {
+    return new Promise((resolve) => {
+        const request = factory.open(FIREBASE_DB);
+        request.onerror = () => resolve();
+        request.onsuccess = () => {
+            const db = request.result;
+            try {
+                const tx = db.transaction(FIREBASE_STORE, 'readwrite');
+                tx.objectStore(FIREBASE_STORE).delete(key);
+                tx.oncomplete = () => {
+                    db.close();
+                    resolve();
+                };
+                tx.onerror = () => {
+                    db.close();
+                    resolve();
+                };
+            }
+            catch {
+                db.close();
+                resolve();
+            }
+        };
+    });
+}
+/** Firebase's public token refresh (the web SDK's own call): a fresh ID token, or undefined. */
+async function refreshFirebaseIdToken(apiKey, refreshToken, fetchImpl = fetch) {
+    try {
+        const res = await fetchImpl(`https://securetoken.googleapis.com/v1/token?key=${encodeURIComponent(apiKey)}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken }).toString(),
+        });
+        if (!res.ok)
+            return undefined;
+        const body = (await res.json());
+        return str(body.id_token);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The Firebase ID token this page is signed in with (IndexedDB, else local/session storage persistence). */
+async function readFirebaseBrowserSession(options = {}) {
+    const factory = options.indexedDB ?? (typeof indexedDB !== 'undefined' ? indexedDB : undefined);
+    const candidates = [];
+    if (factory) {
+        for (const row of await idbAll(factory)) {
+            const key = str(row.fbase_key);
+            const rec = key ? firebaseRecord(key, row.value) : null;
+            if (rec)
+                candidates.push({ ...rec, remove: () => idbDelete(factory, rec.key) });
+        }
+    }
+    for (const s of storages(options.storage)) {
+        for (const key of keysOf(s)) {
+            const rec = firebaseRecord(key, s.getItem(key));
+            if (rec)
+                candidates.push({ ...rec, remove: () => s.removeItem(key) });
+        }
+    }
+    const found = candidates.find((c) => !options.apiKey || c.apiKey === options.apiKey);
+    if (!found?.accessToken)
+        return undefined;
+    let token = found.accessToken;
+    if (expired(token) && options.refresh !== false && found.refreshToken) {
+        token = (await refreshFirebaseIdToken(found.apiKey, found.refreshToken, options.fetchImpl)) ?? token;
+    }
+    return { token, clear: found.remove };
+}
+const AMPLIFY_LAST_USER = /^CognitoIdentityServiceProvider\.([^.]+)\.LastAuthUser$/;
+/** Cognito's public refresh: a fresh ID token for a client without a secret, or undefined. */
+async function refreshCognitoIdToken(idToken, clientId, refreshToken, fetchImpl = fetch) {
+    const iss = str(peekJwtPayload(idToken)?.iss);
+    const region = iss?.match(/^https:\/\/cognito-idp\.([a-z0-9-]+)\.amazonaws\.com\//)?.[1];
+    if (!region)
+        return undefined;
+    try {
+        const res = await fetchImpl(`https://cognito-idp.${region}.amazonaws.com/`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-amz-json-1.1', 'x-amz-target': 'AWSCognitoIdentityProviderService.InitiateAuth' },
+            body: JSON.stringify({ AuthFlow: 'REFRESH_TOKEN_AUTH', ClientId: clientId, AuthParameters: { REFRESH_TOKEN: refreshToken } }),
+        });
+        if (!res.ok)
+            return undefined;
+        const body = (await res.json());
+        return str(body.AuthenticationResult?.IdToken);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The Cognito ID token Amplify (v5/v6) or amazon-cognito-identity-js keeps for this page. */
+async function readAmplifyBrowserSession(options = {}) {
+    for (const s of storages(options.storage)) {
+        for (const key of keysOf(s)) {
+            const m = AMPLIFY_LAST_USER.exec(key);
+            if (!m || (options.clientId && m[1] !== options.clientId))
+                continue;
+            const clientId = m[1];
+            const username = s.getItem(key);
+            if (!username)
+                continue;
+            const prefix = `CognitoIdentityServiceProvider.${clientId}.${username}`;
+            let token = s.getItem(`${prefix}.idToken`);
+            if (!token)
+                continue;
+            const refreshToken = s.getItem(`${prefix}.refreshToken`);
+            if (expired(token) && options.refresh !== false && refreshToken) {
+                token = (await refreshCognitoIdToken(token, clientId, refreshToken, options.fetchImpl)) ?? token;
+            }
+            return {
+                token,
+                clear: () => {
+                    for (const k of keysOf(s))
+                        if (k.startsWith(`CognitoIdentityServiceProvider.${clientId}.`))
+                            s.removeItem(k);
+                },
+            };
+        }
+    }
+    return undefined;
+}
+// ── MSAL (Azure AD B2C / Entra External ID) ──────────────────────────────────
+/**
+ * The ID token in an msal-browser v2/v3 cache (sessionStorage by default,
+ * localStorage when the app chose it). msal-browser v4 encrypts its cache, so
+ * nothing is found there: those apps rely on lazy migration.
+ */
+async function readMsalBrowserSession(options = {}) {
+    for (const s of storages(options.storage)) {
+        for (const key of keysOf(s)) {
+            const v = json(s.getItem(key));
+            if (!v || v.credentialType !== 'IdToken')
+                continue;
+            if (options.clientId && v.clientId !== options.clientId)
+                continue;
+            const token = str(v.secret);
+            if (!token || token.split('.').length !== 3)
+                continue;
+            const clientId = str(v.clientId);
+            return {
+                token,
+                clear: () => {
+                    for (const k of keysOf(s)) {
+                        if (k.startsWith('msal.') || (clientId && k.includes(clientId)))
+                            s.removeItem(k);
+                    }
+                },
+            };
+        }
+    }
+    return undefined;
+}
+// ── Supabase SPA (localStorage) ──────────────────────────────────────────────
+/** The access token supabase-js keeps in `sb-<ref>-auth-token` (an SPA; SSR apps use the server middleware). */
+async function readSupabaseBrowserSession(options = {}) {
+    for (const s of storages(options.storage)) {
+        for (const key of keysOf(s)) {
+            if (options.storageKey ? key !== options.storageKey : !/^sb-[^.]+-auth-token$/.test(key))
+                continue;
+            const v = json(s.getItem(key));
+            const nested = v && typeof v.currentSession === 'object' ? v.currentSession : null;
+            const token = str(v?.access_token) ?? str(nested?.access_token);
+            if (!token)
+                continue;
+            return { token, clear: () => s.removeItem(key) };
+        }
+    }
+    return undefined;
+}
+// ── Appwrite (localStorage cookie fallback) ──────────────────────────────────
+/**
+ * The session the Appwrite Web SDK keeps in localStorage `cookieFallback`
+ * (`{"a_session_<projectId>": "<session>"}`) when third-party cookies are
+ * blocked. Atlas checks it with Appwrite (the `appwrite` remote bridge preset).
+ */
+async function readAppwriteBrowserSession(options = {}) {
+    for (const s of storages(options.storage)) {
+        const v = json(s.getItem('cookieFallback'));
+        if (!v)
+            continue;
+        for (const [key, value] of Object.entries(v)) {
+            if (options.projectId ? key !== `a_session_${options.projectId}` : !key.startsWith('a_session_') || key.endsWith('_legacy'))
+                continue;
+            const token = str(value);
+            if (!token)
+                continue;
+            return {
+                token,
+                clear: () => {
+                    const rest = { ...v };
+                    delete rest[key];
+                    delete rest[`${key}_legacy`];
+                    if (Object.keys(rest).length && s.setItem)
+                        s.setItem('cookieFallback', JSON.stringify(rest));
+                    else
+                        s.removeItem('cookieFallback');
+                },
+            };
+        }
+    }
+    return undefined;
+}
+// ── PocketBase (localStorage) ─────────────────────────────────────────────────
+/** The auth token the PocketBase JS SDK keeps in `pocketbase_auth`. */
+async function readPocketBaseBrowserSession(options = {}) {
+    const name = options.storageKey ?? 'pocketbase_auth';
+    for (const s of storages(options.storage)) {
+        const token = str(json(s.getItem(name))?.token);
+        if (token)
+            return { token, clear: () => s.removeItem(name) };
+    }
+    return undefined;
+}
+// ── Nhost (localStorage) ──────────────────────────────────────────────────────
+/** The refresh token nhost-js v2/v3 keeps in `nhostRefreshToken` (matched against the sessions in the bundle). */
+async function readNhostBrowserSession(options = {}) {
+    for (const s of storages(options.storage)) {
+        const v4 = json(s.getItem('nhostSession'));
+        const token = s.getItem('nhostRefreshToken') ?? str(v4?.refreshToken);
+        if (token) {
+            return {
+                token,
+                clear: () => {
+                    s.removeItem('nhostRefreshToken');
+                    s.removeItem('nhostRefreshTokenExpiresAt');
+                    s.removeItem('nhostSession');
+                },
+            };
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=migration-browser-sessions.js.map

package/dist/migration-browser-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-browser-sessions.js","sourceRoot":"","sources":["../src/migration-browser-sessions.ts"],"names":[],"mappings":";;AAsCA,oEAEC;AASD,0EAkCC;AA0CD,wCAUC;AA2GD,wDAaC;AAGD,gEAuBC;AAgBD,sDAgBC;AAGD,8DAwBC;AASD,wDAoBC;AAKD,gEAYC;AASD,gEAqBC;AAKD,oEAOC;AAKD,0DAgBC;AA3ZD,SAAgB,4BAA4B,CAAC,MAAc;IACzD,OAAO,yBAAyB,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC,CAAC;AAEjH;;;GAGG;AACI,KAAK,UAAU,+BAA+B,CACnD,MAAkB,EAClB,KAAiG;IAEjG,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC,CAAC;IACF,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAC1B,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,EAC1C,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACrE,MAAM,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,iBAAiB,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,qBAAqB,IAAI,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,EAAE,CAAC;QACtJ,MAAM,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/D,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,KAAK,EAAE,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAMD,SAAS,QAAQ,CAAC,KAAqB;IACrC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,OAAO,YAAY,KAAK,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IACD,IAAI,CAAC;QACH,IAAI,OAAO,cAAc,KAAK,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,CAAc;IAC5B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,IAAmB;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACtC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAgB,cAAc,CAAC,KAAa;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,WAAW,GAAG,EAAE;IAC9C,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACvC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC;AAClF,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAc7F,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAC9C,MAAM,YAAY,GAAG,6BAA6B,CAAC;AASnD,SAAS,cAAc,CAAC,GAAW,EAAE,KAAc;IACjD,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAmC,CAAC;IAC9F,MAAM,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,eAA2C,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AACxG,CAAC;AAED,SAAS,MAAM,CAAC,OAAmB;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO;QACT,CAAC;QACD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;YAC7B,uEAAuE;YACvE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;YAC7B,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC,CAAC;QACF,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;YACvB,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;oBAClD,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,EAAE,CAAC,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC5F,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE;oBACnB,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAoD,CAAC,CAAC;gBACjF,CAAC,CAAC;gBACF,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE;oBACjB,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,EAAE,CAAC,CAAC;gBACd,CAAC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,OAAmB,EAAE,GAAW;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAClC,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;YACvB,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBACvD,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC3C,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE;oBACnB,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC;gBACF,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE;oBAChB,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AACzF,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,YAAoB,EAAE,YAA0B,KAAK;IAChH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,mDAAmD,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE;YAC3G,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE;SACnG,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,6GAA6G;AACtG,KAAK,UAAU,0BAA0B,CAAC,UAAyC,EAAE;IAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChG,MAAM,UAAU,GAAuE,EAAE,CAAC;IAC1F,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,GAAG,IAAI,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxD,IAAI,GAAG;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAChD,IAAI,GAAG;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,EAAE,WAAW;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtE,KAAK,GAAG,CAAC,MAAM,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC;IACvG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AAaD,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;AAEpF,8FAA8F;AACvF,KAAK,UAAU,qBAAqB,CAAC,OAAe,EAAE,QAAgB,EAAE,YAAoB,EAAE,YAA0B,KAAK;IAClI,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,wDAAwD,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,uBAAuB,MAAM,iBAAiB,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,4BAA4B,EAAE,cAAc,EAAE,gDAAgD,EAAE;YAC3H,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,CAAC;SAC9H,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqD,CAAC;QACpF,OAAO,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8FAA8F;AACvF,KAAK,UAAU,yBAAyB,CAAC,UAAwC,EAAE;IACxF,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpE,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,MAAM,GAAG,kCAAkC,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACxE,IAAI,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,eAAe,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,YAAY,EAAE,CAAC;gBAChE,KAAK,GAAG,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC;YACnG,CAAC;YACD,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,GAAG,EAAE;oBACV,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;wBAAE,IAAI,CAAC,CAAC,UAAU,CAAC,kCAAkC,QAAQ,GAAG,CAAC;4BAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC9G,CAAC;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACI,KAAK,UAAU,sBAAsB,CAAC,UAA0D,EAAE;IACvG,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS;gBAAE,SAAS;YACnD,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;gBAAE,SAAS;YAClE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,GAAG,EAAE;oBACV,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1B,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;4BAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBACnF,CAAC;gBACH,CAAC;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gFAAgF;AAEhF,gHAAgH;AACzG,KAAK,UAAU,0BAA0B,CAAC,UAA4D,EAAE;IAC7G,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACnG,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,cAA0C,CAAC,CAAC,CAAC,IAAI,CAAC;YAChH,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACI,KAAK,UAAU,0BAA0B,CAAC,UAA2D,EAAE;IAC5G,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YACtI,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,GAAG,EAAE;oBACV,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;oBACtB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjB,OAAO,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;oBAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO;wBAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;;wBACxF,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;gBACtC,CAAC;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AAEjF,uEAAuE;AAChE,KAAK,UAAU,4BAA4B,CAAC,UAA4D,EAAE;IAC/G,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AAEjF,kHAAkH;AAC3G,KAAK,UAAU,uBAAuB,CAAC,UAAuC,EAAE;IACrF,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,GAAG,EAAE;oBACV,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;oBAClC,CAAC,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;oBAC3C,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;gBAC/B,CAAC;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}