@arbium/enterprise-agent-connect 0.1.1 → 0.1.2-dev.cba5f68

package/dist/connectors/workday/vendor.js

@@ -0,0 +1,199 @@
+import { createHash } from "node:crypto";
+import { vendorFetch } from "../../packages/connector-kit/src/fetch.js";
+import { vendorError } from "../../packages/connector-kit/src/oauth.js";
+import { ConnectError, TokenCache, } from "../../packages/connector-kit/src/types.js";
+// A Workday API client for integrations, signing in as its Integration System User with a
+// non-expiring refresh token (OAuth 2.0 refresh token grant at /ccx/oauth2/<tenant>/token, the
+// client id and secret as HTTP Basic). REST calls under /ccx/api/<service>/<version>/<tenant>,
+// custom reports (Reports-as-a-Service) under /ccx/service/customreport2/<tenant>. Service
+// paths are Workday's REST directory (developer.workday.com, services_oas3.json, read October
+// 27, 2026); its spec files need a Workday sign-in, so answer fields follow CData's Workday
+// tables, which are generated from them.
+const HOST = /^[a-z0-9-]+(\.[a-z0-9-]+)*\.(myworkday|workday)\.com$/;
+const TENANT = /^[A-Za-z0-9_]{1,64}$/;
+const REPORT_SEGMENT = /^[A-Za-z0-9_.\-]{1,200}$/;
+const PROMPT = /^[A-Za-z0-9_!.\-]{1,100}$/;
+const MAX_REPORTS = 30;
+// Workday's token answer may carry no lifetime: reuse a token this long, re-mint once on a 401.
+const DEFAULT_TOKEN_SECONDS = 600;
+// The REST API endpoint shown on Workday's View API Clients page, e.g.
+// https://wd5-services1.myworkday.com/ccx/api/v1/acme: host and tenant.
+export function parseEndpoint(raw) {
+    let url;
+    try {
+        url = new URL(raw.trim());
+    }
+    catch {
+        throw new ConnectError("Enter the Workday REST API endpoint, such as https://wd5-services1.myworkday.com/ccx/api/v1/acme");
+    }
+    const host = url.hostname.toLowerCase();
+    if (url.protocol !== "https:" || url.port || !HOST.test(host))
+        throw new ConnectError(`${url.host} is not a Workday address (ending myworkday.com or workday.com)`);
+    const tenant = /^\/ccx\/api\/(?:[A-Za-z]+\/)?v\d+\/([^/]+)\/?$/.exec(url.pathname)?.[1];
+    if (!tenant || !TENANT.test(tenant))
+        throw new ConnectError("The endpoint should end with /ccx/api/v1/<tenant>, as shown on the View API Clients page");
+    return { host, tenant };
+}
+// Each report's JSON link from Workday (the report's Actions > Web Service > View URLs > JSON),
+// separated by spaces or new lines. Its query names are the report's prompts; one whose example
+// value is a date takes dates.
+export function parseReports(raw, host, tenant) {
+    const links = raw.split(/\s+/).filter(Boolean);
+    if (links.length > MAX_REPORTS)
+        throw new ConnectError(`Enter at most ${MAX_REPORTS} reports`);
+    const reports = links.map((link) => {
+        let url;
+        try {
+            url = new URL(link);
+        }
+        catch {
+            throw new ConnectError(`${link.slice(0, 100)} is not a report link`);
+        }
+        const parts = url.pathname.split("/").map((p) => decodeURIComponent(p));
+        const [, ccx, service, kind, t, owner, report] = parts;
+        if (url.protocol !== "https:" ||
+            url.hostname.toLowerCase() !== host ||
+            ccx !== "ccx" ||
+            service !== "service" ||
+            kind !== "customreport2" ||
+            parts.length !== 7 ||
+            !REPORT_SEGMENT.test(owner ?? "") ||
+            !REPORT_SEGMENT.test(report ?? ""))
+            throw new ConnectError(`${link.slice(0, 100)} is not a custom report link on ${host} (…/ccx/service/customreport2/${tenant}/<owner>/<report>)`);
+        if (t !== tenant)
+            throw new ConnectError(`${report} belongs to tenant ${t}, not ${tenant}`);
+        const prompts = [];
+        for (const [name, value] of url.searchParams) {
+            if (name === "format")
+                continue;
+            if (!PROMPT.test(name))
+                throw new ConnectError(`${report}: ${name} is not a prompt name`);
+            prompts.push({ name, type: /^\d{4}-\d{2}-\d{2}/.test(value) ? "date" : "text" });
+        }
+        return { name: report, owner, report, prompts };
+    });
+    const names = reports.map((r) => r.name);
+    const twice = names.find((n, i) => names.indexOf(n) !== i);
+    if (twice)
+        throw new ConnectError(`${twice} is entered twice`);
+    return reports;
+}
+export function connectedReports(config) {
+    return config.reports ? JSON.parse(config.reports) : [];
+}
+export function workdayVendor(unguarded = fetch) {
+    const fetchImpl = vendorFetch("Workday", unguarded);
+    const tokens = new TokenCache();
+    const key = (c) => createHash("sha256")
+        .update(`${c.config.host}\n${c.config.tenant}\n${c.secret.client_id}\n${c.secret.refresh_token}`)
+        .digest("hex");
+    async function mint(c) {
+        const { host, tenant } = c.config;
+        const res = await fetchImpl(`https://${host}/ccx/oauth2/${tenant}/token`, {
+            method: "POST",
+            headers: {
+                authorization: `Basic ${Buffer.from(`${c.secret.client_id}:${c.secret.client_secret}`).toString("base64")}`,
+                "content-type": "application/x-www-form-urlencoded",
+                accept: "application/json",
+            },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                refresh_token: c.secret.refresh_token,
+            }),
+        });
+        const raw = await res.text();
+        const body = parse(raw);
+        if (!res.ok)
+            throw new ConnectError(`Workday refused the sign-in (${res.status}${vendorError(body) ? `: ${vendorError(body)}` : ""}). Check the client ID, secret and refresh token, and that the refresh token was made for this API client.`);
+        if (typeof body !== "object" || !body || typeof body.access_token !== "string")
+            throw new ConnectError("Workday answered the sign-in without a token");
+        const expiresIn = Number(body.expires_in);
+        return {
+            token: body.access_token,
+            expiresIn: Number.isFinite(expiresIn) && expiresIn > 60 ? expiresIn : DEFAULT_TOKEN_SECONDS,
+        };
+    }
+    async function send(c, access, request) {
+        const res = await fetchImpl(`https://${c.config.host}${request.path}`, {
+            method: request.method,
+            headers: {
+                authorization: `Bearer ${access}`,
+                accept: "application/json",
+                ...(request.body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            body: request.body === undefined ? undefined : JSON.stringify(request.body),
+        });
+        const raw = await res.text();
+        return {
+            status: res.status,
+            data: raw ? parse(raw) : null,
+            headers: Object.fromEntries(res.headers),
+        };
+    }
+    const call = async (c, request) => {
+        if (!HOST.test(c.config.host ?? "") || !TENANT.test(c.config.tenant ?? ""))
+            throw new Error("Workday connection has no host or tenant");
+        if (!request.path.startsWith("/ccx/"))
+            throw new Error(`Not a Workday path: ${request.path}`);
+        let res = await send(c, await tokens.get(key(c), () => mint(c)), request);
+        if (res.status === 401) {
+            tokens.forget(key(c));
+            res = await send(c, await tokens.get(key(c), () => mint(c)), request);
+        }
+        return res;
+    };
+    return {
+        async connect(fields) {
+            const { host, tenant } = parseEndpoint(fields.endpoint ?? "");
+            const clientId = fields.client_id?.trim();
+            const clientSecret = fields.client_secret?.trim();
+            const refreshToken = fields.refresh_token?.trim();
+            if (!clientId || !clientSecret || !refreshToken)
+                throw new ConnectError("Enter the client ID, client secret and refresh token");
+            const reports = parseReports(fields.reports ?? "", host, tenant);
+            const orgColumn = fields.report_org_column?.trim() ?? "";
+            if (orgColumn && !PROMPT.test(orgColumn))
+                throw new ConnectError(`${orgColumn} is not a report column name`);
+            const conn = {
+                config: {
+                    host,
+                    tenant,
+                    account: `${host}/${tenant}`,
+                    reports: JSON.stringify(reports),
+                    ...(orgColumn ? { reportOrgColumn: orgColumn } : {}),
+                },
+                secret: { client_id: clientId, client_secret: clientSecret, refresh_token: refreshToken },
+            };
+            tokens.forget(key(conn));
+            await tokens.get(key(conn), () => mint(conn));
+            return { ...conn, accountLabel: `${tenant} (${host})` };
+        },
+        call,
+        checks: {
+            // One worker read proves the account reaches staffing data; nothing of it is shown.
+            async tenant(connection) {
+                const res = await call(connection, {
+                    method: "GET",
+                    path: `/ccx/api/staffing/v7/${connection.config.tenant}/workers?limit=1`,
+                });
+                if (res.status === 401 || res.status === 403)
+                    throw new ConnectError(`Workday refused to list workers (${res.status}). Give the account's security group View on Worker Data: Public Worker Reports, activate the pending security policy changes, then check again.`);
+                if (res.status < 200 || res.status >= 300)
+                    throw new ConnectError(`Workday answered ${res.status}: ${vendorError(res.data) || "no reason given"}`);
+                return { values: [`${connection.config.tenant} (${connection.config.host})`] };
+            },
+            async reports(connection) {
+                return { values: connectedReports(connection.config).map((r) => r.name) };
+            },
+        },
+    };
+}
+function parse(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+//# sourceMappingURL=vendor.js.map

package/dist/connectors/workday/vendor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../../connectors/workday/vendor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EACL,YAAY,EACZ,UAAU,GAKX,MAAM,2CAA2C,CAAC;AAEnD,0FAA0F;AAC1F,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,yCAAyC;AAEzC,MAAM,IAAI,GAAG,uDAAuD,CAAC;AACrE,MAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAClD,MAAM,MAAM,GAAG,2BAA2B,CAAC;AAC3C,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,gGAAgG;AAChG,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAKlC,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CACpB,kGAAkG,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3D,MAAM,IAAI,YAAY,CACpB,GAAG,GAAG,CAAC,IAAI,iEAAiE,CAC7E,CAAC;IACJ,MAAM,MAAM,GAAG,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACjC,MAAM,IAAI,YAAY,CACpB,0FAA0F,CAC3F,CAAC;IACJ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,gGAAgG;AAChG,gGAAgG;AAChG,+BAA+B;AAC/B,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY,EAAE,MAAc;IACpE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW;QAAE,MAAM,IAAI,YAAY,CAAC,iBAAiB,WAAW,UAAU,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;QACvD,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI;YACnC,GAAG,KAAK,KAAK;YACb,OAAO,KAAK,SAAS;YACrB,IAAI,KAAK,eAAe;YACxB,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YAElC,MAAM,IAAI,YAAY,CACpB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mCAAmC,IAAI,iCAAiC,MAAM,oBAAoB,CACxH,CAAC;QACJ,IAAI,CAAC,KAAK,MAAM;YAAE,MAAM,IAAI,YAAY,CAAC,GAAG,MAAM,sBAAsB,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YAC7C,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,YAAY,CAAC,GAAG,MAAM,KAAK,IAAI,uBAAuB,CAAC,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAA8B;IAC7D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAmB,KAAK;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,CAAmB,EAAE,EAAE,CAClC,UAAU,CAAC,QAAQ,CAAC;SACjB,MAAM,CACL,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CACzF;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,KAAK,UAAU,IAAI,CAAC,CAAmB;QACrC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,IAAI,eAAe,MAAM,QAAQ,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBAC3G,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa;aACtC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAqE,CAAC;QAC5F,IAAI,CAAC,GAAG,CAAC,EAAE;YACT,MAAM,IAAI,YAAY,CACpB,gCAAgC,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,4GAA4G,CAC3M,CAAC;QACJ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YAC5E,MAAM,IAAI,YAAY,CAAC,8CAA8C,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB;SAC5F,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,CAAmB,EAAE,MAAc,EAAE,OAAsB;QAC7E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE;YACrE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC9E;YACD,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;SAC5E,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7B,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAmB,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;QAChD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;YAClD,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY;gBAC7C,MAAM,IAAI,YAAY,CAAC,sDAAsD,CAAC,CAAC;YACjF,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;gBACtC,MAAM,IAAI,YAAY,CAAC,GAAG,SAAS,8BAA8B,CAAC,CAAC;YACrE,MAAM,IAAI,GAAqB;gBAC7B,MAAM,EAAE;oBACN,IAAI;oBACJ,MAAM;oBACN,OAAO,EAAE,GAAG,IAAI,IAAI,MAAM,EAAE;oBAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAChC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD;gBACD,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE;aAC1F,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzB,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI;QAEJ,MAAM,EAAE;YACN,oFAAoF;YACpF,KAAK,CAAC,MAAM,CAAC,UAAU;gBACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;oBACjC,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,wBAAwB,UAAU,CAAC,MAAM,CAAC,MAAM,kBAAkB;iBACzE,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAC1C,MAAM,IAAI,YAAY,CACpB,oCAAoC,GAAG,CAAC,MAAM,kJAAkJ,CACjM,CAAC;gBACJ,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;oBACvC,MAAM,IAAI,YAAY,CACpB,oBAAoB,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,iBAAiB,EAAE,CAChF,CAAC;gBACJ,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACjF,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,UAAU;gBACtB,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/packages/connector-kit/src/branding.d.ts

@@ -0,0 +1,57 @@
+import { z } from "zod";
+export declare const brandingSchema: z.ZodObject<{
+    productName: z.ZodDefault<z.ZodString>;
+    logoUrl: z.ZodOptional<z.ZodURL>;
+    resourcePrefix: z.ZodDefault<z.ZodString>;
+    microsoft: z.ZodDefault<z.ZodObject<{
+        appName: z.ZodDefault<z.ZodString>;
+        mailboxGroup: z.ZodDefault<z.ZodString>;
+        mailboxGroupAlias: z.ZodDefault<z.ZodString>;
+        botRole: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>>;
+    teams: z.ZodDefault<z.ZodObject<{
+        resourceGroup: z.ZodDefault<z.ZodString>;
+        developer: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            websiteUrl: z.ZodURL;
+            privacyUrl: z.ZodURL;
+            termsOfUseUrl: z.ZodURL;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type Branding = z.infer<typeof brandingSchema>;
+export type BrandingInput = z.input<typeof brandingSchema>;
+export declare const DEFAULT_BRANDING: Branding;
+export declare function parseBranding(raw: unknown): Branding;
+export declare const brand: () => {
+    productName: string;
+    resourcePrefix: string;
+    microsoft: {
+        appName: string;
+        mailboxGroup: string;
+        mailboxGroupAlias: string;
+        botRole: string;
+    };
+    teams: {
+        resourceGroup: string;
+        developer?: {
+            name: string;
+            websiteUrl: string;
+            privacyUrl: string;
+            termsOfUseUrl: string;
+        } | undefined;
+    };
+    logoUrl?: string | undefined;
+};
+export declare function setBranding(b: Branding): void;
+/** Fills `{brand.a.b}` placeholders; one naming no text field of the branding throws. */
+export declare function fillBrand(text: string, b?: Branding): string;
+/** fillBrand over every string in a parsed JSON value. */
+export declare function fillBrandDeep<T>(value: T, b?: Branding): T;
+/** The Teams manifest's developer, which a package needs. */
+export declare function teamsDeveloper(b?: Branding): {
+    name: string;
+    websiteUrl: string;
+    privacyUrl: string;
+    termsOfUseUrl: string;
+};

package/dist/packages/connector-kit/src/certificate.d.ts

@@ -0,0 +1,19 @@
+export type NewCertificate = {
+    certificate: string;
+    privateKey: string;
+};
+export declare function newCertificate(commonName: string, now?: Date): NewCertificate;
+/** What the admin sees of a certificate: Entra lists it by its SHA-1 thumbprint. */
+export declare function describeCertificate(pem: string): {
+    thumbprint: string;
+    expiresAt: string;
+};
+/** A signed client assertion (RFC 7523) for Microsoft's token endpoint, valid five minutes.
+ *  Microsoft pairs the x5t#S256 header with PS256 (RSA-PSS). */
+export declare function clientAssertion(input: {
+    clientId: string;
+    tokenUrl: string;
+    certificate: string;
+    privateKey: string;
+    now?: number;
+}): string;

package/dist/packages/connector-kit/src/common.d.ts

@@ -0,0 +1,36 @@
+import type { CallToolResult, McpServer } from "@modelcontextprotocol/server";
+import { type Limits, type VendorRequest, type VendorResponse } from "./types.js";
+export type ToolContext = {
+    limits: Limits;
+    /** The connection's settings, e.g. the sites it was connected with. */
+    config: Record<string, string>;
+    call(request: VendorRequest): Promise<VendorResponse>;
+    /** Per tool: what to add to a 403 from the app (its capability's `forbidden`). */
+    forbidden?: Record<string, string>;
+    audit(entry: {
+        tool: string;
+        target: string | null;
+        decision: "allowed" | "denied" | "failed";
+        reason: string | null;
+        vendorStatus: number | null;
+    }): Promise<void>;
+};
+export type Toolset = {
+    names: readonly string[];
+    register(server: McpServer, ctx: ToolContext, allowed: ReadonlySet<string>): void;
+};
+/** One app's tools from several sets, e.g. SharePoint's files and spreadsheets. */
+export declare const toolsets: (...sets: Toolset[]) => Toolset;
+export declare class Denied extends Error {
+}
+export declare class VendorFailed extends Error {
+    readonly status: number;
+    readonly hintTool?: string | undefined;
+    constructor(status: number, message: string, hintTool?: string | undefined);
+}
+export declare function listLimit(limits: Limits, id: string): string[] | null;
+export declare function mapLimit(limits: Limits, id: string): Record<string, string> | null;
+export declare function textLimit(limits: Limits, id: string): string | null;
+export declare const argumentsTarget: (args: unknown) => string | null;
+export declare const json: (data: unknown) => CallToolResult;
+export declare function audited(ctx: ToolContext, tool: string, target: string | null, run: (vendorStatus: (status: number) => void, retarget: (sent: string) => void) => Promise<CallToolResult>): Promise<CallToolResult>;

package/dist/packages/connector-kit/src/common.js

@@ -1,3 +1,4 @@
+import { ConnectError } from "./types.js";
 /** One app's tools from several sets, e.g. SharePoint's files and spreadsheets. */
 export const toolsets = (...sets) => ({
     names: sets.flatMap((s) => s.names),
@@ -59,7 +60,9 @@ export async function audited(ctx, tool, target, run) {
     try {
         result = await run((s) => (status = s), (sent) => (target = sent));
     }
-    catch (error) {
+    catch (caught) {
+        // A ConnectError (an app's redirect, an unreachable address) is written for people to read.
+        const error = caught instanceof ConnectError ? new VendorFailed(502, caught.message) : caught;
         if (error instanceof Denied) {
             await ctx.audit({
                 tool,

package/dist/packages/connector-kit/src/common.js.map

@@ -1 +1 @@
-{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../packages/connector-kit/src/common.ts"],"names":[],"mappings":"AA+BA,mFAAmF;AACnF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAe,EAAW,EAAE,CAAC,CAAC;IACxD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACnC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;CAC1F,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,OAAO,MAAO,SAAQ,KAAK;CAAG;AAEpC,+FAA+F;AAC/F,+FAA+F;AAC/F,+CAA+C;AAC/C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAE1B;IAEA;IAHX,YACW,MAAc,EACvB,OAAe,EACN,QAAiB;QAE1B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QAEd,aAAQ,GAAR,QAAQ,CAAS;IAG5B,CAAC;CACF;AAED,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,EAAU;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,EAAU;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,EAAU;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAa,EAAiB,EAAE,CAC9D,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAkB,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;CACjE,CAAC,CAAC;AAEH,4FAA4F;AAC5F,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAgB,EAChB,IAAY,EACZ,MAAqB,EACrB,GAG4B;IAE5B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAkB,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EACnB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAC1B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,MAAM,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC,KAAK,CAAC;gBACd,IAAI;gBACJ,MAAM;gBACN,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,iFAAiF;gBACjF,YAAY,EAAE,MAAM;aACrB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;YACtF,MAAM,GAAG,CAAC,KAAK,CAAC;gBACd,IAAI;gBACJ,MAAM;gBACN,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC7B,YAAY,EAAE,KAAK,CAAC,MAAM;aAC3B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,iFAAiF;QACjF,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,SAAS,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,GAAG,CAAC,KAAK,CAAC;YACd,IAAI;YACJ,MAAM;YACN,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;YACxB,YAAY,EAAE,MAAM;SACrB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IACD,uFAAuF;IACvF,+BAA+B;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,4CAA4C,EAAE,KAAK,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../packages/connector-kit/src/common.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAwD,MAAM,YAAY,CAAC;AA0BhG,mFAAmF;AACnF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAe,EAAW,EAAE,CAAC,CAAC;IACxD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACnC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;CAC1F,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,OAAO,MAAO,SAAQ,KAAK;CAAG;AAEpC,+FAA+F;AAC/F,+FAA+F;AAC/F,+CAA+C;AAC/C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAE1B;IAEA;IAHX,YACW,MAAc,EACvB,OAAe,EACN,QAAiB;QAE1B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QAEd,aAAQ,GAAR,QAAQ,CAAS;IAG5B,CAAC;CACF;AAED,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,EAAU;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,EAAU;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,EAAU;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAa,EAAiB,EAAE,CAC9D,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAkB,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;CACjE,CAAC,CAAC;AAEH,4FAA4F;AAC5F,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAgB,EAChB,IAAY,EACZ,MAAqB,EACrB,GAG4B;IAE5B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAkB,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EACnB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAC1B,CAAC;IACJ,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,4FAA4F;QAC5F,MAAM,KAAK,GAAG,MAAM,YAAY,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9F,IAAI,KAAK,YAAY,MAAM,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC,KAAK,CAAC;gBACd,IAAI;gBACJ,MAAM;gBACN,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,iFAAiF;gBACjF,YAAY,EAAE,MAAM;aACrB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;YACtF,MAAM,GAAG,CAAC,KAAK,CAAC;gBACd,IAAI;gBACJ,MAAM;gBACN,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC7B,YAAY,EAAE,KAAK,CAAC,MAAM;aAC3B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,iFAAiF;QACjF,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,SAAS,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,GAAG,CAAC,KAAK,CAAC;YACd,IAAI;YACJ,MAAM;YACN,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;YACxB,YAAY,EAAE,MAAM;SACrB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IACD,uFAAuF;IACvF,+BAA+B;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,4CAA4C,EAAE,KAAK,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}