@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.1

package/dist/packages/server/src/index.js

@@ -0,0 +1,129 @@
+import { pathToFileURL } from "node:url";
+import { createApp } from "./app.js";
+import { parseBranding, setBranding, } from "../../connector-kit/src/branding.js";
+import { builtinConnectors } from "./builtin.js";
+import httpConnector from "../../../connectors/http/index.js";
+import { loadConnectors, loadProviders } from "../../connector-kit/src/connector.js";
+import { migrate as runMigrations } from "./migrate.js";
+import { CredentialKey } from "./secrets.js";
+import { assertToolsImplemented, createService } from "./service.js";
+import { assertSchemaName, connectDatabase, createStore } from "./store.js";
+import { createTeamsAdmin, resealTeamsCredentials } from "./teams/admin.js";
+import { botClient } from "./teams/bot.js";
+import { claudeClient } from "./teams/claude.js";
+import { botFrameworkAuth } from "./teams/jwt.js";
+import { LIVE_CHECKS } from "./teams/provision.js";
+import { claudeManagedAgents, signedWebhook } from "./teams/runner.js";
+import { createTeamsRuntime } from "./teams/runtime.js";
+import { createTeamsStore } from "./teams/store.js";
+import { microsoftClient } from "../../../connectors/microsoft/client.js";
+export { builtinConnectors } from "./builtin.js";
+export { claudeManagedAgents, signature, signedWebhook } from "./teams/runner.js";
+/** The whole service, checked and wired: fetch serves /agent-connect/*, start runs the Teams
+ *  queue worker and watcher. Throws on anything misconfigured. */
+export async function createAgentConnect(options) {
+    const log = options.log ?? console;
+    setBranding(parseBranding(options.branding));
+    const schema = options.schema ?? "agent_connect";
+    assertSchemaName(schema);
+    const microsoft = microsoftClient({ sharedApp: options.microsoftSharedApp ?? null });
+    const modules = new Map((options.connectors ?? builtinConnectors).map((m) => [m.id, m]));
+    const connectors = [
+        ...loadConnectors(),
+        ...(options.extraConnectorDirs ?? []).flatMap((dir) => {
+            const found = loadConnectors(pathToFileURL(`${dir.replace(/\/+$/, "")}/`));
+            if (!found.length)
+                throw new Error(`No connector.json in a subfolder of ${dir}`);
+            return found;
+        }),
+    ];
+    const apps = connectors.map((connector) => {
+        if (connectors.filter((c) => c.id === connector.id).length > 1)
+            throw new Error(`Two connectors have the id ${connector.id}`);
+        // An app described entirely in its connector.json runs on the generic http module.
+        const module = modules.get(connector.id) ?? (connector.http ? httpConnector : undefined);
+        if (!module)
+            throw new Error(`Connector ${connector.id} has no code (ConnectorModule)`);
+        return { connector, ...module.create({ microsoft, connector }) };
+    });
+    assertToolsImplemented(apps);
+    // Every `live` step check a connector names is one the Teams admin runs.
+    for (const { connector } of apps)
+        for (const step of [...connector.setup, ...connector.afterConnect])
+            if (step.live && !LIVE_CHECKS.includes(step.live))
+                throw new Error(`Connector ${connector.id}: no live check ${step.live}`);
+    const providerClients = { microsoft: microsoft.provider };
+    const providers = loadProviders().map((provider) => {
+        const client = providerClients[provider.id];
+        if (!client)
+            throw new Error(`connectors/${provider.id}/provider.json has no client`);
+        return { provider, client };
+    });
+    const teamsConnector = apps.find((a) => a.connector.id === "teams")?.connector;
+    if (!teamsConnector)
+        throw new Error("The teams connector is missing");
+    const ownsSql = !("unsafe" in options.database);
+    const sql = "unsafe" in options.database ? options.database : connectDatabase(options.database.url);
+    if (options.migrate ?? true)
+        await runMigrations(sql, schema);
+    const store = createStore(sql, schema);
+    const key = new CredentialKey(options.encryptionKey, options.previousEncryptionKey);
+    const teamsStore = createTeamsStore(sql, schema);
+    const bots = botClient();
+    const base = options.publicBaseUrl?.trim().replace(/\/+$/, "");
+    const publicUrl = base ? `${base}/agent-connect` : null;
+    const runners = new Map((options.runners ?? [claudeManagedAgents(), signedWebhook()])
+        .map((make) => make({ teams: teamsStore, key, publicUrl }))
+        .map((r) => [r.id, r]));
+    const runtime = createTeamsRuntime({
+        store,
+        teams: teamsStore,
+        key,
+        auth: botFrameworkAuth(),
+        bots,
+        runners,
+        connector: teamsConnector,
+        publicUrl,
+    });
+    const service = createService({
+        apps,
+        providers,
+        store,
+        key,
+        bots: { botForAgent: teamsStore.botForAgent, access: runtime.access },
+    });
+    const app = createApp({
+        service,
+        store,
+        adminToken: options.adminToken,
+        teams: {
+            runtime,
+            admin: createTeamsAdmin({
+                store,
+                teams: teamsStore,
+                key,
+                bots,
+                claude: claudeClient,
+                runners,
+                publicUrl,
+                microsoft,
+            }),
+        },
+    });
+    return {
+        fetch: (req) => app.fetch(req),
+        connectors: apps.map((a) => a.connector.id),
+        start() {
+            runtime.start();
+            // While rotating the key, move what Teams sealed onto the new one.
+            if (options.previousEncryptionKey)
+                resealTeamsCredentials(teamsStore, key).then((n) => log.log(`[agent-connect] re-sealed ${n.bots} bot credentials, ${n.claudeKeys} Claude keys and ${n.triggerSecrets} trigger secrets`), (error) => log.error("[agent-connect] re-sealing Teams credentials failed", error));
+        },
+        async stop() {
+            await runtime.stop();
+            if (ownsSql)
+                await sql.end();
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/packages/server/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/server/src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EACL,aAAa,EACb,WAAW,GAEZ,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACvE,OAAO,aAAa,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAA8B,MAAM,cAAc,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAY,MAAM,YAAY,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAsB,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAI1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA6BlF;kEACkE;AAClE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA4B;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC;IACnC,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC;IACjD,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG;QACjB,GAAG,cAAc,EAAE;QACnB,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3E,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;KACH,CAAC;IACF,MAAM,IAAI,GAAU,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/C,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,mFAAmF;QACnF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,SAAS,CAAC,EAAE,gCAAgC,CAAC,CAAC;QACxF,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC7B,yEAAyE;IACzE,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI;QAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC;YAChE,IAAI,IAAI,CAAC,IAAI,IAAI,CAAE,WAAiC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBACtE,MAAM,IAAI,KAAK,CAAC,aAAa,SAAS,CAAC,EAAE,mBAAmB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,eAAe,GAA0C,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;IACjG,MAAM,SAAS,GAAkB,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,CAAC,EAAE,8BAA8B,CAAC,CAAC;QACtF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,SAAS,CAAC;IAC/E,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,GAAG,GACP,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1F,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI;QAAE,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,mBAAmB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CACzB,CAAC;IACF,MAAM,OAAO,GAAG,kBAAkB,CAAC;QACjC,KAAK;QACL,KAAK,EAAE,UAAU;QACjB,GAAG;QACH,IAAI,EAAE,gBAAgB,EAAE;QACxB,IAAI;QACJ,OAAO;QACP,SAAS,EAAE,cAAc;QACzB,SAAS;KACV,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,aAAa,CAAC;QAC5B,IAAI;QACJ,SAAS;QACT,KAAK;QACL,GAAG;QACH,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;KACtE,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,OAAO;QACP,KAAK;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE;YACL,OAAO;YACP,KAAK,EAAE,gBAAgB,CAAC;gBACtB,KAAK;gBACL,KAAK,EAAE,UAAU;gBACjB,GAAG;gBACH,IAAI;gBACJ,MAAM,EAAE,YAAY;gBACpB,OAAO;gBACP,SAAS;gBACT,SAAS;aACV,CAAC;SACH;KACF,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;QACvC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,mEAAmE;YACnE,IAAI,OAAO,CAAC,qBAAqB;gBAC/B,sBAAsB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,GAAG,CACL,6BAA6B,CAAC,CAAC,IAAI,qBAAqB,CAAC,CAAC,UAAU,oBAAoB,CAAC,CAAC,cAAc,kBAAkB,CAC3H,EACH,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC,CACnF,CAAC;QACN,CAAC;QACD,KAAK,CAAC,IAAI;YACR,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,IAAI,OAAO;gBAAE,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/packages/server/src/migrate.js

@@ -0,0 +1,134 @@
+import { createHash } from "node:crypto";
+import { readdirSync, readFileSync } from "node:fs";
+import { assertSchemaName } from "./store.js";
+// The service's own schema migrations: plain numbered SQL in migrations/, written with
+// unqualified names and run with search_path set to the configured schema, recorded in that
+// schema's schema_migrations.
+const DIR = new URL("../migrations/", import.meta.url);
+// What the earlier layout had in public, made by the host's migration before the service had a schema.
+// 0001 makes the same tables, so an install that has them adopts them as 0001.
+const PREFIX = "agent_connect_";
+const LEGACY = [
+    "agents",
+    "providers",
+    "connections",
+    "grants",
+    "audit",
+    "confirmed",
+    "teams_bots",
+    "teams_conversations",
+    "teams_events",
+    "teams_triggers",
+    "teams_runs",
+    "teams_spend",
+].map((name) => `${PREFIX}${name}`);
+export function migrationFiles() {
+    return readdirSync(DIR)
+        .filter((file) => /^\d{4}_[a-z0-9_]+\.sql$/.test(file))
+        .sort()
+        .map((file) => {
+        const sql = readFileSync(new URL(file, DIR), "utf8");
+        return {
+            id: file.slice(0, -4),
+            version: Number(file.slice(0, 4)),
+            name: file.slice(5, -4),
+            sql,
+            checksum: createHash("sha256").update(sql).digest("hex"),
+        };
+    });
+}
+/** Applies pending migrations in one transaction; returns what it did, in order. */
+export async function migrate(sql, schema, log = console.log) {
+    assertSchemaName(schema);
+    const files = migrationFiles();
+    return sql.begin(async (tx) => {
+        // One run at a time, e.g. two pods starting together; released with the transaction.
+        await tx `select pg_advisory_xact_lock(hashtext(${`${schema}.migrate`}))`;
+        // "Already exists, skipping" on every start is noise.
+        await tx `set local client_min_messages = warning`;
+        await tx.unsafe(`create schema if not exists ${schema}`);
+        await tx.unsafe(`revoke all on schema ${schema} from public`);
+        await tx.unsafe(`create table if not exists ${schema}.schema_migrations (
+      version int primary key,
+      name text not null,
+      checksum text not null,
+      adopted boolean not null default false,
+      applied_at timestamptz not null default now())`);
+        const applied = await tx.unsafe(`select version, checksum from ${schema}.schema_migrations order by version`);
+        for (const row of applied) {
+            const file = files.find((f) => f.version === row.version);
+            if (!file)
+                throw new Error(`Migration ${row.version} is applied in ${schema} but not known to this version`);
+            if (file.checksum !== row.checksum)
+                throw new Error(`Migration ${file.id} changed after it was applied`);
+        }
+        const ran = [];
+        const legacy = await legacyTables(tx);
+        const adopting = legacy.length > 0 && !applied.length;
+        if (adopting) {
+            // Moved, not copied: the rows, ids and sequences stay as they are.
+            for (const table of LEGACY)
+                await tx.unsafe(`alter table public.${table} set schema ${schema}`);
+            const first = files[0];
+            await tx.unsafe(`insert into ${schema}.schema_migrations (version, name, checksum, adopted)
+         values ($1, $2, $3, true)`, [first.version, first.name, first.checksum]);
+            applied.push({ version: first.version, checksum: first.checksum });
+            ran.push(`adopted public.agent_connect_* as ${first.id}`);
+        }
+        else if (legacy.length) {
+            // The host's migration made them after this schema existed: a fresh install where the
+            // service started before the host's migrations ran. Empty, they are dropped; rows are not.
+            const filled = [];
+            for (const table of legacy) {
+                // FORCE RLS with no policies hides every row from an owner without bypassrls, and
+                // this check is all that stands before the drop. Rolled back with the transaction.
+                await tx.unsafe(`alter table public.${table} no force row level security`);
+                const [{ any }] = await tx.unsafe(`select exists (select from public.${table}) as any`);
+                if (any)
+                    filled.push(table);
+            }
+            if (filled.length)
+                throw new Error(`public.${filled.join(", public.")} hold rows, but ${schema} already has the service's tables`);
+            await tx.unsafe(`drop table ${legacy.map((t) => `public.${t}`).join(", ")}`);
+            ran.push(`dropped empty public.${legacy.join(", public.")}`);
+        }
+        await tx.unsafe(`set local search_path to ${schema}`);
+        const done = new Set(applied.map((row) => row.version));
+        for (const file of files.filter((f) => !done.has(f.version))) {
+            await tx.unsafe(file.sql).simple();
+            await tx.unsafe(`insert into ${schema}.schema_migrations (version, name, checksum) values ($1, $2, $3)`, [file.version, file.name, file.checksum]);
+            ran.push(`applied ${file.id}`);
+        }
+        if (adopting) {
+            // So that a rolled-back 0.7.x image, which reads public.agent_connect_*, keeps serving
+            // until to-legacy.sql runs. Simple views, so its inserts, upserts and row locks go
+            // through. TODO(next release): drop them in a migration before any column changes.
+            for (const table of LEGACY)
+                await tx.unsafe(`create view public.${table} as select * from ${schema}.${table.slice(PREFIX.length)}`);
+            // Default privileges on public can grant them to API roles; they bypass RLS, so only
+            // their owner keeps them.
+            const grants = await tx.unsafe(`select distinct c.relname as view, a.grantee::regrole::text as role
+           from pg_class c join pg_namespace n on n.oid = c.relnamespace,
+                aclexplode(c.relacl) a
+          where n.nspname = 'public' and c.relname = any($1::text[])
+            and a.grantee not in (0, c.relowner)`, [LEGACY]);
+            for (const { view, role } of grants)
+                await tx.unsafe(`revoke all on public.${view} from ${role}`);
+            for (const table of LEGACY)
+                await tx.unsafe(`revoke all on public.${table} from public`);
+            ran.push(`made views public.${PREFIX}* for the previous release`);
+        }
+        for (const line of ran)
+            log(`[agent-connect] migrations: ${line} (schema ${schema})`);
+        return ran;
+    });
+}
+async function legacyTables(tx) {
+    // Tables only: the views made on adoption have the same names. In LEGACY's order, not the
+    // catalog's, which moves as other tables are made.
+    const rows = await tx.unsafe(`select c.relname as name from pg_class c join pg_namespace n on n.oid = c.relnamespace
+      where n.nspname = 'public' and c.relkind in ('r', 'p') and c.relname = any($1::text[])
+      order by array_position($1::text[], c.relname::text)`, [LEGACY]);
+    return rows.map((row) => row.name);
+}
+//# sourceMappingURL=migrate.js.map

package/dist/packages/server/src/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../../../packages/server/src/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAY,MAAM,YAAY,CAAC;AAExD,uFAAuF;AACvF,4FAA4F;AAC5F,8BAA8B;AAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEvD,uGAAuG;AACvG,+EAA+E;AAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,MAAM,GAAG;IACb,QAAQ;IACR,WAAW;IACX,aAAa;IACb,QAAQ;IACR,OAAO;IACP,WAAW;IACX,YAAY;IACZ,qBAAqB;IACrB,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,aAAa;CACd,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;AAWpC,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACtD,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,GAAG;YACH,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACzD,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAQ,EACR,MAAc,EACd,MAA8B,OAAO,CAAC,GAAG;IAEzC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,qFAAqF;QACrF,MAAM,EAAE,CAAA,yCAAyC,GAAG,MAAM,UAAU,IAAI,CAAC;QACzE,sDAAsD;QACtD,MAAM,EAAE,CAAA,yCAAyC,CAAC;QAClD,MAAM,EAAE,CAAC,MAAM,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC,MAAM,CAAC,wBAAwB,MAAM,cAAc,CAAC,CAAC;QAC9D,MAAM,EAAE,CAAC,MAAM,CAAC,8BAA8B,MAAM;;;;;qDAKH,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAC7B,iCAAiC,MAAM,qCAAqC,CAC7E,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI;gBACP,MAAM,IAAI,KAAK,CACb,aAAa,GAAG,CAAC,OAAO,kBAAkB,MAAM,gCAAgC,CACjF,CAAC;YACJ,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;gBAChC,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,EAAE,+BAA+B,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,mEAAmE;YACnE,KAAK,MAAM,KAAK,IAAI,MAAM;gBACxB,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,KAAK,eAAe,MAAM,EAAE,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,EAAE,CAAC,MAAM,CACb,eAAe,MAAM;mCACM,EAC3B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAC5C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,qCAAqC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACzB,sFAAsF;YACtF,2FAA2F;YAC3F,MAAM,MAAM,GAAG,EAAE,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,kFAAkF;gBAClF,mFAAmF;gBACnF,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,KAAK,8BAA8B,CAAC,CAAC;gBAC3E,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,qCAAqC,KAAK,UAAU,CAAC,CAAC;gBACxF,IAAI,GAAG;oBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,MAAM,CAAC,MAAM;gBACf,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,MAAM,mCAAmC,CAC/F,CAAC;YACJ,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,EAAE,CAAC,MAAM,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,EAAE,CAAC,MAAM,CACb,eAAe,MAAM,kEAAkE,EACvF,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CACzC,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,uFAAuF;YACvF,mFAAmF;YACnF,mFAAmF;YACnF,KAAK,MAAM,KAAK,IAAI,MAAM;gBACxB,MAAM,EAAE,CAAC,MAAM,CACb,sBAAsB,KAAK,qBAAqB,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CACvF,CAAC;YACJ,qFAAqF;YACrF,0BAA0B;YAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAC5B;;;;iDAIyC,EACzC,CAAC,MAAM,CAAC,CACT,CAAC;YACF,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM;gBACjC,MAAM,EAAE,CAAC,MAAM,CAAC,wBAAwB,IAAI,SAAS,IAAI,EAAE,CAAC,CAAC;YAC/D,KAAK,MAAM,KAAK,IAAI,MAAM;gBAAE,MAAM,EAAE,CAAC,MAAM,CAAC,wBAAwB,KAAK,cAAc,CAAC,CAAC;YACzF,GAAG,CAAC,IAAI,CAAC,qBAAqB,MAAM,4BAA4B,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG;YAAE,GAAG,CAAC,+BAA+B,IAAI,YAAY,MAAM,GAAG,CAAC,CAAC;QACtF,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAA2B;IACrD,0FAA0F;IAC1F,mDAAmD;IACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAC1B;;2DAEuD,EACvD,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/dist/packages/server/src/openapi.js

@@ -0,0 +1,101 @@
+import { isDeepStrictEqual } from "node:util";
+import { z } from "zod";
+import { PARAMS, routes, schemas } from "./api.js";
+export const ADMIN_V1 = "/agent-connect/admin/v1";
+function convert(schema, io, components) {
+    const { $schema: _, $defs, ...json } = z.toJSONSchema(schema, {
+        io,
+        target: "draft-2020-12",
+    });
+    const ref = (value) => Array.isArray(value)
+        ? value.map(ref)
+        : value && typeof value === "object"
+            ? Object.fromEntries(Object.entries(value).map(([k, v]) => [
+                k,
+                k === "$ref" && typeof v === "string"
+                    ? v.replace("#/$defs/", "#/components/schemas/")
+                    : ref(v),
+            ]))
+            : value;
+    for (const [id, def] of Object.entries($defs ?? {})) {
+        const next = ref(def);
+        // One id, one shape: a body and an answer naming the same schema must agree.
+        if (id in components && !isDeepStrictEqual(components[id], next))
+            throw new Error(`Schema ${id} differs between its uses`);
+        components[id] = next;
+    }
+    return ref(json);
+}
+function answer(status, a, components) {
+    const description = status < 300 ? "OK" : "Refused";
+    if (a === null)
+        return { description };
+    if ("file" in a)
+        return { description, content: { [a.file]: { schema: { type: "string", format: "binary" } } } };
+    return {
+        description,
+        content: { "application/json": { schema: convert(a, "output", components) } },
+    };
+}
+export function openapi() {
+    const components = {};
+    const error = () => answer(400, schemas.Error, components);
+    const paths = {};
+    for (const [operationId, spec] of Object.entries(routes)) {
+        const parameters = [
+            ...[...spec.path.matchAll(/\{(\w+)\}/g)].map(([, p]) => ({
+                name: p,
+                in: "path",
+                required: true,
+                schema: { type: "string", pattern: `^${PARAMS[p]}$` },
+            })),
+            ...Object.entries(spec.query ?? {}).map(([q, description]) => ({
+                name: q,
+                in: "query",
+                required: false,
+                description,
+                schema: { type: "string" },
+            })),
+        ];
+        const responses = {};
+        for (const [status, a] of Object.entries(spec.responses))
+            responses[status] = answer(Number(status), a, components);
+        // Every route: bad input, a wrong token, an unknown organization or route, a refusal by
+        // the app being connected.
+        for (const status of ["400", "401", "404", "422"])
+            responses[status] ??= error();
+        (paths[spec.path] ??= {})[spec.method.toLowerCase()] = {
+            operationId,
+            summary: spec.summary,
+            ...(spec.teams ? { tags: ["teams"] } : {}),
+            ...(parameters.length ? { parameters } : {}),
+            ...(spec.body
+                ? {
+                    requestBody: {
+                        required: !spec.body.safeParse(undefined).success,
+                        content: { "application/json": { schema: convert(spec.body, "input", components) } },
+                    },
+                }
+                : {}),
+            responses,
+        };
+    }
+    return {
+        openapi: "3.1.0",
+        info: {
+            title: "Agent Connect admin API",
+            version: "1",
+            description: "Server to server only: a bearer token (AGENT_CONNECT_ADMIN_TOKEN), and requests " +
+                "carrying X-Forwarded-For are refused. Routes tagged teams are served only where " +
+                "Teams is set up.",
+        },
+        servers: [{ url: ADMIN_V1 }],
+        security: [{ bearer: [] }],
+        paths,
+        components: {
+            schemas: Object.fromEntries(Object.entries(components).sort(([a], [b]) => a.localeCompare(b))),
+            securitySchemes: { bearer: { type: "http", scheme: "bearer" } },
+        },
+    };
+}
+//# sourceMappingURL=openapi.js.map

package/dist/packages/server/src/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../../../packages/server/src/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAA+B,MAAM,UAAU,CAAC;AAOhF,MAAM,CAAC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAElD,SAAS,OAAO,CAAC,MAAiB,EAAE,EAAsB,EAAE,UAAgB;IAC1E,MAAM,EACJ,OAAO,EAAE,CAAC,EACV,KAAK,EACL,GAAG,IAAI,EACR,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE;QACzB,EAAE;QACF,MAAM,EAAE,eAAe;KACxB,CAA4C,CAAC;IAC9C,MAAM,GAAG,GAAG,CAAC,KAAc,EAAW,EAAE,CACtC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAClB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAChB,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAClC,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;gBACpC,CAAC;gBACD,CAAC,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,QAAQ;oBACnC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,uBAAuB,CAAC;oBAChD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aACX,CAAC,CACH;YACH,CAAC,CAAC,KAAK,CAAC;IACd,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,6EAA6E;QAC7E,IAAI,EAAE,IAAI,UAAU,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;QAC3D,UAAU,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAS,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,CAAS,EAAE,UAAgB;IACzD,MAAM,WAAW,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACvC,IAAI,MAAM,IAAI,CAAC;QACb,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC;IAClG,OAAO;QACL,WAAW;QACX,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE;KAC9E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,MAAM,UAAU,GAAS,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAA0B,EAAE,CAAC;QAClF,MAAM,UAAU,GAAG;YACjB,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvD,IAAI,EAAE,CAAC;gBACP,EAAE,EAAE,MAAM;gBACV,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,CAAwB,CAAC,GAAG,EAAE;aAC7E,CAAC,CAAC;YACH,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7D,IAAI,EAAE,CAAC;gBACP,EAAE,EAAE,OAAO;gBACX,QAAQ,EAAE,KAAK;gBACf,WAAW;gBACX,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC3B,CAAC,CAAC;SACJ,CAAC;QACF,MAAM,SAAS,GAAS,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;YACtD,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QAC5D,wFAAwF;QACxF,2BAA2B;QAC3B,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;YAAE,SAAS,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QACjF,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG;YACrD,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,IAAI;gBACX,CAAC,CAAC;oBACE,WAAW,EAAE;wBACX,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO;wBACjD,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE;qBACrF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS;SACV,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,yBAAyB;YAChC,OAAO,EAAE,GAAG;YACZ,WAAW,EACT,kFAAkF;gBAClF,kFAAkF;gBAClF,kBAAkB;SACrB;QACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QAC5B,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC1B,KAAK;QACL,UAAU,EAAE;YACV,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAClE;YACD,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;SAChE;KACF,CAAC;AACJ,CAAC"}

package/dist/packages/server/src/secrets.js

@@ -0,0 +1,76 @@
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, timingSafeEqual, } from "node:crypto";
+const keyId = (key) => createHash("sha256").update(key).digest("hex").slice(0, 16);
+function parseKey(base64, name) {
+    const key = Buffer.from(base64, "base64");
+    if (key.length !== 32)
+        throw new Error(`${name} must be 32 bytes, base64`);
+    return key;
+}
+// Rotation: set the new key as CONNECT_ENCRYPTION_KEY and the old one as `previous`. Rows
+// sealed with the old key still open, and are re-sealed with the new one when next checked.
+export class CredentialKey {
+    id;
+    #key;
+    #previous;
+    constructor(base64, previousBase64) {
+        this.#key = parseKey(base64, "CONNECT_ENCRYPTION_KEY");
+        this.id = keyId(this.#key);
+        const previous = previousBase64
+            ? parseKey(previousBase64, "CONNECT_ENCRYPTION_KEY_PREVIOUS")
+            : null;
+        this.#previous = new Map(previous ? [[keyId(previous), previous]] : []);
+    }
+    /** Ids of the previous key(s) still loaded while rotating. */
+    get previousIds() {
+        return [...this.#previous.keys()];
+    }
+    // A separate key for another purpose (e.g. signing consent state), never the sealing key.
+    derive(purpose) {
+        return Buffer.from(hkdfSync("sha256", this.#key, "", `agent-connect:${purpose}`, 32));
+    }
+    seal(secret, aad) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", this.#key, iv);
+        cipher.setAAD(Buffer.from(aad));
+        const body = Buffer.concat([cipher.update(JSON.stringify(secret), "utf8"), cipher.final()]);
+        return { ciphertext: Buffer.concat([iv, cipher.getAuthTag(), body]), keyId: this.id };
+    }
+    open(sealed, aad) {
+        const key = sealed.keyId === this.id ? this.#key : this.#previous.get(sealed.keyId);
+        if (!key)
+            throw new Error(`Credential was sealed with key ${sealed.keyId}, which is not loaded`);
+        const iv = sealed.ciphertext.subarray(0, 12);
+        const tag = sealed.ciphertext.subarray(12, 28);
+        const decipher = createDecipheriv("aes-256-gcm", key, iv);
+        decipher.setAAD(Buffer.from(aad));
+        decipher.setAuthTag(tag);
+        const plain = Buffer.concat([
+            decipher.update(sealed.ciphertext.subarray(28)),
+            decipher.final(),
+        ]);
+        return JSON.parse(plain.toString("utf8"));
+    }
+}
+export const credentialAad = (organizationId, connectorId) => `agent-connect:${organizationId}:${connectorId}`;
+// Both shapes are accepted, forever (the shape check is not the authentication; the hash
+// lookup is). New keys keep arb_agent_ for this release, because a rollback to the previous one,
+// which accepts only that, must still take keys made meanwhile. Switch to eac_agent_ in the
+// next release.
+const AGENT_KEY_PREFIX = "arb_agent_";
+export function newAgentKey() {
+    return AGENT_KEY_PREFIX + randomBytes(32).toString("base64url");
+}
+// Agent keys carry 256 bits of randomness, so an unsalted SHA-256 is enough to make a
+// database read useless for calling the service.
+export function hashAgentKey(key) {
+    return createHash("sha256").update(key).digest("hex");
+}
+export function looksLikeAgentKey(key) {
+    return /^(eac|arb)_agent_[A-Za-z0-9_-]{43}$/.test(key);
+}
+export function tokensEqual(a, b) {
+    const ha = createHash("sha256").update(a).digest();
+    const hb = createHash("sha256").update(b).digest();
+    return timingSafeEqual(ha, hb);
+}
+//# sourceMappingURL=secrets.js.map

package/dist/packages/server/src/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../../packages/server/src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,QAAQ,EACR,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AAQrB,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE3F,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IAC3E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0FAA0F;AAC1F,4FAA4F;AAC5F,MAAM,OAAO,aAAa;IACf,EAAE,CAAS;IACX,IAAI,CAAS;IACb,SAAS,CAAsB;IAExC,YAAY,MAAc,EAAE,cAAuB;QACjD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,cAAc;YAC7B,CAAC,CAAC,QAAQ,CAAC,cAAc,EAAE,iCAAiC,CAAC;YAC7D,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,8DAA8D;IAC9D,IAAI,WAAW;QACb,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,0FAA0F;IAC1F,MAAM,CAAC,OAAe;QACpB,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,MAA8B,EAAE,GAAW;QAC9C,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,MAAc,EAAE,GAAW;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpF,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,KAAK,uBAAuB,CAAC,CAAC;QACzF,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC1B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC/C,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,cAAsB,EAAE,WAAmB,EAAE,EAAE,CAC3E,iBAAiB,cAAc,IAAI,WAAW,EAAE,CAAC;AAEnD,yFAAyF;AACzF,iGAAiG;AACjG,4FAA4F;AAC5F,gBAAgB;AAChB,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC,MAAM,UAAU,WAAW;IACzB,OAAO,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClE,CAAC;AAED,sFAAsF;AACtF,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnD,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnD,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC"}

package/dist/packages/server/src/server.js

@@ -0,0 +1,69 @@
+import { serve } from "@hono/node-server";
+import { createAgentConnect } from "./index.js";
+import { migrate } from "./migrate.js";
+import { assertSchemaName, connectDatabase } from "./store.js";
+// The container's entry: reads the environment, builds the service with createAgentConnect
+// and listens. `node dist/server.js migrate` only applies pending migrations and exits, for
+// installs that run schema changes as their own step (MIGRATE_ON_START=false).
+function required(name) {
+    const value = process.env[name];
+    if (!value)
+        throw new Error(`Missing required env var: ${name}`);
+    return value;
+}
+// The name a setting had before the service had its own; read for one release so an install
+// whose environment still sets only the old name keeps working, saying so in its log.
+function renamed(name, old) {
+    const value = process.env[name]?.trim();
+    if (value)
+        return value;
+    const legacy = process.env[old]?.trim();
+    if (legacy)
+        console.log(`[agent-connect] ${old} is deprecated; set ${name} instead`);
+    return legacy || undefined;
+}
+const schema = process.env.DATABASE_SCHEMA?.trim() || "agent_connect";
+assertSchemaName(schema);
+const migrateOnStart = process.env.MIGRATE_ON_START?.trim() ?? "true";
+if (migrateOnStart !== "true" && migrateOnStart !== "false")
+    throw new Error("MIGRATE_ON_START must be true or false");
+if (process.argv[2] === "migrate") {
+    const sql = connectDatabase(required("DATABASE_URL"));
+    await migrate(sql, schema);
+    await sql.end();
+    process.exit(0);
+}
+const sharedApp = process.env.MICROSOFT_SHARED_APP?.trim() ?? "";
+if (sharedApp !== "" && sharedApp !== "enabled")
+    throw new Error("MICROSOFT_SHARED_APP must be unset or enabled");
+const sharedAppSetting = (name, old) => {
+    const value = renamed(name, old);
+    if (!value)
+        throw new Error(`Missing required env var: ${name}`);
+    return value;
+};
+const service = await createAgentConnect({
+    database: { url: required("DATABASE_URL") },
+    schema,
+    migrate: migrateOnStart === "true",
+    encryptionKey: required("CONNECT_ENCRYPTION_KEY"),
+    previousEncryptionKey: process.env.CONNECT_ENCRYPTION_KEY_PREVIOUS || undefined,
+    adminToken: required("AGENT_CONNECT_ADMIN_TOKEN"),
+    publicBaseUrl: renamed("PUBLIC_BASE_URL", "SELF_HOST_PUBLIC_BASE_URL") ?? null,
+    branding: process.env.BRANDING?.trim() ? JSON.parse(process.env.BRANDING) : undefined,
+    extraConnectorDirs: (process.env.CONNECTOR_DIRS ?? "").split(":").filter(Boolean),
+    microsoftSharedApp: sharedApp === "enabled"
+        ? {
+            clientId: sharedAppSetting("MICROSOFT_SHARED_APP_CLIENT_ID", "ARBIUM_MICROSOFT_CLIENT_ID"),
+            clientSecret: sharedAppSetting("MICROSOFT_SHARED_APP_CLIENT_SECRET", "ARBIUM_MICROSOFT_CLIENT_SECRET"),
+        }
+        : null,
+});
+service.start();
+process.on("SIGTERM", () => {
+    service.stop().finally(() => process.exit(0));
+});
+const port = Number(process.env.PORT || 3000);
+serve({ fetch: service.fetch, port });
+console.log(`[agent-connect] listening on :${port} with ${service.connectors.join(", ")}`);
+//# sourceMappingURL=server.js.map

package/dist/packages/server/src/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../../packages/server/src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/D,2FAA2F;AAC3F,4FAA4F;AAC5F,+EAA+E;AAE/E,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4FAA4F;AAC5F,sFAAsF;AACtF,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,uBAAuB,IAAI,UAAU,CAAC,CAAC;IACrF,OAAO,MAAM,IAAI,SAAS,CAAC;AAC7B,CAAC;AAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC;AACtE,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACzB,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;AACtE,IAAI,cAAc,KAAK,MAAM,IAAI,cAAc,KAAK,OAAO;IACzD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACtD,MAAM,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjE,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,SAAS;IAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AACnE,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAE;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC;IACvC,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;IAC3C,MAAM;IACN,OAAO,EAAE,cAAc,KAAK,MAAM;IAClC,aAAa,EAAE,QAAQ,CAAC,wBAAwB,CAAC;IACjD,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,SAAS;IAC/E,UAAU,EAAE,QAAQ,CAAC,2BAA2B,CAAC;IACjD,aAAa,EAAE,OAAO,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,IAAI,IAAI;IAC9E,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;IACrF,kBAAkB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IACjF,kBAAkB,EAChB,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC;YACE,QAAQ,EAAE,gBAAgB,CACxB,gCAAgC,EAChC,4BAA4B,CAC7B;YACD,YAAY,EAAE,gBAAgB,CAC5B,oCAAoC,EACpC,gCAAgC,CACjC;SACF;QACH,CAAC,CAAC,IAAI;CACX,CAAC,CAAC;AACH,OAAO,CAAC,KAAK,EAAE,CAAC;AAChB,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;AAC9C,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACtC,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,SAAS,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC"}