@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.1

package/dist/connectors/fedex/vendor.js

@@ -0,0 +1,98 @@
+import { createHash } from "node:crypto";
+import { clientCredentials, vendorError } from "../../packages/connector-kit/src/oauth.js";
+import { ConnectError, } from "../../packages/connector-kit/src/types.js";
+// A FedEx Developer Portal project: API key and secret key, OAuth client credentials at
+// /oauth/token (form-encoded, expires_in 3600), then JSON calls with the bearer token. Hosts
+// and request shapes are FedEx's published OpenAPI files (developer.fedex.com/api/en-us/catalog/
+// {authorization,track,rate,ship}/v1/docs.html, retrieved October 21, 2026).
+export const FEDEX_HOSTS = {
+    sandbox: "https://apis-sandbox.fedex.com",
+    production: "https://apis.fedex.com",
+};
+export const ACCOUNT_NUMBER = /^[0-9]{9,12}$/;
+const MAX_ACCOUNTS = 50;
+// FedEx documents x-locale; errors and status text come back in English.
+const HEADERS = { "x-locale": "en_US" };
+// A number no shipment has: the Track API answers it (with a not-found result), which proves
+// the token reaches the Track API without reading anyone's shipment.
+export const PROBE_TRACKING_NUMBER = "000000000000";
+export function parseAccounts(raw) {
+    const accounts = [...new Set(raw.split(/[\s,;]+/).filter(Boolean))];
+    if (!accounts.length)
+        throw new ConnectError("Enter at least one FedEx account number");
+    const bad = accounts.find((a) => !ACCOUNT_NUMBER.test(a));
+    if (bad)
+        throw new ConnectError(`${bad} is not a FedEx account number (9 to 12 digits)`);
+    if (accounts.length > MAX_ACCOUNTS)
+        throw new ConnectError(`Enter at most ${MAX_ACCOUNTS} account numbers`);
+    return accounts;
+}
+export function connectedAccounts(config) {
+    return (config.accounts ?? "").split(",").filter(Boolean);
+}
+function host(config) {
+    const base = Object.hasOwn(FEDEX_HOSTS, config.environment)
+        ? FEDEX_HOSTS[config.environment]
+        : null;
+    if (!base)
+        throw new Error(`Unknown FedEx environment ${config.environment}`);
+    return base;
+}
+export function fedexVendor(fetchImpl = fetch) {
+    const oauth = clientCredentials("FedEx", fetchImpl);
+    const creds = (c) => ({
+        tokenUrl: `${host(c.config)}/oauth/token`,
+        clientId: c.secret.api_key,
+        clientSecret: c.secret.secret_key,
+    });
+    const call = (c, request) => oauth.call(creds(c), host(c.config), request, HEADERS);
+    return {
+        async connect(fields) {
+            const environment = fields.environment ?? "";
+            if (!Object.hasOwn(FEDEX_HOSTS, environment))
+                throw new ConnectError("Choose Sandbox or Production");
+            const apiKey = fields.api_key?.trim();
+            const secretKey = fields.secret_key?.trim();
+            if (!apiKey || !secretKey)
+                throw new ConnectError("Enter the API key and secret key from your FedEx project");
+            const accounts = parseAccounts(fields.account_numbers ?? "");
+            const conn = {
+                config: {
+                    environment,
+                    accounts: accounts.join(","),
+                    // Names the project reached without keeping the key in plain config.
+                    project: createHash("sha256").update(apiKey).digest("hex").slice(0, 12),
+                },
+                secret: { api_key: apiKey, secret_key: secretKey },
+            };
+            await oauth.signIn(creds(conn));
+            return {
+                ...conn,
+                accountLabel: `${environment === "production" ? "Production" : "Sandbox"} · ${accounts.length} account${accounts.length === 1 ? "" : "s"}`,
+            };
+        },
+        call,
+        checks: {
+            // A Track API answer about a number no shipment has.
+            async track(connection) {
+                const res = await call(connection, {
+                    method: "POST",
+                    path: "/track/v1/trackingnumbers",
+                    body: {
+                        includeDetailedScans: false,
+                        trackingInfo: [{ trackingNumberInfo: { trackingNumber: PROBE_TRACKING_NUMBER } }],
+                    },
+                });
+                if (res.status === 401 || res.status === 403)
+                    throw new ConnectError(`FedEx refused the Track API for this project. Add the Track API to the project, then check again. (${vendorError(res.data) || res.status})`);
+                if (res.status < 200 || res.status >= 300)
+                    throw new ConnectError(`FedEx Track API answered ${res.status}: ${vendorError(res.data) || "no reason given"}`);
+                return { values: [new URL(host(connection.config)).host] };
+            },
+            async accounts(connection) {
+                return { values: connectedAccounts(connection.config) };
+            },
+        },
+    };
+}
+//# sourceMappingURL=vendor.js.map

package/dist/connectors/fedex/vendor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../../connectors/fedex/vendor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,YAAY,GAIb,MAAM,2CAA2C,CAAC;AAEnD,wFAAwF;AACxF,6FAA6F;AAC7F,iGAAiG;AACjG,6EAA6E;AAE7E,MAAM,CAAC,MAAM,WAAW,GAA2B;IACjD,OAAO,EAAE,gCAAgC;IACzC,UAAU,EAAE,wBAAwB;CACrC,CAAC;AACF,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAC9C,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,yEAAyE;AACzE,MAAM,OAAO,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACxC,6FAA6F;AAC7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAEpD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,yCAAyC,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,GAAG,iDAAiD,CAAC,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,GAAG,YAAY;QAChC,MAAM,IAAI,YAAY,CAAC,iBAAiB,YAAY,kBAAkB,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,IAAI,CAAC,MAA8B;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC;QACzD,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,YAAmB,KAAK;IAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC;QACtC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc;QACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO;QAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU;KAClC,CAAC,CAAC;IACH,MAAM,IAAI,GAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAC1C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAEzD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC;gBAC1C,MAAM,IAAI,YAAY,CAAC,8BAA8B,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;gBACvB,MAAM,IAAI,YAAY,CAAC,0DAA0D,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAqB;gBAC7B,MAAM,EAAE;oBACN,WAAW;oBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;oBAC5B,qEAAqE;oBACrE,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;iBACxE;gBACD,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE;aACnD,CAAC;YACF,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAChC,OAAO;gBACL,GAAG,IAAI;gBACP,YAAY,EAAE,GAAG,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;aAC3I,CAAC;QACJ,CAAC;QAED,IAAI;QAEJ,MAAM,EAAE;YACN,qDAAqD;YACrD,KAAK,CAAC,KAAK,CAAC,UAAU;gBACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;oBACjC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,2BAA2B;oBACjC,IAAI,EAAE;wBACJ,oBAAoB,EAAE,KAAK;wBAC3B,YAAY,EAAE,CAAC,EAAE,kBAAkB,EAAE,EAAE,cAAc,EAAE,qBAAqB,EAAE,EAAE,CAAC;qBAClF;iBACF,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAC1C,MAAM,IAAI,YAAY,CACpB,sGAAsG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAC7I,CAAC;gBACJ,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;oBACvC,MAAM,IAAI,YAAY,CACpB,4BAA4B,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,iBAAiB,EAAE,CACxF,CAAC;gBACJ,OAAO,EAAE,MAAM,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,CAAC;YACD,KAAK,CAAC,QAAQ,CAAC,UAAU;gBACvB,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/connectors/http/index.js

@@ -0,0 +1,235 @@
+import { z } from "zod";
+import { audited, Denied, json, listLimit, VendorFailed, } from "../../packages/connector-kit/src/common.js";
+import { clientCredentials, vendorError } from "../../packages/connector-kit/src/oauth.js";
+import { ConnectError, } from "../../packages/connector-kit/src/types.js";
+// The generic module behind every connector.json with an `http` block: an app described as
+// data, e.g. a company's internal REST API. Calls reach only baseUrl's origin under its path.
+export const MAX_RESPONSE_BYTES = 1024 * 1024;
+export const MAX_BODY_BYTES = 256 * 1024;
+export const MAX_TARGET_BYTES = 8 * 1024;
+const TIMEOUT_MS = 30_000;
+// fetch that reaches only `allowed` origins, follows no redirect, gives up after TIMEOUT_MS and
+// reads at most MAX_RESPONSE_BYTES of JSON or text. Its refusals are ConnectError.
+export function guardedFetch(allowed, fetchImpl = fetch) {
+    return (async (input, init) => {
+        const url = new URL(input instanceof Request ? input.url : input);
+        if (!allowed.includes(url.origin))
+            throw new ConnectError(`${url.origin} is not this app's address`);
+        const res = await fetchImpl(url, {
+            ...init,
+            redirect: "manual",
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (res.status >= 300 && res.status < 400)
+            throw new ConnectError(`The app answered with a redirect (${res.status}), which is not followed`);
+        const type = res.headers.get("content-type") ?? "";
+        if (res.body &&
+            !/^(application\/([\w.+-]*\+)?json|text\/)/i.test(type) &&
+            res.headers.get("content-length") !== "0") {
+            await res.body.cancel();
+            throw new ConnectError(`The app answered ${type || "without a content type"}; only JSON or text is passed on`);
+        }
+        const chunks = [];
+        let size = 0;
+        const reader = res.body?.getReader();
+        for (let r = await reader?.read(); r && !r.done; r = await reader.read()) {
+            size += r.value.byteLength;
+            if (size > MAX_RESPONSE_BYTES) {
+                await reader.cancel();
+                throw new ConnectError(`The app's answer is larger than ${MAX_RESPONSE_BYTES / 1024} KB`);
+            }
+            chunks.push(r.value);
+        }
+        // These statuses may not carry a body, even an empty one.
+        const body = [204, 205, 304].includes(res.status) ? null : Buffer.concat(chunks);
+        return new Response(body, { status: res.status, headers: res.headers });
+    });
+}
+function parse(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+export function httpVendor(connector, fetchImpl = fetch) {
+    const http = connector.http;
+    const base = new URL(http.baseUrl);
+    const prefix = base.pathname.replace(/\/+$/, "");
+    const auth = http.auth;
+    const safe = guardedFetch([base.origin, ...(auth.type === "oauth2" ? [new URL(auth.tokenUrl).origin] : [])], fetchImpl);
+    const oauth = auth.type === "oauth2" ? clientCredentials(connector.name, safe) : null;
+    const oauthCreds = (c) => auth.type === "oauth2"
+        ? {
+            tokenUrl: auth.tokenUrl,
+            clientId: c.config[auth.clientId],
+            clientSecret: c.secret[auth.clientSecret],
+        }
+        : null;
+    function headersFor(c) {
+        if (auth.type === "header")
+            return { [auth.header]: c.secret[auth.value] };
+        if (auth.type === "bearer")
+            return { authorization: `Bearer ${c.secret[auth.token]}` };
+        if (auth.type === "basic")
+            return {
+                authorization: `Basic ${Buffer.from(`${c.config[auth.username]}:${c.secret[auth.password]}`).toString("base64")}`,
+            };
+        return {};
+    }
+    const call = async (c, request) => {
+        // The path is the tool's, already encoded; it must stay under baseUrl's path.
+        const url = new URL(`${base.origin}${prefix}${request.path}`);
+        if (url.origin !== base.origin || !`${url.pathname}/`.startsWith(`${prefix}/`))
+            throw new ConnectError("The call leaves this app's address");
+        const req = {
+            method: request.method,
+            path: `${url.pathname}${url.search}`,
+            body: request.body,
+        };
+        if (oauth)
+            return oauth.call(oauthCreds(c), base.origin, req);
+        const res = await safe(`${base.origin}${req.path}`, {
+            method: req.method,
+            headers: {
+                accept: "application/json",
+                ...headersFor(c),
+                ...(req.body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            body: req.body === undefined ? undefined : JSON.stringify(req.body),
+        });
+        const raw = await res.text();
+        return { status: res.status, data: raw ? parse(raw) : null };
+    };
+    return {
+        async connect(fields) {
+            const config = { host: base.host };
+            const secret = {};
+            for (const f of connector.fields) {
+                const value = fields[f.id]?.trim() ?? "";
+                if (!value)
+                    throw new ConnectError(`Enter ${f.label}`);
+                (f.secret ? secret : config)[f.id] = value;
+            }
+            const conn = { config, secret };
+            if (oauth)
+                await oauth.signIn(oauthCreds(conn));
+            return { ...conn, accountLabel: config[connector.accountKey] ?? base.host };
+        },
+        call,
+    };
+}
+// Whether every item of the answer (or the answer itself) has `path` among `values`.
+function answerWithin(data, path, values) {
+    const items = Array.isArray(data) ? data : [data];
+    return items.every((item) => {
+        let v = item;
+        for (const key of path.split(".")) {
+            if (v === null || typeof v !== "object" || !Object.hasOwn(v, key))
+                return false;
+            v = v[key];
+        }
+        return (typeof v === "string" || typeof v === "number") && values.includes(String(v));
+    });
+}
+const zodType = {
+    string: z.string(),
+    number: z.number(),
+    integer: z.number().int(),
+    boolean: z.boolean(),
+};
+export function httpTools(http) {
+    return {
+        names: http.tools.map((t) => t.name),
+        register(server, ctx, allowed) {
+            for (const tool of http.tools) {
+                if (!allowed.has(tool.name))
+                    continue;
+                const shape = Object.fromEntries(Object.entries(tool.params).map(([name, p]) => {
+                    const type = zodType[p.type].describe(p.description);
+                    return [name, p.required ? type : type.optional()];
+                }));
+                const destructive = tool.destructive || tool.method === "DELETE";
+                server.registerTool(tool.name, {
+                    description: tool.description,
+                    inputSchema: z.object(shape).strict(),
+                    annotations: {
+                        readOnlyHint: tool.method === "GET",
+                        destructiveHint: destructive,
+                        openWorldHint: true,
+                    },
+                }, (args) => audited(ctx, tool.name, JSON.stringify(args).slice(0, 300), async (mark) => {
+                    for (const [name, p] of Object.entries(tool.params)) {
+                        const allowedValues = p.limit ? listLimit(ctx.limits, p.limit) : null;
+                        if (!allowedValues)
+                            continue;
+                        // Left out, an optional param would mean "all of them".
+                        if (args[name] === undefined)
+                            throw new Denied(`${name} is required: this agent is limited to some values`);
+                        if (!allowedValues.includes(String(args[name])))
+                            throw new Denied(`${name} ${String(args[name])} is outside this agent's limits`);
+                    }
+                    const path = tool.path.replace(/\{([a-z][a-z0-9_]*)\}/g, (_, name) => {
+                        const value = String(args[name]);
+                        // URLs resolve . and .. segments even when percent-encoded.
+                        if (value === "." || value === ".." || value === "")
+                            throw new Denied(`${name} is not a valid value`);
+                        return encodeURIComponent(value);
+                    });
+                    const query = new URLSearchParams();
+                    const body = {};
+                    for (const [name, p] of Object.entries(tool.params)) {
+                        if (args[name] === undefined)
+                            continue;
+                        if (p.in === "query")
+                            query.set(name, String(args[name]));
+                        if (p.in === "body")
+                            body[name] = args[name];
+                    }
+                    const target = query.size ? `${path}?${query}` : path;
+                    if (Buffer.byteLength(target) > MAX_TARGET_BYTES)
+                        throw new Denied(`The address is longer than ${MAX_TARGET_BYTES / 1024} KB`);
+                    const hasBody = Object.values(tool.params).some((p) => p.in === "body");
+                    if (hasBody && Buffer.byteLength(JSON.stringify(body)) > MAX_BODY_BYTES)
+                        throw new Denied(`The request is larger than ${MAX_BODY_BYTES / 1024} KB`);
+                    let res;
+                    try {
+                        res = await ctx.call({
+                            method: tool.method,
+                            path: target,
+                            ...(hasBody ? { body } : {}),
+                        });
+                    }
+                    catch (error) {
+                        if (error instanceof ConnectError)
+                            throw new VendorFailed(502, error.message);
+                        throw error;
+                    }
+                    mark(res.status);
+                    if (res.status < 200 || res.status >= 300) {
+                        const detail = vendorError(res.data);
+                        throw new VendorFailed(res.status, `The app answered ${res.status}${detail ? `: ${detail}` : ""}`);
+                    }
+                    for (const a of tool.answerLimits) {
+                        const values = listLimit(ctx.limits, a.limit);
+                        if (values && !answerWithin(res.data, a.field, values))
+                            throw new Denied(`The answer's ${a.field} is outside this agent's limits`);
+                    }
+                    return typeof res.data === "string"
+                        ? { content: [{ type: "text", text: res.data }] }
+                        : json(res.data);
+                }));
+            }
+        },
+    };
+}
+/** Binds to any connector with an `http` block; createAgentConnect uses it for those. */
+export default {
+    id: "http",
+    create: ({ connector }) => ({
+        vendor: httpVendor(connector),
+        toolset: httpTools(connector.http),
+    }),
+};
+//# sourceMappingURL=index.js.map

package/dist/connectors/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../connectors/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,EACT,YAAY,GAEb,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,YAAY,GAKb,MAAM,2CAA2C,CAAC;AAEnD,2FAA2F;AAC3F,8FAA8F;AAE9F,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC;AACzC,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,gGAAgG;AAChG,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,OAAiB,EAAE,YAAmB,KAAK;IACtE,OAAO,CAAC,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAC/B,MAAM,IAAI,YAAY,CAAC,GAAG,GAAG,CAAC,MAAM,4BAA4B,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC/B,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YACvC,MAAM,IAAI,YAAY,CACpB,qCAAqC,GAAG,CAAC,MAAM,0BAA0B,CAC1E,CAAC;QACJ,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnD,IACE,GAAG,CAAC,IAAI;YACR,CAAC,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;YACvD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,EACzC,CAAC;YACD,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,oBAAoB,IAAI,IAAI,wBAAwB,kCAAkC,CACvF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,KAAK,IAAI,CAAC,GAAG,MAAM,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,MAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1E,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3B,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;gBAC9B,MAAM,MAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,YAAY,CAAC,mCAAmC,kBAAkB,GAAG,IAAI,KAAK,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,0DAA0D;QAC1D,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAU,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAoB,EAAE,YAAmB,KAAK;IACvE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,YAAY,CACvB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EACjF,SAAS,CACV,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,MAAM,UAAU,GAAG,CAAC,CAAmB,EAAE,EAAE,CACzC,IAAI,CAAC,IAAI,KAAK,QAAQ;QACpB,CAAC,CAAC;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;SAC1C;QACH,CAAC,CAAC,IAAK,CAAC;IAEZ,SAAS,UAAU,CAAC,CAAmB;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACvF,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YACvB,OAAO;gBACL,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;aAClH,CAAC;QACJ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAmB,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;QAChD,8EAA8E;QAC9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;YAC5E,MAAM,IAAI,YAAY,CAAC,oCAAoC,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAkB;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE;YAClD,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,UAAU,CAAC,CAAC,CAAC;gBAChB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC1E;YACD,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;SACpE,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,MAAM,MAAM,GAA2B,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3D,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACvD,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;YAC7C,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAChC,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,IAAa,EAAE,IAAY,EAAE,MAAgB;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,IAAI,CAAC,GAAY,IAAI,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChF,CAAC,GAAI,CAA6B,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,GAAG;IACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO;YAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACtC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;oBAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;oBACrD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACrD,CAAC,CAAC,CACH,CAAC;gBACF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;gBACjE,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT;oBACE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE;oBACrC,WAAW,EAAE;wBACX,YAAY,EAAE,IAAI,CAAC,MAAM,KAAK,KAAK;wBACnC,eAAe,EAAE,WAAW;wBAC5B,aAAa,EAAE,IAAI;qBACpB;iBACF,EACD,CAAC,IAA6B,EAAE,EAAE,CAChC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBACzE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;wBACpD,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;wBACtE,IAAI,CAAC,aAAa;4BAAE,SAAS;wBAC7B,wDAAwD;wBACxD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS;4BAC1B,MAAM,IAAI,MAAM,CAAC,GAAG,IAAI,oDAAoD,CAAC,CAAC;wBAChF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;4BAC7C,MAAM,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,iCAAiC,CAAC,CAAC;oBACrF,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;wBAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;wBACjC,4DAA4D;wBAC5D,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;4BACjD,MAAM,IAAI,MAAM,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;wBACnD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;oBACnC,CAAC,CAAC,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;oBACpC,MAAM,IAAI,GAA4B,EAAE,CAAC;oBACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;wBACpD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS;4BAAE,SAAS;wBACvC,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO;4BAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBAC1D,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM;4BAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/C,CAAC;oBACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;oBACtD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,gBAAgB;wBAC9C,MAAM,IAAI,MAAM,CAAC,8BAA8B,gBAAgB,GAAG,IAAI,KAAK,CAAC,CAAC;oBAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;oBACxE,IAAI,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,cAAc;wBACrE,MAAM,IAAI,MAAM,CAAC,8BAA8B,cAAc,GAAG,IAAI,KAAK,CAAC,CAAC;oBAC7E,IAAI,GAAG,CAAC;oBACR,IAAI,CAAC;wBACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC;4BACnB,MAAM,EAAE,IAAI,CAAC,MAAM;4BACnB,IAAI,EAAE,MAAM;4BACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC7B,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,YAAY;4BAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;wBAC9E,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACjB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;wBAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBACrC,MAAM,IAAI,YAAY,CACpB,GAAG,CAAC,MAAM,EACV,oBAAoB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/D,CAAC;oBACJ,CAAC;oBACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;wBAC9C,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC;4BACpD,MAAM,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,iCAAiC,CAAC,CAAC;oBAC/E,CAAC;oBACD,OAAO,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;wBACjC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE;wBACjD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC,CAAC,CACL,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,eAAe;IACb,EAAE,EAAE,MAAM;IACV,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAC7B,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,IAAK,CAAC;KACpC,CAAC;CACuB,CAAC"}

package/dist/connectors/intune/connector.json

@@ -0,0 +1,106 @@
+{
+  "id": "intune",
+  "name": "Microsoft Intune",
+  "description": "Let agents look up the devices Intune manages: who uses them, their system and version, compliance, encryption, last check-in and the apps found on them. Read-only.",
+  "logo": "/brand/registry/intune.svg",
+  "identity": "Your Microsoft app registration, through the Microsoft connection. It can read your managed devices and, if you allow it, their Autopilot status, and change nothing: it cannot wipe, lock, retire or sync a device, or change an Autopilot profile. Each API key can be kept to the devices of people in chosen groups.",
+  "provider": "microsoft",
+  "order": 6,
+  "accountKey": "tenantId",
+  "connectionKind": "guided",
+  "setup": [
+    {
+      "title": "Add these Microsoft Graph permissions to the app",
+      "body": "In the app, open API permissions, select Add a permission, then Microsoft Graph, then Application permissions, and add exactly these. They only read. Do not add DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementManagedDevices.PrivilegedOperations.All or DeviceManagementServiceConfig.ReadWrite.All: they let the app change, wipe or retire devices or change Autopilot. Your organization needs an Intune license.",
+      "copy": [
+        "az ad app permission add --id {clientId} --api 00000003-0000-0000-c000-000000000000 --api-permissions \"$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query \"appRoles[?value=='{scope}'].id\" -o tsv)=Role\""
+      ],
+      "click": [
+        "In the Microsoft Entra admin center, go to Entra ID, then App registrations, and open {brand.microsoft.appName}.",
+        "Select API permissions, then Add a permission, then Microsoft Graph, then Application permissions.",
+        "Tick {scopes} and select Add permissions."
+      ],
+      "shell": "bash"
+    },
+    {
+      "title": "Grant admin consent",
+      "body": "Still under API permissions, select \"Grant admin consent\". This needs a Global Administrator or Privileged Role Administrator. Each permission should then show Granted. With Commands, a permission that was granted already is answered with \"Permission being assigned already exists\", which is fine.",
+      "click": [
+        "Still under API permissions, select Grant admin consent for your organization, then Yes.",
+        "Each permission should show Granted under Status."
+      ],
+      "copy": [
+        "SP=$(az ad sp show --id {clientId} --query id -o tsv)",
+        "GRAPH=$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query id -o tsv)",
+        "az rest --method post --url \"https://graph.microsoft.com/v1.0/servicePrincipals/$SP/appRoleAssignments\" --body \"{\\\"principalId\\\": \\\"$SP\\\", \\\"resourceId\\\": \\\"$GRAPH\\\", \\\"appRoleId\\\": \\\"$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query \"appRoles[?value=='{scope}'].id\" -o tsv)\\\"}\""
+      ],
+      "shell": "bash"
+    }
+  ],
+  "afterConnect": [],
+  "fields": [
+    {
+      "id": "people_groups",
+      "label": "Keeping keys to groups of people",
+      "secret": false,
+      "options": [
+        {
+          "value": "off",
+          "label": "Not used",
+          "description": "Each API key reaches every managed device."
+        },
+        {
+          "value": "groups",
+          "label": "Keep keys to people's groups",
+          "description": "Lets you keep an API key to the devices whose primary user is in groups you choose. The app then also reads your organization's people and group memberships.",
+          "scopes": ["User.ReadBasic.All", "GroupMember.Read.All"]
+        }
+      ]
+    }
+  ],
+  "capabilities": [
+    {
+      "id": "read",
+      "label": "Look up managed devices",
+      "description": "List and search managed devices, read one device's details and the apps found on it, a person's devices, and compliance across devices.",
+      "required": true,
+      "note": "Reaches every managed device unless you keep a key to chosen groups under API keys. Read-only.",
+      "scopes": ["DeviceManagementManagedDevices.Read.All"],
+      "permissions": [],
+      "tools": [
+        "intune_list_devices",
+        "intune_get_device",
+        "intune_device_apps",
+        "intune_person_devices",
+        "intune_compliance_summary"
+      ],
+      "forbidden": "Microsoft refused this. The app needs {scopes} with admin consent (the Microsoft Intune page in {brand.productName} shows how), and your organization needs an Intune license."
+    },
+    {
+      "id": "autopilot",
+      "label": "Read Autopilot status",
+      "description": "Look up a Windows Autopilot device by serial number: its enrollment state, profile, group tag, last contact with Intune and, once managed, its compliance and primary user.",
+      "note": "Reads the Autopilot device list of your whole organization. Read-only. The answer also reads the managed device, which \"Look up managed devices\" (always on) allows.",
+      "scopes": ["DeviceManagementServiceConfig.Read.All"],
+      "permissions": [],
+      "tools": ["intune_autopilot_status"],
+      "forbidden": "Microsoft refused this. The app needs {scopes} with admin consent (the Microsoft Intune page in {brand.productName} shows how), and your organization needs an Intune license."
+    }
+  ],
+  "limits": [
+    {
+      "id": "groups",
+      "label": "Groups",
+      "help": "Optional: only devices whose primary user is in these groups (their object IDs, from Groups in the Microsoft Entra admin center). Needs \"Keep keys to people's groups\" on the Microsoft Intune page. At most 20. Leave empty for every device. Autopilot status (if allowed) also needs any user assigned on the Autopilot record to be in these groups; for a device no person is tied to yet (a spare), it answers only the serial number, the Autopilot enrollment state and whether Intune manages it and its compliance: no device id, names or group tag.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+    }
+  ],
+  "verify": {
+    "label": "Microsoft permissions the app has",
+    "check": "permissions",
+    "ifEmpty": "The app has no Microsoft Graph application permissions yet. Add the permissions above and grant admin consent."
+  },
+  "revoke": "Remove DeviceManagementManagedDevices.Read.All and DeviceManagementServiceConfig.Read.All (and User.ReadBasic.All and GroupMember.Read.All, unless another app here needs them) from the app under API permissions. To stop every Microsoft app at once, remove the app registration (see the Microsoft connection)."
+}

package/dist/connectors/intune/index.js

@@ -0,0 +1,4 @@
+import { microsoftApp } from "../microsoft/client.js";
+import { intuneTools } from "./tools.js";
+export default microsoftApp("intune", intuneTools);
+//# sourceMappingURL=index.js.map

package/dist/connectors/intune/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../connectors/intune/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAe,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC"}