@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.2-dev.d2aa5ca

package/dist/packages/server/src/teams/claude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../../../../packages/server/src/teams/claude.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wCAAwC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAsCnE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,OAAO,EAAE,CAAC;AAEvF;;wFAEwF;AACxF,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAe;IAC1D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/C,OAAO,CAAC,GAAW,EAA0B,EAAE;QAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACvD,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED;;;yFAGyF;AACzF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAuD;IAEvD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,YAAY,CAAC,gEAAgE,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;QAC/C,MAAM,IAAI,YAAY,CACpB,mCAAmC,KAAK,EAAE,CAAC,WAAW,kBAAkB,GAAG,GAAG,CAC/E,CAAC;IACJ,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IAC7D,IAAI,KAAK;QACP,MAAM,IAAI,YAAY,CACpB,sCAAsC,KAAK,EAAE,CAAC,WAAW,aAAa,KAAK,gBAAgB,GAAG,GAAG,CAClG,CAAC;IACJ,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,gCAAgC,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;QAC/D,IAAI,OAAO;YACT,MAAM,IAAI,YAAY,CACpB,SAAS,EAAE,iCAAiC,KAAK,EAAE,CAAC,WAAW,aAAa,OAAO,4CAA4C,CAChI,CAAC;QACJ,QAAQ,KAAK,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,YAAY,CACpB,wCAAwC,GAAG,sBAAsB,KAAK,EAAE,CAAC,WAAW,cAAc,CACnG,CAAC;AACN,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,SAAS,CAAC,aAAa,CAAC;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAkB,CAAC,MAAM,EAAE,EAAE;IACpD,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,OAAO;QACL,KAAK,CAAC,UAAU;YACd,MAAM,GAAG,GAAmC,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;oBACxD,IAAI,CAAC,CAAC,CAAC,WAAW;wBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,KAAK,YAAY,SAAS,CAAC,mBAAmB;oBAC9C,KAAK,YAAY,SAAS,CAAC,qBAAqB;oBAEhD,MAAM,IAAI,YAAY,CAAC,gCAAgC,CAAC,CAAC;gBAC3D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,EAAE;YACZ,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACjD,OAAO,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACrF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,QAAQ,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACjC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,EAAE;YACZ,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACjD,IAAI,KAAK,CAAC,WAAW;oBAAE,OAAO,IAAI,CAAC;gBACnC,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAAa,EAAE,CAAC;gBAChC,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC3D,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBACpC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe;wBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC9E,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,QAAQ,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACjC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,EAAE;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACzC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,QAAQ,CAAC,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAClC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,KAAK;YACvB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC7C,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,cAAc,EAAE,KAAK,CAAC,aAAa;gBACnC,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,MAAM,EAAE;oBACN,IAAI,EAAE,OAAO;oBACb,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;iBACtE;gBACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;aAC1F,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW;YAC5C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;YACtD,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE;gBACxC,MAAM,EAAE;oBACN,IAAI,EAAE,OAAO;oBACb,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;iBACxE;aACF,CAAC,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE;gBAC7C,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;aACtE,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAS;YACrB,IAAI,CAAC,CAAC;YACN,IAAI,CAAC;gBACH,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,QAAQ,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACjC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC;YAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,OAAO;gBACL,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,SAAS;gBACT,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK;aAC7E,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,SAAS;YACvB,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/packages/server/src/teams/jwt.d.ts

@@ -0,0 +1,17 @@
+import type { Fetch } from "../../../connector-kit/src/types.js";
+export declare const BOT_ISSUER = "https://api.botframework.com";
+export declare class Unauthorized extends Error {
+}
+export declare function botFrameworkAuth(fetchImpl?: Fetch, now?: () => number): {
+    token: (authorization: string | null, appId: string) => Promise<(activity: {
+        serviceUrl: string;
+        channelId: string;
+    }) => void>;
+    /** Both checks at once: the token, then the activity it came with. */
+    verify(authorization: string | null, expect: {
+        appId: string;
+        serviceUrl: string;
+        channelId: string;
+    }): Promise<void>;
+};
+export type BotAuth = ReturnType<typeof botFrameworkAuth>;

package/dist/packages/server/src/teams/jwt.js

@@ -0,0 +1,121 @@
+import { createPublicKey, verify } from "node:crypto";
+// Checks the token Teams sends with every request to a bot's endpoint, as Microsoft documents
+// for the Bot Connector (docs/teams.md 2.2). Every check is required; none can be turned off.
+const METADATA = "https://login.botframework.com/v1/.well-known/openidconfiguration";
+export const BOT_ISSUER = "https://api.botframework.com";
+const SKEW_S = 300;
+const REFRESH_MS = 24 * 3600_000;
+const REFETCH_MIN_MS = 60_000;
+// A request that fails a check. Answered 403 with nothing recorded but a log line.
+export class Unauthorized extends Error {
+}
+const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const b64json = (part) => JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+export function botFrameworkAuth(fetchImpl = fetch, now = () => Date.now()) {
+    let keys = new Map();
+    let algorithms = [];
+    let loadedAt = 0;
+    let lastFetch = -Infinity;
+    let inflight = null;
+    // One fetch at a time, shared by every request waiting on it.
+    function refresh() {
+        inflight ??= load().finally(() => (inflight = null));
+        return inflight;
+    }
+    async function load() {
+        lastFetch = now();
+        const meta = (await (await fetchImpl(METADATA)).json());
+        if (!meta.jwks_uri?.startsWith("https://login.botframework.com/"))
+            throw new Error("Bot Framework metadata has an unexpected jwks_uri");
+        const set = (await (await fetchImpl(meta.jwks_uri)).json());
+        const next = new Map();
+        for (const jwk of set.keys ?? []) {
+            if (!jwk.kid || jwk.kty !== "RSA" || !jwk.n || !jwk.e)
+                continue;
+            next.set(jwk.kid, {
+                key: createPublicKey({ key: { kty: "RSA", n: jwk.n, e: jwk.e }, format: "jwk" }),
+                endorsements: Array.isArray(jwk.endorsements)
+                    ? jwk.endorsements.filter((e) => typeof e === "string")
+                    : [],
+            });
+        }
+        keys = next;
+        algorithms = meta.id_token_signing_alg_values_supported ?? [];
+        loadedAt = now();
+    }
+    // Refreshed daily; an unknown key id refetches at most once a minute (key rollover). A
+    // failed daily refresh keeps the keys already held (Microsoft rolls them over weeks apart)
+    // and is retried at most once a minute.
+    async function signingKey(kid) {
+        if (now() - loadedAt > REFRESH_MS && now() - lastFetch >= REFETCH_MIN_MS) {
+            try {
+                await refresh();
+            }
+            catch (error) {
+                if (!keys.size)
+                    throw error;
+                console.error("[agent-connect] Bot Framework key refresh failed; using the keys held", error);
+            }
+        }
+        let found = keys.get(kid);
+        if (!found && now() - lastFetch >= REFETCH_MIN_MS) {
+            await refresh();
+            found = keys.get(kid);
+        }
+        if (!found)
+            throw new Unauthorized("unknown signing key");
+        return found;
+    }
+    /** Throws Unauthorized unless the bearer token is Microsoft's and for this bot. Returns the
+     *  check that the activity, read only after this, is the one the token was issued for. */
+    async function token(authorization, appId) {
+        if (!authorization?.startsWith("Bearer "))
+            throw new Unauthorized("no bearer token");
+        const parts = authorization.slice(7).split(".");
+        if (parts.length !== 3)
+            throw new Unauthorized("malformed token");
+        let header;
+        let claims;
+        try {
+            header = b64json(parts[0]);
+            claims = b64json(parts[1]);
+            if (!isObject(header) || !isObject(claims))
+                throw new Error("not an object");
+        }
+        catch {
+            throw new Unauthorized("malformed token");
+        }
+        if (header.alg !== "RS256" || !header.kid)
+            throw new Unauthorized("unexpected algorithm");
+        const { key, endorsements } = await signingKey(header.kid);
+        if (!algorithms.includes(header.alg))
+            throw new Unauthorized("unexpected algorithm");
+        const signed = verify("sha256", Buffer.from(`${parts[0]}.${parts[1]}`), key, Buffer.from(parts[2], "base64url"));
+        if (!signed)
+            throw new Unauthorized("bad signature");
+        if (claims.iss !== BOT_ISSUER)
+            throw new Unauthorized("wrong issuer");
+        if (claims.aud !== appId)
+            throw new Unauthorized("wrong audience");
+        const t = Math.floor(now() / 1000);
+        if (typeof claims.exp !== "number" || claims.exp + SKEW_S < t)
+            throw new Unauthorized("expired");
+        if (typeof claims.nbf === "number" && claims.nbf - SKEW_S > t)
+            throw new Unauthorized("not yet valid");
+        return (activity) => {
+            // Microsoft names this claim in lowercase.
+            if (claims.serviceurl !== activity.serviceUrl)
+                throw new Unauthorized("serviceUrl does not match the token");
+            if (activity.channelId !== "msteams" || !endorsements.includes(activity.channelId))
+                throw new Unauthorized("key not endorsed for this channel");
+        };
+    }
+    return {
+        token,
+        /** Both checks at once: the token, then the activity it came with. */
+        async verify(authorization, expect) {
+            (await token(authorization, expect.appId))(expect);
+        },
+    };
+}
+//# sourceMappingURL=jwt.js.map

package/dist/packages/server/src/teams/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../../../packages/server/src/teams/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAGtE,8FAA8F;AAC9F,8FAA8F;AAE9F,MAAM,QAAQ,GAAG,mEAAmE,CAAC;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAC;AACzD,MAAM,MAAM,GAAG,GAAG,CAAC;AACnB,MAAM,UAAU,GAAG,EAAE,GAAG,QAAQ,CAAC;AACjC,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,mFAAmF;AACnF,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAK1C,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE3D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAE9F,MAAM,UAAU,gBAAgB,CAAC,YAAmB,KAAK,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IAC/E,IAAI,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IACzC,IAAI,UAAU,GAAa,EAAE,CAAC;IAC9B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAAS,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAE1C,8DAA8D;IAC9D,SAAS,OAAO;QACd,QAAQ,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,IAAI;QACjB,SAAS,GAAG,GAAG,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAGrD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,iCAAiC,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAqB,CAAC;QAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAAE,SAAS;YAChE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;gBAChB,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAChF,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;oBAC3C,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACpE,CAAC,CAAC,EAAE;aACP,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,IAAI,CAAC;QACZ,UAAU,GAAG,IAAI,CAAC,qCAAqC,IAAI,EAAE,CAAC;QAC9D,QAAQ,GAAG,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,uFAAuF;IACvF,2FAA2F;IAC3F,wCAAwC;IACxC,KAAK,UAAU,UAAU,CAAC,GAAW;QACnC,IAAI,GAAG,EAAE,GAAG,QAAQ,GAAG,UAAU,IAAI,GAAG,EAAE,GAAG,SAAS,IAAI,cAAc,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,MAAM,KAAK,CAAC;gBAC5B,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,GAAG,SAAS,IAAI,cAAc,EAAE,CAAC;YAClD,MAAM,OAAO,EAAE,CAAC;YAChB,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;8FAC0F;IAC1F,KAAK,UAAU,KAAK,CAClB,aAA4B,EAC5B,KAAa;QAEb,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAClE,IAAI,MAAsC,CAAC;QAC3C,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAC1F,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,CACnB,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EACtC,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,YAAY,CAAC,eAAe,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU;YAAE,MAAM,IAAI,YAAY,CAAC,cAAc,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACnC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC;YAC3D,MAAM,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC;YAC3D,MAAM,IAAI,YAAY,CAAC,eAAe,CAAC,CAAC;QAC1C,OAAO,CAAC,QAAQ,EAAE,EAAE;YAClB,2CAA2C;YAC3C,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;gBAC3C,MAAM,IAAI,YAAY,CAAC,qCAAqC,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAChF,MAAM,IAAI,YAAY,CAAC,mCAAmC,CAAC,CAAC;QAChE,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK;QACL,sEAAsE;QACtE,KAAK,CAAC,MAAM,CACV,aAA4B,EAC5B,MAAgE;YAEhE,CAAC,MAAM,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/packages/server/src/teams/package.d.ts

@@ -0,0 +1,79 @@
+export declare const MANIFEST_VERSION = "1.24";
+export declare const RSC_PERMISSIONS: string[];
+export type PackageInput = {
+    displayName: string;
+    teamsAppId: string;
+    botAppId: string;
+    manifestVersion: number;
+    publicUrl: string;
+};
+export declare function manifest(input: PackageInput): {
+    $schema: string;
+    manifestVersion: string;
+    version: string;
+    id: string;
+    developer: {
+        name: string;
+        websiteUrl: string;
+        privacyUrl: string;
+        termsOfUseUrl: string;
+    };
+    name: {
+        short: string;
+        full: string;
+    };
+    description: {
+        short: string;
+        full: string;
+    };
+    icons: {
+        color: string;
+        outline: string;
+    };
+    accentColor: string;
+    bots: {
+        botId: string;
+        scopes: string[];
+        isNotificationOnly: boolean;
+        supportsFiles: boolean;
+    }[];
+    webApplicationInfo: {
+        id: string;
+        resource: string;
+    };
+    authorization: {
+        permissions: {
+            resourceSpecific: {
+                name: string;
+                type: string;
+            }[];
+        };
+    };
+};
+export declare function packageZip(input: PackageInput): Buffer;
+/** Up to two characters: the first letters of the first two words, else "AI". */
+export declare function initials(name: string): string;
+/** 192×192, the initials in white on the agent's color. */
+export declare function colorIcon(name: string): Buffer;
+/** 32×32, only white and transparent pixels, as Teams requires. */
+export declare function outlineIcon(name: string): Buffer;
+/** One PowerShell script that creates the agent's bot in the customer's tenant: app
+ *  registration with the service's certificate, Azure Bot with the Teams channel, and the
+ *  Teams app in the organization's catalog. The admin pastes the printed application ID back. */
+export declare function setupScript(input: {
+    /** The bot's row id: its app registration's unique name, as Add to Teams names it. */
+    botId: string;
+    displayName: string;
+    teamsAppId: string;
+    tenantId: string;
+    certificate: string;
+    publicUrl: string;
+}): string;
+/** What removes the bot from the customer's tenant again. `catalogOnly`: the service already
+ *  deleted the rest, so only the Teams app (which needs a signed-in administrator) is left. */
+export declare function removalScript(input: {
+    botId: string;
+    botAppId: string | null;
+    teamsAppId: string;
+    catalogOnly?: boolean;
+}): string;

package/dist/packages/server/src/teams/package.js

@@ -0,0 +1,319 @@
+import { createHash } from "node:crypto";
+import { crc32, deflateRawSync, deflateSync } from "node:zlib";
+import { brand, teamsDeveloper } from "../../../connector-kit/src/branding.js";
+// The Teams app package for one agent's bot (manifest + generated icons, zipped) and the
+// setup script that creates the bot in the customer's tenant. docs/teams.md 5 and 10.
+export const MANIFEST_VERSION = "1.24";
+// Teams delivers every message where the bot is installed, not just @mentions, and the bot can
+// read those conversations through Graph. Only where it was added; consented at install.
+export const RSC_PERMISSIONS = ["ChannelMessage.Read.Group", "ChatMessage.Read.Chat"];
+export function manifest(input) {
+    const name = input.displayName.trim();
+    if (name.length < 1 || name.length > 30)
+        throw new Error("A bot name is 1 to 30 characters");
+    const host = new URL(input.publicUrl).host;
+    const full = `${name} is an agent your organization set up in ${brand().productName}. It reads messages in the teams and chats it is added to, and answers when asked. Your administrator controls what it may do.`;
+    return {
+        $schema: `https://developer.microsoft.com/json-schemas/teams/v${MANIFEST_VERSION}/MicrosoftTeams.schema.json`,
+        manifestVersion: MANIFEST_VERSION,
+        version: `1.0.${input.manifestVersion}`,
+        id: input.teamsAppId,
+        // The app's developer, from the branding.
+        developer: teamsDeveloper(),
+        name: { short: name, full: `${name} (${brand().productName} agent)`.slice(0, 100) },
+        description: { short: `${name}, an agent from ${brand().productName}`.slice(0, 80), full },
+        icons: { color: "color.png", outline: "outline.png" },
+        accentColor: accent(name),
+        bots: [
+            {
+                botId: input.botAppId,
+                scopes: ["personal", "team", "groupChat"],
+                isNotificationOnly: false,
+                supportsFiles: false,
+            },
+        ],
+        webApplicationInfo: {
+            id: input.botAppId,
+            resource: `api://${host}/agent-connect/teams/${input.botAppId}`,
+        },
+        authorization: {
+            permissions: {
+                resourceSpecific: RSC_PERMISSIONS.map((name) => ({ name, type: "Application" })),
+            },
+        },
+    };
+}
+export function packageZip(input) {
+    const name = input.displayName;
+    return zip([
+        ["manifest.json", Buffer.from(JSON.stringify(manifest(input), null, 2))],
+        ["color.png", colorIcon(name)],
+        ["outline.png", outlineIcon(name)],
+    ]);
+}
+// ---- icons: the agent's initials, from a 5x7 bitmap font, on a color from its name ----
+const GLYPHS = {
+    A: "01110100011000111111100011000110001",
+    B: "11110100011000111110100011000111110",
+    C: "01110100011000010000100001000101110",
+    D: "11100100101000110001100011001011100",
+    E: "11111100001000011110100001000011111",
+    F: "11111100001000011110100001000010000",
+    G: "01110100011000010111100011000101111",
+    H: "10001100011000111111100011000110001",
+    I: "01110001000010000100001000010001110",
+    J: "00111000100001000010000101001001100",
+    K: "10001100101010011000101001001010001",
+    L: "10000100001000010000100001000011111",
+    M: "10001110111010110101100011000110001",
+    N: "10001100011100110101100111000110001",
+    O: "01110100011000110001100011000101110",
+    P: "11110100011000111110100001000010000",
+    Q: "01110100011000110001101011001001101",
+    R: "11110100011000111110101001001010001",
+    S: "01111100001000001110000010000111110",
+    T: "11111001000010000100001000010000100",
+    U: "10001100011000110001100011000101110",
+    V: "10001100011000110001100010101000100",
+    W: "10001100011000110101101011010101010",
+    X: "10001100010101000100010101000110001",
+    Y: "10001100010101000100001000010000100",
+    Z: "11111000010001000100010001000011111",
+    "0": "01110100011001110101110011000101110",
+    "1": "00100011000010000100001000010001110",
+    "2": "01110100010000100010001000100011111",
+    "3": "11111000100010000010000011000101110",
+    "4": "00010001100101010010111110001000010",
+    "5": "11111100001111000001000011000101110",
+    "6": "00110010001000011110100011000101110",
+    "7": "11111000010001000100010000100001000",
+    "8": "01110100011000101110100011000101110",
+    "9": "01110100011000101111000010001001100",
+};
+/** Up to two characters: the first letters of the first two words, else "AI". */
+export function initials(name) {
+    const words = name
+        .normalize("NFD")
+        .replace(/\p{M}/gu, "")
+        .toUpperCase()
+        .split(/[^A-Z0-9]+/)
+        .filter(Boolean);
+    const out = words
+        .slice(0, 2)
+        .map((w) => w[0])
+        .join("");
+    return out || "AI";
+}
+const hue = (name) => createHash("sha256").update(name).digest()[0] / 255;
+function hsl(h, s, l) {
+    const f = (n) => {
+        const k = (n + h * 12) % 12;
+        const a = s * Math.min(l, 1 - l);
+        return Math.round(255 * (l - a * Math.max(-1, Math.min(k - 3, 9 - k, 1))));
+    };
+    return [f(0), f(8), f(4)];
+}
+function accent(name) {
+    return `#${hsl(hue(name), 0.55, 0.38)
+        .map((v) => v.toString(16).padStart(2, "0"))
+        .join("")}`.toUpperCase();
+}
+// Pixels of the initials, centered, `scale` pixels per font dot.
+function glyphMask(text, size, scale) {
+    const chars = [...text].map((c) => GLYPHS[c] ?? GLYPHS.A);
+    const width = (chars.length * 5 + (chars.length - 1)) * scale;
+    const x0 = Math.floor((size - width) / 2);
+    const y0 = Math.floor((size - 7 * scale) / 2);
+    return (x, y) => {
+        const gx = Math.floor((x - x0) / scale);
+        const gy = Math.floor((y - y0) / scale);
+        if (x < x0 || y < y0 || gy >= 7)
+            return false;
+        const index = Math.floor(gx / 6);
+        const col = gx % 6;
+        if (index >= chars.length || col === 5)
+            return false;
+        return chars[index][gy * 5 + col] === "1";
+    };
+}
+/** 192×192, the initials in white on the agent's color. */
+export function colorIcon(name) {
+    const text = initials(name);
+    const [r, g, b] = hsl(hue(name), 0.55, 0.38);
+    const on = glyphMask(text, 192, text.length > 1 ? 12 : 16);
+    return png(192, (x, y) => (on(x, y) ? [255, 255, 255, 255] : [r, g, b, 255]));
+}
+/** 32×32, only white and transparent pixels, as Teams requires. */
+export function outlineIcon(name) {
+    const text = initials(name);
+    const on = glyphMask(text, 32, 2);
+    return png(32, (x, y) => (on(x, y) ? [255, 255, 255, 255] : [0, 0, 0, 0]));
+}
+function chunk(type, data) {
+    const length = Buffer.alloc(4);
+    length.writeUInt32BE(data.length);
+    const body = Buffer.concat([Buffer.from(type, "ascii"), data]);
+    const crc = Buffer.alloc(4);
+    crc.writeUInt32BE(crc32(body));
+    return Buffer.concat([length, body, crc]);
+}
+function png(size, pixel) {
+    const header = Buffer.alloc(13);
+    header.writeUInt32BE(size, 0);
+    header.writeUInt32BE(size, 4);
+    header.set([8, 6, 0, 0, 0], 8); // 8-bit RGBA
+    const raw = Buffer.alloc(size * (size * 4 + 1));
+    for (let y = 0; y < size; y++)
+        for (let x = 0; x < size; x++)
+            raw.set(pixel(x, y), y * (size * 4 + 1) + 1 + x * 4);
+    return Buffer.concat([
+        Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
+        chunk("IHDR", header),
+        chunk("IDAT", deflateSync(raw)),
+        chunk("IEND", Buffer.alloc(0)),
+    ]);
+}
+// ---- zip (deflate), enough for three files ----
+function zip(files) {
+    const locals = [];
+    const centrals = [];
+    let offset = 0;
+    for (const [name, data] of files) {
+        const packed = deflateRawSync(data);
+        const nameBytes = Buffer.from(name, "utf8");
+        const common = Buffer.alloc(26);
+        common.writeUInt16LE(20, 0); // version needed
+        common.writeUInt16LE(0, 2); // flags
+        common.writeUInt16LE(8, 4); // deflate
+        common.writeUInt32LE(0x00210000, 6); // 1980-01-01 00:00, for reproducible output
+        common.writeUInt32LE(crc32(data), 10);
+        common.writeUInt32LE(packed.length, 14);
+        common.writeUInt32LE(data.length, 18);
+        common.writeUInt16LE(nameBytes.length, 22);
+        common.writeUInt16LE(0, 24);
+        const local = Buffer.concat([Buffer.from([0x50, 0x4b, 0x03, 0x04]), common, nameBytes, packed]);
+        const central = Buffer.alloc(46);
+        central.writeUInt32LE(0x02014b50, 0);
+        central.writeUInt16LE(20, 4);
+        common.copy(central, 6);
+        central.writeUInt32LE(offset, 42);
+        centrals.push(central, nameBytes);
+        locals.push(local);
+        offset += local.length;
+    }
+    const dir = Buffer.concat(centrals);
+    const end = Buffer.alloc(22);
+    end.writeUInt32LE(0x06054b50, 0);
+    end.writeUInt16LE(files.length, 8);
+    end.writeUInt16LE(files.length, 10);
+    end.writeUInt32LE(dir.length, 12);
+    end.writeUInt32LE(offset, 16);
+    return Buffer.concat([...locals, dir, end]);
+}
+// ---- setup script ----
+/** The bot's app registration, by the unique name both Add to Teams and the script give it. */
+const appUri = (botId) => `https://graph.microsoft.com/v1.0/applications(uniqueName='${brand().resourcePrefix}-bot-${botId}')`;
+// PowerShell reads the typographic single quotes as quotes too; each is doubled like '.
+const psQuote = (s) => `'${s.replace(/['\u2018\u2019\u201a\u201b]/g, "$&$&")}'`;
+/** One PowerShell script that creates the agent's bot in the customer's tenant: app
+ *  registration with the service's certificate, Azure Bot with the Teams channel, and the
+ *  Teams app in the organization's catalog. The admin pastes the printed application ID back. */
+export function setupScript(input) {
+    // The bot's app id is only known once the script made the app: the package is filled in
+    // there, from a manifest with a placeholder.
+    const PLACEHOLDER = "00000000-0000-0000-0000-00000000b07a";
+    const template = JSON.stringify(manifest({ ...input, botAppId: PLACEHOLDER, manifestVersion: 1 }), null, 2);
+    const endpoint = `${input.publicUrl.replace(/\/+$/, "")}/teams/bots/{0}/messages`;
+    return `# Creates the Microsoft Teams bot for the ${brand().productName} agent ${JSON.stringify(input.displayName)}.
+# Needs an Azure subscription where you are Contributor (the bot uses the free tier and costs
+# nothing), PowerShell 7 (Windows, macOS or Linux) with the MicrosoftTeams module
+# (Install-Module MicrosoftTeams), and az login --tenant ${input.tenantId} as someone who can
+# create app registrations. It signs you in to Teams itself (a Teams administrator); on macOS
+# and Linux with a code you enter in a browser.
+# Safe to run again: what already exists is reused.
+param(
+  [string]$Subscription = "",
+  [string]$ResourceGroup = "${brand().teams.resourceGroup}",
+  # Where the bot's Azure record is kept.
+  [string]$Location = "westeurope"
+)
+$ErrorActionPreference = "Stop"
+$PSNativeCommandUseErrorActionPreference = $true
+$Name = ${psQuote(input.displayName)}
+$Tenant = ${psQuote(input.tenantId)}
+$TeamsAppId = ${psQuote(input.teamsAppId)}
+
+# 0. Check everything this needs before creating anything.
+if (-not (Get-Module -ListAvailable MicrosoftTeams)) { throw "Install the Teams module first: Install-Module MicrosoftTeams" }
+if ((az account show --query tenantId -o tsv) -ne $Tenant) { throw "Sign in to tenant $Tenant with az login --tenant $Tenant" }
+if ($Subscription) { az account set --subscription $Subscription }
+$Sub = az account show --query "{id:id,tenant:tenantId}" -o json | ConvertFrom-Json
+if (-not $Sub.id -or $Sub.tenant -ne $Tenant) { throw "This needs an Azure subscription where you are Contributor. The bot uses the free tier and costs nothing. Pass one with -Subscription." }
+# Windows signs in with a window; elsewhere Microsoft shows a code to enter in a browser.
+try { Get-CsTenant | Out-Null } catch {
+  if ($IsWindows -or $PSVersionTable.PSEdition -eq "Desktop") { Connect-MicrosoftTeams | Out-Null } else { Connect-MicrosoftTeams -UseDeviceAuthentication | Out-Null }
+}
+$Existing = Get-TeamsApp -ExternalId $TeamsAppId
+function Retry([scriptblock]$Step) {
+  for ($i = 1; ; $i++) {
+    try { return & $Step } catch { if ($i -ge 5) { throw }; Start-Sleep -Seconds 10 }
+  }
+}
+$Work = Join-Path ([IO.Path]::GetTempPath()) ("${brand().resourcePrefix}-bot-" + [guid]::NewGuid())
+New-Item -ItemType Directory $Work | Out-Null
+
+# 1. App registration in this organization only, with ${brand().productName}'s certificate (public half).
+# Found again by its unique name, never by its display name, so no other app is touched.
+$AppUri = ${psQuote(appUri(input.botId))}
+@{ displayName = "$Name (${brand().productName})"; signInAudience = "AzureADMyOrg" } | ConvertTo-Json | Set-Content (Join-Path $Work "app.json")
+az rest --method PATCH --uri $AppUri --headers "Prefer=create-if-missing" --body ("@" + (Join-Path $Work "app.json")) | Out-Null
+$app = Retry { az rest --method GET --uri ($AppUri + '?$select=id,appId') | ConvertFrom-Json }
+Write-Host "Application ID: $($app.appId)"
+if (-not (az ad sp list --filter "appId eq '$($app.appId)'" --query "[0].id" -o tsv)) { Retry { az ad sp create --id $app.appId | Out-Null } }
+Set-Content (Join-Path $Work "${brand().resourcePrefix}.pem") -NoNewline -Value @'
+${input.certificate.trim()}
+'@
+Retry { az ad app credential reset --id $app.appId --cert ("@" + (Join-Path $Work "${brand().resourcePrefix}.pem")) --append | Out-Null }
+
+# 2. Azure Bot (free tier) with the Teams channel, sending messages to ${brand().productName}.
+$Bot = "${brand().resourcePrefix}-" + $app.appId.Substring(0, 8)
+az provider register -n Microsoft.BotService --wait
+az group create -n $ResourceGroup -l $Location | Out-Null
+$found = az resource list -g $ResourceGroup --resource-type Microsoft.BotService/botServices --query "[?name=='$Bot'].id" -o tsv
+# The name holds only 8 hex of the app id, so a bot made for another app may hold it.
+if ($found -and (az resource show --ids $found --query properties.msaAppId -o tsv) -ne $app.appId) { throw "An Azure Bot named $Bot in $ResourceGroup belongs to another app, so it is left as it is. Rename or remove it, then run this script again." }
+if (-not $found) { Retry { az bot create -g $ResourceGroup -n $Bot --app-type SingleTenant --appid $app.appId --tenant-id $Tenant --endpoint (${psQuote(endpoint)} -f $app.appId) --sku F0 --display-name $Name | Out-Null } }
+try { az bot msteams show -g $ResourceGroup -n $Bot 2>$null | Out-Null } catch { az bot msteams create -g $ResourceGroup -n $Bot | Out-Null }
+
+# 3. The Teams app, published to your organization's app catalog.
+$Manifest = @'
+${template}
+'@
+Set-Content (Join-Path $Work "manifest.json") -Value $Manifest.Replace(${psQuote(PLACEHOLDER)}, $app.appId)
+[IO.File]::WriteAllBytes((Join-Path $Work "color.png"), [Convert]::FromBase64String(${psQuote(colorIcon(input.displayName).toString("base64"))}))
+[IO.File]::WriteAllBytes((Join-Path $Work "outline.png"), [Convert]::FromBase64String(${psQuote(outlineIcon(input.displayName).toString("base64"))}))
+$Zip = Join-Path $Work "agent.zip"
+Compress-Archive -Path (Join-Path $Work "manifest.json"), (Join-Path $Work "color.png"), (Join-Path $Work "outline.png") -DestinationPath $Zip
+if ($Existing) { Set-TeamsApp -Id $Existing.Id -Path $Zip | Out-Null } else { New-TeamsApp -DistributionMethod organization -Path $Zip | Out-Null }
+
+Write-Host ""
+Write-Host "Done. Paste this application ID into ${brand().productName} before you add the bot to a team: $($app.appId)"
+`;
+}
+/** What removes the bot from the customer's tenant again. `catalogOnly`: the service already
+ *  deleted the rest, so only the Teams app (which needs a signed-in administrator) is left. */
+export function removalScript(input) {
+    const lines = [
+        "# Removes the agent's Teams bot from your organization. Run in PowerShell 7.",
+        "# Or, without PowerShell: Teams admin center, Teams apps, Manage apps, open the app, Delete.",
+        'if ($IsWindows -or $PSVersionTable.PSEdition -eq "Desktop") { Connect-MicrosoftTeams } else { Connect-MicrosoftTeams -UseDeviceAuthentication }',
+        `Get-TeamsApp -ExternalId ${psQuote(input.teamsAppId)} | ForEach-Object { Remove-TeamsApp -Id $_.Id }`,
+    ];
+    if (input.botAppId && !input.catalogOnly) {
+        // Only an app registration carrying this bot's unique name is the service's to delete.
+        const unique = `${brand().resourcePrefix}-bot-${input.botId}`;
+        lines.push(`$Made = az rest --method GET --uri ${psQuote(`https://graph.microsoft.com/v1.0/applications(appId='${input.botAppId}')?$select=uniqueName`)} --query uniqueName -o tsv`, `if ($Made -eq ${psQuote(unique)}) {`, `  az resource list --resource-type Microsoft.BotService/botServices --query "[?name=='${brand().resourcePrefix}-${input.botAppId.slice(0, 8)}'].id" -o tsv | ForEach-Object { if ((az resource show --ids $_ --query properties.msaAppId -o tsv) -eq ${psQuote(input.botAppId)}) { az resource delete --ids $_ } }`, `  az ad app delete --id ${input.botAppId}`, `} else { Write-Host "App registration ${input.botAppId} was not made by this bot's setup, so it is left as it is. Delete it and its Azure Bot yourself if they are the bot's." }`);
+    }
+    return lines.join("\n") + "\n";
+}
+//# sourceMappingURL=package.js.map

package/dist/packages/server/src/teams/package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.js","sourceRoot":"","sources":["../../../../../packages/server/src/teams/package.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAE/E,yFAAyF;AACzF,sFAAsF;AAEtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,+FAA+F;AAC/F,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,2BAA2B,EAAE,uBAAuB,CAAC,CAAC;AAWtF,MAAM,UAAU,QAAQ,CAAC,KAAmB;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,GAAG,IAAI,4CAA4C,KAAK,EAAE,CAAC,WAAW,gIAAgI,CAAC;IACpN,OAAO;QACL,OAAO,EAAE,uDAAuD,gBAAgB,6BAA6B;QAC7G,eAAe,EAAE,gBAAgB;QACjC,OAAO,EAAE,OAAO,KAAK,CAAC,eAAe,EAAE;QACvC,EAAE,EAAE,KAAK,CAAC,UAAU;QACpB,0CAA0C;QAC1C,SAAS,EAAE,cAAc,EAAE;QAC3B,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,WAAW,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;QACnF,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,mBAAmB,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE;QAC1F,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE;QACrD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,EAAE;YACJ;gBACE,KAAK,EAAE,KAAK,CAAC,QAAQ;gBACrB,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC;gBACzC,kBAAkB,EAAE,KAAK;gBACzB,aAAa,EAAE,KAAK;aACrB;SACF;QACD,kBAAkB,EAAE;YAClB,EAAE,EAAE,KAAK,CAAC,QAAQ;YAClB,QAAQ,EAAE,SAAS,IAAI,wBAAwB,KAAK,CAAC,QAAQ,EAAE;SAChE;QACD,aAAa,EAAE;YACb,WAAW,EAAE;gBACX,gBAAgB,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;aACjF;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAmB;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC;IAC/B,OAAO,GAAG,CAAC;QACT,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;KACnC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAE1F,MAAM,MAAM,GAA2B;IACrC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;IACxC,GAAG,EAAE,qCAAqC;IAC1C,GAAG,EAAE,qCAAqC;IAC1C,GAAG,EAAE,qCAAqC;IAC1C,GAAG,EAAE,qCAAqC;IAC1C,GAAG,EAAE,qCAAqC;IAC1C,GAAG,EAAE,qCAAqC;IAC1C,GAAG,EAAE,qCAAqC;IAC1C,GAAG,EAAE,qCAAqC;IAC1C,GAAG,EAAE,qCAAqC;IAC1C,GAAG,EAAE,qCAAqC;CAC3C,CAAC;AAEF,iFAAiF;AACjF,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI;SACf,SAAS,CAAC,KAAK,CAAC;SAChB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,KAAK;SACd,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChB,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;AAElF,SAAS,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAC1C,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE;QACtB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;AAC9B,CAAC;AAED,iEAAiE;AACjE,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY,EAAE,KAAa;IAC1D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACd,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;QACnB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,KAAyC;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7D,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,kDAAkD;AAElD,SAAS,GAAG,CAAC,KAAyB;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB;QAC9C,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;QACpC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU;QACtC,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,4CAA4C;QACjF,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,GAAG,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACjC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,yBAAyB;AAEzB,+FAA+F;AAC/F,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAC/B,6DAA6D,KAAK,EAAE,CAAC,cAAc,QAAQ,KAAK,IAAI,CAAC;AAEvG,wFAAwF;AACxF,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,8BAA8B,EAAE,MAAM,CAAC,GAAG,CAAC;AAExF;;iGAEiG;AACjG,MAAM,UAAU,WAAW,CAAC,KAQ3B;IACC,wFAAwF;IACxF,6CAA6C;IAC7C,MAAM,WAAW,GAAG,sCAAsC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAC7B,QAAQ,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,EACjE,IAAI,EACJ,CAAC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC;IAClF,OAAO,6CAA6C,KAAK,EAAE,CAAC,WAAW,UAAU,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC;;;2DAGzD,KAAK,CAAC,QAAQ;;;;;;8BAM3C,KAAK,EAAE,CAAC,KAAK,CAAC,aAAa;;;;;;UAM/C,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACnB,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;;iDAkBQ,KAAK,EAAE,CAAC,cAAc;;;wDAGf,KAAK,EAAE,CAAC,WAAW;;YAE/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;2BACb,KAAK,EAAE,CAAC,WAAW;;;;;gCAKd,KAAK,EAAE,CAAC,cAAc;EACpD,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE;;qFAE2D,KAAK,EAAE,CAAC,cAAc;;yEAElC,KAAK,EAAE,CAAC,WAAW;UAClF,KAAK,EAAE,CAAC,cAAc;;;;;;gJAMgH,OAAO,CAAC,QAAQ,CAAC;;;;;EAK/J,QAAQ;;yEAE+D,OAAO,CAAC,WAAW,CAAC;sFACP,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;wFACtD,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;;;;;;mDAM/F,KAAK,EAAE,CAAC,WAAW;CACrE,CAAC;AACF,CAAC;AAED;+FAC+F;AAC/F,MAAM,UAAU,aAAa,CAAC,KAK7B;IACC,MAAM,KAAK,GAAG;QACZ,8EAA8E;QAC9E,8FAA8F;QAC9F,iJAAiJ;QACjJ,4BAA4B,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,iDAAiD;KACvG,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACzC,uFAAuF;QACvF,MAAM,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,cAAc,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CACR,sCAAsC,OAAO,CAAC,wDAAwD,KAAK,CAAC,QAAQ,uBAAuB,CAAC,4BAA4B,EACxK,iBAAiB,OAAO,CAAC,MAAM,CAAC,KAAK,EACrC,yFAAyF,KAAK,EAAE,CAAC,cAAc,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,2GAA2G,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,qCAAqC,EACpT,2BAA2B,KAAK,CAAC,QAAQ,EAAE,EAC3C,yCAAyC,KAAK,CAAC,QAAQ,2HAA2H,CACnL,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC"}