@equinor/fusion-framework-module-msal 10.0.2 → 11.0.0-next.1

package/dist/esm/mock/MsalMockConfigurator.js

@@ -0,0 +1,239 @@
+import { MsalConfigurator } from '../MsalConfigurator';
+import { MsalMockClient } from './MsalMockClient';
+import { createMockUserFromToken } from './create-mock-user-from-token';
+/**
+ * The client configuration used when a test declares none.
+ *
+ * @remarks
+ * `MsalClientConfig.auth.clientId` is required, so a mock still needs a client
+ * configuration to exist. Supplying a default is what lets an application boot
+ * under test without declaring credentials it does not have.
+ */
+const defaultMockClientConfig = {
+    auth: {
+        clientId: 'fusion-mock-client',
+        tenantId: 'fusion-mock-tenant',
+    },
+};
+/**
+ * The real MSAL configurator, backed by an in-process client.
+ *
+ * @remarks
+ * Nothing else changes: the same builder API, the same validation and the same
+ * `MsalProvider` are used. Only the boundary that would contact Entra ID is
+ * substituted, through the same
+ * {@link MsalConfigurator._createClient | _createClient} seam the real
+ * configurator builds its own client from — and from the same
+ * {@link MsalConfigurator._createClientConfig | _createClientConfig}, so
+ * `setClientConfig` means exactly what it means in production.
+ *
+ * A user named `Test User` is signed in by default, so an application boots
+ * without declaring anything.
+ *
+ * @example Name the signed-in user
+ * ```typescript
+ * enableMsalMock(configurator, (builder) => {
+ *   builder.setAccount({ name: 'Ada Lovelace', username: 'ada@equinor.com' });
+ * });
+ * ```
+ *
+ * @example Configure the client exactly as in production
+ * ```typescript
+ * enableMsalMock(configurator, (builder) => {
+ *   builder.setClientConfig({ auth: { clientId: 'my-app', tenantId: 'my-tenant' } });
+ * });
+ * ```
+ *
+ * @example Take full control of authentication
+ * ```typescript
+ * enableMsalMock(configurator, (builder) => {
+ *   builder.setClient(new MyOwnMsalClient());
+ * });
+ * ```
+ */
+export class MsalMockConfigurator extends MsalConfigurator {
+    /**
+     * Declares the user to sign in.
+     *
+     * @remarks
+     * Who is signed in is session state, not client configuration — which is what
+     * lets {@link MsalMockClient} take the same argument the real client takes: a
+     * client is configured with *what it talks to*, never with *who is signed in*.
+     *
+     * The user is therefore recorded on the configuration as `mock.account`, not
+     * on this builder, and is signed in on whichever client the module ends up
+     * authenticating through — wherever that client was built:
+     *
+     * - The client this builder builds, normally. The user is in place before
+     *   `MsalProvider.initialize` runs, which is what makes the provider's own
+     *   start-up path observable: with `signedOut` and `setRequiresAuth(true)`, a
+     *   test sees the real automatic login run.
+     * - The **host's** client when the module is hoisted onto a host
+     *   application's provider, because none is built here. An application inside
+     *   a portal shares the portal's session, so this changes who the host sees
+     *   signed in too, as it would in production.
+     * - A client supplied through {@link MsalConfigurator.setClient | setClient},
+     *   when that client is a {@link MsalMockClient}.
+     *
+     * Throws when that client cannot represent a declared user, rather than
+     * failing quietly — a silent no-op is the whole failure mode this exists to
+     * prevent.
+     *
+     * Pass `null` when nobody is signed in, or `{ signedOut: true }` to keep an
+     * identity without a session — a later login then resolves as that user.
+     *
+     * @param account - The user, or an ordinary config-builder callback resolving it.
+     * @returns The builder, for chaining.
+     *
+     * @example Derive the user from the modules in scope
+     * ```typescript
+     * builder.setAccount(async ({ hasModule }) => ({
+     *   name: hasModule('app') ? 'App User' : 'Portal User',
+     * }));
+     * ```
+     */
+    setAccount(account) {
+        this._set('mock.account', account);
+        return this;
+    }
+    /**
+     * Declares the token to return, independent of who is signed in.
+     *
+     * @remarks
+     * Use this when a backend mock validates its own tokens (specific claims, an
+     * audience, or a signature) — the client then returns this token verbatim
+     * instead of fabricating one from the signed-in user's fields.
+     *
+     * @param token - A JWT (e.g. from `createMockToken`, or issued by an external mock).
+     * @param skipResolve - When `true`, override only the token and leave an account
+     * declared through {@link setAccount} untouched. Defaults to `false`, which also signs
+     * in the user described by the token's claims, via {@link createMockUserFromToken}.
+     * @returns The builder, for chaining.
+     *
+     * @example Sign in as whoever the token names
+     * ```typescript
+     * builder.setToken(token);
+     * ```
+     *
+     * @example Keep a separately declared account, but return this exact token
+     * ```typescript
+     * builder.setAccount({ name: 'Ada Lovelace' }).setToken(token, true);
+     * ```
+     */
+    setToken(token, skipResolve = false) {
+        this._set('mock.token', token);
+        // skipResolve defaults to false - most callers want the token's claims to name who is signed in
+        if (!skipResolve) {
+            this.setAccount(createMockUserFromToken(token));
+        }
+        return this;
+    }
+    /**
+     * Resolves the client the module authenticates through, wherever it was built.
+     *
+     * @remarks
+     * Shared by {@link setAccount} and {@link setToken} application: neither can
+     * assume the scope declaring mock state is the scope that built the client,
+     * which is exactly what is not true when an application is tested inside a
+     * portal. The host built that client, in a scope this builder never sees, so
+     * the client has to be located rather than assumed.
+     *
+     * @param config - The validated configuration, carrying the client when one was built.
+     * @param init - The builder arguments, carrying the host reference when hoisted.
+     * @param action - Describes what could not be applied, for the thrown error.
+     * @returns The resolved mock client.
+     * @throws When the resolved client is not a {@link MsalMockClient}.
+     */
+    #getClient(config, init, action) {
+        const host = init?.ref?.auth;
+        const client = config.client ?? host?.client;
+        // Reject a real client because mock state cannot be applied to it.
+        if (!(client instanceof MsalMockClient)) {
+            throw new Error(`MsalMockConfigurator: cannot ${action}, because this module does not authenticate through a mock client. Declare it where that client is configured instead.`);
+        }
+        return client;
+    }
+    /**
+     * Signs the declared user in on the client the module authenticates through.
+     *
+     * @param account - The user to sign in, or `null` when nobody is.
+     * @param config - The validated configuration, carrying the client when one was built.
+     * @param init - The builder arguments, carrying the host reference when hoisted.
+     * @throws When the resolved client is not a {@link MsalMockClient}.
+     */
+    #signIn(account, config, init) {
+        this.#getClient(config, init, 'sign a user in').setUser(account);
+    }
+    /**
+     * Assembles the configuration, then signs the declared user in.
+     *
+     * @remarks
+     * Stands a client configuration in first when this builder is the one that
+     * will build a client: `MsalClientConfig.auth.clientId` is required to build
+     * any client at all and a test has no real credentials to declare. It then
+     * flows through the very same
+     * {@link MsalConfigurator._createClientConfig | _createClientConfig}
+     * enrichment the real client is built from, and anything declared through
+     * {@link MsalConfigurator.setClientConfig | setClientConfig} wins — exactly as
+     * in production.
+     *
+     * Doing that here rather than in the constructor is deliberate: a hoisted
+     * module authenticates through the host and builds no client, so it must not
+     * look configured either.
+     *
+     * The user is read from `rawConfig`, because the schema strips `mock` when it
+     * validates — the key exists to carry a test's declaration through the
+     * builder, never to reach the provider.
+     *
+     * @param rawConfig - The raw configuration to process.
+     * @param init - The builder arguments, carrying the host reference when hoisted.
+     * @returns The processed and validated configuration.
+     */
+    async _processConfig(rawConfig, init) {
+        // Supply mock credentials only when this builder owns client construction.
+        if (!this._isHoisted(init) && !this.getClientConfig()) {
+            this.setClientConfig(defaultMockClientConfig);
+        }
+        const config = await super._processConfig(rawConfig, init);
+        // `null` is a declaration in its own right — nobody is signed in — so only
+        // an absent one means the test said nothing about the user
+        const account = rawConfig.mock?.account;
+        // Apply even null because null explicitly requests a signed-out mock state.
+        if (account !== undefined) {
+            this.#signIn(account, config, init);
+        }
+        // Applied after the account so a token declared alongside `skipResolve: true`
+        // overrides whatever `setUser` above just fabricated.
+        const token = rawConfig.mock?.token;
+        // absent means the test declared no token override; leave the client generating its own
+        if (token !== undefined) {
+            this.#getClient(config, init, 'set a token').setToken(token);
+        }
+        return config;
+    }
+    /**
+     * Builds an in-process client.
+     *
+     * @remarks
+     * Called only when no client was set, so
+     * {@link MsalConfigurator.setClient | setClient} still replaces authentication
+     * outright.
+     *
+     * Deliberately does not delegate to `super`, which would build a real
+     * `MsalClient` and contact Entra ID. It is never reached when the module is
+     * hoisted onto a host application's provider, because the base configurator
+     * gates client creation on {@link MsalConfigurator._isHoisted | _isHoisted} —
+     * a mock client built there would shadow the host's client, the exact scenario
+     * an application-inside-a-portal test exists to cover.
+     *
+     * Knows nothing about who is signed in: a client is built from what it talks
+     * to, and the declared user is applied to it afterwards.
+     *
+     * @param config - The validated configuration the client is built from.
+     * @returns A client resolving tokens in-process.
+     */
+    async _createClient(config) {
+        return new MsalMockClient(this._createClientConfig(config) ?? defaultMockClientConfig);
+    }
+}
+//# sourceMappingURL=MsalMockConfigurator.js.map

package/dist/esm/mock/MsalMockConfigurator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MsalMockConfigurator.js","sourceRoot":"","sources":["../../../src/mock/MsalMockConfigurator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAmB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,cAAc,EAAqB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAgCxE;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAqB;IAChD,IAAI,EAAE;QACJ,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,oBAAoB;KAC/B;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,OAAO,oBAAqB,SAAQ,gBAAgB;IACxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACI,UAAU,CACf,OAAyE;QAEzE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACI,QAAQ,CAAC,KAAa,EAAE,WAAW,GAAG,KAAK;QAChD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC/B,gGAAgG;QAChG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CACR,MAAkB,EAClB,IAA2C,EAC3C,MAAc;QAEd,MAAM,IAAI,GAAI,IAAI,EAAE,GAA4C,EAAE,IAAI,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;QAE7C,mEAAmE;QACnE,IAAI,CAAC,CAAC,MAAM,YAAY,cAAc,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,wHAAwH,CAC/J,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,OAA4B,EAC5B,MAAkB,EAClB,IAAgC;QAEhC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACM,KAAK,CAAC,cAAc,CAC3B,SAAqB,EACrB,IAAgC;QAEhC,2EAA2E;QAC3E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YACtD,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAE3D,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;QACxC,4EAA4E;QAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAED,8EAA8E;QAC9E,sDAAsD;QACtD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC;QACpC,wFAAwF;QACxF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACgB,KAAK,CAAC,aAAa,CAAC,MAAkB;QACvD,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,CAAC;IACzF,CAAC;CACF"}

package/dist/esm/mock/create-mock-token.js

@@ -0,0 +1,60 @@
+/**
+ * Encodes a value as base64url without padding, as used in JWT segments.
+ *
+ * @param value - Raw string to encode.
+ * @returns The base64url representation.
+ */
+const base64Url = (value) => {
+    // btoa operates on latin1; encodeURIComponent round-trip keeps non-ASCII names intact
+    const bytes = new TextEncoder().encode(value);
+    let binary = '';
+    // Iterate over encoded bytes so Unicode claims are preserved before base64url encoding.
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+/**
+ * Creates a structurally valid, unsigned JWT for use in tests.
+ *
+ * The token has three base64url segments and decodes to the supplied claims, so
+ * code that splits, decodes, or inspects token claims behaves exactly as it does
+ * in production. The signature segment is a fixed placeholder — the token is
+ * **not** cryptographically valid and will be rejected by any real service.
+ *
+ * @remarks
+ * Timestamps default to a fixed issue time and a one-hour lifetime so repeated
+ * runs produce byte-identical tokens. A test that needs an expired token can set
+ * `exp` in the past.
+ *
+ * @param claims - Claims to embed in the token payload.
+ * @returns An unsigned JWT string in `header.payload.signature` form.
+ *
+ * @example
+ * ```typescript
+ * const token = createMockToken({ name: 'Test User', scp: 'Files.Read' });
+ * const [, payload] = token.split('.');
+ * JSON.parse(decodeJwtSegment(payload)).name; // 'Test User'
+ * ```
+ */
+export const createMockToken = (claims = {}) => {
+    const header = { alg: 'none', typ: 'JWT' };
+    // Fixed default clock keeps generated tokens byte-identical between runs
+    const issuedAt = claims.iat ?? 1_700_000_000;
+    const payload = {
+        iss: 'https://login.microsoftonline.com/fusion-test-tenant/v2.0',
+        aud: 'fusion-test-client',
+        tid: 'fusion-test-tenant',
+        oid: 'fusion-test-user',
+        iat: issuedAt,
+        nbf: issuedAt,
+        exp: issuedAt + 3600,
+        ...claims,
+    };
+    return [
+        base64Url(JSON.stringify(header)),
+        base64Url(JSON.stringify(payload)),
+        'fusion-test-signature',
+    ].join('.');
+};
+//# sourceMappingURL=create-mock-token.js.map

package/dist/esm/mock/create-mock-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-mock-token.js","sourceRoot":"","sources":["../../../src/mock/create-mock-token.ts"],"names":[],"mappings":"AA+BA;;;;;GAKG;AACH,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE;IAC1C,sFAAsF;IACtF,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,wFAAwF;IACxF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,GAAoB,EAAE,EAAU,EAAE;IACtE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC3C,yEAAyE;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,IAAI,aAAa,CAAC;IAC7C,MAAM,OAAO,GAAoB;QAC/B,GAAG,EAAE,2DAA2D;QAChE,GAAG,EAAE,oBAAoB;QACzB,GAAG,EAAE,oBAAoB;QACzB,GAAG,EAAE,kBAAkB;QACvB,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,QAAQ,GAAG,IAAI;QACpB,GAAG,MAAM;KACV,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,uBAAuB;KACxB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC,CAAC"}

package/dist/esm/mock/create-mock-user-from-token.js

@@ -0,0 +1,40 @@
+import { decodeJwtSegment } from './decode-jwt-segment';
+/**
+ * Derives a {@link MsalMockUser} from a JWT's payload claims, so a token minted
+ * outside this module (e.g. by a backend's own mock) can drive who the mock
+ * signs in as.
+ *
+ * @remarks
+ * Maps the standard Entra ID claims Fusion applications read — `name`,
+ * `preferred_username`, `oid`, `tid`, `scp` — onto the matching
+ * {@link MsalMockUser} fields. Identity only: it does not affect which token
+ * the client returns — use {@link MsalMockConfigurator.setToken} for that.
+ *
+ * @param token - A JWT (e.g. from {@link createMockToken}, or issued by an
+ * external mock) with a base64url-encoded payload segment.
+ * @returns A mock user built from the token's claims.
+ * @throws When the token has no payload segment (`header.payload.signature`).
+ *
+ * @example
+ * ```typescript
+ * enableMsalMock(configurator, (builder) => {
+ *   builder.setAccount(createMockUserFromToken(token));
+ * });
+ * ```
+ */
+export const createMockUserFromToken = (token) => {
+    const [, payload] = token.split('.');
+    // fail loudly rather than signing in an empty/garbage user from a malformed token
+    if (!payload) {
+        throw new Error('createMockUserFromToken: expected a JWT with a payload segment (header.payload.signature)');
+    }
+    const claims = JSON.parse(decodeJwtSegment(payload));
+    return {
+        name: claims.name,
+        username: claims.preferred_username,
+        userId: claims.oid,
+        tenantId: claims.tid,
+        scopes: claims.scp?.split(' '),
+    };
+};
+//# sourceMappingURL=create-mock-user-from-token.js.map

package/dist/esm/mock/create-mock-user-from-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-mock-user-from-token.js","sourceRoot":"","sources":["../../../src/mock/create-mock-user-from-token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAa,EAAgB,EAAE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,kFAAkF;IAClF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAoB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtE,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,kBAAkB;QACnC,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC,CAAC"}

package/dist/esm/mock/create-msal-mock-client.js

@@ -0,0 +1,20 @@
+import { MsalMockClient } from './MsalMockClient';
+/**
+ * Convenience helper that creates a mock client instance.
+ *
+ * @remarks
+ * The class form is preferred for a more familiar configuration pattern.
+ *
+ * @param config - The same client configuration the real client is built from.
+ * @param user - Optional user to sign in, applied after construction.
+ * @returns A client that resolves tokens in-process.
+ */
+export const createMsalMockClient = (config, user) => {
+    const client = new MsalMockClient(config);
+    // Apply the optional identity after construction so the helper matches setUser semantics.
+    if (user) {
+        client.setUser(user);
+    }
+    return client;
+};
+//# sourceMappingURL=create-msal-mock-client.js.map

package/dist/esm/mock/create-msal-mock-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-msal-mock-client.js","sourceRoot":"","sources":["../../../src/mock/create-msal-mock-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAqB,MAAM,kBAAkB,CAAC;AAErE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,MAAwB,EACxB,IAAmB,EACN,EAAE;IACf,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,0FAA0F;IAC1F,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/esm/mock/decode-jwt-segment.js

@@ -0,0 +1,22 @@
+/**
+ * Decodes a base64url segment of a {@link createMockToken} JWT back to its JSON string.
+ *
+ * @remarks
+ * Plain `atob` alone mangles non-ASCII claims: it treats its output as latin1,
+ * while segments are UTF-8 encoded. This reverses that encoding and also
+ * restores the standard base64 alphabet/padding `atob` expects.
+ *
+ * @param segment - A base64url segment, e.g. from splitting a JWT on `.`.
+ * @returns The decoded UTF-8 string.
+ */
+export function decodeJwtSegment(segment) {
+    const base64 = segment
+        .replace(/-/g, '+')
+        .replace(/_/g, '/')
+        .padEnd(segment.length + ((4 - (segment.length % 4)) % 4), '=');
+    const binary = atob(base64);
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+}
+export default decodeJwtSegment;
+//# sourceMappingURL=decode-jwt-segment.js.map

package/dist/esm/mock/decode-jwt-segment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode-jwt-segment.js","sourceRoot":"","sources":["../../../src/mock/decode-jwt-segment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,MAAM,GAAG,OAAO;SACnB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,eAAe,gBAAgB,CAAC"}

package/dist/esm/mock/index.js

@@ -0,0 +1,31 @@
+/**
+ * Mock MSAL for tests: real provider, real configurator, fake client.
+ *
+ * @remarks
+ * Substituting the client is the smallest change that removes Entra ID from a test.
+ * Everything above it — scope resolution, silent-first token acquisition, account
+ * handling, proxy providers, telemetry — is the production code path.
+ *
+ * @example
+ * ```typescript
+ * import { enableMsalMock } from '@equinor/fusion-framework-module-msal/mock';
+ *
+ * // default mock user
+ * enableMsalMock(configurator);
+ *
+ * // or a specific one
+ * enableMsalMock(configurator, (builder) => {
+ *   builder.setAccount({ name: 'Ada Lovelace', signedOut: true });
+ * });
+ * ```
+ *
+ * @packageDocumentation
+ */
+export { MsalMockClient } from './MsalMockClient';
+export { createMsalMockClient } from './create-msal-mock-client';
+export { MsalMockConfigurator } from './MsalMockConfigurator';
+export { enableMsalMock, msalMockModule } from './module';
+export { createMockToken } from './create-mock-token';
+export { createMockUserFromToken } from './create-mock-user-from-token';
+export { decodeJwtSegment } from './decode-jwt-segment';
+//# sourceMappingURL=index.js.map

package/dist/esm/mock/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mock/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,cAAc,EAAqB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAyB,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,eAAe,EAAwB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/esm/mock/module.js

@@ -0,0 +1,38 @@
+import { module } from '../module';
+import { MsalMockConfigurator } from './MsalMockConfigurator';
+/**
+ * The MSAL module with a mock client instead of a live connection to Entra ID.
+ *
+ * @remarks
+ * Only `configure` differs from the real module. `initialize` is the production
+ * one, untouched, so proxy providers, host-provider hoisting and provider
+ * initialization all behave exactly as they do in production — and a test
+ * observes the real start-up path rather than a rehearsal of it.
+ */
+export const msalMockModule = {
+    ...module,
+    configure: () => new MsalMockConfigurator(),
+};
+/**
+ * Enables MSAL against a mock client, so a test needs no credentials and no network.
+ *
+ * @remarks
+ * Registered last, this replaces whichever auth module the configurator already
+ * carries, so it works on a `FrameworkConfigurator` that pre-registers the real one.
+ *
+ * @param configurator - The modules configurator to register on.
+ * @param configure - Optional callback to override the default mock client.
+ *
+ * @example
+ * ```typescript
+ * enableMsalMock(configurator, (builder) => {
+ *   builder.setAccount({ name: 'Ada Lovelace' });
+ * });
+ * ```
+ */
+export const enableMsalMock = (
+// biome-ignore lint/suspicious/noExplicitAny: must be any to support all module types
+configurator, configure) => {
+    configurator.addConfig({ module: msalMockModule, configure });
+};
+//# sourceMappingURL=module.js.map

package/dist/esm/mock/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/mock/module.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAmB,MAAM,WAAW,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,GAAG,MAAM;IACT,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,oBAAoB,EAAE;CAC5C,CAAC;AAUF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;AAC5B,sFAAsF;AACtF,YAA4C,EAC5C,SAA4B,EACtB,EAAE;IACR,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAEzD,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/esm/msal-config-schema.js

@@ -0,0 +1,37 @@
+import z from 'zod';
+import semver from 'semver';
+import { CacheLookupPolicy } from '@azure/msal-browser';
+import { TelemetryConfigSchema } from './telemetry-config-schema';
+/**
+ * Zod schema for MSAL module configuration validation.
+ *
+ * @remarks
+ * Kept in its own module so the configuration can be extended at its source.
+ * The schema itself describes what reaches `MsalProvider` and strips anything
+ * else; keys a variant of this module needs only while the configuration is
+ * being built are declared on {@link MsalConfigExtension} instead.
+ */
+export const MsalConfigSchema = z.object({
+    client: z.custom().optional(),
+    provider: z.custom().optional(),
+    requiresAuth: z.boolean().optional(),
+    redirectUri: z.string().optional(),
+    loginHint: z.string().optional(),
+    authCode: z.string().optional(),
+    cacheLookupPolicy: z
+        .custom((val) => typeof val === 'number' &&
+        Object.values(CacheLookupPolicy).includes(val))
+        .optional(),
+    version: z.string().transform((value, ctx) => {
+        const coerced = semver.coerce(value);
+        // `semver.coerce` returns `null` for an unparseable version; without this guard it
+        // would silently become the literal string "null" instead of failing validation.
+        if (!coerced) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Invalid MSAL module version' });
+            return z.NEVER;
+        }
+        return coerced.version;
+    }),
+    telemetry: TelemetryConfigSchema,
+});
+//# sourceMappingURL=msal-config-schema.js.map

package/dist/esm/msal-config-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal-config-schema.js","sourceRoot":"","sources":["../../src/msal-config-schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAIxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGlE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAe,CAAC,QAAQ,EAAE;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAiB,CAAC,QAAQ,EAAE;IAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,iBAAiB,EAAE,CAAC;SACjB,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CACN,OAAO,GAAG,KAAK,QAAQ;QACvB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,GAAwB,CAAC,CACtE;SACA,QAAQ,EAAE;IACb,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,mFAAmF;QACnF,iFAAiF;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACtF,OAAO,CAAC,CAAC,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC;IACzB,CAAC,CAAC;IACF,SAAS,EAAE,qBAAqB;CACjC,CAAC,CAAC"}

package/dist/esm/telemetry-config-schema.js

@@ -0,0 +1,16 @@
+import z from 'zod';
+import { version } from './version';
+/**
+ * Zod schema for telemetry configuration validation.
+ *
+ * @internal
+ */
+export const TelemetryConfigSchema = z.object({
+    provider: z.custom().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional().default({
+        module: 'msal',
+        version,
+    }),
+    scope: z.array(z.string()).optional().default(['framework', 'authentication']),
+});
+//# sourceMappingURL=telemetry-config-schema.js.map

package/dist/esm/telemetry-config-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-config-schema.js","sourceRoot":"","sources":["../../src/telemetry-config-schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAsB,CAAC,QAAQ,EAAE;IACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO;KACR,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;CAC/E,CAAC,CAAC"}

package/dist/esm/version.js

@@ -1,3 +1,3 @@
 // Generated by genversion.
-export const version = '10.0.2';
+export const version = '11.0.0-next.1';
 //# sourceMappingURL=version.js.map

package/dist/esm/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,MAAM,CAAC,MAAM,OAAO,GAAG,eAAe,CAAC"}

package/dist/esm/versioning/resolve-version.js

@@ -24,7 +24,6 @@ import { version as latestVersionString } from '../version';
  * ```
  */
 function mapVersionToEnumVersion(version) {
-    console.log('Resolving version:', version);
     const coercedVersion = semver.coerce(version);
     // An uncoercible version string cannot be mapped to a module version
     if (!coercedVersion) {

package/dist/esm/versioning/resolve-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-version.js","sourceRoot":"","sources":["../../../src/versioning/resolve-version.ts"],"names":[],"mappings":"AAAA,OAAO,MAAuB,MAAM,QAAQ,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,uBAAuB,CAAC,OAAwB;IACvD,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,qEAAqE;IACrE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,gFAAgF;IAChF,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO,iBAAiB,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,kFAAkF;IAClF,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO,iBAAiB,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,iBAAiB,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,cAAc,CAAC,OAAyB;IACtD,8DAA8D;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,oEAAoE;IACpE,IAAI,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE1F,yDAAyD;IACzD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAEzD,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CACpB,mCAAmC,mBAAmB,mHAAmH,EACzK,aAAa,IAAI,mBAAmB,EACpC,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,qBAAqB,GAAG,IAAI,YAAY,CAC5C,sCAAsC,OAAO,IAAI,mBAAmB,GAAG,EACvE,OAAO,IAAI,mBAAmB,EAC9B,aAAa,CACd,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC7C,aAAa,GAAG,aAAa,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,IAAI,aAAa,CAAC,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,yBAAyB,GAAG,IAAI,YAAY,CAChD,2BAA2B,aAAa,CAAC,KAAK,uCAAuC,aAAa,CAAC,KAAK,EAAE,EAC1G,aAAa,EACb,aAAa,CACd,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,uDAAuD;IACvD,yFAAyF;IACzF,IAAI,aAAa,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK,EAAE,CAAC;QAC/F,MAAM,oBAAoB,GAAG,IAAI,YAAY,CAC3C,2BAA2B,aAAa,CAAC,KAAK,+CAA+C,aAAa,CAAC,KAAK,EAAE,EAClH,aAAa,EACb,aAAa,CACd,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,WAAW,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAE3D,iDAAiD;IACjD,OAAO;QACL,aAAa;QACb,aAAa;QACb,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;QACpD,eAAe,EAAE,aAAa,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK;QAC5D,WAAW;QACX,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAC3B,CAAC;AAC9B,CAAC;AAED,eAAe,cAAc,CAAC"}
+{"version":3,"file":"resolve-version.js","sourceRoot":"","sources":["../../../src/versioning/resolve-version.ts"],"names":[],"mappings":"AAAA,OAAO,MAAuB,MAAM,QAAQ,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,uBAAuB,CAAC,OAAwB;IACvD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,qEAAqE;IACrE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,gFAAgF;IAChF,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO,iBAAiB,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,kFAAkF;IAClF,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO,iBAAiB,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,iBAAiB,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,cAAc,CAAC,OAAyB;IACtD,8DAA8D;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,oEAAoE;IACpE,IAAI,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE1F,yDAAyD;IACzD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAEzD,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CACpB,mCAAmC,mBAAmB,mHAAmH,EACzK,aAAa,IAAI,mBAAmB,EACpC,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,qBAAqB,GAAG,IAAI,YAAY,CAC5C,sCAAsC,OAAO,IAAI,mBAAmB,GAAG,EACvE,OAAO,IAAI,mBAAmB,EAC9B,aAAa,CACd,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC7C,aAAa,GAAG,aAAa,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,IAAI,aAAa,CAAC,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,yBAAyB,GAAG,IAAI,YAAY,CAChD,2BAA2B,aAAa,CAAC,KAAK,uCAAuC,aAAa,CAAC,KAAK,EAAE,EAC1G,aAAa,EACb,aAAa,CACd,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,uDAAuD;IACvD,yFAAyF;IACzF,IAAI,aAAa,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK,EAAE,CAAC;QAC/F,MAAM,oBAAoB,GAAG,IAAI,YAAY,CAC3C,2BAA2B,aAAa,CAAC,KAAK,+CAA+C,aAAa,CAAC,KAAK,EAAE,EAClH,aAAa,EACb,aAAa,CACd,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,WAAW,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAE3D,iDAAiD;IACjD,OAAO;QACL,aAAa;QACb,aAAa;QACb,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;QACpD,eAAe,EAAE,aAAa,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK;QAC5D,WAAW;QACX,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAC3B,CAAC;AAC9B,CAAC;AAED,eAAe,cAAc,CAAC"}