@chipmobilesdk/rn-auth 0.4.0 → 0.6.0

package/lib/module/access/accessTier.js

@@ -0,0 +1,106 @@
+"use strict";
+
+/**
+ * Access-tier evaluation (FR-010/FR-011/FR-019/FR-020, R6).
+ *
+ * Pure function over the authenticated token's claims and the app-specific
+ * mapping. Object ids are authoritative; display names never grant access.
+ * Missing, stale, ambiguous, or group-overage claims fail closed (premium
+ * denied, verification = 'unverified').
+ */
+
+/** The fail-closed default: free + unverified. */
+export function failClosedTier() {
+  return {
+    tier: 'free',
+    source: 'default',
+    verification: 'unverified'
+  };
+}
+function toStringArray(value) {
+  if (Array.isArray(value)) {
+    return value.filter(entry => typeof entry === 'string');
+  }
+  if (typeof value === 'string') {
+    return [value];
+  }
+  return [];
+}
+
+/**
+ * Entra emits a groups overage indicator (`_claim_names.groups` or `hasgroups`)
+ * instead of inline groups when the list is too large. Reading the full list
+ * would require Graph (out of scope, FR-012), so overage fails closed.
+ */
+function hasGroupOverage(claims) {
+  if (claims.hasgroups === true) {
+    return true;
+  }
+  const claimNames = claims._claim_names;
+  if (claimNames && typeof claimNames === 'object' && 'groups' in claimNames) {
+    return true;
+  }
+  return false;
+}
+function matchesClaim(claims, matcher) {
+  const value = claims[matcher.claim];
+  if (Array.isArray(value)) {
+    return value.includes(matcher.equals);
+  }
+  return value === matcher.equals;
+}
+
+/** Evaluate the access tier, failing closed when entitlement is unverifiable. */
+export function evaluateAccessTier(claims, mapping, now = Date.now()) {
+  // Object ids first (authoritative). Display names are never consulted.
+  const groups = toStringArray(claims.groups);
+  if (mapping.premiumGroupObjectIds.length > 0 && groups.some(group => mapping.premiumGroupObjectIds.includes(group))) {
+    return {
+      tier: 'premium',
+      source: 'group',
+      verification: 'verified',
+      lastRefreshAt: now
+    };
+  }
+
+  // Roles next.
+  const roles = toStringArray(claims.roles);
+  if (mapping.premiumRoleNames?.length && roles.some(role => mapping.premiumRoleNames.includes(role))) {
+    return {
+      tier: 'premium',
+      source: 'role',
+      verification: 'verified',
+      lastRefreshAt: now
+    };
+  }
+
+  // Custom claim matchers last.
+  if (mapping.premiumClaimMatchers?.some(matcher => matchesClaim(claims, matcher))) {
+    return {
+      tier: 'premium',
+      source: 'claim',
+      verification: 'verified',
+      lastRefreshAt: now
+    };
+  }
+
+  // No premium indicator matched. If group claims are unavailable due to
+  // overage and premium depends on groups, we cannot verify → fail closed.
+  if (mapping.premiumGroupObjectIds.length > 0 && hasGroupOverage(claims)) {
+    return {
+      tier: 'free',
+      source: 'default',
+      verification: 'unverified',
+      lastRefreshAt: now
+    };
+  }
+
+  // Verified free: claims were present and simply did not grant premium.
+  return {
+    tier: 'free',
+    source: 'default',
+    verification: 'verified',
+    lastRefreshAt: now
+  };
+}
+//# sourceMappingURL=accessTier.js.map

package/lib/module/access/accessTier.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["failClosedTier","tier","source","verification","toStringArray","value","Array","isArray","filter","entry","hasGroupOverage","claims","hasgroups","claimNames","_claim_names","matchesClaim","matcher","claim","includes","equals","evaluateAccessTier","mapping","now","Date","groups","premiumGroupObjectIds","length","some","group","lastRefreshAt","roles","premiumRoleNames","role","premiumClaimMatchers"],"sourceRoot":"../../../src","sources":["access/accessTier.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA,OAAO,SAASA,cAAcA,CAAA,EAAe;EAC5C,OAAO;IAAEC,IAAI,EAAE,MAAM;IAAEC,MAAM,EAAE,SAAS;IAAEC,YAAY,EAAE;EAAa,CAAC;AACvE;AAEA,SAASC,aAAaA,CAACC,KAAc,EAAY;EAChD,IAAIC,KAAK,CAACC,OAAO,CAACF,KAAK,CAAC,EAAE;IACzB,OAAOA,KAAK,CAACG,MAAM,CAAEC,KAAK,IAAsB,OAAOA,KAAK,KAAK,QAAQ,CAAC;EAC3E;EACA,IAAI,OAAOJ,KAAK,KAAK,QAAQ,EAAE;IAC9B,OAAO,CAACA,KAAK,CAAC;EACf;EACA,OAAO,EAAE;AACV;;AAEA;AACA;AACA;AACA;AACA;AACA,SAASK,eAAeA,CAACC,MAA+B,EAAW;EAClE,IAAIA,MAAM,CAACC,SAAS,KAAK,IAAI,EAAE;IAC9B,OAAO,IAAI;EACZ;EACA,MAAMC,UAAU,GAAGF,MAAM,CAACG,YAAmD;EAC7E,IAAID,UAAU,IAAI,OAAOA,UAAU,KAAK,QAAQ,IAAI,QAAQ,IAAIA,UAAU,EAAE;IAC3E,OAAO,IAAI;EACZ;EACA,OAAO,KAAK;AACb;AAEA,SAASE,YAAYA,CAACJ,MAA+B,EAAEK,OAAqB,EAAW;EACtF,MAAMX,KAAK,GAAGM,MAAM,CAACK,OAAO,CAACC,KAAK,CAAC;EACnC,IAAIX,KAAK,CAACC,OAAO,CAACF,KAAK,CAAC,EAAE;IACzB,OAAOA,KAAK,CAACa,QAAQ,CAACF,OAAO,CAACG,MAAM,CAAC;EACtC;EACA,OAAOd,KAAK,KAAKW,OAAO,CAACG,MAAM;AAChC;;AAEA;AACA,OAAO,SAASC,kBAAkBA,CACjCT,MAA+B,EAC/BU,OAA0B,EAC1BC,GAAW,GAAGC,IAAI,CAACD,GAAG,CAAC,CAAC,EACX;EACb;EACA,MAAME,MAAM,GAAGpB,aAAa,CAACO,MAAM,CAACa,MAAM,CAAC;EAC3C,IACCH,OAAO,CAACI,qBAAqB,CAACC,MAAM,GAAG,CAAC,IACxCF,MAAM,CAACG,IAAI,CAACC,KAAK,IAAIP,OAAO,CAACI,qBAAqB,CAACP,QAAQ,CAACU,KAAK,CAAC,CAAC,EAClE;IACD,OAAO;MAAE3B,IAAI,EAAE,SAAS;MAAEC,MAAM,EAAE,OAAO;MAAEC,YAAY,EAAE,UAAU;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EAC1F;;EAEA;EACA,MAAMQ,KAAK,GAAG1B,aAAa,CAACO,MAAM,CAACmB,KAAK,CAAC;EACzC,IACCT,OAAO,CAACU,gBAAgB,EAAEL,MAAM,IAChCI,KAAK,CAACH,IAAI,CAACK,IAAI,IAAIX,OAAO,CAACU,gBAAgB,CAAEb,QAAQ,CAACc,IAAI,CAAC,CAAC,EAC3D;IACD,OAAO;MAAE/B,IAAI,EAAE,SAAS;MAAEC,MAAM,EAAE,MAAM;MAAEC,YAAY,EAAE,UAAU;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EACzF;;EAEA;EACA,IAAID,OAAO,CAACY,oBAAoB,EAAEN,IAAI,CAACX,OAAO,IAAID,YAAY,CAACJ,MAAM,EAAEK,OAAO,CAAC,CAAC,EAAE;IACjF,OAAO;MAAEf,IAAI,EAAE,SAAS;MAAEC,MAAM,EAAE,OAAO;MAAEC,YAAY,EAAE,UAAU;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EAC1F;;EAEA;EACA;EACA,IAAID,OAAO,CAACI,qBAAqB,CAACC,MAAM,GAAG,CAAC,IAAIhB,eAAe,CAACC,MAAM,CAAC,EAAE;IACxE,OAAO;MAAEV,IAAI,EAAE,MAAM;MAAEC,MAAM,EAAE,SAAS;MAAEC,YAAY,EAAE,YAAY;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EAC3F;;EAEA;EACA,OAAO;IAAErB,IAAI,EAAE,MAAM;IAAEC,MAAM,EAAE,SAAS;IAAEC,YAAY,EAAE,UAAU;IAAE0B,aAAa,EAAEP;EAAI,CAAC;AACzF","ignoreList":[]}

package/lib/module/app-auth.js

@@ -0,0 +1,9 @@
+"use strict";
+
+/**
+ * `@chipmobilesdk/rn-auth/app-auth`: the default OIDC client over
+ * react-native-app-auth (AUTH-09). Its own entrypoint, so an app that injects its
+ * own client never reaches this module.
+ */
+export { createAppAuthClient } from "./oidc/authClient.js";
+//# sourceMappingURL=app-auth.js.map

package/lib/module/app-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createAppAuthClient"],"sourceRoot":"../../src","sources":["app-auth.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA,SAASA,mBAAmB,QAAmC,sBAAmB","ignoreList":[]}

package/lib/module/config/types.js

@@ -0,0 +1,46 @@
+"use strict";
+
+/**
+ * Public type contracts for @chipmobilesdk/rn-auth. Shapes follow
+ * specs/003-mobile-entra-auth/data-model.md.
+ */
+
+/** The providers this package has copy for out of the box. */
+
+/**
+ * A provider id. Open on purpose: routing is `domain_hint` and nothing else, so
+ * adding an IdP the tenant federates — Microsoft account, an email one-time
+ * code — is a change to an app's config, not a release of this package
+ * (AUTH-14). `KnownProviderId` keeps the three familiar ones in autocomplete.
+ */
+
+export const DEVICE_PLATFORMS = ['ios', 'android'];
+
+/** Provider Setup Configuration — non-secret public values only (FR-016/FR-017). */
+
+/** One configured protected resource for delegated token requests (FR-007). */
+
+/** App-specific mapping from tenant indicators to access tiers (FR-019/FR-020). */
+
+/** App-supplied, public-only setup input (FR-015/FR-016/FR-017). */
+
+/** Advanced/testing options. `platform` overrides the detected device platform. */
+
+/** Customer User / app-visible profile (FR-006). */
+
+/** Access Tier — local interpretation of tenant indicators (FR-010). */
+
+/** Access Token Request result (FR-007). */
+
+/** Single active app-visible authenticated state (FR-005/FR-022). */
+
+/** Result of a premium-only gate check (US3). */
+
+/**
+ * What `signOutGlobal` did beyond the device (added in 0.2.2). Local state is
+ * cleared either way; `failed` means the tenant session may still be alive, so
+ * the next interactive sign-in can complete without a password prompt.
+ */
+
+/** The auth controller returned by `createAuth` (single active account). */
+//# sourceMappingURL=types.js.map

package/lib/module/config/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["DEVICE_PLATFORMS"],"sourceRoot":"../../../src","sources":["config/types.ts"],"mappings":";;AAAA;AACA;AACA;AACA;;AAQA;;AAGA;AACA;AACA;AACA;AACA;AACA;;AAIA,OAAO,MAAMA,gBAA2C,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC;;AAE7E;;AAoBA;;AAYA;;AAUA;;AAmBA;;AAiBA;;AAoBA;;AAUA;;AASA;;AASA;;AAMA;AACA;AACA;AACA;AACA;;AAOA","ignoreList":[]}

package/lib/module/config/validateConfig.js

@@ -0,0 +1,110 @@
+"use strict";
+
+/**
+ * Deterministic configuration validation (FR-005 → configuration-error).
+ * Throws AuthConfigError before any provider flow can start (US4 scenario 2).
+ * Covers the auth-config.md Section A–F rules.
+ */
+
+import { DEVICE_PLATFORMS } from "./types.js";
+import { AuthConfigError } from "../diagnostics/errors.js";
+function hasScheme(url) {
+  return /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(url);
+}
+
+/** https, or http on a development machine. */
+function isSecureAuthority(url) {
+  if (/^https:/i.test(url)) {
+    return true;
+  }
+  return /^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?(\/|$)/i.test(url);
+}
+export function validateConfig(config) {
+  // Section A — tenant/client settings
+  if (!config.authority || !config.authority.trim()) {
+    throw new AuthConfigError('auth.error.configuration', 'Missing "authority"');
+  }
+  if (!hasScheme(config.authority)) {
+    throw new AuthConfigError('auth.error.configuration', '"authority" must be an absolute URL');
+  }
+  // Tokens travel over this. A tenant reachable over plaintext http is a
+  // configuration mistake, not a deployment choice — except on a dev machine.
+  if (!isSecureAuthority(config.authority)) {
+    throw new AuthConfigError('auth.error.configuration', '"authority" must use https (http is accepted only for localhost)');
+  }
+  if (!config.clientId || !config.clientId.trim()) {
+    throw new AuthConfigError('auth.error.configuration', 'Missing "clientId"');
+  }
+  if (!config.redirectUrl || !config.redirectUrl.trim()) {
+    throw new AuthConfigError('auth.error.configuration', 'Missing "redirectUrl"');
+  }
+  if (!hasScheme(config.redirectUrl)) {
+    throw new AuthConfigError('auth.error.redirectMismatch', '"redirectUrl" must include a scheme matching the native redirect configuration');
+  }
+  if (!Array.isArray(config.scopes) || config.scopes.length === 0) {
+    throw new AuthConfigError('auth.error.configuration', 'At least one OIDC scope is required');
+  }
+  if (!config.scopes.includes('offline_access')) {
+    throw new AuthConfigError('auth.error.configuration', '"offline_access" scope is required for session restore and silent refresh');
+  }
+
+  // Sections B/C — providers
+  if (!Array.isArray(config.providers) || config.providers.length === 0) {
+    throw new AuthConfigError('auth.error.configuration', 'At least one provider must be configured');
+  }
+  const providerIds = new Set();
+  for (const provider of config.providers) {
+    if (providerIds.has(provider.id)) {
+      throw new AuthConfigError('auth.error.configuration', `Duplicate provider "${provider.id}"`);
+    }
+    providerIds.add(provider.id);
+    if (!provider.domainHint || !provider.domainHint.trim()) {
+      throw new AuthConfigError('auth.error.configuration', `Provider "${provider.id}" is missing a domainHint`);
+    }
+    if (!Array.isArray(provider.platforms) || provider.platforms.length === 0) {
+      throw new AuthConfigError('auth.error.configuration', `Provider "${provider.id}" must declare at least one platform`);
+    }
+    for (const platform of provider.platforms) {
+      if (!DEVICE_PLATFORMS.includes(platform)) {
+        // A typo here hides the provider on every device rather than failing.
+        throw new AuthConfigError('auth.error.configuration', `Provider "${provider.id}" declares unknown platform "${String(platform)}"`);
+      }
+    }
+    if (typeof provider.labelKey !== 'string' || !provider.labelKey.trim()) {
+      throw new AuthConfigError('auth.error.configuration', `Provider "${provider.id}" is missing a labelKey`);
+    }
+  }
+
+  // Section D — resources
+  if (config.resources) {
+    const resourceKeys = new Set();
+    for (const resource of config.resources) {
+      if (!resource.key || !resource.key.trim()) {
+        throw new AuthConfigError('auth.error.configuration', 'A resource is missing "key"');
+      }
+      if (resourceKeys.has(resource.key)) {
+        throw new AuthConfigError('auth.error.configuration', `Duplicate resource "${resource.key}"`);
+      }
+      resourceKeys.add(resource.key);
+      if (!Array.isArray(resource.scopes) || resource.scopes.length === 0) {
+        throw new AuthConfigError('auth.error.configuration', `Resource "${resource.key}" must declare at least one scope`);
+      }
+    }
+  }
+
+  // Section E — access-tier mapping
+  const mapping = config.accessTierMapping;
+  if (!mapping) {
+    throw new AuthConfigError('auth.error.configuration', 'Missing "accessTierMapping"');
+  }
+  const hasPremiumIndicator = (mapping.premiumGroupObjectIds?.length ?? 0) > 0 || (mapping.premiumRoleNames?.length ?? 0) > 0 || (mapping.premiumClaimMatchers?.length ?? 0) > 0;
+  if (!hasPremiumIndicator) {
+    throw new AuthConfigError('auth.error.configuration', 'accessTierMapping must define at least one premium group object id, role name, or claim matcher');
+  }
+
+  // Section F — injected ports
+  if (!config.secureStore) {
+    throw new AuthConfigError('auth.error.configuration', 'A secureStore is required (FR-021)');
+  }
+}
+//# sourceMappingURL=validateConfig.js.map

package/lib/module/config/validateConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["DEVICE_PLATFORMS","AuthConfigError","hasScheme","url","test","isSecureAuthority","validateConfig","config","authority","trim","clientId","redirectUrl","Array","isArray","scopes","length","includes","providers","providerIds","Set","provider","has","id","add","domainHint","platforms","platform","String","labelKey","resources","resourceKeys","resource","key","mapping","accessTierMapping","hasPremiumIndicator","premiumGroupObjectIds","premiumRoleNames","premiumClaimMatchers","secureStore"],"sourceRoot":"../../../src","sources":["config/validateConfig.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;;AAEA,SAASA,gBAAgB,QAAyB,YAAS;AAC3D,SAASC,eAAe,QAAQ,0BAAuB;AAEvD,SAASC,SAASA,CAACC,GAAW,EAAW;EACxC,OAAO,2BAA2B,CAACC,IAAI,CAACD,GAAG,CAAC;AAC7C;;AAEA;AACA,SAASE,iBAAiBA,CAACF,GAAW,EAAW;EAChD,IAAI,UAAU,CAACC,IAAI,CAACD,GAAG,CAAC,EAAE;IACzB,OAAO,IAAI;EACZ;EACA,OAAO,0DAA0D,CAACC,IAAI,CAACD,GAAG,CAAC;AAC5E;AAEA,OAAO,SAASG,cAAcA,CAACC,MAAkB,EAAQ;EACxD;EACA,IAAI,CAACA,MAAM,CAACC,SAAS,IAAI,CAACD,MAAM,CAACC,SAAS,CAACC,IAAI,CAAC,CAAC,EAAE;IAClD,MAAM,IAAIR,eAAe,CAAC,0BAA0B,EAAE,qBAAqB,CAAC;EAC7E;EACA,IAAI,CAACC,SAAS,CAACK,MAAM,CAACC,SAAS,CAAC,EAAE;IACjC,MAAM,IAAIP,eAAe,CAAC,0BAA0B,EAAE,qCAAqC,CAAC;EAC7F;EACA;EACA;EACA,IAAI,CAACI,iBAAiB,CAACE,MAAM,CAACC,SAAS,CAAC,EAAE;IACzC,MAAM,IAAIP,eAAe,CACxB,0BAA0B,EAC1B,kEACD,CAAC;EACF;EACA,IAAI,CAACM,MAAM,CAACG,QAAQ,IAAI,CAACH,MAAM,CAACG,QAAQ,CAACD,IAAI,CAAC,CAAC,EAAE;IAChD,MAAM,IAAIR,eAAe,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;EAC5E;EACA,IAAI,CAACM,MAAM,CAACI,WAAW,IAAI,CAACJ,MAAM,CAACI,WAAW,CAACF,IAAI,CAAC,CAAC,EAAE;IACtD,MAAM,IAAIR,eAAe,CAAC,0BAA0B,EAAE,uBAAuB,CAAC;EAC/E;EACA,IAAI,CAACC,SAAS,CAACK,MAAM,CAACI,WAAW,CAAC,EAAE;IACnC,MAAM,IAAIV,eAAe,CACxB,6BAA6B,EAC7B,gFACD,CAAC;EACF;EACA,IAAI,CAACW,KAAK,CAACC,OAAO,CAACN,MAAM,CAACO,MAAM,CAAC,IAAIP,MAAM,CAACO,MAAM,CAACC,MAAM,KAAK,CAAC,EAAE;IAChE,MAAM,IAAId,eAAe,CAAC,0BAA0B,EAAE,qCAAqC,CAAC;EAC7F;EACA,IAAI,CAACM,MAAM,CAACO,MAAM,CAACE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;IAC9C,MAAM,IAAIf,eAAe,CACxB,0BAA0B,EAC1B,2EACD,CAAC;EACF;;EAEA;EACA,IAAI,CAACW,KAAK,CAACC,OAAO,CAACN,MAAM,CAACU,SAAS,CAAC,IAAIV,MAAM,CAACU,SAAS,CAACF,MAAM,KAAK,CAAC,EAAE;IACtE,MAAM,IAAId,eAAe,CACxB,0BAA0B,EAC1B,0CACD,CAAC;EACF;EACA,MAAMiB,WAAW,GAAG,IAAIC,GAAG,CAAS,CAAC;EACrC,KAAK,MAAMC,QAAQ,IAAIb,MAAM,CAACU,SAAS,EAAE;IACxC,IAAIC,WAAW,CAACG,GAAG,CAACD,QAAQ,CAACE,EAAE,CAAC,EAAE;MACjC,MAAM,IAAIrB,eAAe,CAAC,0BAA0B,EAAE,uBAAuBmB,QAAQ,CAACE,EAAE,GAAG,CAAC;IAC7F;IACAJ,WAAW,CAACK,GAAG,CAACH,QAAQ,CAACE,EAAE,CAAC;IAC5B,IAAI,CAACF,QAAQ,CAACI,UAAU,IAAI,CAACJ,QAAQ,CAACI,UAAU,CAACf,IAAI,CAAC,CAAC,EAAE;MACxD,MAAM,IAAIR,eAAe,CACxB,0BAA0B,EAC1B,aAAamB,QAAQ,CAACE,EAAE,2BACzB,CAAC;IACF;IACA,IAAI,CAACV,KAAK,CAACC,OAAO,CAACO,QAAQ,CAACK,SAAS,CAAC,IAAIL,QAAQ,CAACK,SAAS,CAACV,MAAM,KAAK,CAAC,EAAE;MAC1E,MAAM,IAAId,eAAe,CACxB,0BAA0B,EAC1B,aAAamB,QAAQ,CAACE,EAAE,sCACzB,CAAC;IACF;IACA,KAAK,MAAMI,QAAQ,IAAIN,QAAQ,CAACK,SAAS,EAAE;MAC1C,IAAI,CAACzB,gBAAgB,CAACgB,QAAQ,CAACU,QAAQ,CAAC,EAAE;QACzC;QACA,MAAM,IAAIzB,eAAe,CACxB,0BAA0B,EAC1B,aAAamB,QAAQ,CAACE,EAAE,gCAAgCK,MAAM,CAACD,QAAQ,CAAC,GACzE,CAAC;MACF;IACD;IACA,IAAI,OAAON,QAAQ,CAACQ,QAAQ,KAAK,QAAQ,IAAI,CAACR,QAAQ,CAACQ,QAAQ,CAACnB,IAAI,CAAC,CAAC,EAAE;MACvE,MAAM,IAAIR,eAAe,CACxB,0BAA0B,EAC1B,aAAamB,QAAQ,CAACE,EAAE,yBACzB,CAAC;IACF;EACD;;EAEA;EACA,IAAIf,MAAM,CAACsB,SAAS,EAAE;IACrB,MAAMC,YAAY,GAAG,IAAIX,GAAG,CAAS,CAAC;IACtC,KAAK,MAAMY,QAAQ,IAAIxB,MAAM,CAACsB,SAAS,EAAE;MACxC,IAAI,CAACE,QAAQ,CAACC,GAAG,IAAI,CAACD,QAAQ,CAACC,GAAG,CAACvB,IAAI,CAAC,CAAC,EAAE;QAC1C,MAAM,IAAIR,eAAe,CAAC,0BAA0B,EAAE,6BAA6B,CAAC;MACrF;MACA,IAAI6B,YAAY,CAACT,GAAG,CAACU,QAAQ,CAACC,GAAG,CAAC,EAAE;QACnC,MAAM,IAAI/B,eAAe,CACxB,0BAA0B,EAC1B,uBAAuB8B,QAAQ,CAACC,GAAG,GACpC,CAAC;MACF;MACAF,YAAY,CAACP,GAAG,CAACQ,QAAQ,CAACC,GAAG,CAAC;MAC9B,IAAI,CAACpB,KAAK,CAACC,OAAO,CAACkB,QAAQ,CAACjB,MAAM,CAAC,IAAIiB,QAAQ,CAACjB,MAAM,CAACC,MAAM,KAAK,CAAC,EAAE;QACpE,MAAM,IAAId,eAAe,CACxB,0BAA0B,EAC1B,aAAa8B,QAAQ,CAACC,GAAG,mCAC1B,CAAC;MACF;IACD;EACD;;EAEA;EACA,MAAMC,OAAO,GAAG1B,MAAM,CAAC2B,iBAAiB;EACxC,IAAI,CAACD,OAAO,EAAE;IACb,MAAM,IAAIhC,eAAe,CAAC,0BAA0B,EAAE,6BAA6B,CAAC;EACrF;EACA,MAAMkC,mBAAmB,GACxB,CAACF,OAAO,CAACG,qBAAqB,EAAErB,MAAM,IAAI,CAAC,IAAI,CAAC,IAChD,CAACkB,OAAO,CAACI,gBAAgB,EAAEtB,MAAM,IAAI,CAAC,IAAI,CAAC,IAC3C,CAACkB,OAAO,CAACK,oBAAoB,EAAEvB,MAAM,IAAI,CAAC,IAAI,CAAC;EAChD,IAAI,CAACoB,mBAAmB,EAAE;IACzB,MAAM,IAAIlC,eAAe,CACxB,0BAA0B,EAC1B,iGACD,CAAC;EACF;;EAEA;EACA,IAAI,CAACM,MAAM,CAACgC,WAAW,EAAE;IACxB,MAAM,IAAItC,eAAe,CAAC,0BAA0B,EAAE,oCAAoC,CAAC;EAC5F;AACD","ignoreList":[]}