@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.2-dev.d2aa5ca

package/dist/connectors/workday/vendor.js

@@ -0,0 +1,195 @@
+import { createHash } from "node:crypto";
+import { vendorError } from "../../packages/connector-kit/src/oauth.js";
+import { ConnectError, TokenCache, } from "../../packages/connector-kit/src/types.js";
+// A Workday API client for integrations, signing in as its Integration System User with a
+// non-expiring refresh token (OAuth 2.0 refresh token grant at /ccx/oauth2/<tenant>/token, the
+// client id and secret as HTTP Basic). REST calls under /ccx/api/<service>/<version>/<tenant>,
+// custom reports (Reports-as-a-Service) under /ccx/service/customreport2/<tenant>. Service
+// paths are Workday's REST directory (developer.workday.com, services_oas3.json, read October
+// 27, 2026); its spec files need a Workday sign-in, so answer fields follow CData's Workday
+// tables, which are generated from them.
+const HOST = /^[a-z0-9-]+(\.[a-z0-9-]+)*\.(myworkday|workday)\.com$/;
+const TENANT = /^[A-Za-z0-9_]{1,64}$/;
+const REPORT_SEGMENT = /^[A-Za-z0-9_.\-]{1,200}$/;
+const PROMPT = /^[A-Za-z0-9_!.\-]{1,100}$/;
+const MAX_REPORTS = 30;
+// Workday's token answer may carry no lifetime: reuse a token this long, re-mint once on a 401.
+const DEFAULT_TOKEN_SECONDS = 600;
+// The REST API endpoint shown on Workday's View API Clients page, e.g.
+// https://wd5-services1.myworkday.com/ccx/api/v1/acme: host and tenant.
+export function parseEndpoint(raw) {
+    let url;
+    try {
+        url = new URL(raw.trim());
+    }
+    catch {
+        throw new ConnectError("Enter the Workday REST API endpoint, such as https://wd5-services1.myworkday.com/ccx/api/v1/acme");
+    }
+    const host = url.hostname.toLowerCase();
+    if (url.protocol !== "https:" || url.port || !HOST.test(host))
+        throw new ConnectError(`${url.host} is not a Workday address (ending myworkday.com or workday.com)`);
+    const tenant = /^\/ccx\/api\/(?:[A-Za-z]+\/)?v\d+\/([^/]+)\/?$/.exec(url.pathname)?.[1];
+    if (!tenant || !TENANT.test(tenant))
+        throw new ConnectError("The endpoint should end with /ccx/api/v1/<tenant>, as shown on the View API Clients page");
+    return { host, tenant };
+}
+// Each report's JSON link from Workday (the report's Actions > Web Service > View URLs > JSON),
+// separated by spaces or new lines. Its query names are the report's prompts; one whose example
+// value is a date takes dates.
+export function parseReports(raw, host, tenant) {
+    const links = raw.split(/\s+/).filter(Boolean);
+    if (links.length > MAX_REPORTS)
+        throw new ConnectError(`Enter at most ${MAX_REPORTS} reports`);
+    const reports = links.map((link) => {
+        let url;
+        try {
+            url = new URL(link);
+        }
+        catch {
+            throw new ConnectError(`${link.slice(0, 100)} is not a report link`);
+        }
+        const parts = url.pathname.split("/").map((p) => decodeURIComponent(p));
+        const [, ccx, service, kind, t, owner, report] = parts;
+        if (url.protocol !== "https:" ||
+            url.hostname.toLowerCase() !== host ||
+            ccx !== "ccx" ||
+            service !== "service" ||
+            kind !== "customreport2" ||
+            parts.length !== 7 ||
+            !REPORT_SEGMENT.test(owner ?? "") ||
+            !REPORT_SEGMENT.test(report ?? ""))
+            throw new ConnectError(`${link.slice(0, 100)} is not a custom report link on ${host} (…/ccx/service/customreport2/${tenant}/<owner>/<report>)`);
+        if (t !== tenant)
+            throw new ConnectError(`${report} belongs to tenant ${t}, not ${tenant}`);
+        const prompts = [];
+        for (const [name, value] of url.searchParams) {
+            if (name === "format")
+                continue;
+            if (!PROMPT.test(name))
+                throw new ConnectError(`${report}: ${name} is not a prompt name`);
+            prompts.push({ name, type: /^\d{4}-\d{2}-\d{2}/.test(value) ? "date" : "text" });
+        }
+        return { name: report, owner, report, prompts };
+    });
+    const names = reports.map((r) => r.name);
+    const twice = names.find((n, i) => names.indexOf(n) !== i);
+    if (twice)
+        throw new ConnectError(`${twice} is entered twice`);
+    return reports;
+}
+export function connectedReports(config) {
+    return config.reports ? JSON.parse(config.reports) : [];
+}
+export function workdayVendor(fetchImpl = fetch) {
+    const tokens = new TokenCache();
+    const key = (c) => createHash("sha256")
+        .update(`${c.config.host}\n${c.config.tenant}\n${c.secret.client_id}\n${c.secret.refresh_token}`)
+        .digest("hex");
+    async function mint(c) {
+        const { host, tenant } = c.config;
+        const res = await fetchImpl(`https://${host}/ccx/oauth2/${tenant}/token`, {
+            method: "POST",
+            headers: {
+                authorization: `Basic ${Buffer.from(`${c.secret.client_id}:${c.secret.client_secret}`).toString("base64")}`,
+                "content-type": "application/x-www-form-urlencoded",
+                accept: "application/json",
+            },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                refresh_token: c.secret.refresh_token,
+            }),
+            redirect: "manual",
+        });
+        const raw = await res.text();
+        const body = parse(raw);
+        if (!res.ok)
+            throw new ConnectError(`Workday refused the sign-in (${res.status}${vendorError(body) ? `: ${vendorError(body)}` : ""}). Check the client ID, secret and refresh token, and that the refresh token was made for this API client.`);
+        if (typeof body !== "object" || !body || typeof body.access_token !== "string")
+            throw new ConnectError("Workday answered the sign-in without a token");
+        const expiresIn = Number(body.expires_in);
+        return {
+            token: body.access_token,
+            expiresIn: Number.isFinite(expiresIn) && expiresIn > 60 ? expiresIn : DEFAULT_TOKEN_SECONDS,
+        };
+    }
+    async function send(c, access, request) {
+        const res = await fetchImpl(`https://${c.config.host}${request.path}`, {
+            method: request.method,
+            headers: {
+                authorization: `Bearer ${access}`,
+                accept: "application/json",
+                ...(request.body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            body: request.body === undefined ? undefined : JSON.stringify(request.body),
+            redirect: "manual",
+        });
+        const raw = await res.text();
+        return { status: res.status, data: raw ? parse(raw) : null };
+    }
+    const call = async (c, request) => {
+        if (!HOST.test(c.config.host ?? "") || !TENANT.test(c.config.tenant ?? ""))
+            throw new Error("Workday connection has no host or tenant");
+        if (!request.path.startsWith("/ccx/"))
+            throw new Error(`Not a Workday path: ${request.path}`);
+        let res = await send(c, await tokens.get(key(c), () => mint(c)), request);
+        if (res.status === 401) {
+            tokens.forget(key(c));
+            res = await send(c, await tokens.get(key(c), () => mint(c)), request);
+        }
+        return res;
+    };
+    return {
+        async connect(fields) {
+            const { host, tenant } = parseEndpoint(fields.endpoint ?? "");
+            const clientId = fields.client_id?.trim();
+            const clientSecret = fields.client_secret?.trim();
+            const refreshToken = fields.refresh_token?.trim();
+            if (!clientId || !clientSecret || !refreshToken)
+                throw new ConnectError("Enter the client ID, client secret and refresh token");
+            const reports = parseReports(fields.reports ?? "", host, tenant);
+            const orgColumn = fields.report_org_column?.trim() ?? "";
+            if (orgColumn && !PROMPT.test(orgColumn))
+                throw new ConnectError(`${orgColumn} is not a report column name`);
+            const conn = {
+                config: {
+                    host,
+                    tenant,
+                    account: `${host}/${tenant}`,
+                    reports: JSON.stringify(reports),
+                    ...(orgColumn ? { reportOrgColumn: orgColumn } : {}),
+                },
+                secret: { client_id: clientId, client_secret: clientSecret, refresh_token: refreshToken },
+            };
+            tokens.forget(key(conn));
+            await tokens.get(key(conn), () => mint(conn));
+            return { ...conn, accountLabel: `${tenant} (${host})` };
+        },
+        call,
+        checks: {
+            // One worker read proves the account reaches staffing data; nothing of it is shown.
+            async tenant(connection) {
+                const res = await call(connection, {
+                    method: "GET",
+                    path: `/ccx/api/staffing/v7/${connection.config.tenant}/workers?limit=1`,
+                });
+                if (res.status === 401 || res.status === 403)
+                    throw new ConnectError(`Workday refused to list workers (${res.status}). Give the account's security group View on Worker Data: Public Worker Reports, activate the pending security policy changes, then check again.`);
+                if (res.status < 200 || res.status >= 300)
+                    throw new ConnectError(`Workday answered ${res.status}: ${vendorError(res.data) || "no reason given"}`);
+                return { values: [`${connection.config.tenant} (${connection.config.host})`] };
+            },
+            async reports(connection) {
+                return { values: connectedReports(connection.config).map((r) => r.name) };
+            },
+        },
+    };
+}
+function parse(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+//# sourceMappingURL=vendor.js.map

package/dist/connectors/workday/vendor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../../connectors/workday/vendor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EACL,YAAY,EACZ,UAAU,GAKX,MAAM,2CAA2C,CAAC;AAEnD,0FAA0F;AAC1F,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,yCAAyC;AAEzC,MAAM,IAAI,GAAG,uDAAuD,CAAC;AACrE,MAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAClD,MAAM,MAAM,GAAG,2BAA2B,CAAC;AAC3C,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,gGAAgG;AAChG,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAKlC,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CACpB,kGAAkG,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3D,MAAM,IAAI,YAAY,CACpB,GAAG,GAAG,CAAC,IAAI,iEAAiE,CAC7E,CAAC;IACJ,MAAM,MAAM,GAAG,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACjC,MAAM,IAAI,YAAY,CACpB,0FAA0F,CAC3F,CAAC;IACJ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,gGAAgG;AAChG,gGAAgG;AAChG,+BAA+B;AAC/B,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY,EAAE,MAAc;IACpE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW;QAAE,MAAM,IAAI,YAAY,CAAC,iBAAiB,WAAW,UAAU,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;QACvD,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI;YACnC,GAAG,KAAK,KAAK;YACb,OAAO,KAAK,SAAS;YACrB,IAAI,KAAK,eAAe;YACxB,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YAElC,MAAM,IAAI,YAAY,CACpB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mCAAmC,IAAI,iCAAiC,MAAM,oBAAoB,CACxH,CAAC;QACJ,IAAI,CAAC,KAAK,MAAM;YAAE,MAAM,IAAI,YAAY,CAAC,GAAG,MAAM,sBAAsB,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YAC7C,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,YAAY,CAAC,GAAG,MAAM,KAAK,IAAI,uBAAuB,CAAC,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAA8B;IAC7D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAmB,KAAK;IACpD,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,CAAmB,EAAE,EAAE,CAClC,UAAU,CAAC,QAAQ,CAAC;SACjB,MAAM,CACL,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CACzF;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,KAAK,UAAU,IAAI,CAAC,CAAmB;QACrC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,IAAI,eAAe,MAAM,QAAQ,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBAC3G,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa;aACtC,CAAC;YACF,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAqE,CAAC;QAC5F,IAAI,CAAC,GAAG,CAAC,EAAE;YACT,MAAM,IAAI,YAAY,CACpB,gCAAgC,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,4GAA4G,CAC3M,CAAC;QACJ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YAC5E,MAAM,IAAI,YAAY,CAAC,8CAA8C,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB;SAC5F,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,CAAmB,EAAE,MAAc,EAAE,OAAsB;QAC7E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE;YACrE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC9E;YACD,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3E,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAmB,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;QAChD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;YAClD,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY;gBAC7C,MAAM,IAAI,YAAY,CAAC,sDAAsD,CAAC,CAAC;YACjF,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;gBACtC,MAAM,IAAI,YAAY,CAAC,GAAG,SAAS,8BAA8B,CAAC,CAAC;YACrE,MAAM,IAAI,GAAqB;gBAC7B,MAAM,EAAE;oBACN,IAAI;oBACJ,MAAM;oBACN,OAAO,EAAE,GAAG,IAAI,IAAI,MAAM,EAAE;oBAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAChC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD;gBACD,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE;aAC1F,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzB,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI;QAEJ,MAAM,EAAE;YACN,oFAAoF;YACpF,KAAK,CAAC,MAAM,CAAC,UAAU;gBACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;oBACjC,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,wBAAwB,UAAU,CAAC,MAAM,CAAC,MAAM,kBAAkB;iBACzE,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAC1C,MAAM,IAAI,YAAY,CACpB,oCAAoC,GAAG,CAAC,MAAM,kJAAkJ,CACjM,CAAC;gBACJ,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;oBACvC,MAAM,IAAI,YAAY,CACpB,oBAAoB,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,iBAAiB,EAAE,CAChF,CAAC;gBACJ,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACjF,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,UAAU;gBACtB,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/packages/connector-kit/src/branding.d.ts

@@ -0,0 +1,57 @@
+import { z } from "zod";
+export declare const brandingSchema: z.ZodObject<{
+    productName: z.ZodDefault<z.ZodString>;
+    logoUrl: z.ZodOptional<z.ZodURL>;
+    resourcePrefix: z.ZodDefault<z.ZodString>;
+    microsoft: z.ZodDefault<z.ZodObject<{
+        appName: z.ZodDefault<z.ZodString>;
+        mailboxGroup: z.ZodDefault<z.ZodString>;
+        mailboxGroupAlias: z.ZodDefault<z.ZodString>;
+        botRole: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>>;
+    teams: z.ZodDefault<z.ZodObject<{
+        resourceGroup: z.ZodDefault<z.ZodString>;
+        developer: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            websiteUrl: z.ZodURL;
+            privacyUrl: z.ZodURL;
+            termsOfUseUrl: z.ZodURL;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type Branding = z.infer<typeof brandingSchema>;
+export type BrandingInput = z.input<typeof brandingSchema>;
+export declare const DEFAULT_BRANDING: Branding;
+export declare function parseBranding(raw: unknown): Branding;
+export declare const brand: () => {
+    productName: string;
+    resourcePrefix: string;
+    microsoft: {
+        appName: string;
+        mailboxGroup: string;
+        mailboxGroupAlias: string;
+        botRole: string;
+    };
+    teams: {
+        resourceGroup: string;
+        developer?: {
+            name: string;
+            websiteUrl: string;
+            privacyUrl: string;
+            termsOfUseUrl: string;
+        } | undefined;
+    };
+    logoUrl?: string | undefined;
+};
+export declare function setBranding(b: Branding): void;
+/** Fills `{brand.a.b}` placeholders; one naming no text field of the branding throws. */
+export declare function fillBrand(text: string, b?: Branding): string;
+/** fillBrand over every string in a parsed JSON value. */
+export declare function fillBrandDeep<T>(value: T, b?: Branding): T;
+/** The Teams manifest's developer, which a package needs. */
+export declare function teamsDeveloper(b?: Branding): {
+    name: string;
+    websiteUrl: string;
+    privacyUrl: string;
+    termsOfUseUrl: string;
+};

package/dist/packages/connector-kit/src/branding.js

@@ -0,0 +1,102 @@
+import { z } from "zod";
+import { ConnectError } from "./types.js";
+// The names this deployment shows and creates: in copy, in the connectors' steps (as
+// {brand.*} placeholders) and in what it makes in a customer's tenant. The names it creates
+// (mailbox group, Azure role, resource group, bot and app names) must not change once
+// customers have made them, so an install sets them once.
+const https = z.url({ protocol: /^https$/ });
+// Names go into copy and into PowerShell strings, double- and single-quoted, so none of
+// $ " ' ` { } < >.
+const nameText = z
+    .string()
+    .trim()
+    .regex(/^[\p{L}\p{N} .,&()-]{1,80}$/u);
+const name = (fallback) => nameText.default(fallback);
+export const brandingSchema = z.strictObject({
+    productName: name("Enterprise Agent Connect"),
+    logoUrl: https.optional(),
+    // Prefix of what it names in a tenant (bot app `<prefix>-bot-<id>`, Azure Bot `<prefix>-<8>`).
+    resourcePrefix: z
+        .string()
+        .regex(/^[a-z][a-z0-9-]{1,20}$/)
+        .default("eac"),
+    microsoft: z
+        .strictObject({
+        appName: name("Enterprise Agent Connect"),
+        mailboxGroup: name("Agent Mailboxes"),
+        mailboxGroupAlias: z
+            .string()
+            .regex(/^[a-z0-9-]{1,64}$/)
+            .default("agent-mailboxes"),
+        botRole: name("Agent Connect bots"),
+    })
+        .default({
+        appName: "Enterprise Agent Connect",
+        mailboxGroup: "Agent Mailboxes",
+        mailboxGroupAlias: "agent-mailboxes",
+        botRole: "Agent Connect bots",
+    }),
+    teams: z
+        .strictObject({
+        resourceGroup: z
+            .string()
+            .regex(/^[A-Za-z0-9._()-]{1,90}$/)
+            .default("agent-connect"),
+        // The Teams app manifest's developer. Unset: no Teams package can be made until it is.
+        developer: z
+            .strictObject({
+            name: nameText.max(32),
+            websiteUrl: https,
+            privacyUrl: https,
+            termsOfUseUrl: https,
+        })
+            .optional(),
+    })
+        .default({ resourceGroup: "agent-connect" }),
+});
+export const DEFAULT_BRANDING = brandingSchema.parse({});
+export function parseBranding(raw) {
+    const parsed = brandingSchema.safeParse(raw ?? {});
+    if (!parsed.success)
+        throw new Error(`branding: ${z.prettifyError(parsed.error)}`);
+    return parsed.data;
+}
+// ponytail: one branding per process (set by createAgentConnect before anything reads it);
+// thread it through the deps if two differently branded instances must share a process.
+let current = DEFAULT_BRANDING;
+let set = false;
+export const brand = () => current;
+export function setBranding(b) {
+    if (set && JSON.stringify(b) !== JSON.stringify(current))
+        throw new Error("This process already runs with another branding");
+    current = b;
+    set = true;
+}
+/** Fills `{brand.a.b}` placeholders; one naming no text field of the branding throws. */
+export function fillBrand(text, b = current) {
+    return text.replace(/\{brand\.([A-Za-z.]+)\}/g, (whole, path) => {
+        let v = b;
+        for (const part of path.split("."))
+            v = v?.[part];
+        if (typeof v !== "string")
+            throw new Error(`${whole} names no branding text`);
+        return v;
+    });
+}
+/** fillBrand over every string in a parsed JSON value. */
+export function fillBrandDeep(value, b = current) {
+    if (typeof value === "string")
+        return fillBrand(value, b);
+    if (Array.isArray(value))
+        return value.map((v) => fillBrandDeep(v, b));
+    if (value && typeof value === "object")
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, fillBrandDeep(v, b)]));
+    return value;
+}
+/** The Teams manifest's developer, which a package needs. */
+export function teamsDeveloper(b = current) {
+    if (!b.teams.developer)
+        throw new ConnectError("Set branding.teams.developer (name and https website, privacy and terms addresses) to make Teams packages");
+    return b.teams.developer;
+}
+//# sourceMappingURL=branding.js.map

package/dist/packages/connector-kit/src/branding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../../../packages/connector-kit/src/branding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,qFAAqF;AACrF,4FAA4F;AAC5F,sFAAsF;AACtF,0DAA0D;AAE1D,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AAC7C,wFAAwF;AACxF,mBAAmB;AACnB,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,8BAA8B,CAAC,CAAC;AACzC,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,WAAW,EAAE,IAAI,CAAC,0BAA0B,CAAC;IAC7C,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE;IACzB,+FAA+F;IAC/F,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,KAAK,CAAC,wBAAwB,CAAC;SAC/B,OAAO,CAAC,KAAK,CAAC;IACjB,SAAS,EAAE,CAAC;SACT,YAAY,CAAC;QACZ,OAAO,EAAE,IAAI,CAAC,0BAA0B,CAAC;QACzC,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC;QACrC,iBAAiB,EAAE,CAAC;aACjB,MAAM,EAAE;aACR,KAAK,CAAC,mBAAmB,CAAC;aAC1B,OAAO,CAAC,iBAAiB,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC;KACpC,CAAC;SACD,OAAO,CAAC;QACP,OAAO,EAAE,0BAA0B;QACnC,YAAY,EAAE,iBAAiB;QAC/B,iBAAiB,EAAE,iBAAiB;QACpC,OAAO,EAAE,oBAAoB;KAC9B,CAAC;IACJ,KAAK,EAAE,CAAC;SACL,YAAY,CAAC;QACZ,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,KAAK,CAAC,0BAA0B,CAAC;aACjC,OAAO,CAAC,eAAe,CAAC;QAC3B,uFAAuF;QACvF,SAAS,EAAE,CAAC;aACT,YAAY,CAAC;YACZ,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,KAAK;SACrB,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,OAAO,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;CAC/C,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,gBAAgB,GAAa,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAEnE,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,2FAA2F;AAC3F,wFAAwF;AACxF,IAAI,OAAO,GAAG,gBAAgB,CAAC;AAC/B,IAAI,GAAG,GAAG,KAAK,CAAC;AAEhB,MAAM,CAAC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;AAEnC,MAAM,UAAU,WAAW,CAAC,CAAW;IACrC,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC,CAAC;IACZ,GAAG,GAAG,IAAI,CAAC;AACb,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAc,OAAO;IAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QACtE,IAAI,CAAC,GAAY,CAAC,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,CAAC,GAAI,CAAyC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3F,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAI,KAAQ,EAAE,IAAc,OAAO;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,KAAK,EAAE,CAAC,CAAM,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAM,CAAC;IAC5E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;IAClG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,IAAc,OAAO;IAClD,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;QACpB,MAAM,IAAI,YAAY,CACpB,2GAA2G,CAC5G,CAAC;IACJ,OAAO,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;AAC3B,CAAC"}

package/dist/packages/connector-kit/src/certificate.d.ts

@@ -0,0 +1,19 @@
+export type NewCertificate = {
+    certificate: string;
+    privateKey: string;
+};
+export declare function newCertificate(commonName: string, now?: Date): NewCertificate;
+/** What the admin sees of a certificate: Entra lists it by its SHA-1 thumbprint. */
+export declare function describeCertificate(pem: string): {
+    thumbprint: string;
+    expiresAt: string;
+};
+/** A signed client assertion (RFC 7523) for Microsoft's token endpoint, valid five minutes.
+ *  Microsoft pairs the x5t#S256 header with PS256 (RSA-PSS). */
+export declare function clientAssertion(input: {
+    clientId: string;
+    tokenUrl: string;
+    certificate: string;
+    privateKey: string;
+    now?: number;
+}): string;

package/dist/packages/connector-kit/src/certificate.js

@@ -0,0 +1,84 @@
+import { constants, createHash, generateKeyPairSync, randomBytes, randomUUID, sign, X509Certificate, } from "node:crypto";
+// A key pair the service makes for one connection: the private key is sealed with the connection's
+// credential and never leaves the service; the self-signed certificate is what the admin
+// uploads to their own app registration. Node can parse X.509 but not create it, so the
+// certificate's DER is written here (RFC 5280, no extensions).
+const VALID_DAYS = 730;
+function der(tag, ...parts) {
+    const body = Buffer.concat(parts);
+    let length;
+    if (body.length < 0x80)
+        length = Buffer.from([body.length]);
+    else {
+        const bytes = [];
+        for (let n = body.length; n > 0; n = Math.floor(n / 256))
+            bytes.unshift(n % 256);
+        length = Buffer.from([0x80 | bytes.length, ...bytes]);
+    }
+    return Buffer.concat([Buffer.from([tag]), length, body]);
+}
+const seq = (...parts) => der(0x30, ...parts);
+function oid(dotted) {
+    const [a, b, ...rest] = dotted.split(".").map(Number);
+    const bytes = [40 * a + b];
+    for (const n of rest) {
+        const chunk = [n & 0x7f];
+        for (let v = n >> 7; v > 0; v >>= 7)
+            chunk.unshift((v & 0x7f) | 0x80);
+        bytes.push(...chunk);
+    }
+    return der(0x06, Buffer.from(bytes));
+}
+// UTCTime, YYMMDDHHMMSSZ: valid for dates before 2050.
+const utcTime = (d) => der(0x17, Buffer.from(d.toISOString().replace(/[-:T]/g, "").slice(2, 14) + "Z"));
+const name = (cn) => seq(der(0x31, seq(oid("2.5.4.3"), der(0x0c, Buffer.from(cn, "utf8")))));
+export function newCertificate(commonName, now = new Date()) {
+    const { privateKey, publicKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+    const serial = randomBytes(16);
+    serial[0] = (serial[0] & 0x7f) | 0x01;
+    const sha256WithRsa = seq(oid("1.2.840.113549.1.1.11"), der(0x05));
+    const tbs = seq(der(0xa0, der(0x02, Buffer.from([2]))), der(0x02, serial), sha256WithRsa, name(commonName), seq(utcTime(now), utcTime(new Date(now.getTime() + VALID_DAYS * 86_400_000))), name(commonName), publicKey.export({ type: "spki", format: "der" }));
+    const signature = sign("sha256", tbs, privateKey);
+    const cert = seq(tbs, sha256WithRsa, der(0x03, Buffer.from([0]), signature));
+    const lines = cert.toString("base64").match(/.{1,64}/g);
+    return {
+        certificate: `-----BEGIN CERTIFICATE-----\n${lines.join("\n")}\n-----END CERTIFICATE-----\n`,
+        privateKey: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    };
+}
+/** What the admin sees of a certificate: Entra lists it by its SHA-1 thumbprint. */
+export function describeCertificate(pem) {
+    const cert = new X509Certificate(pem);
+    return {
+        thumbprint: cert.fingerprint.replaceAll(":", ""),
+        expiresAt: new Date(cert.validTo).toISOString(),
+    };
+}
+const b64url = (v) => Buffer.from(v).toString("base64url");
+/** A signed client assertion (RFC 7523) for Microsoft's token endpoint, valid five minutes.
+ *  Microsoft pairs the x5t#S256 header with PS256 (RSA-PSS). */
+export function clientAssertion(input) {
+    const raw = new X509Certificate(input.certificate).raw;
+    const now = Math.floor((input.now ?? Date.now()) / 1000);
+    const header = b64url(JSON.stringify({
+        alg: "PS256",
+        typ: "JWT",
+        "x5t#S256": b64url(createHash("sha256").update(raw).digest()),
+    }));
+    const payload = b64url(JSON.stringify({
+        aud: input.tokenUrl,
+        iss: input.clientId,
+        sub: input.clientId,
+        jti: randomUUID(),
+        nbf: now,
+        iat: now,
+        exp: now + 300,
+    }));
+    const signature = sign("sha256", Buffer.from(`${header}.${payload}`), {
+        key: input.privateKey,
+        padding: constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
+    });
+    return `${header}.${payload}.${b64url(signature)}`;
+}
+//# sourceMappingURL=certificate.js.map

package/dist/packages/connector-kit/src/certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../../../../packages/connector-kit/src/certificate.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,UAAU,EACV,IAAI,EACJ,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,mGAAmG;AACnG,yFAAyF;AACzF,wFAAwF;AACxF,+DAA+D;AAE/D,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,SAAS,GAAG,CAAC,GAAW,EAAE,GAAG,KAAe;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAc,CAAC;IACnB,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;SACvD,CAAC;QACJ,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC;YAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACjF,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAG,KAAe,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;AAExD,SAAS,GAAG,CAAC,MAAc;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,uDAAuD;AACvD,MAAM,OAAO,GAAG,CAAC,CAAO,EAAE,EAAE,CAC1B,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAEnF,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAC1B,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAI1E,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACjE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACtC,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CACb,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACtC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EACjB,aAAa,EACb,IAAI,CAAC,UAAU,CAAC,EAChB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,EAC7E,IAAI,CAAC,UAAU,CAAC,EAChB,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAClD,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC;IACzD,OAAO;QACL,WAAW,EAAE,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;QAC5F,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3E,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;QAChD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE5E;gEACgE;AAChE,MAAM,UAAU,eAAe,CAAC,KAM/B;IACC,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,CACnB,IAAI,CAAC,SAAS,CAAC;QACb,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;QACV,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;KAC9D,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CACpB,IAAI,CAAC,SAAS,CAAC;QACb,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,GAAG,EAAE,UAAU,EAAE;QACjB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,GAAG;KACf,CAAC,CACH,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,EAAE;QACpE,GAAG,EAAE,KAAK,CAAC,UAAU;QACrB,OAAO,EAAE,SAAS,CAAC,qBAAqB;QACxC,UAAU,EAAE,SAAS,CAAC,sBAAsB;KAC7C,CAAC,CAAC;IACH,OAAO,GAAG,MAAM,IAAI,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;AACrD,CAAC"}

package/dist/packages/connector-kit/src/common.d.ts

@@ -0,0 +1,40 @@
+import type { CallToolResult, McpServer } from "@modelcontextprotocol/server";
+import type { Limits } from "../../server/src/store.js";
+import type { TeamsAccess } from "../../server/src/teams/runtime.js";
+import type { VendorRequest, VendorResponse } from "./types.js";
+export type ToolContext = {
+    limits: Limits;
+    /** The connection's settings, e.g. the sites it was connected with. */
+    config: Record<string, string>;
+    call(request: VendorRequest): Promise<VendorResponse>;
+    /** Per tool: what to add to a 403 from the app (its capability's `forbidden`). */
+    forbidden?: Record<string, string>;
+    /** Teams only: the agent's own bot. */
+    teams?: TeamsAccess;
+    audit(entry: {
+        tool: string;
+        target: string | null;
+        decision: "allowed" | "denied" | "failed";
+        reason: string | null;
+        vendorStatus: number | null;
+    }): Promise<void>;
+};
+export type Toolset = {
+    names: readonly string[];
+    register(server: McpServer, ctx: ToolContext, allowed: ReadonlySet<string>): void;
+};
+/** One app's tools from several sets, e.g. SharePoint's files and spreadsheets. */
+export declare const toolsets: (...sets: Toolset[]) => Toolset;
+export declare class Denied extends Error {
+}
+export declare class VendorFailed extends Error {
+    readonly status: number;
+    readonly hintTool?: string | undefined;
+    constructor(status: number, message: string, hintTool?: string | undefined);
+}
+export declare function listLimit(limits: Limits, id: string): string[] | null;
+export declare function mapLimit(limits: Limits, id: string): Record<string, string> | null;
+export declare function textLimit(limits: Limits, id: string): string | null;
+export declare const argumentsTarget: (args: unknown) => string | null;
+export declare const json: (data: unknown) => CallToolResult;
+export declare function audited(ctx: ToolContext, tool: string, target: string | null, run: (vendorStatus: (status: number) => void, retarget: (sent: string) => void) => Promise<CallToolResult>): Promise<CallToolResult>;

package/dist/packages/connector-kit/src/common.js

@@ -0,0 +1,107 @@
+/** One app's tools from several sets, e.g. SharePoint's files and spreadsheets. */
+export const toolsets = (...sets) => ({
+    names: sets.flatMap((s) => s.names),
+    register: (server, ctx, allowed) => sets.forEach((s) => s.register(server, ctx, allowed)),
+});
+// Refusal of a call the grant does not cover. Its message is returned to the agent.
+export class Denied extends Error {
+}
+// Non-2xx answer from the app. Its message is returned to the agent. `hintTool`: a call a tool
+// makes under another capability (always-on reads, say) names a tool of that capability, whose
+// `forbidden` is then the hint added to a 403.
+export class VendorFailed extends Error {
+    status;
+    hintTool;
+    constructor(status, message, hintTool) {
+        super(message);
+        this.status = status;
+        this.hintTool = hintTool;
+    }
+}
+export function listLimit(limits, id) {
+    const value = limits[id];
+    if (value === undefined)
+        return null;
+    if (!Array.isArray(value))
+        throw new Error(`Limit ${id} must be a list`);
+    return value.length ? value : null;
+}
+export function mapLimit(limits, id) {
+    const value = limits[id];
+    if (value === undefined)
+        return null;
+    if (typeof value !== "object" || Array.isArray(value))
+        throw new Error(`Limit ${id} must be a map`);
+    return Object.keys(value).length ? value : null;
+}
+export function textLimit(limits, id) {
+    const value = limits[id];
+    if (value === undefined || value === "")
+        return null;
+    if (typeof value !== "string")
+        throw new Error(`Limit ${id} must be text`);
+    return value;
+}
+// The audit target of a call refused before any tool ran: what it was sent, shortened.
+export const argumentsTarget = (args) => args === undefined ? null : JSON.stringify(args).slice(0, 300);
+export const json = (data) => ({
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+});
+// Runs one tool call and writes its audit row whatever the outcome. `retarget` replaces the
+// audited target with what was actually sent, e.g. the project-scoped JQL.
+export async function audited(ctx, tool, target, run) {
+    let status = null;
+    const fail = (text) => ({
+        isError: true,
+        content: [{ type: "text", text }],
+    });
+    let result;
+    try {
+        result = await run((s) => (status = s), (sent) => (target = sent));
+    }
+    catch (error) {
+        if (error instanceof Denied) {
+            await ctx.audit({
+                tool,
+                target,
+                decision: "denied",
+                reason: error.message,
+                // Set when the app answered and the answer was refused, e.g. by an answer limit.
+                vendorStatus: status,
+            });
+            return fail(error.message);
+        }
+        if (error instanceof VendorFailed) {
+            const hint = error.status === 403 ? ctx.forbidden?.[error.hintTool ?? tool] : undefined;
+            const message = hint ? `${error.message.replace(/\.$/, "")}. ${hint}` : error.message;
+            await ctx.audit({
+                tool,
+                target,
+                decision: "failed",
+                reason: message.slice(0, 500),
+                vendorStatus: error.status,
+            });
+            return fail(message);
+        }
+        // Internal details (database, keys, config) stay in the log, not with the agent.
+        console.error(`[agent-connect] ${tool} failed`, error);
+        await ctx.audit({
+            tool,
+            target,
+            decision: "failed",
+            reason: "Internal error",
+            vendorStatus: status,
+        });
+        return fail("The call failed. Try again later.");
+    }
+    // The call already happened (mail sent, record deleted): a failed audit write must not
+    // tell the agent to repeat it.
+    try {
+        await ctx.audit({ tool, target, decision: "allowed", reason: null, vendorStatus: status });
+    }
+    catch (error) {
+        console.error(`[agent-connect] ${tool} audit write failed after a completed call`, error);
+    }
+    return result;
+}
+//# sourceMappingURL=common.js.map

package/dist/packages/connector-kit/src/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../packages/connector-kit/src/common.ts"],"names":[],"mappings":"AA+BA,mFAAmF;AACnF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAe,EAAW,EAAE,CAAC,CAAC;IACxD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACnC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;CAC1F,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,OAAO,MAAO,SAAQ,KAAK;CAAG;AAEpC,+FAA+F;AAC/F,+FAA+F;AAC/F,+CAA+C;AAC/C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAE1B;IAEA;IAHX,YACW,MAAc,EACvB,OAAe,EACN,QAAiB;QAE1B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QAEd,aAAQ,GAAR,QAAQ,CAAS;IAG5B,CAAC;CACF;AAED,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,EAAU;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,EAAU;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,EAAU;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAa,EAAiB,EAAE,CAC9D,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAkB,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;CACjE,CAAC,CAAC;AAEH,4FAA4F;AAC5F,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAgB,EAChB,IAAY,EACZ,MAAqB,EACrB,GAG4B;IAE5B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAkB,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EACnB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAC1B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,MAAM,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC,KAAK,CAAC;gBACd,IAAI;gBACJ,MAAM;gBACN,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,iFAAiF;gBACjF,YAAY,EAAE,MAAM;aACrB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;YACtF,MAAM,GAAG,CAAC,KAAK,CAAC;gBACd,IAAI;gBACJ,MAAM;gBACN,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC7B,YAAY,EAAE,KAAK,CAAC,MAAM;aAC3B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,iFAAiF;QACjF,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,SAAS,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,GAAG,CAAC,KAAK,CAAC;YACd,IAAI;YACJ,MAAM;YACN,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;YACxB,YAAY,EAAE,MAAM;SACrB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IACD,uFAAuF;IACvF,+BAA+B;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,4CAA4C,EAAE,KAAK,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}