@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.1

package/dist/connectors/intune/tools.js

@@ -0,0 +1,416 @@
+import { z } from "zod";
+import { audited, Denied, json, listLimit, VendorFailed, } from "../../packages/connector-kit/src/common.js";
+import { MAX_SCOPE_IDS } from "../entra/tools.js";
+import { cursorArg, nextCursor, ok, pageQuery } from "../sharepoint-files/tools.js";
+// Devices Microsoft Intune manages, read-only. A key's `groups` limit keeps it to devices whose
+// primary user (managedDevice.userId) is in those groups, checked on every call, lookups by id
+// included. Request shapes: learn.microsoft.com/graph/api/intune-devices-manageddevice-list,
+// intune-devices-manageddevice-get, resources/intune-devices-user (a user's managedDevices),
+// resources/intune-devices-manageddevice (v1.0 and beta: the
+// detectedApps relationship is beta only), intune-devices-detectedapp-list and
+// directoryobject-checkmemberobjects. intune_autopilot_status: v1.0 windowsAutopilotDeviceIdentity
+// (list; resources/intune-enrollment-windowsautopilotdeviceidentity) and, for the profile name,
+// the beta `deploymentProfile` relationship (intune-shared-windowsautopilotdeploymentprofile-get),
+// both DeviceManagementServiceConfig.Read.All (read October 25, 2026).
+const GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const UPN = /^[^\s/\\?#%'"]+@[^\s/\\?#%'"]+$/;
+const DEVICES = "/v1.0/deviceManagement/managedDevices";
+const AUTOPILOT = "/v1.0/deviceManagement/windowsAutopilotDeviceIdentities";
+// Letters, digits and dashes: nothing that could change a $filter or a path.
+const SERIAL = /^[A-Za-z0-9-]{1,50}$/;
+const NO_ID = "00000000-0000-0000-0000-000000000000";
+const AUTOPILOT_PAGES = 5;
+// Under a groups limit, an Autopilot device no person is tied to (no primary user, no assigned
+// user: a spare). "minimum" answers only its serial, Autopilot state and whether Intune manages
+// it and its compliance; "refuse" treats it as out of scope, as the other Intune tools treat a
+// device with no user. Open question for the owner: change this one line to "refuse".
+const UNASSIGNED_UNDER_GROUPS = "minimum";
+export const COMPLIANCE_STATES = [
+    "unknown",
+    "compliant",
+    "noncompliant",
+    "conflict",
+    "error",
+    "inGracePeriod",
+    "configManager",
+];
+// ponytail: the summary reads at most this many devices; a server-side report when
+// fleets outgrow it.
+export const SUMMARY_MAX_DEVICES = 5000;
+/** The key's groups, refused when Intune is not set up to check them. */
+function keyGroups(ctx) {
+    const groups = listLimit(ctx.limits, "groups");
+    if (!groups)
+        return null;
+    if (ctx.config.people_groups !== "groups")
+        throw new Denied('This key is kept to groups, but Microsoft Intune is not set up to check groups. An administrator has to choose "Keep keys to people\'s groups" on the Microsoft Intune page.');
+    if (groups.length > MAX_SCOPE_IDS)
+        throw new Denied(`This key names more than ${MAX_SCOPE_IDS} groups. Ask an administrator to narrow it.`);
+    return groups;
+}
+/** Whether a user (id or sign-in name) is in any of the groups; one Graph does not find is in none. */
+async function inGroups(ctx, mark, groups, user) {
+    const res = await ctx.call({
+        method: "POST",
+        path: `/v1.0/users/${encodeURIComponent(user)}/checkMemberObjects`,
+        body: { ids: groups },
+    });
+    mark(res.status);
+    if (res.status === 404)
+        return false;
+    if (res.status !== 200) {
+        const message = res.data?.error?.message;
+        throw new VendorFailed(res.status, `Microsoft Graph answered ${res.status}${message ? `: ${message}` : ""}`);
+    }
+    return (res.data.value ?? []).length > 0;
+}
+/** Whether each device's primary user is in the key's groups, one check per user. */
+export function deviceFilter(ctx, mark) {
+    const groups = keyGroups(ctx);
+    if (!groups)
+        return async () => true;
+    const seen = new Map();
+    return (device) => {
+        const user = device.userId;
+        if (!user || !GUID.test(user))
+            return Promise.resolve(false);
+        if (!seen.has(user))
+            seen.set(user, inGroups(ctx, mark, groups, user));
+        return seen.get(user);
+    };
+}
+/** Everyone in the key's groups, read once: scanning a whole fleet then costs a few listings
+ *  instead of a membership check per user. Null when the key has no groups. */
+async function groupMembers(ctx, mark) {
+    const groups = keyGroups(ctx);
+    if (!groups)
+        return null;
+    const ids = new Set();
+    for (const group of groups) {
+        let cursor;
+        do {
+            const data = await ok(ctx, mark, {
+                method: "GET",
+                path: `/v1.0/groups/${encodeURIComponent(group)}/transitiveMembers/microsoft.graph.user?$select=id&${pageQuery(999, cursor)}`,
+            });
+            for (const u of data.value)
+                ids.add(u.id.toLowerCase());
+            cursor = nextCursor(data) ?? undefined;
+        } while (cursor);
+    }
+    return ids;
+}
+const summary = (d) => ({
+    id: d.id,
+    name: d.deviceName ?? null,
+    user: d.userPrincipalName ?? null,
+    user_name: d.userDisplayName ?? null,
+    os: d.operatingSystem ?? null,
+    os_version: d.osVersion ?? null,
+    compliance: d.complianceState ?? null,
+    last_sync: d.lastSyncDateTime ?? null,
+    encrypted: d.isEncrypted ?? null,
+    model: d.model ?? null,
+    manufacturer: d.manufacturer ?? null,
+    serial_number: d.serialNumber ?? null,
+    management_state: d.managementState ?? null,
+    owner: d.managedDeviceOwnerType ?? null,
+});
+const quoted = (v) => `'${v.replaceAll("'", "''")}'`;
+async function allowedDevices(allowed, devices) {
+    const out = [];
+    for (const d of devices)
+        if (await allowed(d))
+            out.push(d);
+    return out;
+}
+/** One device, read and checked against the key's limits. */
+async function openDevice(ctx, mark, id) {
+    if (!GUID.test(id))
+        throw new Denied("Give a device id from intune_list_devices");
+    const allowed = deviceFilter(ctx, mark);
+    const device = await ok(ctx, mark, { method: "GET", path: `${DEVICES}/${id}` });
+    if (!(await allowed(device)))
+        throw new Denied("This agent may not read that device");
+    return device;
+}
+const listed = (data, devices) => ({
+    devices: devices.map(summary),
+    more: Boolean(data["@odata.nextLink"]),
+    next: nextCursor(data),
+});
+/** A Graph read where 404 means "nothing there": null. */
+async function okOrNone(ctx, mark, req) {
+    let notFound = false;
+    const data = await ok(ctx, (status) => {
+        mark(status);
+        notFound = status === 404;
+    }, req).catch((error) => {
+        if (notFound)
+            return null;
+        throw error;
+    });
+    return data;
+}
+/** Where Graph says a listing continues, as a path for the next call: only another page of
+ *  the same listing on Graph (`@odata.nextLink` is used as given, whatever its paging
+ *  parameter), never another host or resource. */
+function nextPath(link, path) {
+    const url = URL.parse(link);
+    if (url?.origin !== "https://graph.microsoft.com" ||
+        url.pathname.toLowerCase() !== path.toLowerCase())
+        throw new Error(`Graph gave a next page outside ${path}: ${link.slice(0, 200)}`);
+    return `${url.pathname}${url.search}`;
+}
+/** The Autopilot identity with exactly this serial number (any case), or null. The filter is
+ *  `contains` and the match is made here: Microsoft's pages for the list do not document
+ *  $filter, and `contains` on serialNumber is what Intune tooling is seen to use. */
+async function autopilotIdentity(ctx, mark, serial) {
+    const filter = encodeURIComponent(`contains(serialNumber,${quoted(serial)})`);
+    let path = `${AUTOPILOT}?$top=50&$filter=${filter}`;
+    for (let page = 0; page < AUTOPILOT_PAGES; page++) {
+        const data = await ok(ctx, mark, { method: "GET", path });
+        const hit = data.value.find((i) => String(i.serialNumber ?? "").toLowerCase() === serial.toLowerCase());
+        if (hit)
+            return hit;
+        const link = data["@odata.nextLink"];
+        if (!link)
+            return null;
+        path = nextPath(link, AUTOPILOT);
+    }
+    throw new Denied("Too many Autopilot devices match that serial number. Give the full serial number.");
+}
+export const intuneTools = {
+    names: [
+        "intune_list_devices",
+        "intune_get_device",
+        "intune_device_apps",
+        "intune_person_devices",
+        "intune_compliance_summary",
+        "intune_autopilot_status",
+    ],
+    register(server, ctx, allowed) {
+        const readOnly = { readOnlyHint: true, openWorldHint: true };
+        const deviceId = z.string().max(36).describe("A device id, from intune_list_devices.");
+        if (allowed.has("intune_list_devices"))
+            server.registerTool("intune_list_devices", {
+                description: "List managed devices: name, user, system and version, compliance, last check-in, encryption, model and serial number. Optionally only names containing `search`, or one compliance state. When `more` is true, call again with `cursor` set to `next`.",
+                inputSchema: z.object({
+                    search: z.string().max(100).optional().describe("Part of the device name."),
+                    compliance: z.enum(COMPLIANCE_STATES).optional(),
+                    max_results: z.number().int().min(1).max(50).default(25),
+                    cursor: cursorArg,
+                }),
+                annotations: readOnly,
+            }, ({ search, compliance, max_results, cursor }) => audited(ctx, "intune_list_devices", [search, compliance].filter(Boolean).join(" ") || null, async (mark) => {
+                const allowed = deviceFilter(ctx, mark);
+                const filters = [
+                    ...(search?.trim() ? [`contains(deviceName,${quoted(search.trim())})`] : []),
+                    ...(compliance ? [`complianceState eq ${quoted(compliance)}`] : []),
+                ];
+                const filter = filters.length
+                    ? `&$filter=${encodeURIComponent(filters.join(" and "))}`
+                    : "";
+                const data = await ok(ctx, mark, {
+                    method: "GET",
+                    path: `${DEVICES}?${pageQuery(max_results, cursor)}${filter}`,
+                });
+                return json(listed(data, await allowedDevices(allowed, data.value)));
+            }));
+        if (allowed.has("intune_get_device"))
+            server.registerTool("intune_get_device", {
+                description: "One device's details: everything intune_list_devices shows, plus enrollment date, compliance grace period, jailbreak state and how it was enrolled.",
+                inputSchema: z.object({ device_id: deviceId }),
+                annotations: readOnly,
+            }, ({ device_id }) => audited(ctx, "intune_get_device", device_id, async (mark) => {
+                const d = await openDevice(ctx, mark, device_id);
+                return json({
+                    ...summary(d),
+                    enrolled: d.enrolledDateTime ?? null,
+                    compliance_grace_period_ends: d.complianceGracePeriodExpirationDateTime ?? null,
+                    jailbroken: d.jailBroken ?? null,
+                    enrollment_type: d.deviceEnrollmentType ?? null,
+                    entra_device_id: d.azureADDeviceId ?? null,
+                });
+            }));
+        if (allowed.has("intune_device_apps"))
+            server.registerTool("intune_device_apps", {
+                description: "The apps Intune found on a device, with version and publisher. When `more` is true, call again with `cursor` set to `next`.",
+                inputSchema: z.object({
+                    device_id: deviceId,
+                    max_results: z.number().int().min(1).max(200).default(100),
+                    cursor: cursorArg,
+                }),
+                annotations: readOnly,
+            }, ({ device_id, max_results, cursor }) => audited(ctx, "intune_device_apps", device_id, async (mark) => {
+                await openDevice(ctx, mark, device_id);
+                // Only Graph beta has a device's detectedApps.
+                const data = await ok(ctx, mark, {
+                    method: "GET",
+                    path: `/beta/deviceManagement/managedDevices/${device_id}/detectedApps?${pageQuery(max_results, cursor)}`,
+                });
+                return json({
+                    apps: data.value.map((a) => ({
+                        name: a.displayName ?? null,
+                        version: a.version ?? null,
+                        publisher: a.publisher ?? null,
+                        platform: a.platform ?? null,
+                    })),
+                    more: Boolean(data["@odata.nextLink"]),
+                    next: nextCursor(data),
+                });
+            }));
+        if (allowed.has("intune_person_devices"))
+            server.registerTool("intune_person_devices", {
+                description: "The managed devices of one person, by their sign-in name or user id. When `more` is true, call again with `cursor` set to `next`.",
+                inputSchema: z.object({
+                    person: z
+                        .string()
+                        .max(320)
+                        .describe("A sign-in name such as ada@contoso.com, or a user id."),
+                    max_results: z.number().int().min(1).max(50).default(25),
+                    cursor: cursorArg,
+                }),
+                annotations: readOnly,
+            }, ({ person, max_results, cursor }) => audited(ctx, "intune_person_devices", person, async (mark) => {
+                const p = person.trim();
+                if (!GUID.test(p) && !UPN.test(p))
+                    throw new Denied("Give a sign-in name such as ada@contoso.com, or a user id");
+                // Same refusal for a person outside the groups and one who does not exist, as
+                // Entra gives, so a kept key cannot learn which names exist.
+                const groups = keyGroups(ctx);
+                if (groups && !(await inGroups(ctx, mark, groups, p)))
+                    throw new Denied("This agent may not look up that person");
+                // The person's own devices, so the check above is the scope check: this listing
+                // leaves userId and userPrincipalName blank (seen live), which deviceFilter would
+                // read as a device with no user.
+                const data = await ok(ctx, mark, {
+                    method: "GET",
+                    path: `/v1.0/users/${encodeURIComponent(p)}/managedDevices?${pageQuery(max_results, cursor)}`,
+                });
+                return json(listed(data, data.value));
+            }));
+        if (allowed.has("intune_compliance_summary"))
+            server.registerTool("intune_compliance_summary", {
+                description: `How many of the devices this agent may see are in each compliance state, by operating system. Reads at most ${SUMMARY_MAX_DEVICES} devices; \`complete\` says whether that was all of them. List the devices of one state with intune_list_devices.`,
+                inputSchema: z.object({}),
+                annotations: readOnly,
+            }, () => audited(ctx, "intune_compliance_summary", null, async (mark) => {
+                const members = await groupMembers(ctx, mark);
+                const counts = {};
+                let counted = 0;
+                let scanned = 0;
+                let cursor;
+                let complete = true;
+                do {
+                    const data = await ok(ctx, mark, {
+                        method: "GET",
+                        path: `${DEVICES}?$select=id,userId,operatingSystem,complianceState&${pageQuery(1000, cursor)}`,
+                    });
+                    scanned += data.value.length;
+                    for (const d of data.value) {
+                        if (members && !(d.userId && members.has(d.userId.toLowerCase())))
+                            continue;
+                        const os = String(d.operatingSystem ?? "unknown");
+                        const state = String(d.complianceState ?? "unknown");
+                        counts[os] ??= {};
+                        counts[os][state] = (counts[os][state] ?? 0) + 1;
+                        counted++;
+                    }
+                    cursor = nextCursor(data) ?? undefined;
+                    if (cursor && scanned >= SUMMARY_MAX_DEVICES) {
+                        complete = false;
+                        break;
+                    }
+                } while (cursor);
+                return json({ devices_counted: counted, complete, by_operating_system: counts });
+            }));
+        if (allowed.has("intune_autopilot_status"))
+            server.registerTool("intune_autopilot_status", {
+                description: "Where a Windows Autopilot device stands, by its exact serial number: its enrollment state (unknown, enrolled, pendingReset, failed, notContacted), assigned profile, group tag, last contact with Intune and, once Intune manages it, that device's id, compliance and primary user. Unknown to Autopilot: {serial_number, found: false}. When this key is kept to groups and no person is tied to the device, only {serial_number, found, deployment_state, managed, compliance, limited} is answered.",
+                inputSchema: z.object({
+                    serial_number: z
+                        .string()
+                        .max(50)
+                        .describe("The device's exact serial number: letters, digits and dashes only (one with spaces, dots or underscores is refused)."),
+                }),
+                annotations: readOnly,
+            }, ({ serial_number }) => audited(ctx, "intune_autopilot_status", serial_number, async (mark) => {
+                const serial = serial_number.trim();
+                if (!SERIAL.test(serial))
+                    throw new Denied("Give the device's exact serial number: letters, digits and dashes only, up to 50. Serial numbers with spaces, dots or underscores (some virtual machines have them) are not accepted by this tool.");
+                const groups = keyGroups(ctx);
+                const identity = await autopilotIdentity(ctx, mark, serial);
+                if (!identity)
+                    return json({ serial_number: serial, found: false });
+                const managedId = String(identity.managedDeviceId ?? "");
+                // The identity can outlive the managed device it pointed to (404). This read is the
+                // always-on `read` capability's permission, so a 403 carries that capability's hint.
+                const managed = GUID.test(managedId) && managedId !== NO_ID
+                    ? await okOrNone(ctx, mark, {
+                        method: "GET",
+                        path: `${DEVICES}/${managedId}`,
+                    }).catch((error) => {
+                        if (error instanceof VendorFailed)
+                            throw new VendorFailed(error.status, error.message, "intune_get_device");
+                        throw error;
+                    })
+                    : null;
+                // Under a groups limit every person tied to the device must be in the groups: the
+                // managed device's primary user and a user assigned on the Autopilot record.
+                if (groups) {
+                    const inScope = deviceFilter(ctx, mark);
+                    if (managed?.userId && !(await inScope(managed)))
+                        throw new Denied("This agent may not read that device");
+                    const assigned = String(identity.userPrincipalName ?? "").trim();
+                    if (assigned &&
+                        (!UPN.test(assigned) || !(await inGroups(ctx, mark, groups, assigned))))
+                        throw new Denied("This agent may not read that device");
+                    // Nobody tied to it (a spare): see UNASSIGNED_UNDER_GROUPS.
+                    if (!managed?.userId && !assigned) {
+                        if (UNASSIGNED_UNDER_GROUPS === "refuse")
+                            throw new Denied("This agent may not read that device");
+                        return json({
+                            serial_number: String(identity.serialNumber ?? serial),
+                            found: true,
+                            deployment_state: identity.enrollmentState ?? null,
+                            managed: Boolean(managed),
+                            compliance: managed ? (managed.complianceState ?? null) : null,
+                            limited: "No person is tied to this device and this key is kept to groups: only its Autopilot state and compliance are answered.",
+                        });
+                    }
+                }
+                // Only Graph beta has the assigned profile; a device with none is expected to answer
+                // 404. Any other failure leaves the profile out, with why, not the v1.0 answer.
+                let profile = null;
+                let profileError = null;
+                if (GUID.test(String(identity.id)))
+                    profile = await okOrNone(ctx, mark, {
+                        method: "GET",
+                        path: `/beta/deviceManagement/windowsAutopilotDeviceIdentities/${identity.id}/deploymentProfile`,
+                    }).catch((error) => {
+                        if (!(error instanceof VendorFailed))
+                            throw error;
+                        profileError = `Microsoft Graph (beta) answered ${error.status} for the profile`;
+                        return null;
+                    });
+                return json({
+                    serial_number: String(identity.serialNumber ?? serial),
+                    found: true,
+                    deployment_state: identity.enrollmentState ?? null,
+                    enrollment_profile: profile?.displayName ?? null,
+                    ...(profileError ? { enrollment_profile_error: profileError } : {}),
+                    group_tag: identity.groupTag || null,
+                    last_contact: identity.lastContactedDateTime ?? null,
+                    managed_device: managed
+                        ? {
+                            id: managed.id,
+                            compliance: managed.complianceState ?? null,
+                            primary_user: managed.userId ? (managed.userPrincipalName ?? null) : null,
+                        }
+                        : null,
+                });
+            }));
+    },
+};
+//# sourceMappingURL=tools.js.map

package/dist/connectors/intune/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../connectors/intune/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,EACT,YAAY,GAGb,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEpF,gGAAgG;AAChG,+FAA+F;AAC/F,6FAA6F;AAC7F,6FAA6F;AAC7F,6DAA6D;AAC7D,+EAA+E;AAC/E,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,uEAAuE;AAEvE,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,MAAM,GAAG,GAAG,iCAAiC,CAAC;AAC9C,MAAM,OAAO,GAAG,uCAAuC,CAAC;AACxD,MAAM,SAAS,GAAG,yDAAyD,CAAC;AAC5E,6EAA6E;AAC7E,MAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,MAAM,KAAK,GAAG,sCAAsC,CAAC;AACrD,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,+FAA+F;AAC/F,gGAAgG;AAChG,+FAA+F;AAC/F,sFAAsF;AACtF,MAAM,uBAAuB,GAAG,SAAiC,CAAC;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS;IACT,WAAW;IACX,cAAc;IACd,UAAU;IACV,OAAO;IACP,eAAe;IACf,eAAe;CACP,CAAC;AACX,mFAAmF;AACnF,qBAAqB;AACrB,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAKxC,yEAAyE;AACzE,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,QAAQ;QACvC,MAAM,IAAI,MAAM,CACd,8KAA8K,CAC/K,CAAC;IACJ,IAAI,MAAM,CAAC,MAAM,GAAG,aAAa;QAC/B,MAAM,IAAI,MAAM,CACd,4BAA4B,aAAa,6CAA6C,CACvF,CAAC;IACJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,QAAQ,CAAC,GAAgB,EAAE,IAAU,EAAE,MAAgB,EAAE,IAAY;IAClF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC;QACzB,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,eAAe,kBAAkB,CAAC,IAAI,CAAC,qBAAqB;QAClE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAI,GAAG,CAAC,IAAgD,EAAE,KAAK,EAAE,OAAO,CAAC;QACtF,MAAM,IAAI,YAAY,CACpB,GAAG,CAAC,MAAM,EACV,4BAA4B,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,CAAE,GAAG,CAAC,IAA6B,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,IAAU;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,OAAO,CAAC,MAAc,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED;+EAC+E;AAC/E,KAAK,UAAU,YAAY,CAAC,GAAgB,EAAE,IAAU;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,MAA0B,CAAC;QAC/B,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;gBAC/B,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,sDAAsD,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE;aAC9H,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAyB;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5E,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QACzC,CAAC,QAAQ,MAAM,EAAE;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;IAC1B,IAAI,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;IACjC,SAAS,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;IACpC,EAAE,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;IAC7B,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;IAC/B,UAAU,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;IACrC,SAAS,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;IACrC,SAAS,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;IACtB,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;IACpC,aAAa,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;IACrC,gBAAgB,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;IAC3C,KAAK,EAAE,CAAC,CAAC,sBAAsB,IAAI,IAAI;CACxC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAE7D,KAAK,UAAU,cAAc,CAAC,OAAwC,EAAE,OAAiB;IACvF,MAAM,GAAG,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,UAAU,CAAC,GAAgB,EAAE,IAAU,EAAE,EAAU;IAChE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,2CAA2C,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,qCAAqC,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAqD,EAAE,OAAiB,EAAE,EAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACtC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;CACvB,CAAC,CAAC;AAEH,0DAA0D;AAC1D,KAAK,UAAU,QAAQ,CAAC,GAAgB,EAAE,IAAU,EAAE,GAA6B;IACjF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,MAAM,EAAE,CACnB,GAAG,EACH,CAAC,MAAM,EAAE,EAAE;QACT,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,QAAQ,GAAG,MAAM,KAAK,GAAG,CAAC;IAC5B,CAAC,EACD,GAAG,CACJ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAChB,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,IAAqB,CAAC;AAC/B,CAAC;AAED;;kDAEkD;AAClD,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,IACE,GAAG,EAAE,MAAM,KAAK,6BAA6B;QAC7C,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;QAEjD,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AAED;;qFAEqF;AACrF,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,IAAU,EAAE,MAAc;IAC3E,MAAM,MAAM,GAAG,kBAAkB,CAAC,yBAAyB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,IAAI,GAAG,GAAG,SAAS,oBAAoB,MAAM,EAAE,CAAC;IACpD,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAI,IAAI,CAAC,KAAmC,CAAC,IAAI,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAC3E,CAAC;QACF,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,IAAI,MAAM,CACd,mFAAmF,CACpF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAY;IAClC,KAAK,EAAE;QACL,qBAAqB;QACrB,mBAAmB;QACnB,oBAAoB;QACpB,uBAAuB;QACvB,2BAA2B;QAC3B,yBAAyB;KAC1B;IAED,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO;QAC3B,MAAM,QAAQ,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAW,CAAC;QACtE,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;QAEvF,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACpC,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;gBACE,WAAW,EACT,wPAAwP;gBAC1P,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;oBAC3E,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;oBAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxD,MAAM,EAAE,SAAS;iBAClB,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAC9C,OAAO,CACL,GAAG,EACH,qBAAqB,EACrB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EACtD,KAAK,EAAE,IAAI,EAAE,EAAE;gBACb,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACxC,MAAM,OAAO,GAAG;oBACd,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,sBAAsB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC;gBACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;oBAC3B,CAAC,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE;oBACzD,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAC/B,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,GAAG,OAAO,IAAI,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE;iBAC9D,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC,CACF,CACJ,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAClC,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;gBACE,WAAW,EACT,qJAAqJ;gBACvJ,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;gBAC9C,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAChB,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC1D,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACjD,OAAO,IAAI,CAAC;oBACV,GAAG,OAAO,CAAC,CAAC,CAAC;oBACb,QAAQ,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;oBACpC,4BAA4B,EAAE,CAAC,CAAC,uCAAuC,IAAI,IAAI;oBAC/E,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;oBAChC,eAAe,EAAE,CAAC,CAAC,oBAAoB,IAAI,IAAI;oBAC/C,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;iBAC3C,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACnC,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;gBACE,WAAW,EACT,6HAA6H;gBAC/H,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,SAAS,EAAE,QAAQ;oBACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;oBAC1D,MAAM,EAAE,SAAS;iBAClB,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CACrC,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC3D,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACvC,+CAA+C;gBAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAC/B,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,yCAAyC,SAAS,iBAAiB,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;iBAC1G,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;oBACV,IAAI,EAAG,IAAI,CAAC,KAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC1D,IAAI,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;wBAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;wBAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;wBAC9B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;qBAC7B,CAAC,CAAC;oBACH,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACtC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;iBACvB,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACtC,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;gBACE,WAAW,EACT,mIAAmI;gBACrI,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC;yBACN,MAAM,EAAE;yBACR,GAAG,CAAC,GAAG,CAAC;yBACR,QAAQ,CAAC,uDAAuD,CAAC;oBACpE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxD,MAAM,EAAE,SAAS;iBAClB,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAClC,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC/B,MAAM,IAAI,MAAM,CAAC,2DAA2D,CAAC,CAAC;gBAChF,8EAA8E;gBAC9E,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;oBACnD,MAAM,IAAI,MAAM,CAAC,wCAAwC,CAAC,CAAC;gBAC7D,gFAAgF;gBAChF,kFAAkF;gBAClF,iCAAiC;gBACjC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAC/B,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,eAAe,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;iBAC9F,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;YAC1C,MAAM,CAAC,YAAY,CACjB,2BAA2B,EAC3B;gBACE,WAAW,EAAE,+GAA+G,mBAAmB,mHAAmH;gBAClQ,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,WAAW,EAAE,QAAQ;aACtB,EACD,GAAG,EAAE,CACH,OAAO,CAAC,GAAG,EAAE,2BAA2B,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC7D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC9C,MAAM,MAAM,GAA2C,EAAE,CAAC;gBAC1D,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,IAAI,MAA0B,CAAC;gBAC/B,IAAI,QAAQ,GAAG,IAAI,CAAC;gBACpB,GAAG,CAAC;oBACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;wBAC/B,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,GAAG,OAAO,sDAAsD,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;qBAChG,CAAC,CAAC;oBACH,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAiB,EAAE,CAAC;wBACvC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;4BAAE,SAAS;wBAC5E,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,SAAS,CAAC,CAAC;wBAClD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,SAAS,CAAC,CAAC;wBACrD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;wBAClB,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;wBACjD,OAAO,EAAE,CAAC;oBACZ,CAAC;oBACD,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;oBACvC,IAAI,MAAM,IAAI,OAAO,IAAI,mBAAmB,EAAE,CAAC;wBAC7C,QAAQ,GAAG,KAAK,CAAC;wBACjB,MAAM;oBACR,CAAC;gBACH,CAAC,QAAQ,MAAM,EAAE;gBACjB,OAAO,IAAI,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;YACxC,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;gBACE,WAAW,EACT,yeAAye;gBAC3e,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,aAAa,EAAE,CAAC;yBACb,MAAM,EAAE;yBACR,GAAG,CAAC,EAAE,CAAC;yBACP,QAAQ,CACP,sHAAsH,CACvH;iBACJ,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACpB,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;oBACtB,MAAM,IAAI,MAAM,CACd,oMAAoM,CACrM,CAAC;gBACJ,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC5D,IAAI,CAAC,QAAQ;oBAAE,OAAO,IAAI,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEpE,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;gBACzD,oFAAoF;gBACpF,qFAAqF;gBACrF,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,KAAK;oBACzC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE;wBACxB,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,GAAG,OAAO,IAAI,SAAS,EAAE;qBAChC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACjB,IAAI,KAAK,YAAY,YAAY;4BAC/B,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;wBAC3E,MAAM,KAAK,CAAC;oBACd,CAAC,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAC;gBACX,kFAAkF;gBAClF,6EAA6E;gBAC7E,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;oBACxC,IAAI,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;wBAC9C,MAAM,IAAI,MAAM,CAAC,qCAAqC,CAAC,CAAC;oBAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjE,IACE,QAAQ;wBACR,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;wBAEvE,MAAM,IAAI,MAAM,CAAC,qCAAqC,CAAC,CAAC;oBAC1D,4DAA4D;oBAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAClC,IAAI,uBAAuB,KAAK,QAAQ;4BACtC,MAAM,IAAI,MAAM,CAAC,qCAAqC,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC;4BACV,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC;4BACtD,KAAK,EAAE,IAAI;4BACX,gBAAgB,EAAE,QAAQ,CAAC,eAAe,IAAI,IAAI;4BAClD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;4BACzB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;4BAC9D,OAAO,EACL,wHAAwH;yBAC3H,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,qFAAqF;gBACrF,gFAAgF;gBAChF,IAAI,OAAO,GAAkB,IAAI,CAAC;gBAClC,IAAI,YAAY,GAAkB,IAAI,CAAC;gBACvC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAChC,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE;wBAClC,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,2DAA2D,QAAQ,CAAC,EAAE,oBAAoB;qBACjG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACjB,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;4BAAE,MAAM,KAAK,CAAC;wBAClD,YAAY,GAAG,mCAAmC,KAAK,CAAC,MAAM,kBAAkB,CAAC;wBACjF,OAAO,IAAI,CAAC;oBACd,CAAC,CAAC,CAAC;gBACL,OAAO,IAAI,CAAC;oBACV,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC;oBACtD,KAAK,EAAE,IAAI;oBACX,gBAAgB,EAAE,QAAQ,CAAC,eAAe,IAAI,IAAI;oBAClD,kBAAkB,EAAG,OAAO,EAAE,WAAkC,IAAI,IAAI;oBACxE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,SAAS,EAAE,QAAQ,CAAC,QAAQ,IAAI,IAAI;oBACpC,YAAY,EAAE,QAAQ,CAAC,qBAAqB,IAAI,IAAI;oBACpD,cAAc,EAAE,OAAO;wBACrB,CAAC,CAAC;4BACE,EAAE,EAAE,OAAO,CAAC,EAAE;4BACd,UAAU,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;4BAC3C,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;yBAC1E;wBACH,CAAC,CAAC,IAAI;iBACT,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;IACN,CAAC;CACF,CAAC"}

package/dist/connectors/jira/connector.json

@@ -0,0 +1,129 @@
+{
+  "id": "jira",
+  "name": "Jira",
+  "description": "Let agents search, read and work on issues in the Jira projects you choose.",
+  "logo": "/brand/jira.svg",
+  "identity": "An Atlassian service account named \"{brand.microsoft.appName}\". It uses no Jira seat.",
+  "accountKey": "cloudId",
+  "connectionKind": "guided",
+  "setup": [
+    {
+      "title": "Create a service account with Jira access",
+      "body": "In Atlassian Administration, create a service account named \"{brand.microsoft.appName}\". When it asks you to select an app role, set Jira to User and leave every other app, including Jira Administration, on None. Without a Jira role the account cannot use Jira at all.",
+      "click": [
+        "Atlassian Administration > Directory > Service accounts > Create service account",
+        "Name: {brand.microsoft.appName}",
+        "Select app role: Jira > User (every other app, including Jira Administration: None) > Create"
+      ],
+      "link": {
+        "label": "Open Atlassian Administration",
+        "href": "https://admin.atlassian.com"
+      }
+    },
+    {
+      "title": "Add it to the projects agents should work in",
+      "body": "How you do this depends on the project. In a team-managed project (the usual kind on the Free plan), add the service account as a Member: Members can browse, comment on, move and create issues, and Viewers can only read. In a company-managed project on Standard or Premium, give it a project role whose permissions include the ones below. Without Browse projects the projects are listed but their issues stay hidden. You can narrow each agent to specific projects here later.",
+      "click": [
+        "Team-managed project: the project > Project settings > Access > Add people > {brand.microsoft.appName} > Role: Member > Add",
+        "Company-managed project: the project > Project settings > People > Add people > {brand.microsoft.appName} > a role with the permissions below"
+      ],
+      "permissions": true
+    },
+    {
+      "title": "Create OAuth 2.0 credentials",
+      "body": "On the service account, select Create credentials, then OAuth 2.0, and select exactly these scopes. Copy the client ID and secret: Atlassian shows the secret only once.",
+      "copy": ["{scopes}"]
+    }
+  ],
+  "afterConnect": [],
+  "fields": [
+    {
+      "id": "site",
+      "label": "Jira site",
+      "help": "The part before .atlassian.net in your Jira address.",
+      "placeholder": "your-company",
+      "secret": false
+    },
+    {
+      "id": "client_id",
+      "label": "Client ID",
+      "secret": false
+    },
+    {
+      "id": "client_secret",
+      "label": "Client secret",
+      "secret": true
+    }
+  ],
+  "capabilities": [
+    {
+      "id": "read",
+      "label": "Read issues",
+      "description": "Search and read issues and list projects.",
+      "required": true,
+      "scopes": ["read:jira-work"],
+      "permissions": ["Browse projects"],
+      "tools": ["jira_search_issues", "jira_get_issue", "jira_list_projects"]
+    },
+    {
+      "id": "comment",
+      "label": "Comment",
+      "description": "Add comments to issues. In a service project a comment is public (the customer is emailed) unless the agent marks it as an internal note.",
+      "scopes": ["write:jira-work"],
+      "permissions": ["Add comments"],
+      "tools": ["jira_add_comment"]
+    },
+    {
+      "id": "transition",
+      "label": "Move issues",
+      "description": "Move issues to another status, such as In Progress or Done.",
+      "scopes": ["write:jira-work"],
+      "permissions": ["Transition issues"],
+      "tools": ["jira_list_transitions", "jira_transition_issue"]
+    },
+    {
+      "id": "create",
+      "label": "Create issues",
+      "description": "Create new issues in the allowed projects.",
+      "scopes": ["write:jira-work"],
+      "permissions": ["Create issues"],
+      "tools": ["jira_create_issue"]
+    },
+    {
+      "id": "delete",
+      "label": "Delete issues",
+      "description": "Delete issues for good. Jira cannot bring a deleted issue back.",
+      "destructive": true,
+      "scopes": ["write:jira-work"],
+      "permissions": ["Delete issues"],
+      "tools": ["jira_delete_issue"]
+    }
+  ],
+  "limits": [
+    {
+      "id": "projects",
+      "label": "Projects",
+      "help": "Leave empty to allow every project the service account can see.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[A-Z][A-Z0-9_]*$"
+    }
+  ],
+  "verify": {
+    "method": "GET",
+    "path": "/rest/api/3/serverInfo",
+    "label": "Connected Jira site",
+    "show": "baseUrl"
+  },
+  "discover": {
+    "method": "POST",
+    "path": "/rest/api/3/permissions/project",
+    "body": {
+      "permissions": ["BROWSE_PROJECTS"]
+    },
+    "label": "Projects agents can see",
+    "show": "projects[].key",
+    "ifEmpty": "The service account cannot browse any project yet, so agents will find no issues. Give it a role with Browse projects in each project agents need, then check again."
+  },
+  "revoke": "In Atlassian Administration, open Directory, then Service accounts, then {brand.microsoft.appName}, and revoke its credentials."
+}

package/dist/connectors/jira/index.js

@@ -0,0 +1,7 @@
+import { jiraTools } from "./tools.js";
+import { jiraVendor } from "./vendor.js";
+export default {
+    id: "jira",
+    create: () => ({ vendor: jiraVendor(), toolset: jiraTools }),
+};
+//# sourceMappingURL=index.js.map

package/dist/connectors/jira/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../connectors/jira/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,eAAe;IACb,EAAE,EAAE,MAAM;IACV,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;CACnC,CAAC"}

package/dist/connectors/jira/jql.js

@@ -0,0 +1,67 @@
+// Confines an agent's JQL to the projects its grant allows. The agent's clause is kept
+// whole inside parentheses, so it has to be lexically closed on its own: balanced
+// parentheses outside strings, no unterminated string. Anything else could close our
+// parenthesis early and OR its way out of the project filter, so it is refused.
+export class JqlRejected extends Error {
+}
+const PROJECT_KEY = /^[A-Z][A-Z0-9_]{0,254}$/;
+// After strings are blanked to "": fields (cf[10010], "Story Points") with optional direction.
+const SORT_FIELD = String.raw `(?:""|[A-Za-z_][\w.]*(?:\[\d+\])?)(?:\s+(?:asc|desc))?`;
+const ORDER_BY = new RegExp(String.raw `^order\s+by\s+${SORT_FIELD}(?:\s*,\s*${SORT_FIELD})*$`, "i");
+export function isProjectKey(key) {
+    return PROJECT_KEY.test(key);
+}
+// Splits at a top-level ORDER BY (outside strings and parentheses).
+function splitOrderBy(jql) {
+    let depth = 0;
+    let quote = null;
+    let orderAt = -1;
+    for (let i = 0; i < jql.length; i++) {
+        const c = jql[i];
+        if (quote) {
+            if (c === "\\")
+                i++;
+            else if (c === quote)
+                quote = null;
+            continue;
+        }
+        if (c === '"' || c === "'")
+            quote = c;
+        else if (c === "(")
+            depth++;
+        else if (c === ")") {
+            depth--;
+            if (depth < 0)
+                throw new JqlRejected("Unbalanced parentheses in the query");
+        }
+        else if (orderAt < 0 &&
+            depth === 0 &&
+            /^order\s+by\b/i.test(jql.slice(i)) &&
+            (i === 0 || /[\s)]/.test(jql[i - 1]))) {
+            orderAt = i;
+        }
+    }
+    if (quote)
+        throw new JqlRejected("Unterminated string in the query");
+    if (depth !== 0)
+        throw new JqlRejected("Unbalanced parentheses in the query");
+    if (orderAt < 0)
+        return { where: jql.trim(), orderBy: null };
+    return { where: jql.slice(0, orderAt).trim(), orderBy: jql.slice(orderAt).trim() };
+}
+export function scopeJql(jql, projects) {
+    const { where, orderBy } = splitOrderBy(jql);
+    if (orderBy && !ORDER_BY.test(orderBy.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, '""')))
+        throw new JqlRejected("ORDER BY must be the last part of the query and list only fields");
+    if (projects === null)
+        return jql.trim();
+    if (projects.length === 0)
+        throw new JqlRejected("No projects are allowed");
+    for (const p of projects)
+        if (!isProjectKey(p))
+            throw new Error(`Invalid project key ${p}`);
+    const filter = `project in (${projects.map((p) => `"${p}"`).join(", ")})`;
+    const scoped = where ? `${filter} AND (${where})` : filter;
+    return orderBy ? `${scoped} ${orderBy}` : scoped;
+}
+//# sourceMappingURL=jql.js.map