@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.1

package/dist/connectors/microsoft/client.js

@@ -0,0 +1,434 @@
+import { createHash } from "node:crypto";
+import { brand } from "../../packages/connector-kit/src/branding.js";
+import { clientAssertion } from "../../packages/connector-kit/src/certificate.js";
+import { choiceFields } from "../../packages/connector-kit/src/connector.js";
+import { ConnectError, TokenCache, } from "../../packages/connector-kit/src/types.js";
+// One Microsoft connection per organization, shared by the Microsoft apps (mail, files).
+// Normally the customer's own single-tenant Entra app, signing in with a certificate the
+// service made (client assertion) or a client secret. Where the deployment offers it, instead
+// the deployment's shared multi-tenant app, approved by the customer's administrator.
+// config.auth: "certificate" | "client_secret" | SHARED_APP_AUTH.
+/** config.auth of a connection approved for the shared app. A value stored in existing rows
+ *  (it predates the service's own name), so it never changes. */
+export const SHARED_APP_AUTH = "arbium_app";
+// Entra role template ids (the same in every tenant) of the roles that can approve an app:
+// Global Administrator, Privileged Role Administrator, Cloud Application Administrator,
+// Application Administrator.
+const APPROVER_ROLES = new Set([
+    "62e90394-69f5-4237-9190-012177145e10",
+    "e8611ab8-c189-46e8-94e1-60213ab1f814",
+    "158c047a-c907-4556-b7ef-446551a6b5f7",
+    "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
+]);
+const LOGIN = "https://login.microsoftonline.com";
+const GRAPH = "https://graph.microsoft.com";
+// Office 365 Exchange Online: permissions granted on it in Entra (full_access_as_app, its
+// Mail.*) open mailboxes through EWS and never show in a Graph token.
+const EXCHANGE = "https://outlook.office365.com";
+export const EXCHANGE_SUFFIX = " (Exchange Online)";
+export const GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+// Right after approval Microsoft can take a few seconds to make the app usable in the tenant.
+const CONNECT_RETRY_MS = [3000, 6000, 10000];
+const tokenUrl = (tenant) => `${LOGIN}/${tenant}/oauth2/v2.0/token`;
+// Claims of a token Microsoft just handed us over TLS; no signature check needed.
+function tokenClaims(jwt) {
+    try {
+        return JSON.parse(Buffer.from(jwt.split(".")[1], "base64url").toString("utf8"));
+    }
+    catch {
+        throw new ConnectError("Microsoft returned an unreadable token");
+    }
+}
+export function tokenClaim(jwt, claim) {
+    try {
+        const value = tokenClaims(jwt)[claim];
+        return typeof value === "string" ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The application permissions in an access token (its `roles` claim). */
+export function tokenRoles(jwt) {
+    const roles = tokenClaims(jwt).roles;
+    return (Array.isArray(roles) ? roles : [])
+        .filter((r) => typeof r === "string")
+        .sort();
+}
+/** The permissions the ticked capabilities need that the app lacks. Extra ones are the
+ *  admin's choice, so they are not called out. */
+export function compareRoles(granted, input) {
+    const missing = input.expected.filter((r) => !granted.includes(r));
+    if (!missing.length)
+        return undefined;
+    const them = missing.length > 1 ? "them" : "it";
+    return `Missing: ${missing.join(", ")}. Add ${them} to the app and grant admin consent, or agents cannot do what you ticked.`;
+}
+function safeJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+export function microsoftClient(options, fetchImpl = fetch, sleep = (ms) => new Promise((r) => setTimeout(r, ms))) {
+    const { sharedApp } = options;
+    const tokens = new TokenCache();
+    async function requestToken(tenant, form) {
+        const res = await fetchImpl(tokenUrl(tenant), {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams(form),
+        });
+        const body = (await res.json().catch(() => ({})));
+        return { ok: res.ok, status: res.status, body };
+    }
+    // The token request's form for this connection's way of signing in.
+    function credentials(c) {
+        const { auth, tenantId, clientId, certificate } = c.config;
+        if (auth === SHARED_APP_AUTH) {
+            if (!sharedApp)
+                throw new ConnectError(`This Microsoft connection was approved for ${brand().productName}'s shared app, which this deployment does not offer. Disconnect Microsoft and connect it with your own app registration.`);
+            return { client_id: sharedApp.clientId, client_secret: sharedApp.clientSecret };
+        }
+        if (!GUID.test(tenantId ?? "") || !GUID.test(clientId ?? ""))
+            throw new Error("Microsoft connection has no tenantId or clientId");
+        if (auth === "client_secret") {
+            if (!c.secret.client_secret)
+                throw new Error("Microsoft connection has no client secret");
+            return { client_id: clientId, client_secret: c.secret.client_secret };
+        }
+        if (auth === "certificate") {
+            if (!certificate || !c.secret.private_key)
+                throw new Error("Microsoft connection has no certificate");
+            return {
+                client_id: clientId,
+                client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+                client_assertion: clientAssertion({
+                    clientId,
+                    tokenUrl: tokenUrl(tenantId),
+                    certificate,
+                    privateKey: c.secret.private_key,
+                }),
+            };
+        }
+        throw new Error(`Microsoft connection has unknown sign-in ${auth}`);
+    }
+    // `resource`: the API the token is for, Microsoft Graph unless an app names another (e.g.
+    // Exchange Online).
+    async function mint(c, resource = GRAPH) {
+        const tenant = c.config.tenantId ?? "";
+        if (!GUID.test(tenant))
+            throw new Error("Microsoft connection has no tenantId");
+        const { ok, status, body } = await requestToken(tenant, {
+            grant_type: "client_credentials",
+            scope: `${resource}/.default`,
+            ...credentials(c),
+        });
+        if (!ok || !body.access_token) {
+            const why = (body.error_description ?? body.error ?? String(status)).split(/\r?\n/)[0];
+            throw new ConnectError(`Microsoft refused the app's sign-in: ${why.slice(0, 300)}`);
+        }
+        return { token: body.access_token, expiresIn: body.expires_in ?? 3600 };
+    }
+    // Cached per credential, so a new certificate or secret never reuses an old token.
+    const cacheKey = (c, resource) => createHash("sha256")
+        .update([
+        resource,
+        c.config.auth,
+        c.config.tenantId,
+        c.config.clientId,
+        c.config.certificate,
+        c.secret.client_secret,
+    ].join("\n"))
+        .digest("hex");
+    async function send(token, request, origin = GRAPH) {
+        // Uploads send the file's bytes; everything else is JSON.
+        const raw = request.body instanceof Uint8Array;
+        const res = await fetchImpl(`${origin}${request.path}`, {
+            method: request.method,
+            headers: {
+                authorization: `Bearer ${token}`,
+                accept: "application/json",
+                ...request.headers,
+                ...(request.body === undefined
+                    ? {}
+                    : { "content-type": raw ? "application/octet-stream" : "application/json" }),
+            },
+            body: request.body === undefined
+                ? undefined
+                : raw
+                    ? request.body
+                    : JSON.stringify(request.body),
+        });
+        const text = await res.text();
+        const asText = request.responseType === "text" && res.ok;
+        return { status: res.status, data: asText ? text : text ? safeJson(text) : null };
+    }
+    /** A request to Graph, or to `origin` with a token for it, re-minting the token once on a
+     *  401. */
+    async function call(connection, request, origin = GRAPH) {
+        const key = cacheKey(connection, origin);
+        const token = () => tokens.get(key, () => mint(connection, origin));
+        let res = await send(await token(), request, origin);
+        if (res.status === 401) {
+            tokens.forget(key);
+            res = await send(await token(), request, origin);
+        }
+        return res;
+    }
+    /** Compares the app's permissions, read from fresh Graph and Exchange Online tokens, with
+     *  what the app's capabilities need. Exchange Online ones are shown with EXCHANGE_SUFFIX.
+     *  Microsoft calls its tokens opaque to clients, so an unreadable one only means this
+     *  readout is unavailable; the connection itself still works. */
+    async function permissions(connection, input) {
+        const [graph, exchange] = await Promise.all([mint(connection), mint(connection, EXCHANGE)]);
+        let roles;
+        try {
+            roles = [
+                ...tokenRoles(graph.token),
+                ...tokenRoles(exchange.token).map((r) => `${r}${EXCHANGE_SUFFIX}`),
+            ];
+        }
+        catch (error) {
+            if (!(error instanceof ConnectError))
+                throw error;
+            return {
+                values: [],
+                warning: "Could not read the app's permissions from Microsoft's token.",
+            };
+        }
+        return { values: roles, warning: compareRoles(roles, input) };
+    }
+    const provider = {
+        async connect(fields, existing) {
+            const tenantId = fields.tenant_id?.trim().toLowerCase() ?? "";
+            const clientId = fields.client_id?.trim().toLowerCase() ?? "";
+            const clientSecret = fields.client_secret?.trim() ?? "";
+            if (!GUID.test(tenantId))
+                throw new ConnectError("Enter the Directory (tenant) ID from the app's Overview page");
+            if (!GUID.test(clientId))
+                throw new ConnectError("Enter the Application (client) ID from the app's Overview page");
+            let connection;
+            if (clientSecret)
+                connection = {
+                    config: { auth: "client_secret", tenantId, clientId },
+                    secret: { client_secret: clientSecret },
+                };
+            else {
+                const certificate = existing?.config.certificate;
+                const privateKey = existing?.secret.private_key;
+                if (!certificate || !privateKey)
+                    throw new ConnectError("Create the certificate and upload it to the app, or enter a client secret");
+                connection = {
+                    config: { auth: "certificate", tenantId, clientId, certificate },
+                    secret: { private_key: privateKey },
+                };
+            }
+            const { token } = await mint(connection);
+            const servicePrincipalId = tokenClaim(token, "oid");
+            if (!servicePrincipalId)
+                throw new Error("Microsoft token has no oid claim");
+            if (tokenClaim(token, "tid") !== tenantId)
+                throw new ConnectError("Microsoft signed the app in to another organization");
+            // A certificate made for rotating stays waiting with the connection.
+            const next = existing?.config.nextCertificate;
+            return {
+                config: {
+                    ...connection.config,
+                    servicePrincipalId,
+                    ...(next ? { nextCertificate: next } : {}),
+                },
+                secret: {
+                    ...connection.secret,
+                    ...(next && existing?.secret.next_private_key
+                        ? { next_private_key: existing.secret.next_private_key }
+                        : {}),
+                },
+                accountLabel: tenantId,
+            };
+        },
+        async verify(connection) {
+            await mint(connection);
+        },
+        ...(sharedApp ? { approval: sharedApproval(sharedApp) } : {}),
+    };
+    function sharedApproval(app) {
+        return {
+            clientId: app.clientId,
+            consentUrl({ state, redirectUri }) {
+                const q = new URLSearchParams({
+                    client_id: app.clientId,
+                    scope: `${GRAPH}/.default`,
+                    redirect_uri: redirectUri,
+                    state,
+                });
+                return `${LOGIN}/organizations/v2.0/adminconsent?${q}`;
+            },
+            signInUrl({ tenant, state, redirectUri, nonce }) {
+                if (!GUID.test(tenant))
+                    throw new ConnectError(`Microsoft did not say which organization approved ${brand().productName}`);
+                const q = new URLSearchParams({
+                    client_id: app.clientId,
+                    response_type: "code",
+                    response_mode: "query",
+                    scope: "openid",
+                    redirect_uri: redirectUri,
+                    state,
+                    nonce,
+                });
+                return `${LOGIN}/${tenant}/oauth2/v2.0/authorize?${q}`;
+            },
+            async proveTenant({ tenant, code, redirectUri, nonce }) {
+                const { ok, status, body } = await requestToken(tenant, {
+                    grant_type: "authorization_code",
+                    client_id: app.clientId,
+                    client_secret: app.clientSecret,
+                    code,
+                    redirect_uri: redirectUri,
+                    scope: "openid",
+                });
+                if (!ok || !body.id_token)
+                    throw new ConnectError(`Microsoft did not confirm the sign-in (${body.error ?? status})`);
+                // Straight from Microsoft's token endpoint over TLS with the shared app's secret, so the token's
+                // signature need not be checked again (OpenID Connect Core 3.1.3.7).
+                const claims = tokenClaims(body.id_token);
+                const issuer = `${LOGIN}/${tenant}/v2.0`;
+                const fresh = typeof claims.exp === "number" && claims.exp * 1000 > Date.now();
+                if (claims.aud !== app.clientId ||
+                    claims.iss !== issuer ||
+                    claims.nonce !== nonce ||
+                    !fresh)
+                    throw new ConnectError("Microsoft's sign-in did not match this approval. Start again.");
+                // A guest signs in to the tenant but belongs to another one (idp names its home).
+                const guest = typeof claims.idp === "string" && !claims.idp.includes(tenant);
+                if (claims.tid !== tenant || guest)
+                    throw new ConnectError(`Sign in with an account of the organization that approved ${brand().productName}, not a guest or another organization's account.`);
+                // The approval's admin_consent=true came through the browser, so the account signing in
+                // must itself hold a role that can approve apps. `wids` is in the id token only when
+                // the shared app's manifest sets groupMembershipClaims to DirectoryRole (or All).
+                const roles = Array.isArray(claims.wids) ? claims.wids : null;
+                if (!roles)
+                    throw new ConnectError(`Microsoft did not say whether this account is an administrator, so the approval cannot be confirmed. Contact ${brand().productName}.`);
+                if (!roles.some((r) => typeof r === "string" && APPROVER_ROLES.has(r.toLowerCase())))
+                    throw new ConnectError("Sign in with an administrator who can approve apps for your organization (Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator).");
+            },
+            async connect(rawTenant) {
+                const tenant = rawTenant.trim().toLowerCase();
+                if (!GUID.test(tenant))
+                    throw new ConnectError(`Microsoft did not say which organization approved ${brand().productName}`);
+                const connection = {
+                    config: { auth: SHARED_APP_AUTH, tenantId: tenant, clientId: app.clientId },
+                    secret: {},
+                };
+                let failure = null;
+                for (const wait of [0, ...CONNECT_RETRY_MS]) {
+                    if (wait)
+                        await sleep(wait);
+                    try {
+                        // A fresh token each try: one minted before the approval applied lacks its role.
+                        const { token } = await mint(connection);
+                        const org = await send(token, {
+                            method: "GET",
+                            path: "/v1.0/organization?$select=displayName,verifiedDomains",
+                        });
+                        if (org.status !== 200) {
+                            failure = new ConnectError(`Microsoft answered ${org.status} when ${brand().productName} checked the connection`);
+                            continue;
+                        }
+                        const servicePrincipalId = tokenClaim(token, "oid");
+                        if (!servicePrincipalId)
+                            throw new Error("Microsoft token has no oid claim");
+                        const info = org.data.value?.[0];
+                        const domain = info?.verifiedDomains?.find((d) => d.isDefault)?.name;
+                        const name = info?.displayName ?? tenant;
+                        return {
+                            config: { ...connection.config, servicePrincipalId, organization: name },
+                            secret: {},
+                            accountLabel: domain ? `${name} (${domain})` : name,
+                        };
+                    }
+                    catch (error) {
+                        if (!(error instanceof ConnectError))
+                            throw error;
+                        failure = error;
+                    }
+                }
+                throw failure;
+            },
+        };
+    }
+    // Cancels an upload session. Its address is pre-authenticated, so no token is sent, and
+    // only a SharePoint address is called.
+    async function cancelUpload(uploadUrl) {
+        const url = new URL(uploadUrl);
+        if (url.protocol !== "https:" || !/\.sharepoint\.com$/i.test(url.hostname))
+            throw new Error(`Upload session address is not SharePoint: ${url.hostname}`);
+        return (await fetchImpl(url.toString(), { method: "DELETE" })).status;
+    }
+    // An administrator signing in to the connection's own app, for what Microsoft allows only on
+    // a person's behalf (publishing to the Teams app catalog). The token is used at once and
+    // never kept.
+    const delegated = {
+        signInUrl(c, input) {
+            const { tenantId, clientId } = c.config;
+            if (!GUID.test(tenantId ?? "") || !GUID.test(clientId ?? ""))
+                throw new Error("Microsoft connection has no tenantId or clientId");
+            const q = new URLSearchParams({
+                client_id: clientId,
+                response_type: "code",
+                response_mode: "query",
+                scope: `openid ${input.scope}`,
+                redirect_uri: input.redirectUri,
+                state: input.state,
+                nonce: input.nonce,
+                prompt: "select_account",
+            });
+            return `${LOGIN}/${tenantId}/oauth2/v2.0/authorize?${q}`;
+        },
+        /** The code redeemed with the connection's own credential. Returns the access token and
+         *  the id token's claims (straight from Microsoft over TLS, so not signature-checked). */
+        async redeem(c, input) {
+            const { ok, status, body } = await requestToken(c.config.tenantId ?? "", {
+                grant_type: "authorization_code",
+                code: input.code,
+                redirect_uri: input.redirectUri,
+                scope: `openid ${input.scope}`,
+                ...credentials(c),
+            });
+            if (!ok || !body.access_token || !body.id_token) {
+                const why = (body.error_description ?? body.error ?? String(status)).split(/\r?\n/)[0];
+                throw new ConnectError(`Microsoft did not confirm the sign-in: ${why.slice(0, 300)}`);
+            }
+            return { accessToken: body.access_token, claims: tokenClaims(body.id_token) };
+        },
+    };
+    return { provider, call, permissions, cancelUpload, delegated };
+}
+/** Apps that need only the Microsoft connection: Outlook mail and calendar (mailboxes are
+ *  reached through the customer's Exchange role assignments to the app, scoped to the
+ *  branding's mailbox group, never through Graph Mail or Calendars permissions), Teams, Entra ID
+ *  and Intune. `keep`: the app's own choice fields kept in its config; nothing else the form
+ *  sends is, so no field can shadow the provider's config. */
+export function mailboxVendor(ms, keep = []) {
+    return {
+        async connect(fields, provider) {
+            if (!provider)
+                throw new Error("Microsoft apps connect through the Microsoft connection");
+            const config = Object.fromEntries(keep.filter((k) => fields[k]).map((k) => [k, fields[k]]));
+            return { config, secret: {}, accountLabel: provider.accountLabel };
+        },
+        call: ms.call,
+        checks: { permissions: ms.permissions },
+    };
+}
+// A Microsoft app keeps its own choice fields (its JSON) and nothing else.
+export const microsoftApp = (id, toolset) => ({
+    id,
+    create: ({ microsoft, connector }) => ({
+        vendor: mailboxVendor(microsoft, choiceFields(connector)),
+        toolset,
+    }),
+});
+//# sourceMappingURL=client.js.map

package/dist/connectors/microsoft/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../connectors/microsoft/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,8CAA8C,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAElF,OAAO,EAAE,YAAY,EAAwB,MAAM,+CAA+C,CAAC;AACnG,OAAO,EACL,YAAY,EACZ,UAAU,GAOX,MAAM,2CAA2C,CAAC;AAEnD,yFAAyF;AACzF,yFAAyF;AACzF,8FAA8F;AAC9F,sFAAsF;AACtF,kEAAkE;AAElE;iEACiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,2FAA2F;AAC3F,wFAAwF;AACxF,6BAA6B;AAC7B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,sCAAsC;IACtC,sCAAsC;IACtC,sCAAsC;IACtC,sCAAsC;CACvC,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,mCAAmC,CAAC;AAClD,MAAM,KAAK,GAAG,6BAA6B,CAAC;AAC5C,0FAA0F;AAC1F,sEAAsE;AACtE,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AACpD,MAAM,CAAC,MAAM,IAAI,GAAG,gEAAgE,CAAC;AACrF,8FAA8F;AAC9F,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAI7C,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,MAAM,oBAAoB,CAAC;AAE5E,kFAAkF;AAClF,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,wCAAwC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,KAAa;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;SACjD,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;kDACkD;AAClD,MAAM,UAAU,YAAY,CAAC,OAAiB,EAAE,KAAiB;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,OAAO,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,2EAA2E,CAAC;AAChI,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,eAAe,CAC7B,OAAwC,EACxC,YAAmB,KAAK,EACxB,QAAQ,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE7D,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAEhC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,IAA4B;QACtE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAgB,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,oEAAoE;IACpE,SAAS,WAAW,CAAC,CAAmB;QACtC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3D,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,YAAY,CACpB,8CAA8C,KAAK,EAAE,CAAC,WAAW,0HAA0H,CAC5L,CAAC;YACJ,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC1F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW;gBACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,OAAO;gBACL,SAAS,EAAE,QAAQ;gBACnB,qBAAqB,EAAE,wDAAwD;gBAC/E,gBAAgB,EAAE,eAAe,CAAC;oBAChC,QAAQ;oBACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;oBAC5B,WAAW;oBACX,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW;iBACjC,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,0FAA0F;IAC1F,oBAAoB;IACpB,KAAK,UAAU,IAAI,CAAC,CAAmB,EAAE,QAAQ,GAAG,KAAK;QACvD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAChF,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE;YACtD,UAAU,EAAE,oBAAoB;YAChC,KAAK,EAAE,GAAG,QAAQ,WAAW;YAC7B,GAAG,WAAW,CAAC,CAAC,CAAC;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,MAAM,IAAI,YAAY,CAAC,wCAAwC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;IAC1E,CAAC;IAED,mFAAmF;IACnF,MAAM,QAAQ,GAAG,CAAC,CAAmB,EAAE,QAAgB,EAAE,EAAE,CACzD,UAAU,CAAC,QAAQ,CAAC;SACjB,MAAM,CACL;QACE,QAAQ;QACR,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,QAAQ;QACjB,CAAC,CAAC,MAAM,CAAC,QAAQ;QACjB,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,MAAM,CAAC,aAAa;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,OAAsB,EAAE,MAAM,GAAG,KAAK;QACvE,0DAA0D;QAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,YAAY,UAAU,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE;YACtD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,OAAO,CAAC,OAAO;gBAClB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC5B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;aAC/E;YACD,IAAI,EACF,OAAO,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,GAAG;oBACH,CAAC,CAAE,OAAO,CAAC,IAAgC;oBAC3C,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,CAAC;IAED;eACW;IACX,KAAK,UAAU,IAAI,CAAC,UAA4B,EAAE,OAAsB,EAAE,MAAM,GAAG,KAAK;QACtF,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;qEAGiE;IACjE,KAAK,UAAU,WAAW,CAAC,UAA4B,EAAE,KAAiB;QACxE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG;gBACN,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC1B,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,eAAe,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;gBAAE,MAAM,KAAK,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,8DAA8D;aACxE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,QAAQ,GAAmB;QAC/B,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ;YAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,8DAA8D,CAAC,CAAC;YACzF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,gEAAgE,CAAC,CAAC;YAC3F,IAAI,UAA4B,CAAC;YACjC,IAAI,YAAY;gBACd,UAAU,GAAG;oBACX,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE;oBACrD,MAAM,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;iBACxC,CAAC;iBACC,CAAC;gBACJ,MAAM,WAAW,GAAG,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC;gBACjD,MAAM,UAAU,GAAG,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC;gBAChD,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU;oBAC7B,MAAM,IAAI,YAAY,CACpB,2EAA2E,CAC5E,CAAC;gBACJ,UAAU,GAAG;oBACX,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE;oBAChE,MAAM,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;iBACpC,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,kBAAkB,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC7E,IAAI,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,QAAQ;gBACvC,MAAM,IAAI,YAAY,CAAC,qDAAqD,CAAC,CAAC;YAChF,qEAAqE;YACrE,MAAM,IAAI,GAAG,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC;YAC9C,OAAO;gBACL,MAAM,EAAE;oBACN,GAAG,UAAU,CAAC,MAAM;oBACpB,kBAAkB;oBAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3C;gBACD,MAAM,EAAE;oBACN,GAAG,UAAU,CAAC,MAAM;oBACpB,GAAG,CAAC,IAAI,IAAI,QAAQ,EAAE,MAAM,CAAC,gBAAgB;wBAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE;wBACxD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,YAAY,EAAE,QAAQ;aACvB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAU;YACrB,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;IAEF,SAAS,cAAc,CAAC,GAAc;QACpC,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE;gBAC/B,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;oBAC5B,SAAS,EAAE,GAAG,CAAC,QAAQ;oBACvB,KAAK,EAAE,GAAG,KAAK,WAAW;oBAC1B,YAAY,EAAE,WAAW;oBACzB,KAAK;iBACN,CAAC,CAAC;gBACH,OAAO,GAAG,KAAK,oCAAoC,CAAC,EAAE,CAAC;YACzD,CAAC;YAED,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;gBAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;oBACpB,MAAM,IAAI,YAAY,CACpB,qDAAqD,KAAK,EAAE,CAAC,WAAW,EAAE,CAC3E,CAAC;gBACJ,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;oBAC5B,SAAS,EAAE,GAAG,CAAC,QAAQ;oBACvB,aAAa,EAAE,MAAM;oBACrB,aAAa,EAAE,OAAO;oBACtB,KAAK,EAAE,QAAQ;oBACf,YAAY,EAAE,WAAW;oBACzB,KAAK;oBACL,KAAK;iBACN,CAAC,CAAC;gBACH,OAAO,GAAG,KAAK,IAAI,MAAM,0BAA0B,CAAC,EAAE,CAAC;YACzD,CAAC;YAED,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;gBACpD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE;oBACtD,UAAU,EAAE,oBAAoB;oBAChC,SAAS,EAAE,GAAG,CAAC,QAAQ;oBACvB,aAAa,EAAE,GAAG,CAAC,YAAY;oBAC/B,IAAI;oBACJ,YAAY,EAAE,WAAW;oBACzB,KAAK,EAAE,QAAQ;iBAChB,CAAC,CAAC;gBACH,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;oBACvB,MAAM,IAAI,YAAY,CAAC,0CAA0C,IAAI,CAAC,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC;gBAC5F,iGAAiG;gBACjG,qEAAqE;gBACrE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,MAAM,OAAO,CAAC;gBACzC,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC/E,IACE,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ;oBAC3B,MAAM,CAAC,GAAG,KAAK,MAAM;oBACrB,MAAM,CAAC,KAAK,KAAK,KAAK;oBACtB,CAAC,KAAK;oBAEN,MAAM,IAAI,YAAY,CAAC,+DAA+D,CAAC,CAAC;gBAC1F,kFAAkF;gBAClF,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC7E,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,IAAI,KAAK;oBAChC,MAAM,IAAI,YAAY,CACpB,6DAA6D,KAAK,EAAE,CAAC,WAAW,kDAAkD,CACnI,CAAC;gBACJ,wFAAwF;gBACxF,qFAAqF;gBACrF,kFAAkF;gBAClF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,IAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7E,IAAI,CAAC,KAAK;oBACR,MAAM,IAAI,YAAY,CACpB,gHAAgH,KAAK,EAAE,CAAC,WAAW,GAAG,CACvI,CAAC;gBACJ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;oBAClF,MAAM,IAAI,YAAY,CACpB,+LAA+L,CAChM,CAAC;YACN,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,SAAS;gBACrB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;oBACpB,MAAM,IAAI,YAAY,CACpB,qDAAqD,KAAK,EAAE,CAAC,WAAW,EAAE,CAC3E,CAAC;gBACJ,MAAM,UAAU,GAAG;oBACjB,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;oBAC3E,MAAM,EAAE,EAAE;iBACX,CAAC;gBACF,IAAI,OAAO,GAAwB,IAAI,CAAC;gBACxC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,EAAE,CAAC;oBAC5C,IAAI,IAAI;wBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC5B,IAAI,CAAC;wBACH,iFAAiF;wBACjF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;wBACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;4BAC5B,MAAM,EAAE,KAAK;4BACb,IAAI,EAAE,wDAAwD;yBAC/D,CAAC,CAAC;wBACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;4BACvB,OAAO,GAAG,IAAI,YAAY,CACxB,sBAAsB,GAAG,CAAC,MAAM,SAAS,KAAK,EAAE,CAAC,WAAW,yBAAyB,CACtF,CAAC;4BACF,SAAS;wBACX,CAAC;wBACD,MAAM,kBAAkB,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;wBACpD,IAAI,CAAC,kBAAkB;4BAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;wBAC7E,MAAM,IAAI,GAAI,GAAG,CAAC,IAA8B,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;wBAC5D,MAAM,MAAM,GAAG,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;wBACrE,MAAM,IAAI,GAAG,IAAI,EAAE,WAAW,IAAI,MAAM,CAAC;wBACzC,OAAO;4BACL,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,IAAI,EAAE;4BACxE,MAAM,EAAE,EAAE;4BACV,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI;yBACpD,CAAC;oBACJ,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;4BAAE,MAAM,KAAK,CAAC;wBAClD,OAAO,GAAG,KAAK,CAAC;oBAClB,CAAC;gBACH,CAAC;gBACD,MAAM,OAAQ,CAAC;YACjB,CAAC;SACF,CAAC;IACJ,CAAC;IAED,wFAAwF;IACxF,uCAAuC;IACvC,KAAK,UAAU,YAAY,CAAC,SAAiB;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACxE,CAAC;IAED,6FAA6F;IAC7F,yFAAyF;IACzF,cAAc;IACd,MAAM,SAAS,GAAG;QAChB,SAAS,CACP,CAAmB,EACnB,KAA2E;YAE3E,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;gBAC5B,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,MAAM;gBACrB,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;gBAC9B,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,OAAO,GAAG,KAAK,IAAI,QAAQ,0BAA0B,CAAC,EAAE,CAAC;QAC3D,CAAC;QAED;kGAC0F;QAC1F,KAAK,CAAC,MAAM,CAAC,CAAmB,EAAE,KAA2D;YAC3F,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE;gBACvE,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,KAAK,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;gBAC9B,GAAG,WAAW,CAAC,CAAC,CAAC;aAClB,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvF,MAAM,IAAI,YAAY,CAAC,0CAA0C,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,CAAC;KACF,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAMD;;;;8DAI8D;AAC9D,MAAM,UAAU,aAAa,CAAC,EAAmB,EAAE,OAA0B,EAAE;IAC7E,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ;YAC5B,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC1F,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5F,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAmB,EAAE,CAAC,CAAC;IAC9E,EAAE;IACF,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QACzD,OAAO;KACR,CAAC;CACH,CAAC,CAAC"}

package/dist/connectors/microsoft/provider.json

@@ -0,0 +1,118 @@
+{
+  "id": "microsoft",
+  "name": "Microsoft 365",
+  "logo": "/brand/registry/microsoft-365.svg",
+  "identity": "An app you register in your own Microsoft Entra tenant. Your Microsoft apps here share it: you enter its details once. It reaches only what you grant it, and you can remove it at any time.",
+  "sharedIdentity": "{brand.productName}'s shared app, approved by your administrator in your Microsoft Entra tenant. Your Microsoft apps here share it. It reaches only what was approved, and you can remove it at any time under Enterprise applications.",
+  "accountKey": "tenantId",
+  "principalKeys": ["clientId", "servicePrincipalId"],
+  "certificate": true,
+  "setup": [
+    {
+      "title": "Register the {brand.microsoft.appName} app",
+      "body": "Every Microsoft app you set up here uses this one app registration, for this organization only and with no redirect address. Keep its Application (client) ID and Directory (tenant) ID for step 3.",
+      "link": {
+        "label": "Open App registrations",
+        "href": "https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade"
+      },
+      "click": [
+        "Sign in to the Microsoft Entra admin center as at least an Application Developer.",
+        "Go to Entra ID, then App registrations, and select New registration.",
+        "Name it {brand.microsoft.appName}. Under Supported account types choose Single tenant only. Leave the redirect address empty and select Register.",
+        "On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID."
+      ],
+      "copy": [
+        "az login --allow-no-subscriptions",
+        "APP_ID=$(az ad app create --display-name \"{brand.microsoft.appName}\" --sign-in-audience AzureADMyOrg --query appId -o tsv)",
+        "az ad sp create --id $APP_ID",
+        "echo \"Application (client) ID: $APP_ID\"; echo \"Directory (tenant) ID: $(az account show --query tenantId -o tsv)\""
+      ],
+      "shell": "bash",
+      "confirm": "microsoft-app-registered"
+    },
+    {
+      "title": "Add its sign-in certificate",
+      "body": "Create the certificate here and download it, then upload it to the app. {brand.productName} signs in with the matching private key, which never leaves {brand.productName} and is never shown to anyone.",
+      "certificate": true,
+      "click": [
+        "Select Download certificate below (or Create certificate if there is none yet) to get {brand.resourcePrefix}-agents.cer.",
+        "In App registrations, open {brand.microsoft.appName}.",
+        "Select Certificates & secrets, then Certificates, then Upload certificate.",
+        "Choose {brand.resourcePrefix}-agents.cer and select Add."
+      ],
+      "copy": [
+        "# In the folder you downloaded {brand.resourcePrefix}-agents.cer to, in the same shell as step 1 (or set APP_ID to the Application (client) ID)",
+        "az ad app credential reset --id $APP_ID --cert \"@{brand.resourcePrefix}-agents.cer\" --append"
+      ],
+      "shell": "bash"
+    }
+  ],
+  "fields": [
+    {
+      "id": "tenant_id",
+      "label": "Directory (tenant) ID",
+      "help": "On the app's Overview page.",
+      "placeholder": "00000000-0000-0000-0000-000000000000",
+      "secret": false
+    },
+    {
+      "id": "client_id",
+      "label": "Application (client) ID",
+      "help": "On the app's Overview page.",
+      "placeholder": "00000000-0000-0000-0000-000000000000",
+      "secret": false
+    },
+    {
+      "id": "client_secret",
+      "label": "Client secret",
+      "help": "Only if you use a client secret instead of the certificate: the secret's Value, from Certificates & secrets.",
+      "secret": true,
+      "optional": true
+    }
+  ],
+  "addAgent": [
+    {
+      "title": "Create the agent's mailbox",
+      "body": "A shared mailbox: it needs no license, and nobody signs in to it. Its address is the agent's email.",
+      "apps": ["outlook-mail", "outlook-calendar"],
+      "link": {
+        "label": "Open Shared mailboxes",
+        "href": "https://admin.microsoft.com/Adminportal/Home#/SharedMailbox"
+      },
+      "click": [
+        "In the Microsoft 365 admin center, go to Teams & groups, then Shared mailboxes. Select Show all if you do not see Teams & groups.",
+        "Select Add a shared mailbox. Enter the name \"{agentName}\" and the email address \"{agentEmail}\", then select Save changes.",
+        "Skip adding members: the agent needs none."
+      ],
+      "copy": [
+        "# Needs the ExchangeOnlineManagement module: Install-Module ExchangeOnlineManagement -Scope CurrentUser",
+        "Connect-ExchangeOnline",
+        "New-Mailbox -Shared -Name '{agentName}' -DisplayName '{agentName}' -PrimarySmtpAddress '{agentEmail}'"
+      ],
+      "shell": "powershell"
+    },
+    {
+      "title": "Add it to {brand.microsoft.mailboxGroup}",
+      "body": "Membership of this group is what lets the app open the mailbox, and nothing else. Microsoft can take up to about 2 hours to apply it. Check access tells you when it works.",
+      "apps": ["outlook-mail", "outlook-calendar"],
+      "agentCheck": true,
+      "link": {
+        "label": "Open Mail-enabled security groups",
+        "href": "https://admin.exchange.microsoft.com/#/groups"
+      },
+      "click": [
+        "In the Exchange admin center, go to Recipients, then Groups, then Mail-enabled security.",
+        "Open {brand.microsoft.mailboxGroup}, then Members, and select View all and manage members.",
+        "Add \"{agentEmail}\" and select Save changes."
+      ],
+      "copy": [
+        "# Needs the ExchangeOnlineManagement module: Install-Module ExchangeOnlineManagement -Scope CurrentUser",
+        "Connect-ExchangeOnline",
+        "Add-DistributionGroupMember -Identity '{brand.microsoft.mailboxGroup}' -Member '{agentEmail}' -BypassSecurityGroupManagerCheck",
+        "Test-ServicePrincipalAuthorization -Identity '{clientId}' -Resource '{agentEmail}'"
+      ],
+      "shell": "powershell"
+    }
+  ],
+  "revoke": "In the Microsoft Entra admin center, open App registrations, then {brand.microsoft.appName}, and delete it, or remove its certificate or secret. Every Microsoft app connected here stops at once."
+}