{"version":3,"file":"ad-config.mjs","sources":["../../../../src/lib/auth/active-directory/ad-config.ts"],"sourcesContent":["/**\n * Active Directory Configuration\n *\n * Configuration types, defaults, and validation for AD authentication.\n * Supports Azure AD, Azure AD B2C, AD FS, and on-premises configurations.\n *\n * @module auth/active-directory/ad-config\n */\n\nimport type {\n  ADConfig,\n  ADFSConfig,\n  ADGroupMappingConfig,\n  ADProviderType,\n  AzureADB2CConfig,\n  AzureADConfig,\n  OnPremisesADConfig,\n  SSOConfig,\n} from './types';\nimport type { Role } from '@/lib';\n\n// =============================================================================\n// Default Configurations\n// =============================================================================\n\n/**\n * Default Azure AD scopes for common operations.\n */\nexport const DEFAULT_AZURE_AD_SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'offline_access',\n  'User.Read',\n] as const;\n\n/**\n * Graph API scopes for group membership resolution.\n */\nexport const GRAPH_GROUP_SCOPES = ['GroupMember.Read.All', 'Directory.Read.All'] as const;\n\n/**\n * Default Azure AD configuration.\n */\nexport const DEFAULT_AZURE_AD_CONFIG: Partial<AzureADConfig> = {\n  authority: 'https://login.microsoftonline.com/common',\n  scopes: [...DEFAULT_AZURE_AD_SCOPES],\n  usePkce: true,\n  cacheLocation: 'sessionStorage',\n  usePopup: false,\n  navigateToLoginRequestUrl: true,\n};\n\n/**\n * Default Azure AD B2C configuration.\n */\nexport const DEFAULT_AZURE_B2C_CONFIG: Partial<AzureADB2CConfig> = {\n  scopes: ['openid', 'profile', 'offline_access'],\n  usePkce: true,\n  cacheLocation: 'sessionStorage',\n  usePopup: false,\n  navigateToLoginRequestUrl: true,\n  policies: {\n    signUpSignIn: 'B2C_1_SignUpSignIn',\n    resetPassword: 'B2C_1_PasswordReset',\n    editProfile: 'B2C_1_ProfileEdit',\n  },\n};\n\n/**\n * Default AD FS configuration.\n */\nexport const DEFAULT_ADFS_CONFIG: Partial<ADFSConfig> = {\n  scopes: ['openid', 'profile', 'email'],\n  useWia: false,\n};\n\n/**\n * Default on-premises AD configuration.\n */\nexport const DEFAULT_ON_PREMISES_CONFIG: Partial<OnPremisesADConfig> = {\n  useTls: true,\n  userSearchFilter: '(&(objectClass=user)(sAMAccountName={username}))',\n  groupSearchFilter: '(&(objectClass=group)(member={userDn}))',\n  syncInterval: 300000, // 5 minutes\n};\n\n/**\n * Default SSO configuration.\n */\nexport const DEFAULT_SSO_CONFIG: SSOConfig = {\n  crossTabSync: true,\n  storagePrefix: 'ad_sso_',\n  sessionTimeout: 28800000, // 8 hours\n  trackActivity: true,\n  activityCheckInterval: 60000, // 1 minute\n  autoExtendSession: true,\n};\n\n/**\n * Default group mapping configuration.\n */\nexport const DEFAULT_GROUP_MAPPING_CONFIG: ADGroupMappingConfig = {\n  mappings: [],\n  defaultRole: 'guest' as Role,\n  defaultPermissions: [],\n  resolveNestedGroups: false,\n  cacheDuration: 300000, // 5 minutes\n  fallbackBehavior: 'use-claims',\n};\n\n/**\n * Default AD configuration.\n */\nexport const DEFAULT_AD_CONFIG: Partial<ADConfig> = {\n  debug: false,\n  multiTenant: false,\n  sessionTimeout: 28800000, // 8 hours\n  silentRefresh: true,\n  featureFlag: 'ad-authentication',\n};\n\n// =============================================================================\n// Configuration Builders\n// =============================================================================\n\n/**\n * Create Azure AD configuration with defaults.\n *\n * @param config - Partial Azure AD configuration\n * @returns Complete Azure AD configuration\n */\nexport function createAzureADConfig(\n  config: Partial<AzureADConfig> & Pick<AzureADConfig, 'tenantId' | 'clientId' | 'redirectUri'>\n): AzureADConfig {\n  return {\n    ...DEFAULT_AZURE_AD_CONFIG,\n    ...config,\n    authority: config.authority ?? `https://login.microsoftonline.com/${config.tenantId}`,\n    scopes: config.scopes ?? [...DEFAULT_AZURE_AD_SCOPES],\n  };\n}\n\n/**\n * Create Azure AD B2C configuration with defaults.\n *\n * @param config - Partial Azure AD B2C configuration\n * @returns Complete Azure AD B2C configuration\n */\nexport function createAzureB2CConfig(\n  config: Partial<AzureADB2CConfig> &\n    Pick<AzureADB2CConfig, 'tenantId' | 'clientId' | 'redirectUri' | 'b2cTenantName'>\n): AzureADB2CConfig {\n  const policies = {\n    ...DEFAULT_AZURE_B2C_CONFIG.policies,\n    ...config.policies,\n  } as AzureADB2CConfig['policies'];\n\n  const authority =\n    config.authority ??\n    `https://${config.b2cTenantName}.b2clogin.com/${config.b2cTenantName}.onmicrosoft.com/${policies.signUpSignIn}`;\n\n  return {\n    ...DEFAULT_AZURE_B2C_CONFIG,\n    ...config,\n    policies,\n    authority,\n    knownAuthorities: config.knownAuthorities ?? [`${config.b2cTenantName}.b2clogin.com`],\n    scopes: config.scopes ?? DEFAULT_AZURE_B2C_CONFIG.scopes ?? [],\n  };\n}\n\n/**\n * Create AD FS configuration with defaults.\n *\n * @param config - Partial AD FS configuration\n * @returns Complete AD FS configuration\n */\nexport function createADFSConfig(\n  config: Partial<ADFSConfig> & Pick<ADFSConfig, 'serverUrl' | 'clientId' | 'redirectUri'>\n): ADFSConfig {\n  return {\n    ...DEFAULT_ADFS_CONFIG,\n    ...config,\n    scopes: config.scopes ?? ['openid', 'profile', 'email'],\n  };\n}\n\n/**\n * Create on-premises AD configuration with defaults.\n *\n * @param config - Partial on-premises configuration\n * @returns Complete on-premises configuration\n */\nexport function createOnPremisesConfig(\n  config: Partial<OnPremisesADConfig> &\n    Pick<OnPremisesADConfig, 'ldapUrl' | 'baseDn' | 'bindDn' | 'bindPassword'>\n): OnPremisesADConfig {\n  return {\n    ...DEFAULT_ON_PREMISES_CONFIG,\n    ...config,\n    useTls: config.useTls ?? true,\n  };\n}\n\n/**\n * Create complete AD configuration with appropriate defaults.\n *\n * @param providerType - The AD provider type\n * @param providerConfig - Provider-specific configuration\n * @param options - Additional options\n * @returns Complete AD configuration\n */\nexport function createADConfig<T extends ADProviderType>(\n  providerType: T,\n  providerConfig: T extends 'azure-ad'\n    ? Partial<AzureADConfig> & Pick<AzureADConfig, 'tenantId' | 'clientId' | 'redirectUri'>\n    : T extends 'azure-ad-b2c'\n      ? Partial<AzureADB2CConfig> &\n          Pick<AzureADB2CConfig, 'tenantId' | 'clientId' | 'redirectUri' | 'b2cTenantName'>\n      : T extends 'adfs'\n        ? Partial<ADFSConfig> & Pick<ADFSConfig, 'serverUrl' | 'clientId' | 'redirectUri'>\n        : T extends 'on-premises'\n          ? Partial<OnPremisesADConfig> &\n              Pick<OnPremisesADConfig, 'ldapUrl' | 'baseDn' | 'bindDn' | 'bindPassword'>\n          : Record<string, unknown>,\n  options?: Partial<Omit<ADConfig, 'providerType' | 'azure' | 'azureB2C' | 'adfs' | 'onPremises'>>\n): ADConfig {\n  const baseConfig: ADConfig = {\n    ...DEFAULT_AD_CONFIG,\n    ...options,\n    providerType,\n  };\n\n  switch (providerType) {\n    case 'azure-ad':\n      baseConfig.azure = createAzureADConfig(\n        providerConfig as Partial<AzureADConfig> &\n          Pick<AzureADConfig, 'tenantId' | 'clientId' | 'redirectUri'>\n      );\n      break;\n    case 'azure-ad-b2c':\n      baseConfig.azureB2C = createAzureB2CConfig(\n        providerConfig as Partial<AzureADB2CConfig> &\n          Pick<AzureADB2CConfig, 'tenantId' | 'clientId' | 'redirectUri' | 'b2cTenantName'>\n      );\n      break;\n    case 'adfs':\n      baseConfig.adfs = createADFSConfig(\n        providerConfig as Partial<ADFSConfig> &\n          Pick<ADFSConfig, 'serverUrl' | 'clientId' | 'redirectUri'>\n      );\n      break;\n    case 'on-premises':\n      baseConfig.onPremises = createOnPremisesConfig(\n        providerConfig as Partial<OnPremisesADConfig> &\n          Pick<OnPremisesADConfig, 'ldapUrl' | 'baseDn' | 'bindDn' | 'bindPassword'>\n      );\n      break;\n    case 'custom':\n      baseConfig.custom = providerConfig as Record<string, unknown>;\n      break;\n  }\n\n  return baseConfig;\n}\n\n// =============================================================================\n// Configuration Validation\n// =============================================================================\n\n/**\n * Validation result for configuration checking.\n */\nexport interface ConfigValidationResult {\n  /** Whether the configuration is valid */\n  valid: boolean;\n  /** List of validation errors */\n  errors: string[];\n  /** List of warnings (non-blocking issues) */\n  warnings: string[];\n}\n\n/**\n * Validate Azure AD configuration.\n */\nfunction validateAzureADConfig(config: AzureADConfig | undefined): ConfigValidationResult {\n  const errors: string[] = [];\n  const warnings: string[] = [];\n\n  if (!config) {\n    errors.push('Azure AD configuration is required');\n    return { valid: false, errors, warnings };\n  }\n\n  if (!config.tenantId) {\n    errors.push('Azure AD tenantId is required');\n  } else if (!/^[a-f0-9-]{36}$|^[a-zA-Z0-9.-]+$/i.test(config.tenantId)) {\n    errors.push('Azure AD tenantId must be a valid GUID or domain');\n  }\n\n  if (!config.clientId) {\n    errors.push('Azure AD clientId is required');\n  } else if (!/^[a-f0-9-]{36}$/i.test(config.clientId)) {\n    errors.push('Azure AD clientId must be a valid GUID');\n  }\n\n  if (!config.redirectUri) {\n    errors.push('Azure AD redirectUri is required');\n  } else if (!isValidUrl(config.redirectUri)) {\n    errors.push('Azure AD redirectUri must be a valid URL');\n  }\n\n  if (config.scopes == null || config.scopes.length === 0) {\n    warnings.push('No scopes specified, using default scopes');\n  }\n\n  if (config.clientSecret != null && config.clientSecret !== '') {\n    warnings.push('Client secret should not be used in browser applications');\n  }\n\n  if (config.cacheLocation === 'localStorage') {\n    warnings.push('localStorage cache may persist across sessions, consider using sessionStorage');\n  }\n\n  return { valid: errors.length === 0, errors, warnings };\n}\n\n/**\n * Validate Azure AD B2C configuration.\n */\nfunction validateAzureB2CConfig(config: AzureADB2CConfig | undefined): ConfigValidationResult {\n  const baseResult = validateAzureADConfig(config);\n  const errors = [...baseResult.errors];\n  const warnings = [...baseResult.warnings];\n\n  if (config) {\n    if (!config.b2cTenantName) {\n      errors.push('Azure AD B2C tenant name is required');\n    }\n\n    if (config.policies?.signUpSignIn == null || config.policies.signUpSignIn === '') {\n      errors.push('Azure AD B2C signUpSignIn policy is required');\n    }\n\n    if (config.knownAuthorities == null || config.knownAuthorities.length === 0) {\n      errors.push('Azure AD B2C known authorities are required');\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings };\n}\n\n/**\n * Validate AD FS configuration.\n */\nfunction validateADFSConfig(config: ADFSConfig | undefined): ConfigValidationResult {\n  const errors: string[] = [];\n  const warnings: string[] = [];\n\n  if (!config) {\n    errors.push('AD FS configuration is required');\n    return { valid: false, errors, warnings };\n  }\n\n  if (!config.serverUrl) {\n    errors.push('AD FS serverUrl is required');\n  } else if (!isValidUrl(config.serverUrl)) {\n    errors.push('AD FS serverUrl must be a valid URL');\n  }\n\n  if (!config.clientId) {\n    errors.push('AD FS clientId is required');\n  }\n\n  if (!config.redirectUri) {\n    errors.push('AD FS redirectUri is required');\n  } else if (!isValidUrl(config.redirectUri)) {\n    errors.push('AD FS redirectUri must be a valid URL');\n  }\n\n  if (config.useWia === true) {\n    warnings.push('Windows Integrated Authentication requires browser and network support');\n  }\n\n  return { valid: errors.length === 0, errors, warnings };\n}\n\n/**\n * Validate on-premises AD configuration.\n */\nfunction validateOnPremisesConfig(config: OnPremisesADConfig | undefined): ConfigValidationResult {\n  const errors: string[] = [];\n  const warnings: string[] = [];\n\n  if (!config) {\n    errors.push('On-premises AD configuration is required');\n    return { valid: false, errors, warnings };\n  }\n\n  if (!config.ldapUrl) {\n    errors.push('LDAP URL is required');\n  } else if (!config.ldapUrl.startsWith('ldap://') && !config.ldapUrl.startsWith('ldaps://')) {\n    errors.push('LDAP URL must start with ldap:// or ldaps://');\n  }\n\n  if (!config.baseDn) {\n    errors.push('Base DN is required');\n  }\n\n  if (!config.bindDn) {\n    errors.push('Bind DN is required');\n  }\n\n  if (!config.bindPassword) {\n    errors.push('Bind password is required');\n  }\n\n  if (!config.useTls && config.ldapUrl?.startsWith('ldap://')) {\n    warnings.push('LDAP connection without TLS is insecure');\n  }\n\n  return { valid: errors.length === 0, errors, warnings };\n}\n\n/**\n * Validate complete AD configuration.\n *\n * @param config - The AD configuration to validate\n * @returns Validation result with errors and warnings\n */\nexport function validateADConfig(config: ADConfig): ConfigValidationResult {\n  const errors: string[] = [];\n  const warnings: string[] = [];\n\n  if (!config.providerType) {\n    errors.push('Provider type is required');\n    return { valid: false, errors, warnings };\n  }\n\n  let providerResult: ConfigValidationResult;\n\n  switch (config.providerType) {\n    case 'azure-ad':\n      providerResult = validateAzureADConfig(config.azure);\n      break;\n    case 'azure-ad-b2c':\n      providerResult = validateAzureB2CConfig(config.azureB2C);\n      break;\n    case 'adfs':\n      providerResult = validateADFSConfig(config.adfs);\n      break;\n    case 'on-premises':\n      providerResult = validateOnPremisesConfig(config.onPremises);\n      break;\n    case 'custom':\n      if (!config.custom || Object.keys(config.custom).length === 0) {\n        warnings.push('Custom provider configuration is empty');\n      }\n      providerResult = { valid: true, errors: [], warnings: [] };\n      break;\n    default:\n      errors.push(`Unknown provider type: ${String(config.providerType)}`);\n      providerResult = { valid: false, errors: [], warnings: [] };\n  }\n\n  errors.push(...providerResult.errors);\n  warnings.push(...providerResult.warnings);\n\n  if (config.sessionTimeout != null && config.sessionTimeout < 60000) {\n    warnings.push('Session timeout less than 1 minute may cause frequent re-authentication');\n  }\n\n  if (config.debug === true) {\n    warnings.push('Debug mode is enabled - disable in production');\n  }\n\n  return { valid: errors.length === 0, errors, warnings };\n}\n\n// =============================================================================\n// Helper Functions\n// =============================================================================\n\n/**\n * Check if a string is a valid URL.\n */\nfunction isValidUrl(url: string): boolean {\n  try {\n    new URL(url);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Get the active provider configuration from ADConfig.\n *\n * @param config - The AD configuration\n * @returns The active provider configuration or null\n */\nexport function getActiveProviderConfig(\n  config: ADConfig\n):\n  | AzureADConfig\n  | AzureADB2CConfig\n  | ADFSConfig\n  | OnPremisesADConfig\n  | Record<string, unknown>\n  | null {\n  switch (config.providerType) {\n    case 'azure-ad':\n      return config.azure ?? null;\n    case 'azure-ad-b2c':\n      return config.azureB2C ?? null;\n    case 'adfs':\n      return config.adfs ?? null;\n    case 'on-premises':\n      return config.onPremises ?? null;\n    case 'custom':\n      return config.custom ?? null;\n    default:\n      return null;\n  }\n}\n\n/**\n * Get the authority URL for the configured provider.\n *\n * @param config - The AD configuration\n * @returns The authority URL or null\n */\nexport function getAuthorityUrl(config: ADConfig): string | null {\n  switch (config.providerType) {\n    case 'azure-ad':\n      return config.azure?.authority ?? null;\n    case 'azure-ad-b2c':\n      return config.azureB2C?.authority ?? null;\n    case 'adfs':\n      return config.adfs?.serverUrl ?? null;\n    default:\n      return null;\n  }\n}\n\n/**\n * Get the configured scopes for the provider.\n *\n * @param config - The AD configuration\n * @returns Array of scopes\n */\nexport function getConfiguredScopes(config: ADConfig): string[] {\n  switch (config.providerType) {\n    case 'azure-ad':\n      return config.azure?.scopes ?? [...DEFAULT_AZURE_AD_SCOPES];\n    case 'azure-ad-b2c':\n      return config.azureB2C?.scopes ?? ['openid', 'profile', 'offline_access'];\n    case 'adfs':\n      return config.adfs?.scopes ?? ['openid', 'profile', 'email'];\n    default:\n      return ['openid', 'profile'];\n  }\n}\n\n/**\n * Merge scopes with Graph API scopes for group resolution.\n *\n * @param baseScopes - The base scopes\n * @param includeGroupScopes - Whether to include group-related scopes\n * @returns Merged scopes array\n */\nexport function mergeWithGraphScopes(baseScopes: string[], includeGroupScopes = false): string[] {\n  const scopes = new Set(baseScopes);\n\n  if (includeGroupScopes) {\n    GRAPH_GROUP_SCOPES.forEach((scope) => scopes.add(scope));\n  }\n\n  return Array.from(scopes);\n}\n"],"names":["DEFAULT_AZURE_AD_SCOPES","GRAPH_GROUP_SCOPES","DEFAULT_AZURE_AD_CONFIG","DEFAULT_AZURE_B2C_CONFIG","DEFAULT_ADFS_CONFIG","DEFAULT_ON_PREMISES_CONFIG","DEFAULT_SSO_CONFIG","DEFAULT_GROUP_MAPPING_CONFIG","DEFAULT_AD_CONFIG","createAzureADConfig","config","createAzureB2CConfig","policies","authority","createADFSConfig","createOnPremisesConfig","createADConfig","providerType","providerConfig","options","baseConfig","validateAzureADConfig","errors","warnings","isValidUrl","validateAzureB2CConfig","baseResult","validateADFSConfig","validateOnPremisesConfig","validateADConfig","providerResult","url","getAuthorityUrl","getConfiguredScopes","mergeWithGraphScopes","baseScopes","includeGroupScopes","scopes","scope"],"mappings":"AA4BO,MAAMA,IAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKaC,IAAqB,CAAC,wBAAwB,oBAAoB,GAKlEC,IAAkD;AAAA,EAC7D,WAAW;AAAA,EACX,QAAQ,CAAC,GAAGF,CAAuB;AAAA,EACnC,SAAS;AAAA,EACT,eAAe;AAAA,EACf,UAAU;AAAA,EACV,2BAA2B;AAC7B,GAKaG,IAAsD;AAAA,EACjE,QAAQ,CAAC,UAAU,WAAW,gBAAgB;AAAA,EAC9C,SAAS;AAAA,EACT,eAAe;AAAA,EACf,UAAU;AAAA,EACV,2BAA2B;AAAA,EAC3B,UAAU;AAAA,IACR,cAAc;AAAA,IACd,eAAe;AAAA,IACf,aAAa;AAAA,EAAA;AAEjB,GAKaC,IAA2C;AAAA,EACtD,QAAQ,CAAC,UAAU,WAAW,OAAO;AAAA,EACrC,QAAQ;AACV,GAKaC,IAA0D;AAAA,EACrE,QAAQ;AAAA,EACR,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,cAAc;AAAA;AAChB,GAKaC,IAAgC;AAAA,EAC3C,cAAc;AAAA,EACd,eAAe;AAAA,EACf,gBAAgB;AAAA;AAAA,EAChB,eAAe;AAAA,EACf,uBAAuB;AAAA;AAAA,EACvB,mBAAmB;AACrB,GAKaC,IAAqD;AAAA,EAChE,UAAU,CAAA;AAAA,EACV,aAAa;AAAA,EACb,oBAAoB,CAAA;AAAA,EACpB,qBAAqB;AAAA,EACrB,eAAe;AAAA;AAAA,EACf,kBAAkB;AACpB,GAKaC,IAAuC;AAAA,EAClD,OAAO;AAAA,EACP,aAAa;AAAA,EACb,gBAAgB;AAAA;AAAA,EAChB,eAAe;AAAA,EACf,aAAa;AACf;AAYO,SAASC,EACdC,GACe;AACf,SAAO;AAAA,IACL,GAAGR;AAAA,IACH,GAAGQ;AAAA,IACH,WAAWA,EAAO,aAAa,qCAAqCA,EAAO,QAAQ;AAAA,IACnF,QAAQA,EAAO,UAAU,CAAC,GAAGV,CAAuB;AAAA,EAAA;AAExD;AAQO,SAASW,EACdD,GAEkB;AAClB,QAAME,IAAW;AAAA,IACf,GAAGT,EAAyB;AAAA,IAC5B,GAAGO,EAAO;AAAA,EAAA,GAGNG,IACJH,EAAO,aACP,WAAWA,EAAO,aAAa,iBAAiBA,EAAO,aAAa,oBAAoBE,EAAS,YAAY;AAE/G,SAAO;AAAA,IACL,GAAGT;AAAA,IACH,GAAGO;AAAA,IACH,UAAAE;AAAA,IACA,WAAAC;AAAA,IACA,kBAAkBH,EAAO,oBAAoB,CAAC,GAAGA,EAAO,aAAa,eAAe;AAAA,IACpF,QAAQA,EAAO,UAAUP,EAAyB,UAAU,CAAA;AAAA,EAAC;AAEjE;AAQO,SAASW,EACdJ,GACY;AACZ,SAAO;AAAA,IACL,GAAGN;AAAA,IACH,GAAGM;AAAA,IACH,QAAQA,EAAO,UAAU,CAAC,UAAU,WAAW,OAAO;AAAA,EAAA;AAE1D;AAQO,SAASK,EACdL,GAEoB;AACpB,SAAO;AAAA,IACL,GAAGL;AAAA,IACH,GAAGK;AAAA,IACH,QAAQA,EAAO,UAAU;AAAA,EAAA;AAE7B;AAUO,SAASM,EACdC,GACAC,GAWAC,GACU;AACV,QAAMC,IAAuB;AAAA,IAC3B,GAAGZ;AAAA,IACH,GAAGW;AAAA,IACH,cAAAF;AAAA,EAAA;AAGF,UAAQA,GAAA;AAAA,IACN,KAAK;AACH,MAAAG,EAAW,QAAQX;AAAA,QACjBS;AAAA,MAAA;AAGF;AAAA,IACF,KAAK;AACH,MAAAE,EAAW,WAAWT;AAAA,QACpBO;AAAA,MAAA;AAGF;AAAA,IACF,KAAK;AACH,MAAAE,EAAW,OAAON;AAAA,QAChBI;AAAA,MAAA;AAGF;AAAA,IACF,KAAK;AACH,MAAAE,EAAW,aAAaL;AAAA,QACtBG;AAAA,MAAA;AAGF;AAAA,IACF,KAAK;AACH,MAAAE,EAAW,SAASF;AACpB;AAAA,EAAA;AAGJ,SAAOE;AACT;AAqBA,SAASC,EAAsBX,GAA2D;AACxF,QAAMY,IAAmB,CAAA,GACnBC,IAAqB,CAAA;AAE3B,SAAKb,KAKAA,EAAO,WAEA,oCAAoC,KAAKA,EAAO,QAAQ,KAClEY,EAAO,KAAK,kDAAkD,IAF9DA,EAAO,KAAK,+BAA+B,GAKxCZ,EAAO,WAEA,mBAAmB,KAAKA,EAAO,QAAQ,KACjDY,EAAO,KAAK,wCAAwC,IAFpDA,EAAO,KAAK,+BAA+B,GAKxCZ,EAAO,cAEAc,EAAWd,EAAO,WAAW,KACvCY,EAAO,KAAK,0CAA0C,IAFtDA,EAAO,KAAK,kCAAkC,IAK5CZ,EAAO,UAAU,QAAQA,EAAO,OAAO,WAAW,MACpDa,EAAS,KAAK,2CAA2C,GAGvDb,EAAO,gBAAgB,QAAQA,EAAO,iBAAiB,MACzDa,EAAS,KAAK,0DAA0D,GAGtEb,EAAO,kBAAkB,kBAC3Ba,EAAS,KAAK,+EAA+E,GAGxF,EAAE,OAAOD,EAAO,WAAW,GAAG,QAAAA,GAAQ,UAAAC,EAAA,MAlC3CD,EAAO,KAAK,oCAAoC,GACzC,EAAE,OAAO,IAAO,QAAAA,GAAQ,UAAAC,EAAA;AAkCnC;AAKA,SAASE,EAAuBf,GAA8D;AAC5F,QAAMgB,IAAaL,EAAsBX,CAAM,GACzCY,IAAS,CAAC,GAAGI,EAAW,MAAM,GAC9BH,IAAW,CAAC,GAAGG,EAAW,QAAQ;AAExC,SAAIhB,MACGA,EAAO,iBACVY,EAAO,KAAK,sCAAsC,IAGhDZ,EAAO,UAAU,gBAAgB,QAAQA,EAAO,SAAS,iBAAiB,OAC5EY,EAAO,KAAK,8CAA8C,IAGxDZ,EAAO,oBAAoB,QAAQA,EAAO,iBAAiB,WAAW,MACxEY,EAAO,KAAK,6CAA6C,IAItD,EAAE,OAAOA,EAAO,WAAW,GAAG,QAAAA,GAAQ,UAAAC,EAAA;AAC/C;AAKA,SAASI,EAAmBjB,GAAwD;AAClF,QAAMY,IAAmB,CAAA,GACnBC,IAAqB,CAAA;AAE3B,SAAKb,KAKAA,EAAO,YAEAc,EAAWd,EAAO,SAAS,KACrCY,EAAO,KAAK,qCAAqC,IAFjDA,EAAO,KAAK,6BAA6B,GAKtCZ,EAAO,YACVY,EAAO,KAAK,4BAA4B,GAGrCZ,EAAO,cAEAc,EAAWd,EAAO,WAAW,KACvCY,EAAO,KAAK,uCAAuC,IAFnDA,EAAO,KAAK,+BAA+B,GAKzCZ,EAAO,WAAW,MACpBa,EAAS,KAAK,wEAAwE,GAGjF,EAAE,OAAOD,EAAO,WAAW,GAAG,QAAAA,GAAQ,UAAAC,EAAA,MAxB3CD,EAAO,KAAK,iCAAiC,GACtC,EAAE,OAAO,IAAO,QAAAA,GAAQ,UAAAC,EAAA;AAwBnC;AAKA,SAASK,EAAyBlB,GAAgE;AAChG,QAAMY,IAAmB,CAAA,GACnBC,IAAqB,CAAA;AAE3B,SAAKb,KAKAA,EAAO,UAED,CAACA,EAAO,QAAQ,WAAW,SAAS,KAAK,CAACA,EAAO,QAAQ,WAAW,UAAU,KACvFY,EAAO,KAAK,8CAA8C,IAF1DA,EAAO,KAAK,sBAAsB,GAK/BZ,EAAO,UACVY,EAAO,KAAK,qBAAqB,GAG9BZ,EAAO,UACVY,EAAO,KAAK,qBAAqB,GAG9BZ,EAAO,gBACVY,EAAO,KAAK,2BAA2B,GAGrC,CAACZ,EAAO,UAAUA,EAAO,SAAS,WAAW,SAAS,KACxDa,EAAS,KAAK,yCAAyC,GAGlD,EAAE,OAAOD,EAAO,WAAW,GAAG,QAAAA,GAAQ,UAAAC,EAAA,MA1B3CD,EAAO,KAAK,0CAA0C,GAC/C,EAAE,OAAO,IAAO,QAAAA,GAAQ,UAAAC,EAAA;AA0BnC;AAQO,SAASM,EAAiBnB,GAA0C;AACzE,QAAMY,IAAmB,CAAA,GACnBC,IAAqB,CAAA;AAE3B,MAAI,CAACb,EAAO;AACV,WAAAY,EAAO,KAAK,2BAA2B,GAChC,EAAE,OAAO,IAAO,QAAAA,GAAQ,UAAAC,EAAA;AAGjC,MAAIO;AAEJ,UAAQpB,EAAO,cAAA;AAAA,IACb,KAAK;AACH,MAAAoB,IAAiBT,EAAsBX,EAAO,KAAK;AACnD;AAAA,IACF,KAAK;AACH,MAAAoB,IAAiBL,EAAuBf,EAAO,QAAQ;AACvD;AAAA,IACF,KAAK;AACH,MAAAoB,IAAiBH,EAAmBjB,EAAO,IAAI;AAC/C;AAAA,IACF,KAAK;AACH,MAAAoB,IAAiBF,EAAyBlB,EAAO,UAAU;AAC3D;AAAA,IACF,KAAK;AACH,OAAI,CAACA,EAAO,UAAU,OAAO,KAAKA,EAAO,MAAM,EAAE,WAAW,MAC1Da,EAAS,KAAK,wCAAwC,GAExDO,IAAiB,EAAE,OAAO,IAAM,QAAQ,CAAA,GAAI,UAAU,GAAC;AACvD;AAAA,IACF;AACE,MAAAR,EAAO,KAAK,0BAA0B,OAAOZ,EAAO,YAAY,CAAC,EAAE,GACnEoB,IAAiB,EAAE,OAAO,IAAO,QAAQ,CAAA,GAAI,UAAU,GAAC;AAAA,EAAE;AAG9D,SAAAR,EAAO,KAAK,GAAGQ,EAAe,MAAM,GACpCP,EAAS,KAAK,GAAGO,EAAe,QAAQ,GAEpCpB,EAAO,kBAAkB,QAAQA,EAAO,iBAAiB,OAC3Da,EAAS,KAAK,yEAAyE,GAGrFb,EAAO,UAAU,MACnBa,EAAS,KAAK,+CAA+C,GAGxD,EAAE,OAAOD,EAAO,WAAW,GAAG,QAAAA,GAAQ,UAAAC,EAAA;AAC/C;AASA,SAASC,EAAWO,GAAsB;AACxC,MAAI;AACF,eAAI,IAAIA,CAAG,GACJ;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAuCO,SAASC,EAAgBtB,GAAiC;AAC/D,UAAQA,EAAO,cAAA;AAAA,IACb,KAAK;AACH,aAAOA,EAAO,OAAO,aAAa;AAAA,IACpC,KAAK;AACH,aAAOA,EAAO,UAAU,aAAa;AAAA,IACvC,KAAK;AACH,aAAOA,EAAO,MAAM,aAAa;AAAA,IACnC;AACE,aAAO;AAAA,EAAA;AAEb;AAQO,SAASuB,EAAoBvB,GAA4B;AAC9D,UAAQA,EAAO,cAAA;AAAA,IACb,KAAK;AACH,aAAOA,EAAO,OAAO,UAAU,CAAC,GAAGV,CAAuB;AAAA,IAC5D,KAAK;AACH,aAAOU,EAAO,UAAU,UAAU,CAAC,UAAU,WAAW,gBAAgB;AAAA,IAC1E,KAAK;AACH,aAAOA,EAAO,MAAM,UAAU,CAAC,UAAU,WAAW,OAAO;AAAA,IAC7D;AACE,aAAO,CAAC,UAAU,SAAS;AAAA,EAAA;AAEjC;AASO,SAASwB,EAAqBC,GAAsBC,IAAqB,IAAiB;AAC/F,QAAMC,IAAS,IAAI,IAAIF,CAAU;AAEjC,SAAIC,KACFnC,EAAmB,QAAQ,CAACqC,MAAUD,EAAO,IAAIC,CAAK,CAAC,GAGlD,MAAM,KAAKD,CAAM;AAC1B;"}