@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.2-dev.d2aa5ca

package/dist/connectors/http/index.js

@@ -0,0 +1,322 @@
+import { z } from "zod";
+import { audited, Denied, json, listLimit, VendorFailed, } from "../../packages/connector-kit/src/common.js";
+import { clientCredentials, vendorError } from "../../packages/connector-kit/src/oauth.js";
+import { ConnectError, } from "../../packages/connector-kit/src/types.js";
+// The generic module behind every connector.json with an `http` block: an app described as
+// data, e.g. a company's internal REST API. Calls reach only baseUrl's origin under its path.
+export const MAX_RESPONSE_BYTES = 1024 * 1024;
+export const MAX_BODY_BYTES = 256 * 1024;
+export const MAX_TARGET_BYTES = 8 * 1024;
+const TIMEOUT_MS = 30_000;
+// fetch that reaches only `allowed` origins, follows no redirect, gives up after TIMEOUT_MS and
+// reads at most MAX_RESPONSE_BYTES of JSON or text (or what `types` matches). Its refusals are
+// ConnectError.
+export function guardedFetch(allowed, fetchImpl = fetch, types = /^(application\/([\w.+-]*\+)?json|text\/)/i, 
+// What `types` lets through, for the refusal.
+passed = "JSON or text") {
+    return (async (input, init) => {
+        const url = new URL(input instanceof Request ? input.url : input);
+        if (!allowed.includes(url.origin))
+            throw new ConnectError(`${url.origin} is not this app's address`);
+        const res = await fetchImpl(url, {
+            ...init,
+            redirect: "manual",
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (res.status >= 300 && res.status < 400)
+            throw new ConnectError(`The app answered with a redirect (${res.status}), which is not followed`);
+        const type = res.headers.get("content-type") ?? "";
+        if (res.body && !types.test(type) && res.headers.get("content-length") !== "0") {
+            await res.body.cancel();
+            throw new ConnectError(`The app answered ${type || "without a content type"}; only ${passed} is passed on`);
+        }
+        const chunks = [];
+        let size = 0;
+        const reader = res.body?.getReader();
+        for (let r = await reader?.read(); r && !r.done; r = await reader.read()) {
+            size += r.value.byteLength;
+            if (size > MAX_RESPONSE_BYTES) {
+                await reader.cancel();
+                throw new ConnectError(`The app's answer is larger than ${MAX_RESPONSE_BYTES / 1024} KB`);
+            }
+            chunks.push(r.value);
+        }
+        // These statuses may not carry a body, even an empty one.
+        const body = [204, 205, 304].includes(res.status) ? null : Buffer.concat(chunks);
+        return new Response(body, { status: res.status, headers: res.headers });
+    });
+}
+function parse(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+// The headers signing a call with a key, token or user and password (oauth2 signs its own, and
+// query auth goes in the address).
+export function authHeaders(auth, c) {
+    if (auth.type === "header")
+        return { [auth.header.toLowerCase()]: `${auth.prefix ?? ""}${c.secret[auth.value]}` };
+    if (auth.type === "bearer")
+        return { authorization: `Bearer ${c.secret[auth.token]}` };
+    if (auth.type === "basic")
+        return {
+            authorization: `Basic ${Buffer.from(`${c.config[auth.username]}:${c.secret[auth.password]}`).toString("base64")}`,
+        };
+    return {};
+}
+// The connect form's values: plain fields into config, secret ones into secret; all required.
+export function formValues(connector, fields) {
+    const config = {};
+    const secret = {};
+    for (const f of connector.fields) {
+        const value = fields[f.id]?.trim() ?? "";
+        if (!value)
+            throw new ConnectError(`Enter ${f.label}`);
+        (f.secret ? secret : config)[f.id] = value;
+    }
+    return { config, secret };
+}
+export function httpVendor(connector, fetchImpl = fetch) {
+    const http = connector.http;
+    const base = new URL(http.baseUrl);
+    const prefix = base.pathname.replace(/\/+$/, "");
+    const auth = http.auth;
+    const safe = guardedFetch([base.origin, ...(auth.type === "oauth2" ? [new URL(auth.tokenUrl).origin] : [])], fetchImpl);
+    const oauth = auth.type === "oauth2" ? clientCredentials(connector.name, safe) : null;
+    // Lower-case, so a configured Accept replaces the default rather than joining it.
+    const fixed = Object.fromEntries(Object.entries(http.headers).map(([k, v]) => [k.toLowerCase(), v]));
+    const oauthCreds = (c) => auth.type === "oauth2"
+        ? {
+            tokenUrl: auth.tokenUrl,
+            clientId: c.config[auth.clientId],
+            clientSecret: c.secret[auth.clientSecret],
+            scope: auth.scope,
+        }
+        : null;
+    const call = async (c, request) => {
+        // The path is the tool's, already encoded; it must stay under baseUrl's path.
+        const url = new URL(`${base.origin}${prefix}${request.path}`);
+        if (url.origin !== base.origin || !`${url.pathname}/`.startsWith(`${prefix}/`))
+            throw new ConnectError("The call leaves this app's address");
+        if (auth.type === "query")
+            url.searchParams.append(auth.param, c.secret[auth.value]);
+        const req = {
+            method: request.method,
+            path: `${url.pathname}${url.search}`,
+            body: request.body,
+        };
+        if (oauth)
+            return oauth.call(oauthCreds(c), base.origin, req, fixed);
+        const res = await safe(`${base.origin}${req.path}`, {
+            method: req.method,
+            headers: {
+                accept: "application/json",
+                ...fixed,
+                ...authHeaders(auth, c),
+                ...(req.body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            body: req.body === undefined ? undefined : JSON.stringify(req.body),
+        });
+        const raw = await res.text();
+        return {
+            status: res.status,
+            data: raw ? parse(raw) : null,
+            headers: Object.fromEntries(res.headers),
+        };
+    };
+    return {
+        async connect(fields) {
+            const { config, secret } = formValues(connector, fields);
+            const conn = { config: { host: base.host, ...config }, secret };
+            if (oauth)
+                await oauth.signIn(oauthCreds(conn));
+            return { ...conn, accountLabel: conn.config[connector.accountKey] ?? base.host };
+        },
+        call,
+    };
+}
+// The values at a dot path; a list on the way gives each of its items' value. Null when any is
+// missing.
+function valuesAt(data, keys) {
+    if (!keys.length)
+        return [data];
+    if (Array.isArray(data)) {
+        const found = data.map((item) => valuesAt(item, keys));
+        return found.some((f) => f === null) ? null : found.flat();
+    }
+    if (data === null || typeof data !== "object" || !Object.hasOwn(data, keys[0]))
+        return null;
+    return valuesAt(data[keys[0]], keys.slice(1));
+}
+// Whether every value of `path` in the answer is among `values`. A missing one fails.
+export function answerWithin(data, path, values) {
+    const found = valuesAt(data, path.split("."));
+    return (found !== null &&
+        found.every((v) => (typeof v === "string" || typeof v === "number") && values.includes(String(v))));
+}
+// The value at a dot path, a list on the way mapped item by item; undefined when missing.
+function pick(data, keys) {
+    if (!keys.length)
+        return data;
+    if (Array.isArray(data))
+        return data.map((item) => pick(item, keys));
+    if (data === null || typeof data !== "object" || !Object.hasOwn(data, keys[0]))
+        return undefined;
+    return pick(data[keys[0]], keys.slice(1));
+}
+function trim(data, result) {
+    // Some apps leave an empty list out of the answer altogether.
+    const items = result.items ? (pick(data, result.items.split(".")) ?? []) : data;
+    if (!result.fields)
+        return items;
+    const keep = (item) => Object.fromEntries(result.fields.map((f) => [f, pick(item, f.split("."))]));
+    return Array.isArray(items) ? items.map(keep) : keep(items);
+}
+// The cursor for the next page, or null on the last one.
+function nextCursor(tool, res) {
+    const paging = tool.paging;
+    const param = tool.params[paging.param];
+    let next;
+    if ("body" in paging)
+        next = pick(res.data, paging.body.split("."));
+    else if ("header" in paging)
+        next = res.headers?.[paging.header.toLowerCase()];
+    else
+        for (const [, url, attrs] of (res.headers?.link ?? "").matchAll(/<([^>]*)>([^,]*)/g))
+            if (/\brel="?[^"]*\bnext\b/i.test(attrs) && URL.canParse(url, "https://x"))
+                next = new URL(url, "https://x").searchParams.get(param.name ?? paging.param);
+    if (typeof next === "number")
+        return next;
+    if (typeof next !== "string" || next === "")
+        return null;
+    return param.type !== "string" && /^-?\d+(\.\d+)?$/.test(next) ? Number(next) : next;
+}
+// Each param naming a list limit the agent has values in must be sent, and each of its values
+// (every item, for an array) must be one of them.
+export function paramLimits(limits, params, args) {
+    for (const [name, p] of Object.entries(params)) {
+        const allowedValues = p.limit ? listLimit(limits, p.limit) : null;
+        if (!allowedValues)
+            continue;
+        const value = args[name];
+        const values = Array.isArray(value) ? value : [value];
+        // Left out (or empty), an optional param would mean "all of them".
+        if (value === undefined || !values.length)
+            throw new Denied(`${name} is required: this agent is limited to some values`);
+        for (const v of values)
+            if (!allowedValues.includes(String(v)))
+                throw new Denied(`${name} ${String(v)} is outside this agent's limits`);
+    }
+}
+export const zodType = {
+    string: z.string(),
+    number: z.number(),
+    integer: z.number().int(),
+    boolean: z.boolean(),
+};
+function paramType(p) {
+    const one = (type) => (p.enum ? z.literal(p.enum) : zodType[type]);
+    const type = (p.type === "array" ? z.array(one(p.items)) : one(p.type)).describe(p.description);
+    if (p.default !== undefined)
+        return type.default(p.default);
+    return p.required ? type : type.optional();
+}
+export function httpTools(http) {
+    return {
+        names: http.tools.map((t) => t.name),
+        register(server, ctx, allowed) {
+            for (const tool of http.tools) {
+                if (!allowed.has(tool.name))
+                    continue;
+                const shape = Object.fromEntries(Object.entries(tool.params).map(([name, p]) => [name, paramType(p)]));
+                const destructive = tool.destructive || tool.method === "DELETE";
+                server.registerTool(tool.name, {
+                    description: tool.description,
+                    inputSchema: z.object(shape).strict(),
+                    annotations: {
+                        readOnlyHint: tool.method === "GET",
+                        destructiveHint: destructive,
+                        openWorldHint: true,
+                    },
+                }, (args) => audited(ctx, tool.name, JSON.stringify(args).slice(0, 300), async (mark) => {
+                    paramLimits(ctx.limits, tool.params, args);
+                    const path = tool.path.replace(/\{([a-z][a-z0-9_]*)\}/g, (_, name) => {
+                        const value = String(args[name]);
+                        // URLs resolve . and .. segments even when percent-encoded.
+                        if (value === "." || value === ".." || value === "")
+                            throw new Denied(`${name} is not a valid value`);
+                        return encodeURIComponent(value);
+                    });
+                    const query = new URLSearchParams();
+                    const body = {};
+                    for (const [name, p] of Object.entries(tool.params)) {
+                        const value = args[name];
+                        const wire = p.name ?? name;
+                        if (value === undefined)
+                            continue;
+                        if (p.in === "body")
+                            body[wire] = value;
+                        else if (p.in !== "query")
+                            continue;
+                        else if (!Array.isArray(value))
+                            query.set(wire, String(value));
+                        else if (p.join)
+                            query.set(wire, value.join(p.join));
+                        else
+                            for (const v of value)
+                                query.append(wire, String(v));
+                    }
+                    const target = query.size ? `${path}?${query}` : path;
+                    if (Buffer.byteLength(target) > MAX_TARGET_BYTES)
+                        throw new Denied(`The address is longer than ${MAX_TARGET_BYTES / 1024} KB`);
+                    const hasBody = Object.values(tool.params).some((p) => p.in === "body");
+                    if (hasBody && Buffer.byteLength(JSON.stringify(body)) > MAX_BODY_BYTES)
+                        throw new Denied(`The request is larger than ${MAX_BODY_BYTES / 1024} KB`);
+                    let res;
+                    try {
+                        res = await ctx.call({
+                            method: tool.method,
+                            path: target,
+                            ...(hasBody ? { body } : {}),
+                        });
+                    }
+                    catch (error) {
+                        if (error instanceof ConnectError)
+                            throw new VendorFailed(502, error.message);
+                        throw error;
+                    }
+                    mark(res.status);
+                    if (res.status < 200 || res.status >= 300) {
+                        const detail = vendorError(res.data);
+                        throw new VendorFailed(res.status, `The app answered ${res.status}${detail ? `: ${detail}` : ""}`);
+                    }
+                    for (const a of tool.answerLimits) {
+                        const values = listLimit(ctx.limits, a.limit);
+                        if (values && !answerWithin(res.data, a.field, values))
+                            throw new Denied(`The answer's ${a.field} is outside this agent's limits`);
+                    }
+                    if (!tool.result && !tool.paging)
+                        return typeof res.data === "string"
+                            ? { content: [{ type: "text", text: res.data }] }
+                            : json(res.data);
+                    if (typeof res.data === "string")
+                        throw new VendorFailed(res.status, "The app answered with text, not JSON");
+                    const data = tool.result ? trim(res.data, tool.result) : res.data;
+                    return json(tool.paging ? { items: data, next: nextCursor(tool, res) } : data);
+                }));
+            }
+        },
+    };
+}
+/** Binds to any connector with an `http` block; createAgentConnect uses it for those. */
+export default {
+    id: "http",
+    create: ({ connector }) => ({
+        vendor: httpVendor(connector),
+        toolset: httpTools(connector.http),
+    }),
+};
+//# sourceMappingURL=index.js.map

package/dist/connectors/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../connectors/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,EACT,YAAY,GAEb,MAAM,4CAA4C,CAAC;AAUpD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,YAAY,GAMb,MAAM,2CAA2C,CAAC;AAGnD,2FAA2F;AAC3F,8FAA8F;AAE9F,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC;AACzC,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,gGAAgG;AAChG,+FAA+F;AAC/F,gBAAgB;AAChB,MAAM,UAAU,YAAY,CAC1B,OAAiB,EACjB,YAAmB,KAAK,EACxB,KAAK,GAAG,2CAA2C;AACnD,8CAA8C;AAC9C,MAAM,GAAG,cAAc;IAEvB,OAAO,CAAC,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAC/B,MAAM,IAAI,YAAY,CAAC,GAAG,GAAG,CAAC,MAAM,4BAA4B,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC/B,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YACvC,MAAM,IAAI,YAAY,CACpB,qCAAqC,GAAG,CAAC,MAAM,0BAA0B,CAC1E,CAAC;QACJ,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/E,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,oBAAoB,IAAI,IAAI,wBAAwB,UAAU,MAAM,eAAe,CACpF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,KAAK,IAAI,CAAC,GAAG,MAAM,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,MAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1E,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3B,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;gBAC9B,MAAM,MAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,YAAY,CAAC,mCAAmC,kBAAkB,GAAG,IAAI,KAAK,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,0DAA0D;QAC1D,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAU,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,mCAAmC;AACnC,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,CAAmB;IAC7D,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QACxB,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACxF,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACvF,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QACvB,OAAO;YACL,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;SAClH,CAAC;IACJ,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,UAAU,CAAC,SAAoB,EAAE,MAA8B;IAC7E,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAoB,EAAE,YAAmB,KAAK;IACvE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,YAAY,CACvB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EACjF,SAAS,CACV,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,kFAAkF;IAClF,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CACnE,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,CAAmB,EAAE,EAAE,CACzC,IAAI,CAAC,IAAI,KAAK,QAAQ;QACpB,CAAC,CAAC;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;YACzC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB;QACH,CAAC,CAAC,IAAK,CAAC;IAEZ,MAAM,IAAI,GAAmB,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;QAChD,8EAA8E;QAC9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;YAC5E,MAAM,IAAI,YAAY,CAAC,oCAAoC,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrF,MAAM,GAAG,GAAkB;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE;YAClD,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,KAAK;gBACR,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC1E;YACD,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;SACpE,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7B,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;SACzC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,IAAI,GAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;YAClF,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnF,CAAC;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,WAAW;AACX,SAAS,QAAQ,CAAC,IAAa,EAAE,IAAc;IAC7C,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,OAAO,QAAQ,CAAE,IAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,IAAY,EAAE,MAAgB;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,CACL,KAAK,KAAK,IAAI;QACd,KAAK,CAAC,KAAK,CACT,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CACtF,CACF,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,IAAI,CAAC,IAAa,EAAE,IAAc;IACzC,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjG,OAAO,IAAI,CAAE,IAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,MAAuC;IAClE,8DAA8D;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,EAAE,CAC7B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,yDAAyD;AACzD,SAAS,UAAU,CAAC,IAAc,EAAE,GAAmB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAO,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,IAAa,CAAC;IAClB,IAAI,MAAM,IAAI,MAAM;QAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;SAC/D,IAAI,QAAQ,IAAI,MAAM;QAAE,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;;QAE7E,KAAK,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAClF,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;gBACxE,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IACpF,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED,8FAA8F;AAC9F,kDAAkD;AAClD,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,MAA0C,EAC1C,IAA6B;IAE7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,IAAI,CAAC,aAAa;YAAE,SAAS;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,mEAAmE;QACnE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM;YACvC,MAAM,IAAI,MAAM,CAAC,GAAG,IAAI,oDAAoD,CAAC,CAAC;QAChF,KAAK,MAAM,CAAC,IAAI,MAAM;YACpB,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACpC,MAAM,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;AAEF,SAAS,SAAS,CAAC,CAAY;IAC7B,MAAM,GAAG,GAAG,CAAC,IAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAc,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAC1F,CAAC,CAAC,WAAW,CACd,CAAC;IACF,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO;YAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACtC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACrE,CAAC;gBACF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;gBACjE,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT;oBACE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE;oBACrC,WAAW,EAAE;wBACX,YAAY,EAAE,IAAI,CAAC,MAAM,KAAK,KAAK;wBACnC,eAAe,EAAE,WAAW;wBAC5B,aAAa,EAAE,IAAI;qBACpB;iBACF,EACD,CAAC,IAA6B,EAAE,EAAE,CAChC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBACzE,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;wBAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;wBACjC,4DAA4D;wBAC5D,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;4BACjD,MAAM,IAAI,MAAM,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;wBACnD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;oBACnC,CAAC,CAAC,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;oBACpC,MAAM,IAAI,GAA4B,EAAE,CAAC;oBACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;wBACpD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;wBACzB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC;wBAC5B,IAAI,KAAK,KAAK,SAAS;4BAAE,SAAS;wBAClC,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM;4BAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;6BACnC,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO;4BAAE,SAAS;6BAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;4BAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;6BAC1D,IAAI,CAAC,CAAC,IAAI;4BAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;;4BAChD,KAAK,MAAM,CAAC,IAAI,KAAK;gCAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5D,CAAC;oBACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;oBACtD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,gBAAgB;wBAC9C,MAAM,IAAI,MAAM,CAAC,8BAA8B,gBAAgB,GAAG,IAAI,KAAK,CAAC,CAAC;oBAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;oBACxE,IAAI,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,cAAc;wBACrE,MAAM,IAAI,MAAM,CAAC,8BAA8B,cAAc,GAAG,IAAI,KAAK,CAAC,CAAC;oBAC7E,IAAI,GAAG,CAAC;oBACR,IAAI,CAAC;wBACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC;4BACnB,MAAM,EAAE,IAAI,CAAC,MAAM;4BACnB,IAAI,EAAE,MAAM;4BACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC7B,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,YAAY;4BAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;wBAC9E,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACjB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;wBAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBACrC,MAAM,IAAI,YAAY,CACpB,GAAG,CAAC,MAAM,EACV,oBAAoB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/D,CAAC;oBACJ,CAAC;oBACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;wBAC9C,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC;4BACpD,MAAM,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,iCAAiC,CAAC,CAAC;oBAC/E,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;wBAC9B,OAAO,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;4BACjC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE;4BACjD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACrB,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;wBAC9B,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,sCAAsC,CAAC,CAAC;oBAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;oBAClE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjF,CAAC,CAAC,CACL,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,eAAe;IACb,EAAE,EAAE,MAAM;IACV,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAC7B,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,IAAK,CAAC;KACpC,CAAC;CACuB,CAAC"}

package/dist/connectors/intune/connector.json

@@ -0,0 +1,106 @@
+{
+  "id": "intune",
+  "name": "Microsoft Intune",
+  "description": "Let agents look up the devices Intune manages: who uses them, their system and version, compliance, encryption, last check-in and the apps found on them. Read-only.",
+  "logo": "/brand/registry/intune.svg",
+  "identity": "Your Microsoft app registration, through the Microsoft connection. It can read your managed devices and, if you allow it, their Autopilot status, and change nothing: it cannot wipe, lock, retire or sync a device, or change an Autopilot profile. Each API key can be kept to the devices of people in chosen groups.",
+  "provider": "microsoft",
+  "order": 6,
+  "accountKey": "tenantId",
+  "connectionKind": "guided",
+  "setup": [
+    {
+      "title": "Add these Microsoft Graph permissions to the app",
+      "body": "In the app, open API permissions, select Add a permission, then Microsoft Graph, then Application permissions, and add exactly these. They only read. Do not add DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementManagedDevices.PrivilegedOperations.All or DeviceManagementServiceConfig.ReadWrite.All: they let the app change, wipe or retire devices or change Autopilot. Your organization needs an Intune license.",
+      "copy": [
+        "az ad app permission add --id {clientId} --api 00000003-0000-0000-c000-000000000000 --api-permissions \"$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query \"appRoles[?value=='{scope}'].id\" -o tsv)=Role\""
+      ],
+      "click": [
+        "In the Microsoft Entra admin center, go to Entra ID, then App registrations, and open {brand.microsoft.appName}.",
+        "Select API permissions, then Add a permission, then Microsoft Graph, then Application permissions.",
+        "Tick {scopes} and select Add permissions."
+      ],
+      "shell": "bash"
+    },
+    {
+      "title": "Grant admin consent",
+      "body": "Still under API permissions, select \"Grant admin consent\". This needs a Global Administrator or Privileged Role Administrator. Each permission should then show Granted. With Commands, a permission that was granted already is answered with \"Permission being assigned already exists\", which is fine.",
+      "click": [
+        "Still under API permissions, select Grant admin consent for your organization, then Yes.",
+        "Each permission should show Granted under Status."
+      ],
+      "copy": [
+        "SP=$(az ad sp show --id {clientId} --query id -o tsv)",
+        "GRAPH=$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query id -o tsv)",
+        "az rest --method post --url \"https://graph.microsoft.com/v1.0/servicePrincipals/$SP/appRoleAssignments\" --body \"{\\\"principalId\\\": \\\"$SP\\\", \\\"resourceId\\\": \\\"$GRAPH\\\", \\\"appRoleId\\\": \\\"$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query \"appRoles[?value=='{scope}'].id\" -o tsv)\\\"}\""
+      ],
+      "shell": "bash"
+    }
+  ],
+  "afterConnect": [],
+  "fields": [
+    {
+      "id": "people_groups",
+      "label": "Keeping keys to groups of people",
+      "secret": false,
+      "options": [
+        {
+          "value": "off",
+          "label": "Not used",
+          "description": "Each API key reaches every managed device."
+        },
+        {
+          "value": "groups",
+          "label": "Keep keys to people's groups",
+          "description": "Lets you keep an API key to the devices whose primary user is in groups you choose. The app then also reads your organization's people and group memberships.",
+          "scopes": ["User.ReadBasic.All", "GroupMember.Read.All"]
+        }
+      ]
+    }
+  ],
+  "capabilities": [
+    {
+      "id": "read",
+      "label": "Look up managed devices",
+      "description": "List and search managed devices, read one device's details and the apps found on it, a person's devices, and compliance across devices.",
+      "required": true,
+      "note": "Reaches every managed device unless you keep a key to chosen groups under API keys. Read-only.",
+      "scopes": ["DeviceManagementManagedDevices.Read.All"],
+      "permissions": [],
+      "tools": [
+        "intune_list_devices",
+        "intune_get_device",
+        "intune_device_apps",
+        "intune_person_devices",
+        "intune_compliance_summary"
+      ],
+      "forbidden": "Microsoft refused this. The app needs {scopes} with admin consent (the Microsoft Intune page in {brand.productName} shows how), and your organization needs an Intune license."
+    },
+    {
+      "id": "autopilot",
+      "label": "Read Autopilot status",
+      "description": "Look up a Windows Autopilot device by serial number: its enrollment state, profile, group tag, last contact with Intune and, once managed, its compliance and primary user.",
+      "note": "Reads the Autopilot device list of your whole organization. Read-only. The answer also reads the managed device, which \"Look up managed devices\" (always on) allows.",
+      "scopes": ["DeviceManagementServiceConfig.Read.All"],
+      "permissions": [],
+      "tools": ["intune_autopilot_status"],
+      "forbidden": "Microsoft refused this. The app needs {scopes} with admin consent (the Microsoft Intune page in {brand.productName} shows how), and your organization needs an Intune license."
+    }
+  ],
+  "limits": [
+    {
+      "id": "groups",
+      "label": "Groups",
+      "help": "Optional: only devices whose primary user is in these groups (their object IDs, from Groups in the Microsoft Entra admin center). Needs \"Keep keys to people's groups\" on the Microsoft Intune page. At most 20. Leave empty for every device. Autopilot status (if allowed) also needs any user assigned on the Autopilot record to be in these groups; for a device no person is tied to yet (a spare), it answers only the serial number, the Autopilot enrollment state and whether Intune manages it and its compliance: no device id, names or group tag.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+    }
+  ],
+  "verify": {
+    "label": "Microsoft permissions the app has",
+    "check": "permissions",
+    "ifEmpty": "The app has no Microsoft Graph application permissions yet. Add the permissions above and grant admin consent."
+  },
+  "revoke": "Remove DeviceManagementManagedDevices.Read.All and DeviceManagementServiceConfig.Read.All (and User.ReadBasic.All and GroupMember.Read.All, unless another app here needs them) from the app under API permissions. To stop every Microsoft app at once, remove the app registration (see the Microsoft connection)."
+}

package/dist/connectors/intune/index.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("../../packages/connector-kit/src/connector.js").ConnectorModule;
+export default _default;

package/dist/connectors/intune/index.js

@@ -0,0 +1,4 @@
+import { microsoftApp } from "../microsoft/client.js";
+import { intuneTools } from "./tools.js";
+export default microsoftApp("intune", intuneTools);
+//# sourceMappingURL=index.js.map

package/dist/connectors/intune/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../connectors/intune/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAe,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC"}

package/dist/connectors/intune/tools.d.ts

@@ -0,0 +1,12 @@
+import { type ToolContext, type Toolset } from "../../packages/connector-kit/src/common.js";
+export declare const COMPLIANCE_STATES: readonly ["unknown", "compliant", "noncompliant", "conflict", "error", "inGracePeriod", "configManager"];
+export declare const SUMMARY_MAX_DEVICES = 5000;
+type Mark = (status: number) => void;
+type Device = Record<string, unknown> & {
+    id: string;
+    userId?: string | null;
+};
+/** Whether each device's primary user is in the key's groups, one check per user. */
+export declare function deviceFilter(ctx: ToolContext, mark: Mark): (device: Device) => Promise<boolean>;
+export declare const intuneTools: Toolset;
+export {};