@egain/ai-agent-sdk 0.1.0

package/dist/core/auth/ClientCredentialsAuthStrategy.js

@@ -0,0 +1,78 @@
+/**
+ * Client credentials authentication strategy for server-side applications
+ * Implements OAuth 2.0 client credentials flow
+ */
+export class ClientCredentialsAuthStrategy {
+    constructor(config) {
+        this.config = config;
+        this.isAuthenticatedFlag = false;
+    }
+    /**
+     * Initialize the client credentials authentication strategy
+     */
+    async initialize(options) {
+        // TODO: Implement initialization logic
+        // - Validate configuration
+        // - Set up token cache if needed
+        this.postAuthentication = options?.postAuthentication;
+        this.deploymentInfo = options?.deploymentInfo;
+    }
+    /**
+     * Authenticate using client credentials flow
+     */
+    async authenticate() {
+        // TODO: Implement authentication logic
+        // - Fetch initial token using client credentials
+        // - Store token for future use
+        const token = await this.getToken();
+        this.isAuthenticatedFlag = true;
+        // Call postAuthentication callback after authentication completes
+        if (this.postAuthentication) {
+            await this.postAuthentication(token);
+        }
+    }
+    /**
+     * Check if the user is currently authenticated
+     */
+    isAuthenticated() {
+        // TODO: Implement authentication check logic
+        // - Check if token exists and is valid
+        return this.isAuthenticatedFlag;
+    }
+    /**
+     * Get authentication token using client credentials flow
+     */
+    async getToken() {
+        // TODO: Implement client credentials token retrieval logic
+        // - Check if cached token exists and is valid
+        // - If not, request new token using client credentials
+        // - Cache the token
+        // - Return access token
+        return '';
+    }
+    /**
+     * Request a new access token from the token endpoint
+     */
+    async requestToken() {
+        // TODO: Implement token request logic
+        // - Make POST request to token endpoint
+        // - Include client_id and client_secret
+        // - Parse response and extract access token
+        return '';
+    }
+    /**
+     * Check if the current token is expired or about to expire
+     */
+    isTokenExpired() {
+        // TODO: Implement token expiration check
+        return false;
+    }
+    /**
+     * Cleanup resources
+     */
+    async cleanup() {
+        // TODO: Implement cleanup logic
+        // - Clear cached tokens
+    }
+}
+//# sourceMappingURL=ClientCredentialsAuthStrategy.js.map

package/dist/core/auth/ClientCredentialsAuthStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientCredentialsAuthStrategy.js","sourceRoot":"","sources":["../../../src/core/auth/ClientCredentialsAuthStrategy.ts"],"names":[],"mappings":"AA6BA;;;GAGG;AACH,MAAM,OAAO,6BAA6B;IAKxC,YAA6B,MAAmC;QAAnC,WAAM,GAAN,MAAM,CAA6B;QAHxD,wBAAmB,GAAY,KAAK,CAAC;IAGsB,CAAC;IAEpE;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAuC;QACtD,uCAAuC;QACvC,2BAA2B;QAC3B,iCAAiC;QACjC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,CAAC;QACtD,IAAI,CAAC,cAAc,GAAG,OAAO,EAAE,cAAc,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,uCAAuC;QACvC,iDAAiD;QACjD,+BAA+B;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAEhC,kEAAkE;QAClE,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe;QACb,6CAA6C;QAC7C,uCAAuC;QACvC,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,2DAA2D;QAC3D,8CAA8C;QAC9C,uDAAuD;QACvD,oBAAoB;QACpB,wBAAwB;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY;QACxB,sCAAsC;QACtC,wCAAwC;QACxC,wCAAwC;QACxC,4CAA4C;QAC5C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,yCAAyC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,gCAAgC;QAChC,wBAAwB;IAC1B,CAAC;CACF"}

package/dist/core/auth/PKCEAuthStrategy.d.ts

@@ -0,0 +1,136 @@
+import { AuthStrategy, AuthStrategyInitializeOptions } from './AuthStrategy.js';
+import { Logger } from '../logging/Logger.js';
+import './msal-loader.js';
+/**
+ * Configuration for PKCE authentication strategy
+ */
+export interface PKCEAuthConfig {
+    /**
+     * Authorization server URL (authority)
+     */
+    authorizationUrl?: string;
+    /**
+     * Token endpoint URL (not used directly by MSAL, but kept for compatibility)
+     */
+    tokenUrl?: string;
+    /**
+     * Client ID
+     */
+    clientId: string;
+    /**
+     * Redirect URI for OAuth callback
+     */
+    redirectUri: string;
+    /**
+     * Optional scopes to request
+     */
+    scopes?: string[];
+    /**
+     * Authentication scheme: 'popup' or 'redirect'
+     * @default 'redirect'
+     */
+    authScheme?: 'popup' | 'redirect';
+    /**
+     * Cache location: 'localStorage' or 'sessionStorage'
+     * @default 'sessionStorage'
+     */
+    cacheLocation?: 'localStorage' | 'sessionStorage';
+    /**
+     * Known authorities
+     */
+    knownAuthorities: string[];
+    /**
+     * Authority metadata
+     */
+    authorityMetadata?: string;
+    /**
+     * Next route to navigate to after authentication (used as state parameter)
+     */
+    nextRoute?: string;
+    /**
+     * When true, forces local account login instead of federated SSO.
+     */
+    localLogin?: boolean;
+}
+declare global {
+    interface Window {
+        msal?: {
+            PublicClientApplication: any;
+            InteractionType: any;
+            PopupRequest: any;
+            RedirectRequest: any;
+            SilentRequest: any;
+            AccountInfo: any;
+            AuthenticationResult: any;
+        };
+    }
+}
+/**
+ * PKCE (Proof Key for Code Exchange) authentication strategy for browsers
+ * Implements OAuth 2.0 PKCE flow for secure browser-based authentication using MSAL
+ */
+export declare class PKCEAuthStrategy implements AuthStrategy {
+    private readonly config;
+    /**
+     * Build PKCE configuration from deployment info and agent details
+     * This method fetches authentication metadata and constructs the PKCE config
+     * @param deploymentInfo - Deployment information containing API domain, client IDs, tenant ID
+     * @param agentDetails - Agent details containing userType and other agent-specific information
+     * @param endpoint - The endpoint URL used to fetch deployment info (used for nextRoute)
+     * @param scopes - Scopes to request (passed from AuthenticationService)
+     * @param logger - Optional logger instance for logging
+     * @param authScheme - Authentication scheme: 'popup' or 'redirect' (defaults to 'popup')
+     * @param egClientId - Optional client ID override from initParams (takes priority over deployment client IDs)
+     * @param localLogin - When true, forces local account login instead of federated SSO
+     * @returns Promise resolving to PKCEAuthConfig
+     */
+    static buildConfigFromDeploymentInfo(deploymentInfo: any, agentDetails: any, endpoint: string, scopes: string[], logger?: Logger, authScheme?: 'popup' | 'redirect', egClientId?: string, localLogin?: boolean): Promise<PKCEAuthConfig>;
+    private postAuthentication?;
+    private isAuthenticatedFlag;
+    private deploymentInfo?;
+    private msalInstance;
+    private authScheme;
+    private accessToken;
+    private account;
+    private isInitialized;
+    constructor(config: PKCEAuthConfig);
+    /**
+     * Initialize the PKCE authentication strategy
+     */
+    initialize(options?: AuthStrategyInitializeOptions): Promise<void>;
+    /**
+     * Handle redirect promise after OAuth redirect
+     */
+    private handleRedirectPromise;
+    /**
+     * Authenticate using PKCE flow
+     */
+    authenticate(): Promise<void>;
+    /**
+     * Check if the user is currently authenticated
+     */
+    isAuthenticated(): boolean;
+    /**
+     * Get authentication token using PKCE flow
+     */
+    getToken(): Promise<string>;
+    /**
+     * Start the PKCE authorization flow
+     * Redirects user to authorization server
+     */
+    startAuthorizationFlow(): Promise<void>;
+    /**
+     * Handle the OAuth callback with authorization code
+     * This is handled automatically by MSAL's handleRedirectPromise
+     */
+    handleCallback(code: string, state: string): Promise<void>;
+    /**
+     * Refresh the access token using refresh token
+     */
+    refreshToken(): Promise<string>;
+    /**
+     * Cleanup resources
+     */
+    cleanup(): Promise<void>;
+}
+//# sourceMappingURL=PKCEAuthStrategy.d.ts.map

package/dist/core/auth/PKCEAuthStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PKCEAuthStrategy.d.ts","sourceRoot":"","sources":["../../../src/core/auth/PKCEAuthStrategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA8B,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAC5G,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,kBAAkB,CAAC;AAE1B;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAElC;;;OAGG;IACH,aAAa,CAAC,EAAE,cAAc,GAAG,gBAAgB,CAAC;IAElD;;OAEG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAE3B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAGD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,IAAI,CAAC,EAAE;YACL,uBAAuB,EAAE,GAAG,CAAC;YAC7B,eAAe,EAAE,GAAG,CAAC;YACrB,YAAY,EAAE,GAAG,CAAC;YAClB,eAAe,EAAE,GAAG,CAAC;YACrB,aAAa,EAAE,GAAG,CAAC;YACnB,WAAW,EAAE,GAAG,CAAC;YACjB,oBAAoB,EAAE,GAAG,CAAC;SAC3B,CAAC;KACH;CACF;AAED;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IAsJvC,OAAO,CAAC,QAAQ,CAAC,MAAM;IArJnC;;;;;;;;;;;;OAYG;WACU,6BAA6B,CACxC,cAAc,EAAE,GAAG,EACnB,YAAY,EAAE,GAAG,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,OAAO,GAAG,UAAU,EACjC,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,cAAc,CAAC;IAsH1B,OAAO,CAAC,kBAAkB,CAAC,CAA6B;IACxD,OAAO,CAAC,mBAAmB,CAAkB;IAC7C,OAAO,CAAC,cAAc,CAAC,CAAM;IAC7B,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,aAAa,CAAkB;gBAEV,MAAM,EAAE,cAAc;IAUnD;;OAEG;IACG,UAAU,CAAC,OAAO,CAAC,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC;IA8FxE;;OAEG;YACW,qBAAqB;IAenC;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAgFnC;;OAEG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAmCjC;;;OAGG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7C;;;OAGG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMhE;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAqBrC;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAO/B"}

package/dist/core/auth/PKCEAuthStrategy.js

@@ -0,0 +1,409 @@
+import './msal-loader.js'; // Ensure MSAL is loaded before using it
+/**
+ * PKCE (Proof Key for Code Exchange) authentication strategy for browsers
+ * Implements OAuth 2.0 PKCE flow for secure browser-based authentication using MSAL
+ */
+export class PKCEAuthStrategy {
+    /**
+     * Build PKCE configuration from deployment info and agent details
+     * This method fetches authentication metadata and constructs the PKCE config
+     * @param deploymentInfo - Deployment information containing API domain, client IDs, tenant ID
+     * @param agentDetails - Agent details containing userType and other agent-specific information
+     * @param endpoint - The endpoint URL used to fetch deployment info (used for nextRoute)
+     * @param scopes - Scopes to request (passed from AuthenticationService)
+     * @param logger - Optional logger instance for logging
+     * @param authScheme - Authentication scheme: 'popup' or 'redirect' (defaults to 'popup')
+     * @param egClientId - Optional client ID override from initParams (takes priority over deployment client IDs)
+     * @param localLogin - When true, forces local account login instead of federated SSO
+     * @returns Promise resolving to PKCEAuthConfig
+     */
+    static async buildConfigFromDeploymentInfo(deploymentInfo, agentDetails, endpoint, scopes, logger, authScheme, egClientId, localLogin) {
+        const intClientId = deploymentInfo.intClientId;
+        const extClientId = deploymentInfo.extClientId;
+        const tenantId = deploymentInfo.tenantId;
+        const clientId = deploymentInfo.clientId;
+        const userType = agentDetails?.userType;
+        // Determine metadata URL based on user type and client IDs
+        let metaDataUrl = "";
+        if ((userType === "agent" && intClientId) ||
+            (userType === "customer" && extClientId)) {
+            metaDataUrl = deploymentInfo.apiDomain + "/core/authmgr/v3/metadata/tenant/" + tenantId;
+        }
+        else {
+            metaDataUrl = deploymentInfo.apiDomain + "/core/authmgr/v3/metadata/deployment";
+        }
+        // Ensure HTTPS protocol
+        metaDataUrl = metaDataUrl && metaDataUrl.startsWith("https://") ? metaDataUrl : "https://" + metaDataUrl;
+        // Fetch metadata
+        let metaData;
+        try {
+            const metaDataResponse = await fetch(metaDataUrl);
+            if (!metaDataResponse.ok) {
+                throw new Error(`Failed to fetch metadata: ${metaDataResponse.status} ${metaDataResponse.statusText}`);
+            }
+            metaData = await metaDataResponse.json();
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            logger?.error('Failed to fetch authentication metadata', error instanceof Error ? error : new Error(errorMessage), { metaDataUrl });
+            throw new Error(`Failed to fetch authentication metadata from ${metaDataUrl}: ${errorMessage}`);
+        }
+        let loginDomainName = "";
+        let idpGatewayId = "";
+        let authorityMetadata = {};
+        let policy;
+        let prefixedScopes = [...scopes]; // Copy scopes to apply prefix later
+        // Build authority metadata based on user type
+        if (userType === "agent") {
+            policy = metaData?.idpPolicies?.userSigninPolicy;
+            const authURL = metaData?.authenticationDetails?.oAuthUser[0]?.authURL;
+            if (authURL) {
+                const authURLObject = new URL(authURL);
+                loginDomainName = authURLObject.hostname;
+                idpGatewayId = authURLObject.pathname.split("/")[1];
+                // Remove query parameters from the URL as domain hints come in authURL for deployment metadata
+                authorityMetadata.authorization_endpoint = authURLObject.origin + authURLObject.pathname;
+            }
+            authorityMetadata.token_endpoint = metaData?.authenticationDetails?.oAuthUser[0]?.accessTokenURL;
+            authorityMetadata.issuer = ["https://" + loginDomainName, "tfp", idpGatewayId, policy, "v2.0/"].join("/");
+            authorityMetadata.jwks_uri = ["https://" + loginDomainName, idpGatewayId, policy, "discovery/v2.0/keys"].join("/");
+        }
+        else if (userType === "customer") {
+            policy = metaData?.idpPolicies?.customerSigninPolicy;
+            const authURL = metaData?.authenticationDetails?.oAuthCustomer[0]?.authURL;
+            if (authURL) {
+                const authURLObject = new URL(authURL);
+                loginDomainName = authURLObject.hostname;
+                idpGatewayId = authURLObject.pathname.split("/")[1];
+                // Remove query parameters from the URL as domain hints come in authURL for deployment metadata
+                authorityMetadata.authorization_endpoint = authURLObject.origin + authURLObject.pathname;
+            }
+            authorityMetadata.token_endpoint = metaData?.authenticationDetails?.oAuthCustomer[0]?.accessTokenURL;
+            authorityMetadata.issuer = ["https://" + loginDomainName, "tfp", idpGatewayId, policy, "v2.0/"].join("/");
+            authorityMetadata.jwks_uri = ["https://" + loginDomainName, idpGatewayId, policy, "discovery/v2.0/keys"].join("/");
+        }
+        else {
+            throw new Error(`Invalid userType: ${userType}. Expected 'agent' or 'customer'.`);
+        }
+        // Build authorization URL (authority)
+        const authorizationUrl = ["https://" + loginDomainName, idpGatewayId, policy].join("/");
+        // Add permission prefixes to scopes
+        const apiPermissionPrefix = userType === "agent" && metaData?.apiMetadata?.CORE?.iApiPermissionPrefix
+            ? metaData.apiMetadata.CORE.iApiPermissionPrefix
+            : userType === "customer" && metaData?.apiMetadata?.CORE?.eApiPermissionPrefix
+                ? metaData.apiMetadata.CORE.eApiPermissionPrefix
+                : metaData?.apiMetadata?.CORE?.apiPermissionPrefix || "";
+        if (apiPermissionPrefix && Array.isArray(prefixedScopes)) {
+            prefixedScopes = prefixedScopes.map((scope) => apiPermissionPrefix + scope);
+        }
+        // Select appropriate client ID (egClientId from initParams takes priority)
+        let selectedClientId = egClientId || clientId;
+        if (!egClientId) {
+            if (userType === "agent" && intClientId) {
+                selectedClientId = intClientId;
+            }
+            else if (userType === "customer" && extClientId) {
+                selectedClientId = extClientId;
+            }
+        }
+        // Build redirect URI from domainHint
+        const domainHint = deploymentInfo.domainHint;
+        const redirectUri = "https://" + domainHint + "/system/templates/selfservice/auth-redirect.html";
+        // Use the current page URL so auth-redirect.html navigates back to the app after login
+        let nextRoute = typeof window !== 'undefined' ? window.location.href : endpoint;
+        // Build and return PKCE config
+        return {
+            clientId: selectedClientId,
+            redirectUri: redirectUri, // TODO: Make this configurable
+            authorizationUrl: authorizationUrl,
+            knownAuthorities: [loginDomainName],
+            authorityMetadata: JSON.stringify(authorityMetadata),
+            scopes: prefixedScopes,
+            authScheme: authScheme ?? 'popup',
+            cacheLocation: "sessionStorage",
+            nextRoute: nextRoute,
+            ...(localLogin != null && { localLogin }),
+        };
+    }
+    constructor(config) {
+        this.config = config;
+        this.isAuthenticatedFlag = false;
+        this.authScheme = 'redirect';
+        this.accessToken = null;
+        this.account = null;
+        this.isInitialized = false;
+        // Validate browser environment
+        if (typeof window === 'undefined') {
+            throw new Error('PKCEAuthStrategy can only be used in browser environments');
+        }
+        // Note: MSAL check is deferred to initialize() to allow lazy loading
+        this.authScheme = config.authScheme || 'redirect';
+    }
+    /**
+     * Initialize the PKCE authentication strategy
+     */
+    async initialize(options) {
+        // Update postAuthentication callback even if already initialized
+        // This allows setting the callback after early initialization (e.g., for fetching agent details)
+        if (options?.postAuthentication) {
+            this.postAuthentication = options.postAuthentication;
+        }
+        if (this.isInitialized) {
+            // If already initialized, just update deploymentInfo if provided
+            if (options?.deploymentInfo) {
+                this.deploymentInfo = options.deploymentInfo;
+            }
+            return;
+        }
+        // Check if MSAL is available (deferred from constructor to allow lazy loading)
+        // The msal-loader import ensures MSAL is bundled, but we still need to verify it's available
+        if (!window.msal) {
+            throw new Error('MSAL library not found. Please ensure msal-browser.js is loaded. The SDK bundle should include MSAL automatically. If you see this error, there may be a bundling issue.');
+        }
+        this.deploymentInfo = options?.deploymentInfo;
+        /**
+         {
+        "auth": {
+            "navigateToLoginRequestUrl": false,
+            "clientId": "0e22ec34-1b8f-4d7f-9621-336e5317d2e7",
+            "redirectUri": "https://EG5841AIN.ezdev.net/system/templates/selfservice/auth-redirect.html",
+            "authority": "https://tmprod95058780int.b2clogin.com/91dc7b59-21d9-4345-a053-a57f4ebddea8/B2C_1A_User_V3_SignIn_OIDC",
+            "knownAuthorities": [
+                "tmprod95058780int.b2clogin.com"
+            ],
+            "authorityMetadata": "{\"authorization_endpoint\":\"https://tmprod95058780int.b2clogin.com/91dc7b59-21d9-4345-a053-a57f4ebddea8/B2C_1A_User_V3_SignIn_OIDC/oauth2/v2.0/authorize\",\"token_endpoint\":\"https://TMPROD95058780int.b2clogin.com/91dc7b59-21d9-4345-a053-a57f4ebddea8/B2C_1A_User_V3_SignIn_OIDC/oauth2/v2.0/token\",\"issuer\":\"https://tmprod95058780int.b2clogin.com/tfp/91dc7b59-21d9-4345-a053-a57f4ebddea8/B2C_1A_User_V3_SignIn_OIDC/v2.0/\",\"jwks_uri\":\"https://tmprod95058780int.b2clogin.com/91dc7b59-21d9-4345-a053-a57f4ebddea8/B2C_1A_User_V3_SignIn_OIDC/discovery/v2.0/keys\"}"
+        },
+        "cache": {
+            "cacheLocation": "sessionStorage",
+            "storeAuthStateInCookie": false,
+            "claimsBasedCachingEnabled": true
+        }
+    }
+         */
+        // Build MSAL configuration
+        const msalConfig = {
+            auth: {
+                navigateToLoginRequestUrl: true,
+                clientId: this.config.clientId,
+                redirectUri: this.config.redirectUri,
+                authority: this.config.authorizationUrl,
+                knownAuthorities: this.config.knownAuthorities,
+                authorityMetadata: this.config.authorityMetadata,
+            },
+            cache: {
+                cacheLocation: this.config.cacheLocation || 'sessionStorage',
+                storeAuthStateInCookie: false,
+                claimsBasedCachingEnabled: true,
+            },
+            system: {
+                allowRedirectInIframe: true,
+            },
+        };
+        // Add OIDC options if tenantAlias or tenantId is present (similar to egAuthentication.js)
+        const tenantAlias = this.deploymentInfo?.tenant_identifier;
+        if (tenantAlias) {
+            msalConfig.auth.protocolMode = "OIDC";
+            msalConfig.auth.OIDCOptions = {
+                serverResponseType: "query"
+            };
+        }
+        // Create MSAL instance
+        this.msalInstance = new window.msal.PublicClientApplication(msalConfig);
+        // Initialize MSAL
+        await this.msalInstance.initialize();
+        // Handle redirect callback if using redirect flow
+        if (this.authScheme === 'redirect') {
+            await this.handleRedirectPromise();
+        }
+        // Check for existing accounts
+        const accounts = this.msalInstance.getAllAccounts();
+        if (accounts.length > 0) {
+            this.account = accounts[0];
+            this.msalInstance.setActiveAccount(this.account);
+            this.isAuthenticatedFlag = true;
+        }
+        this.isInitialized = true;
+    }
+    /**
+     * Handle redirect promise after OAuth redirect
+     */
+    async handleRedirectPromise() {
+        try {
+            const response = await this.msalInstance.handleRedirectPromise();
+            if (response) {
+                this.account = response.account;
+                this.msalInstance.setActiveAccount(this.account);
+                this.accessToken = response.accessToken;
+                this.isAuthenticatedFlag = true;
+            }
+        }
+        catch (error) {
+            console.error('Error handling redirect promise:', error);
+            throw error;
+        }
+    }
+    /**
+     * Authenticate using PKCE flow
+     */
+    async authenticate() {
+        if (!this.isInitialized) {
+            await this.initialize();
+        }
+        // If we have an account from a previous redirect but no cached token,
+        // acquire one silently from MSAL's cache before proceeding
+        if (this.isAuthenticatedFlag && this.account && !this.accessToken) {
+            const silentRequest = {
+                scopes: this.config.scopes || ['openid', 'profile', 'offline_access'],
+                account: this.account,
+            };
+            const response = await this.msalInstance.acquireTokenSilent(silentRequest);
+            this.accessToken = response.accessToken;
+        }
+        // Check if already authenticated
+        if (this.isAuthenticatedFlag && this.accessToken) {
+            if (this.postAuthentication) {
+                await this.postAuthentication(this.accessToken);
+            }
+            return;
+        }
+        // Build login request
+        const loginRequest = {
+            scopes: this.config.scopes || ['openid', 'profile', 'offline_access'],
+        };
+        // Add state parameter from nextRoute if available (similar to egAuthentication.js)
+        if (this.config.nextRoute) {
+            // Remove hash from URL if present (similar to #removeHashFromURL in egAuthentication.js)
+            const relayState = this.config.nextRoute.split('#')[0];
+            loginRequest.state = relayState;
+        }
+        // Add extraQueryParameters for identity provider routing (matches cc-widget behavior)
+        const extraQueryParameters = {};
+        if (this.deploymentInfo?.domainHint) {
+            extraQueryParameters.domain_hint = this.deploymentInfo.domainHint;
+        }
+        if (this.config.localLogin) {
+            extraQueryParameters.localLogin = 'true';
+        }
+        if (Object.keys(extraQueryParameters).length > 0) {
+            loginRequest.extraQueryParameters = extraQueryParameters;
+        }
+        try {
+            let response;
+            if (this.authScheme === 'popup') {
+                // Use popup flow
+                response = await this.msalInstance.loginPopup(loginRequest);
+            }
+            else {
+                // Use redirect flow — page will navigate to the identity provider.
+                await this.msalInstance.loginRedirect(loginRequest);
+                // Block the caller until the browser navigates away.
+                // The promise is garbage-collected when the page unloads.
+                return new Promise(() => { });
+            }
+            // Handle popup response
+            if (response && response.account) {
+                this.account = response.account;
+                this.msalInstance.setActiveAccount(this.account);
+                this.accessToken = response.accessToken;
+                this.isAuthenticatedFlag = true;
+                // Call postAuthentication callback
+                if (this.postAuthentication) {
+                    await this.postAuthentication(response.accessToken);
+                }
+            }
+        }
+        catch (error) {
+            console.error('Authentication error:', error);
+            throw error;
+        }
+    }
+    /**
+     * Check if the user is currently authenticated
+     */
+    isAuthenticated() {
+        return this.isAuthenticatedFlag && this.account !== null;
+    }
+    /**
+     * Get authentication token using PKCE flow
+     */
+    async getToken() {
+        if (!this.isInitialized) {
+            await this.initialize();
+        }
+        // If we have a cached token and account, try to get it silently
+        if (this.account) {
+            try {
+                const silentRequest = {
+                    scopes: this.config.scopes || ['openid', 'profile', 'offline_access'],
+                    account: this.account,
+                };
+                const response = await this.msalInstance.acquireTokenSilent(silentRequest);
+                this.accessToken = response.accessToken;
+                return response.accessToken;
+            }
+            catch (error) {
+                // If silent acquisition fails, we may need to re-authenticate
+                // For now, if we have a stored token, return it
+                if (this.accessToken) {
+                    return this.accessToken;
+                }
+                // Otherwise, throw the error
+                throw error;
+            }
+        }
+        // No account, need to authenticate
+        if (!this.accessToken) {
+            throw new Error('No access token available. Please call authenticate() first.');
+        }
+        return this.accessToken;
+    }
+    /**
+     * Start the PKCE authorization flow
+     * Redirects user to authorization server
+     */
+    async startAuthorizationFlow() {
+        await this.authenticate();
+    }
+    /**
+     * Handle the OAuth callback with authorization code
+     * This is handled automatically by MSAL's handleRedirectPromise
+     */
+    async handleCallback(code, state) {
+        // MSAL handles this automatically via handleRedirectPromise
+        // This method is kept for compatibility but redirects are handled internally
+        await this.handleRedirectPromise();
+    }
+    /**
+     * Refresh the access token using refresh token
+     */
+    async refreshToken() {
+        if (!this.account) {
+            throw new Error('No account available for token refresh');
+        }
+        const silentRequest = {
+            scopes: this.config.scopes || ['openid', 'profile', 'offline_access'],
+            account: this.account,
+            forceRefresh: true,
+        };
+        try {
+            const response = await this.msalInstance.acquireTokenSilent(silentRequest);
+            this.accessToken = response.accessToken;
+            return response.accessToken;
+        }
+        catch (error) {
+            // If silent refresh fails, may need interactive login
+            throw error;
+        }
+    }
+    /**
+     * Cleanup resources
+     */
+    async cleanup() {
+        this.accessToken = null;
+        this.account = null;
+        this.isAuthenticatedFlag = false;
+        this.isInitialized = false;
+        // MSAL handles its own cleanup, but we can clear our references
+    }
+}
+//# sourceMappingURL=PKCEAuthStrategy.js.map

package/dist/core/auth/PKCEAuthStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PKCEAuthStrategy.js","sourceRoot":"","sources":["../../../src/core/auth/PKCEAuthStrategy.ts"],"names":[],"mappings":"AAEA,OAAO,kBAAkB,CAAC,CAAC,wCAAwC;AA+EnE;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAC3B;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,KAAK,CAAC,6BAA6B,CACxC,cAAmB,EACnB,YAAiB,EACjB,QAAgB,EAChB,MAAgB,EAChB,MAAe,EACf,UAAiC,EACjC,UAAmB,EACnB,UAAoB;QAEpB,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC;QAC/C,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC;QAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;QACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;QACzC,MAAM,QAAQ,GAAG,YAAY,EAAE,QAAQ,CAAC;QAExC,2DAA2D;QAC3D,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC;YACvC,CAAC,QAAQ,KAAK,UAAU,IAAI,WAAW,CAAC,EAAE,CAAC;YAC3C,WAAW,GAAG,cAAc,CAAC,SAAS,GAAG,mCAAmC,GAAG,QAAQ,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,cAAc,CAAC,SAAS,GAAG,sCAAsC,CAAC;QAClF,CAAC;QAED,wBAAwB;QACxB,WAAW,GAAG,WAAW,IAAI,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,GAAG,WAAW,CAAC;QAEzG,iBAAiB;QACjB,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,6BAA6B,gBAAgB,CAAC,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC;YACzG,CAAC;YACD,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,MAAM,EAAE,KAAK,CAAC,yCAAyC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YACpI,MAAM,IAAI,KAAK,CAAC,gDAAgD,WAAW,KAAK,YAAY,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,iBAAiB,GAAQ,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC;QACX,IAAI,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,oCAAoC;QAEtE,8CAA8C;QAC9C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,GAAG,QAAQ,EAAE,WAAW,EAAE,gBAAgB,CAAC;YACjD,MAAM,OAAO,GAAG,QAAQ,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;YACvE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBACvC,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAC;gBACzC,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpD,+FAA+F;gBAC/F,iBAAiB,CAAC,sBAAsB,GAAG,aAAa,CAAC,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC;YAC3F,CAAC;YAED,iBAAiB,CAAC,cAAc,GAAG,QAAQ,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC;YACjG,iBAAiB,CAAC,MAAM,GAAG,CAAC,UAAU,GAAG,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1G,iBAAiB,CAAC,QAAQ,GAAG,CAAC,UAAU,GAAG,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrH,CAAC;aAAM,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,QAAQ,EAAE,WAAW,EAAE,oBAAoB,CAAC;YACrD,MAAM,OAAO,GAAG,QAAQ,EAAE,qBAAqB,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;YAC3E,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBACvC,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAC;gBACzC,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpD,+FAA+F;gBAC/F,iBAAiB,CAAC,sBAAsB,GAAG,aAAa,CAAC,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC;YAC3F,CAAC;YAED,iBAAiB,CAAC,cAAc,GAAG,QAAQ,EAAE,qBAAqB,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC;YACrG,iBAAiB,CAAC,MAAM,GAAG,CAAC,UAAU,GAAG,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1G,iBAAiB,CAAC,QAAQ,GAAG,CAAC,UAAU,GAAG,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,mCAAmC,CAAC,CAAC;QACpF,CAAC;QAED,sCAAsC;QACtC,MAAM,gBAAgB,GAAG,CAAC,UAAU,GAAG,eAAe,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAExF,oCAAoC;QACpC,MAAM,mBAAmB,GACvB,QAAQ,KAAK,OAAO,IAAI,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB;YACvE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB;YAChD,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB;gBAC5E,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB;gBAChD,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,IAAI,EAAE,CAAC;QAE/D,IAAI,mBAAmB,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACzD,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,mBAAmB,GAAG,KAAK,CAAC,CAAC;QACtF,CAAC;QAED,2EAA2E;QAC3E,IAAI,gBAAgB,GAAG,UAAU,IAAI,QAAQ,CAAC;QAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,KAAK,OAAO,IAAI,WAAW,EAAE,CAAC;gBACxC,gBAAgB,GAAG,WAAW,CAAC;YACjC,CAAC;iBAAM,IAAI,QAAQ,KAAK,UAAU,IAAI,WAAW,EAAE,CAAC;gBAClD,gBAAgB,GAAG,WAAW,CAAC;YACjC,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC;QAC7C,MAAM,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,kDAAkD,CAAC;QAEjG,uFAAuF;QACvF,IAAI,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEhF,+BAA+B;QAC/B,OAAO;YACL,QAAQ,EAAE,gBAAgB;YAC1B,WAAW,EAAE,WAAW,EAAE,+BAA+B;YACzD,gBAAgB,EAAE,gBAAgB;YAClC,gBAAgB,EAAE,CAAC,eAAe,CAAC;YACnC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;YACpD,MAAM,EAAE,cAAc;YACtB,UAAU,EAAE,UAAU,IAAI,OAAO;YACjC,aAAa,EAAE,gBAAgB;YAC/B,SAAS,EAAE,SAAS;YACpB,GAAG,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAUD,YAA6B,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;QAR3C,wBAAmB,GAAY,KAAK,CAAC;QAGrC,eAAU,GAAyB,UAAU,CAAC;QAC9C,gBAAW,GAAkB,IAAI,CAAC;QAClC,YAAO,GAAQ,IAAI,CAAC;QACpB,kBAAa,GAAY,KAAK,CAAC;QAGrC,+BAA+B;QAC/B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QAED,qEAAqE;QACrE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,UAAU,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAuC;QACtD,iEAAiE;QACjE,iGAAiG;QACjG,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;YAChC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACvD,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,iEAAiE;YACjE,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;gBAC5B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YAC/C,CAAC;YACD,OAAO;QACT,CAAC;QAED,+EAA+E;QAC/E,6FAA6F;QAC7F,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0KAA0K,CAAC,CAAC;QAC9L,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,OAAO,EAAE,cAAc,CAAC;QAE9C;;;;;;;;;;;;;;;;;;WAkBG;QAEH,2BAA2B;QAC3B,MAAM,UAAU,GAAQ;YACtB,IAAI,EAAE;gBACJ,yBAAyB,EAAE,IAAI;gBAC/B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACpC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBACvC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAC9C,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;aACjD;YACD,KAAK,EAAE;gBACL,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,gBAAgB;gBAC5D,sBAAsB,EAAE,KAAK;gBAC7B,yBAAyB,EAAE,IAAI;aAChC;YACD,MAAM,EAAE;gBACN,qBAAqB,EAAE,IAAI;aAC5B;SACF,CAAC;QAEF,0FAA0F;QAC1F,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC;QAC3D,IAAI,WAAW,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,WAAW,GAAG;gBAC5B,kBAAkB,EAAE,OAAO;aAC5B,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,YAAY,GAAG,IAAI,MAAM,CAAC,IAAK,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAEzE,kBAAkB;QAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;QAErC,kDAAkD;QAClD,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACrC,CAAC;QAED,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAClC,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB;QACjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAC;YACjE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;gBAChC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;gBACxC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAClC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;YACzD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAED,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClE,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC;gBACrE,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YAC3E,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QAC1C,CAAC;QAED,iCAAiC;QACjC,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,CAAC;YACD,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,MAAM,YAAY,GAAQ;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC;SACtE,CAAC;QAEF,mFAAmF;QACnF,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1B,yFAAyF;YACzF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,YAAY,CAAC,KAAK,GAAG,UAAU,CAAC;QAClC,CAAC;QAED,sFAAsF;QACtF,MAAM,oBAAoB,GAA2B,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;YACpC,oBAAoB,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,oBAAoB,CAAC,UAAU,GAAG,MAAM,CAAC;QAC3C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,YAAY,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,IAAI,QAAa,CAAC;YAElB,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;gBAChC,iBAAiB;gBACjB,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACpD,qDAAqD;gBACrD,0DAA0D;gBAC1D,OAAO,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,CAAC;YAED,wBAAwB;YACxB,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;gBAChC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;gBACxC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;gBAEhC,mCAAmC;gBACnC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBAC5B,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAED,gEAAgE;QAChE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG;oBACpB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC;oBACrE,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC;gBAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;gBAC3E,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;gBACxC,OAAO,QAAQ,CAAC,WAAW,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,8DAA8D;gBAC9D,gDAAgD;gBAChD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,OAAO,IAAI,CAAC,WAAW,CAAC;gBAC1B,CAAC;gBACD,6BAA6B;gBAC7B,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,KAAa;QAC9C,4DAA4D;QAC5D,6EAA6E;QAC7E,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,aAAa,GAAG;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC;YACrE,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI;SACnB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YAC3E,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;YACxC,OAAO,QAAQ,CAAC,WAAW,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,sDAAsD;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC3B,gEAAgE;IAClE,CAAC;CACF"}