{"version":3,"file":"ad-provider.mjs","sources":["../../../../src/lib/auth/active-directory/ad-provider.tsx"],"sourcesContent":["/**\n * Active Directory Authentication Provider\n *\n * React context provider for AD authentication state and operations.\n * Supports Azure AD, Azure AD B2C, AD FS, and on-premises configurations.\n *\n * @module auth/active-directory/ad-provider\n */\n\nimport {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useReducer,\n  useRef,\n  type ReactNode,\n  type JSX,\n} from 'react';\nimport { useFeatureFlag } from '@/lib/flags';\nimport type {\n  ADConfig,\n  ADContextValue,\n  ADAuthState,\n  ADUser,\n  ADGroup,\n  ADTokens,\n  ADAuthError,\n  ADLogoutOptions,\n  TokenAcquisitionRequest,\n  TokenRefreshResult,\n  ADUserAttributes,\n  ADAuthEvent,\n} from './types';\nimport type { Role, Permission } from '@/lib';\nimport { createADClient } from '@/lib/auth';\nimport { createTokenHandler } from '@/lib/auth';\nimport { type ADGroupMapper, createGroupMapper } from '@/lib/auth';\nimport { type ADAttributeMapper, createAttributeMapper } from '@/lib/auth';\nimport { createSSOManager } from './ad-sso';\nimport { validateADConfig } from '@/lib/auth';\n\n// =============================================================================\n// Context\n// =============================================================================\n\n/**\n * AD Authentication Context.\n */\n// @refresh reset\n// eslint-disable-next-line react-refresh/only-export-components\nexport const ADContext = createContext<ADContextValue | null>(null);\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * AD Provider component props.\n */\nexport interface ADProviderProps {\n  /** AD configuration */\n  config: ADConfig;\n  /** Child components */\n  children: ReactNode;\n  /** Group to role mapping configuration */\n  groupMappings?: Parameters<typeof createGroupMapper>[0];\n  /** Custom attribute mapper configuration */\n  attributeMapperConfig?: Parameters<typeof createAttributeMapper>[0];\n  /** Enable SSO support */\n  enableSSO?: boolean;\n  /** SSO configuration */\n  ssoConfig?: Parameters<typeof createSSOManager>[0];\n  /** Callback when authentication state changes */\n  onAuthStateChange?: (state: ADAuthState) => void;\n  /** Callback when authentication events occur */\n  onAuthEvent?: (event: ADAuthEvent) => void;\n  /** Loading component to show during initialization */\n  loadingComponent?: ReactNode;\n  /** Error component to show on configuration errors */\n  errorComponent?: (error: string) => ReactNode;\n}\n\n/**\n * Action types for auth state reducer.\n */\ntype ADAuthAction =\n  | { type: 'INITIALIZE_START' }\n  | { type: 'INITIALIZE_SUCCESS'; payload: { user: ADUser; tokens: ADTokens } }\n  | { type: 'INITIALIZE_FAILURE'; payload: ADAuthError }\n  | { type: 'INITIALIZE_NO_SESSION' }\n  | { type: 'LOGIN_START' }\n  | { type: 'LOGIN_SUCCESS'; payload: { user: ADUser; tokens: ADTokens } }\n  | { type: 'LOGIN_FAILURE'; payload: ADAuthError }\n  | { type: 'LOGOUT' }\n  | { type: 'TOKEN_REFRESH_START' }\n  | { type: 'TOKEN_REFRESH_SUCCESS'; payload: ADTokens }\n  | { type: 'TOKEN_REFRESH_FAILURE'; payload: ADAuthError }\n  | { type: 'CLEAR_ERROR' }\n  | { type: 'UPDATE_USER'; payload: Partial<ADUser> }\n  | { type: 'SET_SSO_SESSION'; payload: boolean };\n\n// =============================================================================\n// Reducer\n// =============================================================================\n\nconst initialState: ADAuthState = {\n  user: null,\n  isAuthenticated: false,\n  isAuthenticating: false,\n  isRefreshing: false,\n  tokens: null,\n  error: null,\n  provider: null,\n  accountId: null,\n  hasSsoSession: false,\n  lastAuthTime: null,\n  tokenExpiresAt: null,\n};\n\nfunction authReducer(state: ADAuthState, action: ADAuthAction): ADAuthState {\n  switch (action.type) {\n    case 'INITIALIZE_START':\n      return {\n        ...state,\n        isAuthenticating: true,\n        error: null,\n      };\n\n    case 'INITIALIZE_SUCCESS':\n      return {\n        ...state,\n        user: action.payload.user,\n        tokens: action.payload.tokens,\n        isAuthenticated: true,\n        isAuthenticating: false,\n        error: null,\n        provider: action.payload.user.adProvider,\n        accountId: action.payload.tokens.accountId ?? null,\n        lastAuthTime: Date.now(),\n        tokenExpiresAt: action.payload.tokens.expiresAt,\n      };\n\n    case 'INITIALIZE_FAILURE':\n      return {\n        ...state,\n        isAuthenticating: false,\n        error: action.payload,\n      };\n\n    case 'INITIALIZE_NO_SESSION':\n      return {\n        ...state,\n        isAuthenticating: false,\n      };\n\n    case 'LOGIN_START':\n      return {\n        ...state,\n        isAuthenticating: true,\n        error: null,\n      };\n\n    case 'LOGIN_SUCCESS':\n      return {\n        ...state,\n        user: action.payload.user,\n        tokens: action.payload.tokens,\n        isAuthenticated: true,\n        isAuthenticating: false,\n        error: null,\n        provider: action.payload.user.adProvider,\n        accountId: action.payload.tokens.accountId ?? null,\n        lastAuthTime: Date.now(),\n        tokenExpiresAt: action.payload.tokens.expiresAt,\n        hasSsoSession: true,\n      };\n\n    case 'LOGIN_FAILURE':\n      return {\n        ...state,\n        isAuthenticating: false,\n        error: action.payload,\n      };\n\n    case 'LOGOUT':\n      return {\n        ...initialState,\n      };\n\n    case 'TOKEN_REFRESH_START':\n      return {\n        ...state,\n        isRefreshing: true,\n      };\n\n    case 'TOKEN_REFRESH_SUCCESS':\n      return {\n        ...state,\n        tokens: action.payload,\n        isRefreshing: false,\n        tokenExpiresAt: action.payload.expiresAt,\n      };\n\n    case 'TOKEN_REFRESH_FAILURE':\n      return {\n        ...state,\n        isRefreshing: false,\n        error: action.payload,\n      };\n\n    case 'CLEAR_ERROR':\n      return {\n        ...state,\n        error: null,\n      };\n\n    case 'UPDATE_USER':\n      return {\n        ...state,\n        user: state.user ? { ...state.user, ...action.payload } : null,\n      };\n\n    case 'SET_SSO_SESSION':\n      return {\n        ...state,\n        hasSsoSession: action.payload,\n      };\n\n    default:\n      return state;\n  }\n}\n\n// =============================================================================\n// Provider Component\n// =============================================================================\n\n/**\n * Active Directory Authentication Provider.\n *\n * Provides AD authentication context to child components. Manages\n * authentication state, token refresh, group mapping, and SSO.\n *\n * @example\n * ```tsx\n * import { ADProvider } from '@/lib/auth/active-directory';\n * import { createADConfig } from '@/lib/auth/active-directory';\n *\n * const adConfig = createADConfig('azure-ad', {\n *   tenantId: process.env.AZURE_AD_TENANT_ID,\n *   clientId: process.env.AZURE_AD_CLIENT_ID,\n *   redirectUri: window.location.origin,\n * });\n *\n * function App() {\n *   return (\n *     <ADProvider\n *       config={adConfig}\n *       groupMappings=\"azureSecurityGroups\"\n *       enableSSO\n *     >\n *       <MyApplication />\n *     </ADProvider>\n *   );\n * }\n * ```\n */\nexport function ADProvider({\n  config,\n  children,\n  groupMappings,\n  attributeMapperConfig,\n  enableSSO = true,\n  ssoConfig,\n  onAuthStateChange,\n  onAuthEvent,\n  loadingComponent,\n  errorComponent,\n}: ADProviderProps): JSX.Element {\n  // Check feature flag\n  const isADEnabled = useFeatureFlag(config.featureFlag ?? 'ad-authentication');\n\n  // State\n  const [state, dispatch] = useReducer(authReducer, initialState);\n\n  // Validate configuration\n  const configValidation = useMemo(() => validateADConfig(config), [config]);\n\n  // Create services\n  // Event emitter ref to avoid circular dependency\n  const emitEventRef = useRef<((event: ADAuthEvent) => void) | null>(null);\n\n  const adClient = useMemo(\n    () =>\n      createADClient(config, {\n        onTokenRefresh: (tokens) => {\n          dispatch({ type: 'TOKEN_REFRESH_SUCCESS', payload: tokens });\n          emitEventRef.current?.({\n            type: 'token_refreshed',\n            correlationId: generateCorrelationId(),\n          });\n        },\n        onAuthError: (error) => {\n          dispatch({ type: 'TOKEN_REFRESH_FAILURE', payload: error });\n          emitEventRef.current?.({ type: 'error', error, correlationId: generateCorrelationId() });\n        },\n      }),\n    [config]\n  );\n\n  const tokenHandler = useMemo(\n    () =>\n      createTokenHandler(config, {\n        cacheLocation: config.azure?.cacheLocation ?? 'sessionStorage',\n        autoRefresh: config.silentRefresh,\n        debug: config.debug,\n        onTokenRefresh: (tokens) => {\n          dispatch({ type: 'TOKEN_REFRESH_SUCCESS', payload: tokens });\n          adClient.setTokens(tokens);\n        },\n        onRefreshFailed: (error) => {\n          dispatch({ type: 'TOKEN_REFRESH_FAILURE', payload: error });\n        },\n      }),\n    [config, adClient]\n  );\n\n  const groupMapper = useMemo(\n    () => createGroupMapper(groupMappings ?? [], { appPrefix: 'app' }),\n    [groupMappings]\n  );\n\n  const attributeMapper = useMemo(\n    () => createAttributeMapper(attributeMapperConfig),\n    [attributeMapperConfig]\n  );\n\n  const ssoManager = useMemo(\n    () =>\n      enableSSO === true\n        ? createSSOManager({\n            ...ssoConfig,\n            debug: config.debug,\n            onSessionChange: (session) => {\n              dispatch({ type: 'SET_SSO_SESSION', payload: session !== null });\n            },\n            onSessionExpired: () => {\n              dispatch({ type: 'LOGOUT' });\n              emitEventRef.current?.({\n                type: 'session_expired',\n                correlationId: generateCorrelationId(),\n              });\n            },\n          })\n        : null,\n    [enableSSO, ssoConfig, config.debug]\n  );\n\n  // ===========================================================================\n  // Event Emitter\n  // ===========================================================================\n\n  const emitEvent = useCallback(\n    (event: ADAuthEvent) => {\n      onAuthEvent?.(event);\n      if (config.debug === true) {\n        // eslint-disable-next-line no-console\n        console.log('[ADProvider] Event:', event);\n      }\n    },\n    [onAuthEvent, config.debug]\n  );\n\n  // Update the ref\n  emitEventRef.current = emitEvent;\n\n  // ===========================================================================\n  // Authentication Methods\n  // ===========================================================================\n\n  const initialize = useCallback(async () => {\n    const correlationId = generateCorrelationId();\n    dispatch({ type: 'INITIALIZE_START' });\n\n    try {\n      // Check for redirect response first\n      const redirectTokens = await tokenHandler.handleRedirectResponse();\n      if (redirectTokens) {\n        adClient.initialize(redirectTokens);\n        const user = await adClient.getCurrentUser();\n        const mappedUser = applyMappings(user, groupMapper, attributeMapper);\n\n        if (ssoManager != null) {\n          ssoManager.startSession(mappedUser, redirectTokens);\n        }\n\n        dispatch({\n          type: 'LOGIN_SUCCESS',\n          payload: { user: mappedUser, tokens: redirectTokens },\n        });\n        emitEvent({\n          type: 'login_success',\n          user: mappedUser,\n          correlationId,\n        });\n        return;\n      }\n\n      // Check for existing SSO session\n      if (ssoManager) {\n        const existingSession = ssoManager.detectSession();\n        if (existingSession) {\n          const sessionTokens = ssoManager.getSessionTokens();\n          if (sessionTokens) {\n            adClient.initialize(sessionTokens);\n            const user = await adClient.getCurrentUser();\n            const mappedUser = applyMappings(user, groupMapper, attributeMapper);\n\n            dispatch({\n              type: 'INITIALIZE_SUCCESS',\n              payload: { user: mappedUser, tokens: sessionTokens },\n            });\n            emitEvent({\n              type: 'sso_detected',\n              upn: mappedUser.adAttributes.upn,\n              correlationId,\n            });\n            return;\n          }\n        }\n      }\n\n      // Try silent token acquisition\n      const cachedTokens = await tokenHandler.acquireTokenSilent({\n        scopes: getDefaultScopes(config),\n      });\n\n      if (cachedTokens) {\n        adClient.initialize(cachedTokens);\n        const user = await adClient.getCurrentUser();\n        const mappedUser = applyMappings(user, groupMapper, attributeMapper);\n\n        if (ssoManager) {\n          ssoManager.startSession(mappedUser, cachedTokens);\n        }\n\n        dispatch({\n          type: 'INITIALIZE_SUCCESS',\n          payload: { user: mappedUser, tokens: cachedTokens },\n        });\n        return;\n      }\n\n      // No existing session\n      dispatch({ type: 'INITIALIZE_NO_SESSION' });\n    } catch (error) {\n      const authError = createAuthError(error);\n      dispatch({ type: 'INITIALIZE_FAILURE', payload: authError });\n      emitEvent({ type: 'error', error: authError, correlationId });\n    }\n  }, [config, tokenHandler, adClient, groupMapper, attributeMapper, ssoManager, emitEvent]);\n\n  const login = useCallback(\n    async (options?: TokenAcquisitionRequest) => {\n      const correlationId = generateCorrelationId();\n      dispatch({ type: 'LOGIN_START' });\n      emitEvent({\n        type: 'login_initiated',\n        provider: config.providerType,\n        correlationId,\n      });\n\n      try {\n        const tokens = await tokenHandler.acquireTokenInteractive({\n          scopes: options?.scopes ?? getDefaultScopes(config),\n          prompt: options?.prompt,\n          loginHint: options?.loginHint,\n          domainHint: options?.domainHint,\n        });\n\n        adClient.initialize(tokens);\n        const user = await adClient.getCurrentUser();\n        const mappedUser = applyMappings(user, groupMapper, attributeMapper);\n\n        if (ssoManager) {\n          ssoManager.startSession(mappedUser, tokens);\n        }\n\n        dispatch({\n          type: 'LOGIN_SUCCESS',\n          payload: { user: mappedUser, tokens },\n        });\n        emitEvent({\n          type: 'login_success',\n          user: mappedUser,\n          correlationId,\n        });\n      } catch (error) {\n        const authError = createAuthError(error);\n        dispatch({ type: 'LOGIN_FAILURE', payload: authError });\n        emitEvent({\n          type: 'login_failed',\n          error: authError,\n          correlationId,\n        });\n        throw new Error(authError.message);\n      }\n    },\n    [config, tokenHandler, adClient, groupMapper, attributeMapper, ssoManager, emitEvent]\n  );\n\n  const loginSilent = useCallback(\n    async (options?: TokenAcquisitionRequest) => {\n      generateCorrelationId(); // Generate for logging/tracking\n      dispatch({ type: 'LOGIN_START' });\n\n      try {\n        const tokens = await tokenHandler.acquireTokenSilent({\n          scopes: options?.scopes ?? getDefaultScopes(config),\n          account: options?.account,\n        });\n\n        if (tokens == null) {\n          throw new Error('Silent login failed, interaction required');\n        }\n\n        adClient.initialize(tokens);\n        const user = await adClient.getCurrentUser();\n        const mappedUser = applyMappings(user, groupMapper, attributeMapper);\n\n        if (ssoManager) {\n          ssoManager.startSession(mappedUser, tokens);\n        }\n\n        dispatch({\n          type: 'LOGIN_SUCCESS',\n          payload: { user: mappedUser, tokens },\n        });\n      } catch (error) {\n        const authError = createAuthError(error);\n        dispatch({ type: 'LOGIN_FAILURE', payload: authError });\n        throw new Error(authError.message);\n      }\n    },\n    [config, tokenHandler, adClient, groupMapper, attributeMapper, ssoManager]\n  );\n\n  const logout = useCallback(\n    async (options?: ADLogoutOptions): Promise<void> => {\n      const correlationId = generateCorrelationId();\n      emitEvent({ type: 'logout_initiated', correlationId });\n\n      await Promise.resolve(); // Satisfy require-await lint rule\n      try {\n        // End SSO session\n        if (ssoManager != null) {\n          ssoManager.endSession();\n        }\n\n        // Clear token cache\n        tokenHandler.clearCache();\n\n        // Update state\n        dispatch({ type: 'LOGOUT' });\n\n        // If not local only, redirect to AD logout\n        if (options?.localOnly !== true) {\n          const logoutUrl = buildLogoutUrl(config, options);\n          if (logoutUrl != null && logoutUrl !== '') {\n            window.location.href = logoutUrl;\n            return;\n          }\n        }\n\n        emitEvent({ type: 'logout_success', correlationId });\n      } catch {\n        // Ensure we still clear local state on error\n        dispatch({ type: 'LOGOUT' });\n        emitEvent({ type: 'logout_success', correlationId });\n      }\n    },\n    [config, ssoManager, tokenHandler, emitEvent]\n  );\n\n  const acquireToken = useCallback(\n    async (request: TokenAcquisitionRequest): Promise<ADTokens> => {\n      // Try silent first\n      const silentTokens = await tokenHandler.acquireTokenSilent(request);\n      if (silentTokens) {\n        return silentTokens;\n      }\n\n      // Fall back to interactive\n      return tokenHandler.acquireTokenInteractive({\n        ...request,\n        prompt: 'consent',\n      });\n    },\n    [tokenHandler]\n  );\n\n  const acquireTokenSilent = useCallback(\n    async (request: TokenAcquisitionRequest): Promise<ADTokens | null> => {\n      return tokenHandler.acquireTokenSilent(request);\n    },\n    [tokenHandler]\n  );\n\n  const refreshTokens = useCallback(async (): Promise<TokenRefreshResult> => {\n    dispatch({ type: 'TOKEN_REFRESH_START' });\n\n    const cachedTokens = tokenHandler.getCachedTokens();\n    const tokens = await cachedTokens;\n    if (tokens?.refreshToken == null || tokens.refreshToken === '') {\n      const error: ADAuthError = {\n        code: 'no_refresh_token',\n        message: 'No refresh token available',\n        timestamp: Date.now(),\n        recoverable: false,\n      };\n      dispatch({ type: 'TOKEN_REFRESH_FAILURE', payload: error });\n      return { success: false, error, requiresInteraction: true };\n    }\n\n    return tokenHandler.refreshToken(tokens.refreshToken);\n  }, [tokenHandler]);\n\n  const getUserGroups = useCallback(async (): Promise<ADGroup[]> => {\n    if (!state.isAuthenticated) {\n      return [];\n    }\n    return adClient.getUserGroups(true);\n  }, [state.isAuthenticated, adClient]);\n\n  const isInGroup = useCallback(\n    (groupId: string): boolean => {\n      if (!state.user) return false;\n      return state.user.adGroups.some(\n        (g) => g.id === groupId || g.displayName.toLowerCase() === groupId.toLowerCase()\n      );\n    },\n    [state.user]\n  );\n\n  const hasAttribute = useCallback(\n    (attribute: keyof ADUserAttributes, value: unknown): boolean => {\n      if (!state.user) return false;\n      return state.user.adAttributes[attribute] === value;\n    },\n    [state.user]\n  );\n\n  const getMappedRoles = useCallback((): Role[] => {\n    if (!state.user) return [];\n    return state.user.roles;\n  }, [state.user]);\n\n  const getEffectivePermissions = useCallback((): Permission[] => {\n    if (!state.user) return [];\n    return state.user.effectivePermissions;\n  }, [state.user]);\n\n  const clearError = useCallback(() => {\n    dispatch({ type: 'CLEAR_ERROR' });\n  }, []);\n\n  const forceReauth = useCallback(async () => {\n    await logout({ localOnly: true });\n    await login({ prompt: 'login', scopes: getDefaultScopes(config) });\n  }, [logout, login, config]);\n\n  // ===========================================================================\n  // Effects\n  // ===========================================================================\n\n  // Auto-initialize on mount\n  useEffect(() => {\n    if (isADEnabled && configValidation.valid) {\n      void initialize();\n    }\n  }, [isADEnabled, configValidation.valid, initialize]);\n\n  // Notify state changes\n  useEffect(() => {\n    onAuthStateChange?.(state);\n  }, [state, onAuthStateChange]);\n\n  // Cleanup on unmount\n  useEffect(() => {\n    return () => {\n      tokenHandler.dispose();\n      ssoManager?.dispose();\n    };\n  }, [tokenHandler, ssoManager]);\n\n  // ===========================================================================\n  // Context Value\n  // ===========================================================================\n\n  const contextValue: ADContextValue = useMemo(\n    () => ({\n      ...state,\n      config,\n      initialize,\n      login,\n      loginSilent,\n      logout,\n      acquireToken,\n      acquireTokenSilent,\n      refreshTokens,\n      getUserGroups,\n      isInGroup,\n      hasAttribute,\n      getMappedRoles,\n      getEffectivePermissions,\n      clearError,\n      forceReauth,\n    }),\n    [\n      state,\n      config,\n      initialize,\n      login,\n      loginSilent,\n      logout,\n      acquireToken,\n      acquireTokenSilent,\n      refreshTokens,\n      getUserGroups,\n      isInGroup,\n      hasAttribute,\n      getMappedRoles,\n      getEffectivePermissions,\n      clearError,\n      forceReauth,\n    ]\n  );\n\n  // ===========================================================================\n  // Render\n  // ===========================================================================\n\n  // Show error if configuration is invalid\n  if (!configValidation.valid) {\n    const errorMessage = `AD Configuration Error: ${configValidation.errors.join(', ')}`;\n    if (errorComponent) {\n      return <>{errorComponent(errorMessage)}</>;\n    }\n    console.error(errorMessage);\n    return <>{children}</>;\n  }\n\n  // Show loading during initialization\n  if (state.isAuthenticating && !state.isAuthenticated && loadingComponent != null) {\n    return <>{loadingComponent}</>;\n  }\n\n  // Feature flag is disabled\n  if (!isADEnabled) {\n    return <>{children}</>;\n  }\n\n  return <ADContext.Provider value={contextValue}>{children}</ADContext.Provider>;\n}\n\n// =============================================================================\n// Helper Functions\n// =============================================================================\n\nfunction generateCorrelationId(): string {\n  const array = new Uint8Array(8);\n  crypto.getRandomValues(array);\n  return Array.from(array, (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nfunction createAuthError(error: unknown): ADAuthError {\n  if (typeof error === 'object' && error !== null && 'code' in error) {\n    const e = error as { code: string; message?: string; description?: string };\n    return {\n      code: e.code,\n      message: e.message ?? 'Authentication error',\n      description: e.description,\n      timestamp: Date.now(),\n      recoverable: !['config_error', 'state_mismatch'].includes(e.code),\n      originalError: error,\n    };\n  }\n\n  return {\n    code: 'unknown_error',\n    message: error instanceof Error ? error.message : 'An unknown error occurred',\n    timestamp: Date.now(),\n    recoverable: true,\n    originalError: error,\n  };\n}\n\nfunction getDefaultScopes(config: ADConfig): string[] {\n  switch (config.providerType) {\n    case 'azure-ad':\n      return config.azure?.scopes ?? ['openid', 'profile', 'email', 'User.Read'];\n    case 'azure-ad-b2c':\n      return config.azureB2C?.scopes ?? ['openid', 'profile', 'offline_access'];\n    case 'adfs':\n      return config.adfs?.scopes ?? ['openid', 'profile', 'email'];\n    default:\n      return ['openid', 'profile'];\n  }\n}\n\nfunction buildLogoutUrl(config: ADConfig, options?: ADLogoutOptions): string | null {\n  let authority: string | undefined;\n  let postLogoutUri: string | undefined;\n\n  switch (config.providerType) {\n    case 'azure-ad':\n      authority = config.azure?.authority;\n      postLogoutUri = options?.postLogoutRedirectUri ?? config.azure?.postLogoutRedirectUri;\n      break;\n    case 'azure-ad-b2c':\n      authority = config.azureB2C?.authority;\n      postLogoutUri = options?.postLogoutRedirectUri ?? config.azureB2C?.postLogoutRedirectUri;\n      break;\n    case 'adfs':\n      authority = config.adfs?.serverUrl;\n      break;\n    default:\n      return null;\n  }\n\n  if (authority == null || authority === '') return null;\n\n  const params = new URLSearchParams();\n  if (postLogoutUri != null && postLogoutUri !== '') {\n    params.set('post_logout_redirect_uri', postLogoutUri);\n  }\n  if (options?.logoutHint != null && options.logoutHint !== '') {\n    params.set('logout_hint', options.logoutHint);\n  }\n\n  const queryString = params.toString();\n  return `${authority}/oauth2/v2.0/logout${queryString ? `?${queryString}` : ''}`;\n}\n\nfunction applyMappings(\n  user: ADUser,\n  groupMapper: ADGroupMapper,\n  attributeMapper: ADAttributeMapper\n): ADUser {\n  // Apply group to role mapping\n  const { role, permissions } = groupMapper.mapUserGroups(user.adGroups, user);\n\n  // Apply attribute mapping\n  const mappedUser = attributeMapper.mapToUser(user);\n\n  return {\n    ...user,\n    ...mappedUser,\n    roles: role ? [role] : [],\n    permissions,\n    effectivePermissions: permissions,\n    adGroups: user.adGroups,\n  };\n}\n"],"names":["ADContext","createContext","initialState","authReducer","state","action","ADProvider","config","children","groupMappings","attributeMapperConfig","enableSSO","ssoConfig","onAuthStateChange","onAuthEvent","loadingComponent","errorComponent","isADEnabled","useFeatureFlag","dispatch","useReducer","configValidation","useMemo","validateADConfig","emitEventRef","useRef","adClient","createADClient","tokens","generateCorrelationId","error","tokenHandler","createTokenHandler","groupMapper","createGroupMapper","attributeMapper","createAttributeMapper","ssoManager","createSSOManager","session","emitEvent","useCallback","event","initialize","correlationId","redirectTokens","user","mappedUser","applyMappings","sessionTokens","cachedTokens","getDefaultScopes","authError","createAuthError","login","options","loginSilent","logout","logoutUrl","buildLogoutUrl","acquireToken","request","silentTokens","acquireTokenSilent","refreshTokens","getUserGroups","isInGroup","groupId","g","hasAttribute","attribute","value","getMappedRoles","getEffectivePermissions","clearError","forceReauth","useEffect","contextValue","errorMessage","jsx","Fragment","array","byte","e","authority","postLogoutUri","params","queryString","role","permissions"],"mappings":";;;;;;;;;AAmDO,MAAMA,KAAYC,EAAqC,IAAI,GAuD5DC,IAA4B;AAAA,EAChC,MAAM;AAAA,EACN,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,cAAc;AAAA,EACd,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,UAAU;AAAA,EACV,WAAW;AAAA,EACX,eAAe;AAAA,EACf,cAAc;AAAA,EACd,gBAAgB;AAClB;AAEA,SAASC,GAAYC,GAAoBC,GAAmC;AAC1E,UAAQA,EAAO,MAAA;AAAA,IACb,KAAK;AACH,aAAO;AAAA,QACL,GAAGD;AAAA,QACH,kBAAkB;AAAA,QAClB,OAAO;AAAA,MAAA;AAAA,IAGX,KAAK;AACH,aAAO;AAAA,QACL,GAAGA;AAAA,QACH,MAAMC,EAAO,QAAQ;AAAA,QACrB,QAAQA,EAAO,QAAQ;AAAA,QACvB,iBAAiB;AAAA,QACjB,kBAAkB;AAAA,QAClB,OAAO;AAAA,QACP,UAAUA,EAAO,QAAQ,KAAK;AAAA,QAC9B,WAAWA,EAAO,QAAQ,OAAO,aAAa;AAAA,QAC9C,cAAc,KAAK,IAAA;AAAA,QACnB,gBAAgBA,EAAO,QAAQ,OAAO;AAAA,MAAA;AAAA,IAG1C,KAAK;AACH,aAAO;AAAA,QACL,GAAGD;AAAA,QACH,kBAAkB;AAAA,QAClB,OAAOC,EAAO;AAAA,MAAA;AAAA,IAGlB,KAAK;AACH,aAAO;AAAA,QACL,GAAGD;AAAA,QACH,kBAAkB;AAAA,MAAA;AAAA,IAGtB,KAAK;AACH,aAAO;AAAA,QACL,GAAGA;AAAA,QACH,kBAAkB;AAAA,QAClB,OAAO;AAAA,MAAA;AAAA,IAGX,KAAK;AACH,aAAO;AAAA,QACL,GAAGA;AAAA,QACH,MAAMC,EAAO,QAAQ;AAAA,QACrB,QAAQA,EAAO,QAAQ;AAAA,QACvB,iBAAiB;AAAA,QACjB,kBAAkB;AAAA,QAClB,OAAO;AAAA,QACP,UAAUA,EAAO,QAAQ,KAAK;AAAA,QAC9B,WAAWA,EAAO,QAAQ,OAAO,aAAa;AAAA,QAC9C,cAAc,KAAK,IAAA;AAAA,QACnB,gBAAgBA,EAAO,QAAQ,OAAO;AAAA,QACtC,eAAe;AAAA,MAAA;AAAA,IAGnB,KAAK;AACH,aAAO;AAAA,QACL,GAAGD;AAAA,QACH,kBAAkB;AAAA,QAClB,OAAOC,EAAO;AAAA,MAAA;AAAA,IAGlB,KAAK;AACH,aAAO;AAAA,QACL,GAAGH;AAAA,MAAA;AAAA,IAGP,KAAK;AACH,aAAO;AAAA,QACL,GAAGE;AAAA,QACH,cAAc;AAAA,MAAA;AAAA,IAGlB,KAAK;AACH,aAAO;AAAA,QACL,GAAGA;AAAA,QACH,QAAQC,EAAO;AAAA,QACf,cAAc;AAAA,QACd,gBAAgBA,EAAO,QAAQ;AAAA,MAAA;AAAA,IAGnC,KAAK;AACH,aAAO;AAAA,QACL,GAAGD;AAAA,QACH,cAAc;AAAA,QACd,OAAOC,EAAO;AAAA,MAAA;AAAA,IAGlB,KAAK;AACH,aAAO;AAAA,QACL,GAAGD;AAAA,QACH,OAAO;AAAA,MAAA;AAAA,IAGX,KAAK;AACH,aAAO;AAAA,QACL,GAAGA;AAAA,QACH,MAAMA,EAAM,OAAO,EAAE,GAAGA,EAAM,MAAM,GAAGC,EAAO,YAAY;AAAA,MAAA;AAAA,IAG9D,KAAK;AACH,aAAO;AAAA,QACL,GAAGD;AAAA,QACH,eAAeC,EAAO;AAAA,MAAA;AAAA,IAG1B;AACE,aAAOD;AAAA,EAAA;AAEb;AAoCO,SAASE,GAAW;AAAA,EACzB,QAAAC;AAAA,EACA,UAAAC;AAAA,EACA,eAAAC;AAAA,EACA,uBAAAC;AAAA,EACA,WAAAC,IAAY;AAAA,EACZ,WAAAC;AAAA,EACA,mBAAAC;AAAA,EACA,aAAAC;AAAA,EACA,kBAAAC;AAAA,EACA,gBAAAC;AACF,GAAiC;AAE/B,QAAMC,IAAcC,GAAeX,EAAO,eAAe,mBAAmB,GAGtE,CAACH,GAAOe,CAAQ,IAAIC,GAAWjB,IAAaD,CAAY,GAGxDmB,IAAmBC,EAAQ,MAAMC,GAAiBhB,CAAM,GAAG,CAACA,CAAM,CAAC,GAInEiB,IAAeC,GAA8C,IAAI,GAEjEC,IAAWJ;AAAA,IACf,MACEK,GAAepB,GAAQ;AAAA,MACrB,gBAAgB,CAACqB,MAAW;AAC1B,QAAAT,EAAS,EAAE,MAAM,yBAAyB,SAASS,GAAQ,GAC3DJ,EAAa,UAAU;AAAA,UACrB,MAAM;AAAA,UACN,eAAeK,EAAA;AAAA,QAAsB,CACtC;AAAA,MACH;AAAA,MACA,aAAa,CAACC,MAAU;AACtB,QAAAX,EAAS,EAAE,MAAM,yBAAyB,SAASW,GAAO,GAC1DN,EAAa,UAAU,EAAE,MAAM,SAAS,OAAAM,GAAO,eAAeD,EAAA,GAAyB;AAAA,MACzF;AAAA,IAAA,CACD;AAAA,IACH,CAACtB,CAAM;AAAA,EAAA,GAGHwB,IAAeT;AAAA,IACnB,MACEU,GAAmBzB,GAAQ;AAAA,MACzB,eAAeA,EAAO,OAAO,iBAAiB;AAAA,MAC9C,aAAaA,EAAO;AAAA,MACpB,OAAOA,EAAO;AAAA,MACd,gBAAgB,CAACqB,MAAW;AAC1B,QAAAT,EAAS,EAAE,MAAM,yBAAyB,SAASS,GAAQ,GAC3DF,EAAS,UAAUE,CAAM;AAAA,MAC3B;AAAA,MACA,iBAAiB,CAACE,MAAU;AAC1B,QAAAX,EAAS,EAAE,MAAM,yBAAyB,SAASW,GAAO;AAAA,MAC5D;AAAA,IAAA,CACD;AAAA,IACH,CAACvB,GAAQmB,CAAQ;AAAA,EAAA,GAGbO,IAAcX;AAAA,IAClB,MAAMY,GAAkBzB,KAAiB,CAAA,GAAI,EAAE,WAAW,OAAO;AAAA,IACjE,CAACA,CAAa;AAAA,EAAA,GAGV0B,IAAkBb;AAAA,IACtB,MAAMc,GAAsB1B,CAAqB;AAAA,IACjD,CAACA,CAAqB;AAAA,EAAA,GAGlB2B,IAAaf;AAAA,IACjB,MACEX,MAAc,KACV2B,GAAiB;AAAA,MACf,GAAG1B;AAAA,MACH,OAAOL,EAAO;AAAA,MACd,iBAAiB,CAACgC,MAAY;AAC5B,QAAApB,EAAS,EAAE,MAAM,mBAAmB,SAASoB,MAAY,MAAM;AAAA,MACjE;AAAA,MACA,kBAAkB,MAAM;AACtB,QAAApB,EAAS,EAAE,MAAM,UAAU,GAC3BK,EAAa,UAAU;AAAA,UACrB,MAAM;AAAA,UACN,eAAeK,EAAA;AAAA,QAAsB,CACtC;AAAA,MACH;AAAA,IAAA,CACD,IACD;AAAA,IACN,CAAClB,GAAWC,GAAWL,EAAO,KAAK;AAAA,EAAA,GAO/BiC,IAAYC;AAAA,IAChB,CAACC,MAAuB;AACtB,MAAA5B,IAAc4B,CAAK,GACfnC,EAAO,UAAU,MAEnB,QAAQ,IAAI,uBAAuBmC,CAAK;AAAA,IAE5C;AAAA,IACA,CAAC5B,GAAaP,EAAO,KAAK;AAAA,EAAA;AAI5B,EAAAiB,EAAa,UAAUgB;AAMvB,QAAMG,IAAaF,EAAY,YAAY;AACzC,UAAMG,IAAgBf,EAAA;AACtB,IAAAV,EAAS,EAAE,MAAM,oBAAoB;AAErC,QAAI;AAEF,YAAM0B,IAAiB,MAAMd,EAAa,uBAAA;AAC1C,UAAIc,GAAgB;AAClB,QAAAnB,EAAS,WAAWmB,CAAc;AAClC,cAAMC,IAAO,MAAMpB,EAAS,eAAA,GACtBqB,IAAaC,EAAcF,GAAMb,GAAaE,CAAe;AAEnE,QACEE,GAAW,aAAaU,GAAYF,CAAc,GAGpD1B,EAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,EAAE,MAAM4B,GAAY,QAAQF,EAAA;AAAA,QAAe,CACrD,GACDL,EAAU;AAAA,UACR,MAAM;AAAA,UACN,MAAMO;AAAA,UACN,eAAAH;AAAA,QAAA,CACD;AACD;AAAA,MACF;AAGA,UAAIP,KACsBA,EAAW,cAAA,GACd;AACnB,cAAMY,IAAgBZ,EAAW,iBAAA;AACjC,YAAIY,GAAe;AACjB,UAAAvB,EAAS,WAAWuB,CAAa;AACjC,gBAAMH,IAAO,MAAMpB,EAAS,eAAA,GACtBqB,IAAaC,EAAcF,GAAMb,GAAaE,CAAe;AAEnE,UAAAhB,EAAS;AAAA,YACP,MAAM;AAAA,YACN,SAAS,EAAE,MAAM4B,GAAY,QAAQE,EAAA;AAAA,UAAc,CACpD,GACDT,EAAU;AAAA,YACR,MAAM;AAAA,YACN,KAAKO,EAAW,aAAa;AAAA,YAC7B,eAAAH;AAAA,UAAA,CACD;AACD;AAAA,QACF;AAAA,MACF;AAIF,YAAMM,IAAe,MAAMnB,EAAa,mBAAmB;AAAA,QACzD,QAAQoB,EAAiB5C,CAAM;AAAA,MAAA,CAChC;AAED,UAAI2C,GAAc;AAChB,QAAAxB,EAAS,WAAWwB,CAAY;AAChC,cAAMJ,IAAO,MAAMpB,EAAS,eAAA,GACtBqB,IAAaC,EAAcF,GAAMb,GAAaE,CAAe;AAEnE,QAAIE,KACFA,EAAW,aAAaU,GAAYG,CAAY,GAGlD/B,EAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,EAAE,MAAM4B,GAAY,QAAQG,EAAA;AAAA,QAAa,CACnD;AACD;AAAA,MACF;AAGA,MAAA/B,EAAS,EAAE,MAAM,yBAAyB;AAAA,IAC5C,SAASW,GAAO;AACd,YAAMsB,IAAYC,EAAgBvB,CAAK;AACvC,MAAAX,EAAS,EAAE,MAAM,sBAAsB,SAASiC,GAAW,GAC3DZ,EAAU,EAAE,MAAM,SAAS,OAAOY,GAAW,eAAAR,GAAe;AAAA,IAC9D;AAAA,EACF,GAAG,CAACrC,GAAQwB,GAAcL,GAAUO,GAAaE,GAAiBE,GAAYG,CAAS,CAAC,GAElFc,IAAQb;AAAA,IACZ,OAAOc,MAAsC;AAC3C,YAAMX,IAAgBf,EAAA;AACtB,MAAAV,EAAS,EAAE,MAAM,eAAe,GAChCqB,EAAU;AAAA,QACR,MAAM;AAAA,QACN,UAAUjC,EAAO;AAAA,QACjB,eAAAqC;AAAA,MAAA,CACD;AAED,UAAI;AACF,cAAMhB,IAAS,MAAMG,EAAa,wBAAwB;AAAA,UACxD,QAAQwB,GAAS,UAAUJ,EAAiB5C,CAAM;AAAA,UAClD,QAAQgD,GAAS;AAAA,UACjB,WAAWA,GAAS;AAAA,UACpB,YAAYA,GAAS;AAAA,QAAA,CACtB;AAED,QAAA7B,EAAS,WAAWE,CAAM;AAC1B,cAAMkB,IAAO,MAAMpB,EAAS,eAAA,GACtBqB,IAAaC,EAAcF,GAAMb,GAAaE,CAAe;AAEnE,QAAIE,KACFA,EAAW,aAAaU,GAAYnB,CAAM,GAG5CT,EAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,EAAE,MAAM4B,GAAY,QAAAnB,EAAA;AAAA,QAAO,CACrC,GACDY,EAAU;AAAA,UACR,MAAM;AAAA,UACN,MAAMO;AAAA,UACN,eAAAH;AAAA,QAAA,CACD;AAAA,MACH,SAASd,GAAO;AACd,cAAMsB,IAAYC,EAAgBvB,CAAK;AACvC,cAAAX,EAAS,EAAE,MAAM,iBAAiB,SAASiC,GAAW,GACtDZ,EAAU;AAAA,UACR,MAAM;AAAA,UACN,OAAOY;AAAA,UACP,eAAAR;AAAA,QAAA,CACD,GACK,IAAI,MAAMQ,EAAU,OAAO;AAAA,MACnC;AAAA,IACF;AAAA,IACA,CAAC7C,GAAQwB,GAAcL,GAAUO,GAAaE,GAAiBE,GAAYG,CAAS;AAAA,EAAA,GAGhFgB,IAAcf;AAAA,IAClB,OAAOc,MAAsC;AAC3C,MAAA1B,EAAA,GACAV,EAAS,EAAE,MAAM,eAAe;AAEhC,UAAI;AACF,cAAMS,IAAS,MAAMG,EAAa,mBAAmB;AAAA,UACnD,QAAQwB,GAAS,UAAUJ,EAAiB5C,CAAM;AAAA,UAClD,SAASgD,GAAS;AAAA,QAAA,CACnB;AAED,YAAI3B,KAAU;AACZ,gBAAM,IAAI,MAAM,2CAA2C;AAG7D,QAAAF,EAAS,WAAWE,CAAM;AAC1B,cAAMkB,IAAO,MAAMpB,EAAS,eAAA,GACtBqB,IAAaC,EAAcF,GAAMb,GAAaE,CAAe;AAEnE,QAAIE,KACFA,EAAW,aAAaU,GAAYnB,CAAM,GAG5CT,EAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,EAAE,MAAM4B,GAAY,QAAAnB,EAAA;AAAA,QAAO,CACrC;AAAA,MACH,SAASE,GAAO;AACd,cAAMsB,IAAYC,EAAgBvB,CAAK;AACvC,cAAAX,EAAS,EAAE,MAAM,iBAAiB,SAASiC,GAAW,GAChD,IAAI,MAAMA,EAAU,OAAO;AAAA,MACnC;AAAA,IACF;AAAA,IACA,CAAC7C,GAAQwB,GAAcL,GAAUO,GAAaE,GAAiBE,CAAU;AAAA,EAAA,GAGrEoB,IAAShB;AAAA,IACb,OAAOc,MAA6C;AAClD,YAAMX,IAAgBf,EAAA;AACtB,MAAAW,EAAU,EAAE,MAAM,oBAAoB,eAAAI,EAAA,CAAe,GAErD,MAAM,QAAQ,QAAA;AACd,UAAI;AAaF,YAVEP,GAAW,WAAA,GAIbN,EAAa,WAAA,GAGbZ,EAAS,EAAE,MAAM,UAAU,GAGvBoC,GAAS,cAAc,IAAM;AAC/B,gBAAMG,IAAYC,GAAepD,GAAQgD,CAAO;AAChD,cAAIG,KAAa,QAAQA,MAAc,IAAI;AACzC,mBAAO,SAAS,OAAOA;AACvB;AAAA,UACF;AAAA,QACF;AAEA,QAAAlB,EAAU,EAAE,MAAM,kBAAkB,eAAAI,EAAA,CAAe;AAAA,MACrD,QAAQ;AAEN,QAAAzB,EAAS,EAAE,MAAM,UAAU,GAC3BqB,EAAU,EAAE,MAAM,kBAAkB,eAAAI,EAAA,CAAe;AAAA,MACrD;AAAA,IACF;AAAA,IACA,CAACrC,GAAQ8B,GAAYN,GAAcS,CAAS;AAAA,EAAA,GAGxCoB,IAAenB;AAAA,IACnB,OAAOoB,MAAwD;AAE7D,YAAMC,IAAe,MAAM/B,EAAa,mBAAmB8B,CAAO;AAClE,aAAIC,KAKG/B,EAAa,wBAAwB;AAAA,QAC1C,GAAG8B;AAAA,QACH,QAAQ;AAAA,MAAA,CACT;AAAA,IACH;AAAA,IACA,CAAC9B,CAAY;AAAA,EAAA,GAGTgC,IAAqBtB;AAAA,IACzB,OAAOoB,MACE9B,EAAa,mBAAmB8B,CAAO;AAAA,IAEhD,CAAC9B,CAAY;AAAA,EAAA,GAGTiC,IAAgBvB,EAAY,YAAyC;AACzE,IAAAtB,EAAS,EAAE,MAAM,uBAAuB;AAGxC,UAAMS,IAAS,MADMG,EAAa,gBAAA;AAElC,QAAIH,GAAQ,gBAAgB,QAAQA,EAAO,iBAAiB,IAAI;AAC9D,YAAME,IAAqB;AAAA,QACzB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW,KAAK,IAAA;AAAA,QAChB,aAAa;AAAA,MAAA;AAEf,aAAAX,EAAS,EAAE,MAAM,yBAAyB,SAASW,GAAO,GACnD,EAAE,SAAS,IAAO,OAAAA,GAAO,qBAAqB,GAAA;AAAA,IACvD;AAEA,WAAOC,EAAa,aAAaH,EAAO,YAAY;AAAA,EACtD,GAAG,CAACG,CAAY,CAAC,GAEXkC,IAAgBxB,EAAY,YAC3BrC,EAAM,kBAGJsB,EAAS,cAAc,EAAI,IAFzB,CAAA,GAGR,CAACtB,EAAM,iBAAiBsB,CAAQ,CAAC,GAE9BwC,IAAYzB;AAAA,IAChB,CAAC0B,MACM/D,EAAM,OACJA,EAAM,KAAK,SAAS;AAAA,MACzB,CAACgE,MAAMA,EAAE,OAAOD,KAAWC,EAAE,YAAY,kBAAkBD,EAAQ,YAAA;AAAA,IAAY,IAFzD;AAAA,IAK1B,CAAC/D,EAAM,IAAI;AAAA,EAAA,GAGPiE,IAAe5B;AAAA,IACnB,CAAC6B,GAAmCC,MAC7BnE,EAAM,OACJA,EAAM,KAAK,aAAakE,CAAS,MAAMC,IADtB;AAAA,IAG1B,CAACnE,EAAM,IAAI;AAAA,EAAA,GAGPoE,IAAiB/B,EAAY,MAC5BrC,EAAM,OACJA,EAAM,KAAK,QADM,CAAA,GAEvB,CAACA,EAAM,IAAI,CAAC,GAETqE,IAA0BhC,EAAY,MACrCrC,EAAM,OACJA,EAAM,KAAK,uBADM,CAAA,GAEvB,CAACA,EAAM,IAAI,CAAC,GAETsE,IAAajC,EAAY,MAAM;AACnC,IAAAtB,EAAS,EAAE,MAAM,eAAe;AAAA,EAClC,GAAG,CAAA,CAAE,GAECwD,IAAclC,EAAY,YAAY;AAC1C,UAAMgB,EAAO,EAAE,WAAW,IAAM,GAChC,MAAMH,EAAM,EAAE,QAAQ,SAAS,QAAQH,EAAiB5C,CAAM,GAAG;AAAA,EACnE,GAAG,CAACkD,GAAQH,GAAO/C,CAAM,CAAC;AAO1B,EAAAqE,EAAU,MAAM;AACd,IAAI3D,KAAeI,EAAiB,SAC7BsB,EAAA;AAAA,EAET,GAAG,CAAC1B,GAAaI,EAAiB,OAAOsB,CAAU,CAAC,GAGpDiC,EAAU,MAAM;AACd,IAAA/D,IAAoBT,CAAK;AAAA,EAC3B,GAAG,CAACA,GAAOS,CAAiB,CAAC,GAG7B+D,EAAU,MACD,MAAM;AACX,IAAA7C,EAAa,QAAA,GACbM,GAAY,QAAA;AAAA,EACd,GACC,CAACN,GAAcM,CAAU,CAAC;AAM7B,QAAMwC,IAA+BvD;AAAA,IACnC,OAAO;AAAA,MACL,GAAGlB;AAAA,MACH,QAAAG;AAAA,MACA,YAAAoC;AAAA,MACA,OAAAW;AAAA,MACA,aAAAE;AAAA,MACA,QAAAC;AAAA,MACA,cAAAG;AAAA,MACA,oBAAAG;AAAA,MACA,eAAAC;AAAA,MACA,eAAAC;AAAA,MACA,WAAAC;AAAA,MACA,cAAAG;AAAA,MACA,gBAAAG;AAAA,MACA,yBAAAC;AAAA,MACA,YAAAC;AAAA,MACA,aAAAC;AAAA,IAAA;AAAA,IAEF;AAAA,MACEvE;AAAA,MACAG;AAAA,MACAoC;AAAA,MACAW;AAAA,MACAE;AAAA,MACAC;AAAA,MACAG;AAAA,MACAG;AAAA,MACAC;AAAA,MACAC;AAAA,MACAC;AAAA,MACAG;AAAA,MACAG;AAAA,MACAC;AAAA,MACAC;AAAA,MACAC;AAAA,IAAA;AAAA,EACF;AAQF,MAAI,CAACtD,EAAiB,OAAO;AAC3B,UAAMyD,IAAe,2BAA2BzD,EAAiB,OAAO,KAAK,IAAI,CAAC;AAClF,WAAIL,IACK,gBAAA+D,EAAAC,GAAA,EAAG,UAAAhE,EAAe8D,CAAY,GAAE,KAEzC,QAAQ,MAAMA,CAAY,0BAChB,UAAAtE,GAAS;AAAA,EACrB;AAGA,SAAIJ,EAAM,oBAAoB,CAACA,EAAM,mBAAmBW,KAAoB,8BAChE,UAAAA,EAAA,CAAiB,IAIxBE,sBAIGjB,GAAU,UAAV,EAAmB,OAAO6E,GAAe,UAAArE,GAAS,2BAH9C,UAAAA,GAAS;AAIvB;AAMA,SAASqB,IAAgC;AACvC,QAAMoD,IAAQ,IAAI,WAAW,CAAC;AAC9B,gBAAO,gBAAgBA,CAAK,GACrB,MAAM,KAAKA,GAAO,CAACC,MAASA,EAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAChF;AAEA,SAAS7B,EAAgBvB,GAA6B;AACpD,MAAI,OAAOA,KAAU,YAAYA,MAAU,QAAQ,UAAUA,GAAO;AAClE,UAAMqD,IAAIrD;AACV,WAAO;AAAA,MACL,MAAMqD,EAAE;AAAA,MACR,SAASA,EAAE,WAAW;AAAA,MACtB,aAAaA,EAAE;AAAA,MACf,WAAW,KAAK,IAAA;AAAA,MAChB,aAAa,CAAC,CAAC,gBAAgB,gBAAgB,EAAE,SAASA,EAAE,IAAI;AAAA,MAChE,eAAerD;AAAA,IAAA;AAAA,EAEnB;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAASA,aAAiB,QAAQA,EAAM,UAAU;AAAA,IAClD,WAAW,KAAK,IAAA;AAAA,IAChB,aAAa;AAAA,IACb,eAAeA;AAAA,EAAA;AAEnB;AAEA,SAASqB,EAAiB5C,GAA4B;AACpD,UAAQA,EAAO,cAAA;AAAA,IACb,KAAK;AACH,aAAOA,EAAO,OAAO,UAAU,CAAC,UAAU,WAAW,SAAS,WAAW;AAAA,IAC3E,KAAK;AACH,aAAOA,EAAO,UAAU,UAAU,CAAC,UAAU,WAAW,gBAAgB;AAAA,IAC1E,KAAK;AACH,aAAOA,EAAO,MAAM,UAAU,CAAC,UAAU,WAAW,OAAO;AAAA,IAC7D;AACE,aAAO,CAAC,UAAU,SAAS;AAAA,EAAA;AAEjC;AAEA,SAASoD,GAAepD,GAAkBgD,GAA0C;AAClF,MAAI6B,GACAC;AAEJ,UAAQ9E,EAAO,cAAA;AAAA,IACb,KAAK;AACH,MAAA6E,IAAY7E,EAAO,OAAO,WAC1B8E,IAAgB9B,GAAS,yBAAyBhD,EAAO,OAAO;AAChE;AAAA,IACF,KAAK;AACH,MAAA6E,IAAY7E,EAAO,UAAU,WAC7B8E,IAAgB9B,GAAS,yBAAyBhD,EAAO,UAAU;AACnE;AAAA,IACF,KAAK;AACH,MAAA6E,IAAY7E,EAAO,MAAM;AACzB;AAAA,IACF;AACE,aAAO;AAAA,EAAA;AAGX,MAAI6E,KAAa,QAAQA,MAAc,GAAI,QAAO;AAElD,QAAME,IAAS,IAAI,gBAAA;AACnB,EAAID,KAAiB,QAAQA,MAAkB,MAC7CC,EAAO,IAAI,4BAA4BD,CAAa,GAElD9B,GAAS,cAAc,QAAQA,EAAQ,eAAe,MACxD+B,EAAO,IAAI,eAAe/B,EAAQ,UAAU;AAG9C,QAAMgC,IAAcD,EAAO,SAAA;AAC3B,SAAO,GAAGF,CAAS,sBAAsBG,IAAc,IAAIA,CAAW,KAAK,EAAE;AAC/E;AAEA,SAASvC,EACPF,GACAb,GACAE,GACQ;AAER,QAAM,EAAE,MAAAqD,GAAM,aAAAC,MAAgBxD,EAAY,cAAca,EAAK,UAAUA,CAAI,GAGrEC,IAAaZ,EAAgB,UAAUW,CAAI;AAEjD,SAAO;AAAA,IACL,GAAGA;AAAA,IACH,GAAGC;AAAA,IACH,OAAOyC,IAAO,CAACA,CAAI,IAAI,CAAA;AAAA,IACvB,aAAAC;AAAA,IACA,sBAAsBA;AAAA,IACtB,UAAU3C,EAAK;AAAA,EAAA;AAEnB;"}