@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.2-dev.d2aa5ca

package/dist/connectors/intune/tools.js

@@ -0,0 +1,416 @@
+import { z } from "zod";
+import { audited, Denied, json, listLimit, VendorFailed, } from "../../packages/connector-kit/src/common.js";
+import { MAX_SCOPE_IDS } from "../entra/tools.js";
+import { cursorArg, nextCursor, ok, pageQuery } from "../sharepoint-files/tools.js";
+// Devices Microsoft Intune manages, read-only. A key's `groups` limit keeps it to devices whose
+// primary user (managedDevice.userId) is in those groups, checked on every call, lookups by id
+// included. Request shapes: learn.microsoft.com/graph/api/intune-devices-manageddevice-list,
+// intune-devices-manageddevice-get, resources/intune-devices-user (a user's managedDevices),
+// resources/intune-devices-manageddevice (v1.0 and beta: the
+// detectedApps relationship is beta only), intune-devices-detectedapp-list and
+// directoryobject-checkmemberobjects. intune_autopilot_status: v1.0 windowsAutopilotDeviceIdentity
+// (list; resources/intune-enrollment-windowsautopilotdeviceidentity) and, for the profile name,
+// the beta `deploymentProfile` relationship (intune-shared-windowsautopilotdeploymentprofile-get),
+// both DeviceManagementServiceConfig.Read.All (read October 25, 2026).
+const GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const UPN = /^[^\s/\\?#%'"]+@[^\s/\\?#%'"]+$/;
+const DEVICES = "/v1.0/deviceManagement/managedDevices";
+const AUTOPILOT = "/v1.0/deviceManagement/windowsAutopilotDeviceIdentities";
+// Letters, digits and dashes: nothing that could change a $filter or a path.
+const SERIAL = /^[A-Za-z0-9-]{1,50}$/;
+const NO_ID = "00000000-0000-0000-0000-000000000000";
+const AUTOPILOT_PAGES = 5;
+// Under a groups limit, an Autopilot device no person is tied to (no primary user, no assigned
+// user: a spare). "minimum" answers only its serial, Autopilot state and whether Intune manages
+// it and its compliance; "refuse" treats it as out of scope, as the other Intune tools treat a
+// device with no user. Open question for the owner: change this one line to "refuse".
+const UNASSIGNED_UNDER_GROUPS = "minimum";
+export const COMPLIANCE_STATES = [
+    "unknown",
+    "compliant",
+    "noncompliant",
+    "conflict",
+    "error",
+    "inGracePeriod",
+    "configManager",
+];
+// ponytail: the summary reads at most this many devices; a server-side report when
+// fleets outgrow it.
+export const SUMMARY_MAX_DEVICES = 5000;
+/** The key's groups, refused when Intune is not set up to check them. */
+function keyGroups(ctx) {
+    const groups = listLimit(ctx.limits, "groups");
+    if (!groups)
+        return null;
+    if (ctx.config.people_groups !== "groups")
+        throw new Denied('This key is kept to groups, but Microsoft Intune is not set up to check groups. An administrator has to choose "Keep keys to people\'s groups" on the Microsoft Intune page.');
+    if (groups.length > MAX_SCOPE_IDS)
+        throw new Denied(`This key names more than ${MAX_SCOPE_IDS} groups. Ask an administrator to narrow it.`);
+    return groups;
+}
+/** Whether a user (id or sign-in name) is in any of the groups; one Graph does not find is in none. */
+async function inGroups(ctx, mark, groups, user) {
+    const res = await ctx.call({
+        method: "POST",
+        path: `/v1.0/users/${encodeURIComponent(user)}/checkMemberObjects`,
+        body: { ids: groups },
+    });
+    mark(res.status);
+    if (res.status === 404)
+        return false;
+    if (res.status !== 200) {
+        const message = res.data?.error?.message;
+        throw new VendorFailed(res.status, `Microsoft Graph answered ${res.status}${message ? `: ${message}` : ""}`);
+    }
+    return (res.data.value ?? []).length > 0;
+}
+/** Whether each device's primary user is in the key's groups, one check per user. */
+export function deviceFilter(ctx, mark) {
+    const groups = keyGroups(ctx);
+    if (!groups)
+        return async () => true;
+    const seen = new Map();
+    return (device) => {
+        const user = device.userId;
+        if (!user || !GUID.test(user))
+            return Promise.resolve(false);
+        if (!seen.has(user))
+            seen.set(user, inGroups(ctx, mark, groups, user));
+        return seen.get(user);
+    };
+}
+/** Everyone in the key's groups, read once: scanning a whole fleet then costs a few listings
+ *  instead of a membership check per user. Null when the key has no groups. */
+async function groupMembers(ctx, mark) {
+    const groups = keyGroups(ctx);
+    if (!groups)
+        return null;
+    const ids = new Set();
+    for (const group of groups) {
+        let cursor;
+        do {
+            const data = await ok(ctx, mark, {
+                method: "GET",
+                path: `/v1.0/groups/${encodeURIComponent(group)}/transitiveMembers/microsoft.graph.user?$select=id&${pageQuery(999, cursor)}`,
+            });
+            for (const u of data.value)
+                ids.add(u.id.toLowerCase());
+            cursor = nextCursor(data) ?? undefined;
+        } while (cursor);
+    }
+    return ids;
+}
+const summary = (d) => ({
+    id: d.id,
+    name: d.deviceName ?? null,
+    user: d.userPrincipalName ?? null,
+    user_name: d.userDisplayName ?? null,
+    os: d.operatingSystem ?? null,
+    os_version: d.osVersion ?? null,
+    compliance: d.complianceState ?? null,
+    last_sync: d.lastSyncDateTime ?? null,
+    encrypted: d.isEncrypted ?? null,
+    model: d.model ?? null,
+    manufacturer: d.manufacturer ?? null,
+    serial_number: d.serialNumber ?? null,
+    management_state: d.managementState ?? null,
+    owner: d.managedDeviceOwnerType ?? null,
+});
+const quoted = (v) => `'${v.replaceAll("'", "''")}'`;
+async function allowedDevices(allowed, devices) {
+    const out = [];
+    for (const d of devices)
+        if (await allowed(d))
+            out.push(d);
+    return out;
+}
+/** One device, read and checked against the key's limits. */
+async function openDevice(ctx, mark, id) {
+    if (!GUID.test(id))
+        throw new Denied("Give a device id from intune_list_devices");
+    const allowed = deviceFilter(ctx, mark);
+    const device = await ok(ctx, mark, { method: "GET", path: `${DEVICES}/${id}` });
+    if (!(await allowed(device)))
+        throw new Denied("This agent may not read that device");
+    return device;
+}
+const listed = (data, devices) => ({
+    devices: devices.map(summary),
+    more: Boolean(data["@odata.nextLink"]),
+    next: nextCursor(data),
+});
+/** A Graph read where 404 means "nothing there": null. */
+async function okOrNone(ctx, mark, req) {
+    let notFound = false;
+    const data = await ok(ctx, (status) => {
+        mark(status);
+        notFound = status === 404;
+    }, req).catch((error) => {
+        if (notFound)
+            return null;
+        throw error;
+    });
+    return data;
+}
+/** Where Graph says a listing continues, as a path for the next call: only another page of
+ *  the same listing on Graph (`@odata.nextLink` is used as given, whatever its paging
+ *  parameter), never another host or resource. */
+function nextPath(link, path) {
+    const url = URL.parse(link);
+    if (url?.origin !== "https://graph.microsoft.com" ||
+        url.pathname.toLowerCase() !== path.toLowerCase())
+        throw new Error(`Graph gave a next page outside ${path}: ${link.slice(0, 200)}`);
+    return `${url.pathname}${url.search}`;
+}
+/** The Autopilot identity with exactly this serial number (any case), or null. The filter is
+ *  `contains` and the match is made here: Microsoft's pages for the list do not document
+ *  $filter, and `contains` on serialNumber is what Intune tooling is seen to use. */
+async function autopilotIdentity(ctx, mark, serial) {
+    const filter = encodeURIComponent(`contains(serialNumber,${quoted(serial)})`);
+    let path = `${AUTOPILOT}?$top=50&$filter=${filter}`;
+    for (let page = 0; page < AUTOPILOT_PAGES; page++) {
+        const data = await ok(ctx, mark, { method: "GET", path });
+        const hit = data.value.find((i) => String(i.serialNumber ?? "").toLowerCase() === serial.toLowerCase());
+        if (hit)
+            return hit;
+        const link = data["@odata.nextLink"];
+        if (!link)
+            return null;
+        path = nextPath(link, AUTOPILOT);
+    }
+    throw new Denied("Too many Autopilot devices match that serial number. Give the full serial number.");
+}
+export const intuneTools = {
+    names: [
+        "intune_list_devices",
+        "intune_get_device",
+        "intune_device_apps",
+        "intune_person_devices",
+        "intune_compliance_summary",
+        "intune_autopilot_status",
+    ],
+    register(server, ctx, allowed) {
+        const readOnly = { readOnlyHint: true, openWorldHint: true };
+        const deviceId = z.string().max(36).describe("A device id, from intune_list_devices.");
+        if (allowed.has("intune_list_devices"))
+            server.registerTool("intune_list_devices", {
+                description: "List managed devices: name, user, system and version, compliance, last check-in, encryption, model and serial number. Optionally only names containing `search`, or one compliance state. When `more` is true, call again with `cursor` set to `next`.",
+                inputSchema: z.object({
+                    search: z.string().max(100).optional().describe("Part of the device name."),
+                    compliance: z.enum(COMPLIANCE_STATES).optional(),
+                    max_results: z.number().int().min(1).max(50).default(25),
+                    cursor: cursorArg,
+                }),
+                annotations: readOnly,
+            }, ({ search, compliance, max_results, cursor }) => audited(ctx, "intune_list_devices", [search, compliance].filter(Boolean).join(" ") || null, async (mark) => {
+                const allowed = deviceFilter(ctx, mark);
+                const filters = [
+                    ...(search?.trim() ? [`contains(deviceName,${quoted(search.trim())})`] : []),
+                    ...(compliance ? [`complianceState eq ${quoted(compliance)}`] : []),
+                ];
+                const filter = filters.length
+                    ? `&$filter=${encodeURIComponent(filters.join(" and "))}`
+                    : "";
+                const data = await ok(ctx, mark, {
+                    method: "GET",
+                    path: `${DEVICES}?${pageQuery(max_results, cursor)}${filter}`,
+                });
+                return json(listed(data, await allowedDevices(allowed, data.value)));
+            }));
+        if (allowed.has("intune_get_device"))
+            server.registerTool("intune_get_device", {
+                description: "One device's details: everything intune_list_devices shows, plus enrollment date, compliance grace period, jailbreak state and how it was enrolled.",
+                inputSchema: z.object({ device_id: deviceId }),
+                annotations: readOnly,
+            }, ({ device_id }) => audited(ctx, "intune_get_device", device_id, async (mark) => {
+                const d = await openDevice(ctx, mark, device_id);
+                return json({
+                    ...summary(d),
+                    enrolled: d.enrolledDateTime ?? null,
+                    compliance_grace_period_ends: d.complianceGracePeriodExpirationDateTime ?? null,
+                    jailbroken: d.jailBroken ?? null,
+                    enrollment_type: d.deviceEnrollmentType ?? null,
+                    entra_device_id: d.azureADDeviceId ?? null,
+                });
+            }));
+        if (allowed.has("intune_device_apps"))
+            server.registerTool("intune_device_apps", {
+                description: "The apps Intune found on a device, with version and publisher. When `more` is true, call again with `cursor` set to `next`.",
+                inputSchema: z.object({
+                    device_id: deviceId,
+                    max_results: z.number().int().min(1).max(200).default(100),
+                    cursor: cursorArg,
+                }),
+                annotations: readOnly,
+            }, ({ device_id, max_results, cursor }) => audited(ctx, "intune_device_apps", device_id, async (mark) => {
+                await openDevice(ctx, mark, device_id);
+                // Only Graph beta has a device's detectedApps.
+                const data = await ok(ctx, mark, {
+                    method: "GET",
+                    path: `/beta/deviceManagement/managedDevices/${device_id}/detectedApps?${pageQuery(max_results, cursor)}`,
+                });
+                return json({
+                    apps: data.value.map((a) => ({
+                        name: a.displayName ?? null,
+                        version: a.version ?? null,
+                        publisher: a.publisher ?? null,
+                        platform: a.platform ?? null,
+                    })),
+                    more: Boolean(data["@odata.nextLink"]),
+                    next: nextCursor(data),
+                });
+            }));
+        if (allowed.has("intune_person_devices"))
+            server.registerTool("intune_person_devices", {
+                description: "The managed devices of one person, by their sign-in name or user id. When `more` is true, call again with `cursor` set to `next`.",
+                inputSchema: z.object({
+                    person: z
+                        .string()
+                        .max(320)
+                        .describe("A sign-in name such as ada@contoso.com, or a user id."),
+                    max_results: z.number().int().min(1).max(50).default(25),
+                    cursor: cursorArg,
+                }),
+                annotations: readOnly,
+            }, ({ person, max_results, cursor }) => audited(ctx, "intune_person_devices", person, async (mark) => {
+                const p = person.trim();
+                if (!GUID.test(p) && !UPN.test(p))
+                    throw new Denied("Give a sign-in name such as ada@contoso.com, or a user id");
+                // Same refusal for a person outside the groups and one who does not exist, as
+                // Entra gives, so a kept key cannot learn which names exist.
+                const groups = keyGroups(ctx);
+                if (groups && !(await inGroups(ctx, mark, groups, p)))
+                    throw new Denied("This agent may not look up that person");
+                // The person's own devices, so the check above is the scope check: this listing
+                // leaves userId and userPrincipalName blank (seen live), which deviceFilter would
+                // read as a device with no user.
+                const data = await ok(ctx, mark, {
+                    method: "GET",
+                    path: `/v1.0/users/${encodeURIComponent(p)}/managedDevices?${pageQuery(max_results, cursor)}`,
+                });
+                return json(listed(data, data.value));
+            }));
+        if (allowed.has("intune_compliance_summary"))
+            server.registerTool("intune_compliance_summary", {
+                description: `How many of the devices this agent may see are in each compliance state, by operating system. Reads at most ${SUMMARY_MAX_DEVICES} devices; \`complete\` says whether that was all of them. List the devices of one state with intune_list_devices.`,
+                inputSchema: z.object({}),
+                annotations: readOnly,
+            }, () => audited(ctx, "intune_compliance_summary", null, async (mark) => {
+                const members = await groupMembers(ctx, mark);
+                const counts = {};
+                let counted = 0;
+                let scanned = 0;
+                let cursor;
+                let complete = true;
+                do {
+                    const data = await ok(ctx, mark, {
+                        method: "GET",
+                        path: `${DEVICES}?$select=id,userId,operatingSystem,complianceState&${pageQuery(1000, cursor)}`,
+                    });
+                    scanned += data.value.length;
+                    for (const d of data.value) {
+                        if (members && !(d.userId && members.has(d.userId.toLowerCase())))
+                            continue;
+                        const os = String(d.operatingSystem ?? "unknown");
+                        const state = String(d.complianceState ?? "unknown");
+                        counts[os] ??= {};
+                        counts[os][state] = (counts[os][state] ?? 0) + 1;
+                        counted++;
+                    }
+                    cursor = nextCursor(data) ?? undefined;
+                    if (cursor && scanned >= SUMMARY_MAX_DEVICES) {
+                        complete = false;
+                        break;
+                    }
+                } while (cursor);
+                return json({ devices_counted: counted, complete, by_operating_system: counts });
+            }));
+        if (allowed.has("intune_autopilot_status"))
+            server.registerTool("intune_autopilot_status", {
+                description: "Where a Windows Autopilot device stands, by its exact serial number: its enrollment state (unknown, enrolled, pendingReset, failed, notContacted), assigned profile, group tag, last contact with Intune and, once Intune manages it, that device's id, compliance and primary user. Unknown to Autopilot: {serial_number, found: false}. When this key is kept to groups and no person is tied to the device, only {serial_number, found, deployment_state, managed, compliance, limited} is answered.",
+                inputSchema: z.object({
+                    serial_number: z
+                        .string()
+                        .max(50)
+                        .describe("The device's exact serial number: letters, digits and dashes only (one with spaces, dots or underscores is refused)."),
+                }),
+                annotations: readOnly,
+            }, ({ serial_number }) => audited(ctx, "intune_autopilot_status", serial_number, async (mark) => {
+                const serial = serial_number.trim();
+                if (!SERIAL.test(serial))
+                    throw new Denied("Give the device's exact serial number: letters, digits and dashes only, up to 50. Serial numbers with spaces, dots or underscores (some virtual machines have them) are not accepted by this tool.");
+                const groups = keyGroups(ctx);
+                const identity = await autopilotIdentity(ctx, mark, serial);
+                if (!identity)
+                    return json({ serial_number: serial, found: false });
+                const managedId = String(identity.managedDeviceId ?? "");
+                // The identity can outlive the managed device it pointed to (404). This read is the
+                // always-on `read` capability's permission, so a 403 carries that capability's hint.
+                const managed = GUID.test(managedId) && managedId !== NO_ID
+                    ? await okOrNone(ctx, mark, {
+                        method: "GET",
+                        path: `${DEVICES}/${managedId}`,
+                    }).catch((error) => {
+                        if (error instanceof VendorFailed)
+                            throw new VendorFailed(error.status, error.message, "intune_get_device");
+                        throw error;
+                    })
+                    : null;
+                // Under a groups limit every person tied to the device must be in the groups: the
+                // managed device's primary user and a user assigned on the Autopilot record.
+                if (groups) {
+                    const inScope = deviceFilter(ctx, mark);
+                    if (managed?.userId && !(await inScope(managed)))
+                        throw new Denied("This agent may not read that device");
+                    const assigned = String(identity.userPrincipalName ?? "").trim();
+                    if (assigned &&
+                        (!UPN.test(assigned) || !(await inGroups(ctx, mark, groups, assigned))))
+                        throw new Denied("This agent may not read that device");
+                    // Nobody tied to it (a spare): see UNASSIGNED_UNDER_GROUPS.
+                    if (!managed?.userId && !assigned) {
+                        if (UNASSIGNED_UNDER_GROUPS === "refuse")
+                            throw new Denied("This agent may not read that device");
+                        return json({
+                            serial_number: String(identity.serialNumber ?? serial),
+                            found: true,
+                            deployment_state: identity.enrollmentState ?? null,
+                            managed: Boolean(managed),
+                            compliance: managed ? (managed.complianceState ?? null) : null,
+                            limited: "No person is tied to this device and this key is kept to groups: only its Autopilot state and compliance are answered.",
+                        });
+                    }
+                }
+                // Only Graph beta has the assigned profile; a device with none is expected to answer
+                // 404. Any other failure leaves the profile out, with why, not the v1.0 answer.
+                let profile = null;
+                let profileError = null;
+                if (GUID.test(String(identity.id)))
+                    profile = await okOrNone(ctx, mark, {
+                        method: "GET",
+                        path: `/beta/deviceManagement/windowsAutopilotDeviceIdentities/${identity.id}/deploymentProfile`,
+                    }).catch((error) => {
+                        if (!(error instanceof VendorFailed))
+                            throw error;
+                        profileError = `Microsoft Graph (beta) answered ${error.status} for the profile`;
+                        return null;
+                    });
+                return json({
+                    serial_number: String(identity.serialNumber ?? serial),
+                    found: true,
+                    deployment_state: identity.enrollmentState ?? null,
+                    enrollment_profile: profile?.displayName ?? null,
+                    ...(profileError ? { enrollment_profile_error: profileError } : {}),
+                    group_tag: identity.groupTag || null,
+                    last_contact: identity.lastContactedDateTime ?? null,
+                    managed_device: managed
+                        ? {
+                            id: managed.id,
+                            compliance: managed.complianceState ?? null,
+                            primary_user: managed.userId ? (managed.userPrincipalName ?? null) : null,
+                        }
+                        : null,
+                });
+            }));
+    },
+};
+//# sourceMappingURL=tools.js.map

package/dist/connectors/intune/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../connectors/intune/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,EACT,YAAY,GAGb,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEpF,gGAAgG;AAChG,+FAA+F;AAC/F,6FAA6F;AAC7F,6FAA6F;AAC7F,6DAA6D;AAC7D,+EAA+E;AAC/E,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,uEAAuE;AAEvE,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,MAAM,GAAG,GAAG,iCAAiC,CAAC;AAC9C,MAAM,OAAO,GAAG,uCAAuC,CAAC;AACxD,MAAM,SAAS,GAAG,yDAAyD,CAAC;AAC5E,6EAA6E;AAC7E,MAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,MAAM,KAAK,GAAG,sCAAsC,CAAC;AACrD,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,+FAA+F;AAC/F,gGAAgG;AAChG,+FAA+F;AAC/F,sFAAsF;AACtF,MAAM,uBAAuB,GAAG,SAAiC,CAAC;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS;IACT,WAAW;IACX,cAAc;IACd,UAAU;IACV,OAAO;IACP,eAAe;IACf,eAAe;CACP,CAAC;AACX,mFAAmF;AACnF,qBAAqB;AACrB,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAKxC,yEAAyE;AACzE,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,QAAQ;QACvC,MAAM,IAAI,MAAM,CACd,8KAA8K,CAC/K,CAAC;IACJ,IAAI,MAAM,CAAC,MAAM,GAAG,aAAa;QAC/B,MAAM,IAAI,MAAM,CACd,4BAA4B,aAAa,6CAA6C,CACvF,CAAC;IACJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,QAAQ,CAAC,GAAgB,EAAE,IAAU,EAAE,MAAgB,EAAE,IAAY;IAClF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC;QACzB,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,eAAe,kBAAkB,CAAC,IAAI,CAAC,qBAAqB;QAClE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAI,GAAG,CAAC,IAAgD,EAAE,KAAK,EAAE,OAAO,CAAC;QACtF,MAAM,IAAI,YAAY,CACpB,GAAG,CAAC,MAAM,EACV,4BAA4B,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,CAAE,GAAG,CAAC,IAA6B,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,IAAU;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,OAAO,CAAC,MAAc,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED;+EAC+E;AAC/E,KAAK,UAAU,YAAY,CAAC,GAAgB,EAAE,IAAU;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,MAA0B,CAAC;QAC/B,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;gBAC/B,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,sDAAsD,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE;aAC9H,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAyB;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5E,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QACzC,CAAC,QAAQ,MAAM,EAAE;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;IAC1B,IAAI,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;IACjC,SAAS,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;IACpC,EAAE,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;IAC7B,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;IAC/B,UAAU,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;IACrC,SAAS,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;IACrC,SAAS,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;IACtB,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;IACpC,aAAa,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;IACrC,gBAAgB,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;IAC3C,KAAK,EAAE,CAAC,CAAC,sBAAsB,IAAI,IAAI;CACxC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAE7D,KAAK,UAAU,cAAc,CAAC,OAAwC,EAAE,OAAiB;IACvF,MAAM,GAAG,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,UAAU,CAAC,GAAgB,EAAE,IAAU,EAAE,EAAU;IAChE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,2CAA2C,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,qCAAqC,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAqD,EAAE,OAAiB,EAAE,EAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACtC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;CACvB,CAAC,CAAC;AAEH,0DAA0D;AAC1D,KAAK,UAAU,QAAQ,CAAC,GAAgB,EAAE,IAAU,EAAE,GAA6B;IACjF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,MAAM,EAAE,CACnB,GAAG,EACH,CAAC,MAAM,EAAE,EAAE;QACT,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,QAAQ,GAAG,MAAM,KAAK,GAAG,CAAC;IAC5B,CAAC,EACD,GAAG,CACJ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAChB,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,IAAqB,CAAC;AAC/B,CAAC;AAED;;kDAEkD;AAClD,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,IACE,GAAG,EAAE,MAAM,KAAK,6BAA6B;QAC7C,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;QAEjD,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AAED;;qFAEqF;AACrF,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,IAAU,EAAE,MAAc;IAC3E,MAAM,MAAM,GAAG,kBAAkB,CAAC,yBAAyB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,IAAI,GAAG,GAAG,SAAS,oBAAoB,MAAM,EAAE,CAAC;IACpD,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAI,IAAI,CAAC,KAAmC,CAAC,IAAI,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAC3E,CAAC;QACF,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,IAAI,MAAM,CACd,mFAAmF,CACpF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAY;IAClC,KAAK,EAAE;QACL,qBAAqB;QACrB,mBAAmB;QACnB,oBAAoB;QACpB,uBAAuB;QACvB,2BAA2B;QAC3B,yBAAyB;KAC1B;IAED,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO;QAC3B,MAAM,QAAQ,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAW,CAAC;QACtE,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;QAEvF,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACpC,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;gBACE,WAAW,EACT,wPAAwP;gBAC1P,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;oBAC3E,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;oBAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxD,MAAM,EAAE,SAAS;iBAClB,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAC9C,OAAO,CACL,GAAG,EACH,qBAAqB,EACrB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EACtD,KAAK,EAAE,IAAI,EAAE,EAAE;gBACb,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACxC,MAAM,OAAO,GAAG;oBACd,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,sBAAsB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC;gBACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;oBAC3B,CAAC,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE;oBACzD,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAC/B,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,GAAG,OAAO,IAAI,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE;iBAC9D,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC,CACF,CACJ,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAClC,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;gBACE,WAAW,EACT,qJAAqJ;gBACvJ,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;gBAC9C,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAChB,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC1D,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACjD,OAAO,IAAI,CAAC;oBACV,GAAG,OAAO,CAAC,CAAC,CAAC;oBACb,QAAQ,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;oBACpC,4BAA4B,EAAE,CAAC,CAAC,uCAAuC,IAAI,IAAI;oBAC/E,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;oBAChC,eAAe,EAAE,CAAC,CAAC,oBAAoB,IAAI,IAAI;oBAC/C,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;iBAC3C,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACnC,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;gBACE,WAAW,EACT,6HAA6H;gBAC/H,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,SAAS,EAAE,QAAQ;oBACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;oBAC1D,MAAM,EAAE,SAAS;iBAClB,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CACrC,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC3D,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACvC,+CAA+C;gBAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAC/B,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,yCAAyC,SAAS,iBAAiB,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;iBAC1G,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;oBACV,IAAI,EAAG,IAAI,CAAC,KAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC1D,IAAI,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;wBAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;wBAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;wBAC9B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;qBAC7B,CAAC,CAAC;oBACH,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACtC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;iBACvB,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACtC,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;gBACE,WAAW,EACT,mIAAmI;gBACrI,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC;yBACN,MAAM,EAAE;yBACR,GAAG,CAAC,GAAG,CAAC;yBACR,QAAQ,CAAC,uDAAuD,CAAC;oBACpE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxD,MAAM,EAAE,SAAS;iBAClB,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAClC,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC/B,MAAM,IAAI,MAAM,CAAC,2DAA2D,CAAC,CAAC;gBAChF,8EAA8E;gBAC9E,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;oBACnD,MAAM,IAAI,MAAM,CAAC,wCAAwC,CAAC,CAAC;gBAC7D,gFAAgF;gBAChF,kFAAkF;gBAClF,iCAAiC;gBACjC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAC/B,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,eAAe,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;iBAC9F,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;YAC1C,MAAM,CAAC,YAAY,CACjB,2BAA2B,EAC3B;gBACE,WAAW,EAAE,+GAA+G,mBAAmB,mHAAmH;gBAClQ,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,WAAW,EAAE,QAAQ;aACtB,EACD,GAAG,EAAE,CACH,OAAO,CAAC,GAAG,EAAE,2BAA2B,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC7D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC9C,MAAM,MAAM,GAA2C,EAAE,CAAC;gBAC1D,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,IAAI,MAA0B,CAAC;gBAC/B,IAAI,QAAQ,GAAG,IAAI,CAAC;gBACpB,GAAG,CAAC;oBACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;wBAC/B,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,GAAG,OAAO,sDAAsD,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;qBAChG,CAAC,CAAC;oBACH,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAiB,EAAE,CAAC;wBACvC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;4BAAE,SAAS;wBAC5E,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,SAAS,CAAC,CAAC;wBAClD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,SAAS,CAAC,CAAC;wBACrD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;wBAClB,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;wBACjD,OAAO,EAAE,CAAC;oBACZ,CAAC;oBACD,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;oBACvC,IAAI,MAAM,IAAI,OAAO,IAAI,mBAAmB,EAAE,CAAC;wBAC7C,QAAQ,GAAG,KAAK,CAAC;wBACjB,MAAM;oBACR,CAAC;gBACH,CAAC,QAAQ,MAAM,EAAE;gBACjB,OAAO,IAAI,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;YACxC,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;gBACE,WAAW,EACT,yeAAye;gBAC3e,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,aAAa,EAAE,CAAC;yBACb,MAAM,EAAE;yBACR,GAAG,CAAC,EAAE,CAAC;yBACP,QAAQ,CACP,sHAAsH,CACvH;iBACJ,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACpB,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;oBACtB,MAAM,IAAI,MAAM,CACd,oMAAoM,CACrM,CAAC;gBACJ,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC5D,IAAI,CAAC,QAAQ;oBAAE,OAAO,IAAI,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEpE,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;gBACzD,oFAAoF;gBACpF,qFAAqF;gBACrF,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,KAAK;oBACzC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE;wBACxB,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,GAAG,OAAO,IAAI,SAAS,EAAE;qBAChC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACjB,IAAI,KAAK,YAAY,YAAY;4BAC/B,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;wBAC3E,MAAM,KAAK,CAAC;oBACd,CAAC,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAC;gBACX,kFAAkF;gBAClF,6EAA6E;gBAC7E,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;oBACxC,IAAI,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;wBAC9C,MAAM,IAAI,MAAM,CAAC,qCAAqC,CAAC,CAAC;oBAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjE,IACE,QAAQ;wBACR,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;wBAEvE,MAAM,IAAI,MAAM,CAAC,qCAAqC,CAAC,CAAC;oBAC1D,4DAA4D;oBAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAClC,IAAI,uBAAuB,KAAK,QAAQ;4BACtC,MAAM,IAAI,MAAM,CAAC,qCAAqC,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC;4BACV,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC;4BACtD,KAAK,EAAE,IAAI;4BACX,gBAAgB,EAAE,QAAQ,CAAC,eAAe,IAAI,IAAI;4BAClD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;4BACzB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;4BAC9D,OAAO,EACL,wHAAwH;yBAC3H,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,qFAAqF;gBACrF,gFAAgF;gBAChF,IAAI,OAAO,GAAkB,IAAI,CAAC;gBAClC,IAAI,YAAY,GAAkB,IAAI,CAAC;gBACvC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAChC,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE;wBAClC,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,2DAA2D,QAAQ,CAAC,EAAE,oBAAoB;qBACjG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACjB,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;4BAAE,MAAM,KAAK,CAAC;wBAClD,YAAY,GAAG,mCAAmC,KAAK,CAAC,MAAM,kBAAkB,CAAC;wBACjF,OAAO,IAAI,CAAC;oBACd,CAAC,CAAC,CAAC;gBACL,OAAO,IAAI,CAAC;oBACV,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC;oBACtD,KAAK,EAAE,IAAI;oBACX,gBAAgB,EAAE,QAAQ,CAAC,eAAe,IAAI,IAAI;oBAClD,kBAAkB,EAAG,OAAO,EAAE,WAAkC,IAAI,IAAI;oBACxE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,SAAS,EAAE,QAAQ,CAAC,QAAQ,IAAI,IAAI;oBACpC,YAAY,EAAE,QAAQ,CAAC,qBAAqB,IAAI,IAAI;oBACpD,cAAc,EAAE,OAAO;wBACrB,CAAC,CAAC;4BACE,EAAE,EAAE,OAAO,CAAC,EAAE;4BACd,UAAU,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;4BAC3C,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;yBAC1E;wBACH,CAAC,CAAC,IAAI;iBACT,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;IACN,CAAC;CACF,CAAC"}

package/dist/connectors/jamf/connector.json

@@ -0,0 +1,182 @@
+{
+  "id": "jamf",
+  "name": "Jamf Pro",
+  "description": "Let agents look up the Macs, iPhones and iPads Jamf Pro manages, their groups and policies, and, if you allow it, send them commands such as check in, restart, lock or erase.",
+  "logo": "/brand/registry/jamf.svg",
+  "identity": "A Jamf Pro API client named \"{brand.microsoft.appName}\", with an API role holding only the privileges below. Each API key can be kept to the devices, groups and policies of chosen Jamf sites.",
+  "accountKey": "host",
+  "connectionKind": "guided",
+  "setup": [
+    {
+      "title": "Create an API role",
+      "body": "In Jamf Pro, create an API role named \"{brand.microsoft.appName}\" with exactly these privileges. Changing the role's privileges later takes effect at once, with no new secret. With Commands, run them on a Mac or Linux computer with curl and jq, signed in as a Jamf Pro administrator.",
+      "click": [
+        "In Jamf Pro, open Settings, then System, then API roles and clients, and select the API Roles tab.",
+        "Select New and enter the display name {brand.microsoft.appName}.",
+        "Under Jamf Pro API role privileges, add: {scopes}.",
+        "Select Save."
+      ],
+      "copy": [
+        "JAMF=https://your-company.jamfcloud.com",
+        "TOKEN=$(curl -s -u your-admin-username -X POST \"$JAMF/api/v1/auth/token\" | jq -r .token)",
+        "P=()",
+        "P+=(\"{scope}\")",
+        "curl -s -X POST \"$JAMF/api/v1/api-roles\" -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" -d \"$(jq -n --arg name \"{brand.microsoft.appName}\" '{displayName: $name, privileges: $ARGS.positional}' --args \"${P[@]}\")\""
+      ],
+      "shell": "bash",
+      "link": {
+        "label": "Jamf Pro API roles and clients",
+        "href": "https://learn.jamf.com/r/en-US/jamf-pro-documentation-current/API_Roles_and_Clients"
+      }
+    },
+    {
+      "title": "Create an API client",
+      "body": "Create an API client named \"{brand.microsoft.appName}\" with that role only, enable it, and generate its client secret. Leave the access token lifetime at its default. Copy the client ID and secret: Jamf Pro shows the secret only once.",
+      "click": [
+        "Still in API roles and clients, select the API Clients tab, then New.",
+        "Display name: {brand.microsoft.appName}. API roles: {brand.microsoft.appName}. Leave Access token lifetime as it is.",
+        "Select Enable API client, then Save.",
+        "Select Generate client secret, then Create secret, and copy the client ID and secret."
+      ],
+      "copy": [
+        "ID=$(curl -s -X POST \"$JAMF/api/v1/api-integrations\" -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" -d \"$(jq -n --arg name \"{brand.microsoft.appName}\" '{displayName: $name, authorizationScopes: [$name], enabled: true}')\" | jq -r .id)",
+        "curl -s -X POST \"$JAMF/api/v1/api-integrations/$ID/client-credentials\" -H \"Authorization: Bearer $TOKEN\""
+      ],
+      "shell": "bash"
+    }
+  ],
+  "afterConnect": [],
+  "fields": [
+    {
+      "id": "url",
+      "label": "Jamf Pro address",
+      "help": "The address you open Jamf Pro at, with https.",
+      "placeholder": "https://your-company.jamfcloud.com",
+      "secret": false
+    },
+    {
+      "id": "client_id",
+      "label": "Client ID",
+      "secret": false
+    },
+    {
+      "id": "client_secret",
+      "label": "Client secret",
+      "secret": true
+    }
+  ],
+  "capabilities": [
+    {
+      "id": "read",
+      "label": "Look up devices",
+      "description": "Find computers and mobile devices by name, serial number or user, and read one device's system version, last check-in, FileVault or encryption, whether it is managed, its groups and, on request, its apps.",
+      "required": true,
+      "note": "Reaches every device unless you keep a key to chosen sites under API keys. Read-only.",
+      "scopes": ["Read Computers", "Read Mobile Devices", "Read Sites"],
+      "permissions": [],
+      "tools": ["jamf_search_devices", "jamf_get_device"],
+      "forbidden": "Jamf Pro refused this. Add {scopes} to the {brand.microsoft.appName} API role."
+    },
+    {
+      "id": "groups",
+      "label": "Read groups",
+      "description": "List computer and mobile device groups, smart and static, and read their members.",
+      "scopes": [
+        "Read Smart Computer Groups",
+        "Read Static Computer Groups",
+        "Read Smart Mobile Device Groups",
+        "Read Static Mobile Device Groups"
+      ],
+      "permissions": [],
+      "tools": ["jamf_list_groups", "jamf_get_group"],
+      "forbidden": "Jamf Pro refused this. Add {scopes} to the {brand.microsoft.appName} API role."
+    },
+    {
+      "id": "group_membership",
+      "label": "Change static group members",
+      "description": "Add devices to static groups and remove them. Smart groups cannot be changed.",
+      "destructive": true,
+      "note": "Policies, configuration profiles and apps scoped to a group follow its members, so removing a device from a group can remove a profile or an app (and the app's data) from it.",
+      "scopes": [
+        "Read Static Computer Groups",
+        "Update Static Computer Groups",
+        "Read Static Mobile Device Groups",
+        "Update Static Mobile Device Groups"
+      ],
+      "permissions": [],
+      "tools": ["jamf_change_group_members"],
+      "forbidden": "Jamf Pro refused this. Add {scopes} to the {brand.microsoft.appName} API role."
+    },
+    {
+      "id": "check_in",
+      "label": "Ask devices to check in",
+      "description": "Send a blank push, so devices check in now and pick up pending commands, profiles and apps. Changes nothing on the device.",
+      "scopes": [
+        "View MDM command information in Jamf Pro API",
+        "Send Blank Pushes to Mobile Devices"
+      ],
+      "permissions": [],
+      "tools": ["jamf_send_blank_push"],
+      "forbidden": "Jamf Pro refused this. Add {scopes} to the {brand.microsoft.appName} API role. Jamf Pro checks a send privilege for each command and kind of device: if it still refuses computers, add the matching one listed under Jamf Pro Server Actions."
+    },
+    {
+      "id": "restart_lock",
+      "label": "Restart and lock devices",
+      "description": "Restart a device, or lock it with a message and phone number on its lock screen. A locked Mac needs the PIN the agent chose.",
+      "note": "Whoever is using the device is interrupted and can lose unsaved work.",
+      "scopes": [
+        "View MDM command information in Jamf Pro API",
+        "Send Computer Remote Lock Command",
+        "Send Mobile Device Restart Device Command"
+      ],
+      "permissions": [],
+      "tools": ["jamf_restart_device", "jamf_lock_device"],
+      "forbidden": "Jamf Pro refused this. Add {scopes} to the {brand.microsoft.appName} API role. Jamf Pro checks a send privilege for each command and kind of device: if it still refuses, add the matching one listed under Jamf Pro Server Actions."
+    },
+    {
+      "id": "erase",
+      "label": "Erase devices",
+      "description": "Erase a device back to factory settings. Everything on it is deleted for good. The agent must give the device's serial number to confirm.",
+      "destructive": true,
+      "scopes": [
+        "View MDM command information in Jamf Pro API",
+        "Send Computer Remote Wipe Command",
+        "Send Mobile Device Remote Wipe Command"
+      ],
+      "permissions": [],
+      "tools": ["jamf_erase_device"],
+      "forbidden": "Jamf Pro refused this. Add {scopes} to the {brand.microsoft.appName} API role."
+    },
+    {
+      "id": "policies",
+      "label": "Read policies and their logs",
+      "description": "List policies, read one policy's triggers, scope, packages and scripts, and read the policy runs logged on a computer.",
+      "scopes": ["Read Policies"],
+      "permissions": [],
+      "tools": ["jamf_list_policies", "jamf_get_policy", "jamf_computer_policy_logs"],
+      "forbidden": "Jamf Pro refused this. Add {scopes} to the {brand.microsoft.appName} API role."
+    }
+  ],
+  "limits": [
+    {
+      "id": "sites",
+      "label": "Sites",
+      "help": "Optional: only the devices, groups and policies of these Jamf sites (their IDs: in Jamf Pro, open Settings, then Global, then Sites, and open a site; the ID is the number at the end of its address). Devices with no site are left out. Leave empty for every device.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[0-9]{1,10}$"
+    }
+  ],
+  "verify": {
+    "method": "GET",
+    "path": "/api/v1/jamf-pro-version",
+    "label": "Jamf Pro version",
+    "show": "version"
+  },
+  "discover": {
+    "label": "Sites",
+    "check": "sites",
+    "ifEmpty": "Jamf Pro has no sites, so API keys cannot be kept to sites: each key reaches every device."
+  },
+  "revoke": "In Jamf Pro, open Settings, then System, then API roles and clients, select the API Clients tab, open {brand.microsoft.appName}, and disable or delete it."
+}

package/dist/connectors/jamf/index.d.ts

@@ -0,0 +1,8 @@
+declare const _default: {
+    id: string;
+    create: () => {
+        vendor: import("../../packages/connector-kit/src/types.js").Vendor;
+        toolset: import("../../packages/connector-kit/src/common.js").Toolset;
+    };
+};
+export default _default;

package/dist/connectors/jamf/index.js

@@ -0,0 +1,7 @@
+import { jamfTools } from "./tools.js";
+import { jamfVendor } from "./vendor.js";
+export default {
+    id: "jamf",
+    create: () => ({ vendor: jamfVendor(), toolset: jamfTools }),
+};
+//# sourceMappingURL=index.js.map

package/dist/connectors/jamf/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../connectors/jamf/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,eAAe;IACb,EAAE,EAAE,MAAM;IACV,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;CACnC,CAAC"}