@arbium/enterprise-agent-connect 0.1.1 → 0.1.2-dev.d2aa5ca

package/dist/connectors/workday/connector.json

@@ -0,0 +1,186 @@
+{
+  "id": "workday",
+  "name": "Workday",
+  "description": "Let agents look up workers, managers and organizations, read time off, and run the Workday reports you choose. Pay and personal data stay out unless a report you add includes them.",
+  "logo": "/brand/registry/workday.svg",
+  "identity": "An integration system user named \"{brand.microsoft.appName}\" in a security group of its own, signing in through an API client for integrations.",
+  "accountKey": "account",
+  "connectionKind": "guided",
+  "setup": [
+    {
+      "title": "Create an integration system user",
+      "body": "In Workday, create an integration system user named \"{brand.microsoft.appName}\" that cannot sign in to the Workday website. Give it a long random password; it is never typed again. Then exempt it from password expiry, so the connection does not stop when the password would expire.",
+      "click": [
+        "Search: Create Integration System User > User Name: {brand.microsoft.appName} > Session Timeout Minutes: 0 > Do Not Allow UI Sessions: on > OK",
+        "Search: Maintain Password Rules > System Users exempt from password expiration > add {brand.microsoft.appName} > OK"
+      ]
+    },
+    {
+      "title": "Put it in a security group of its own",
+      "body": "Create an integration system security group and add the user to it. Choose Constrained if Workday itself should also keep the account to some organizations; Unconstrained reaches every worker your domain permissions allow, and you can still narrow each agent to organizations here.",
+      "click": [
+        "Search: Create Security Group > Type: Integration System Security Group (Unconstrained) or (Constrained) > Name: {brand.microsoft.appName} > OK",
+        "Integration System Users: {brand.microsoft.appName} > OK"
+      ]
+    },
+    {
+      "title": "Give the group these domain permissions",
+      "body": "Give the security group View (Get) on the domains below, or Modify (Put) where it says so, then activate the pending security policy changes. Without them Workday answers with empty lists or refuses the call.",
+      "click": [
+        "Search: Maintain Permissions for Security Group > {brand.microsoft.appName} > Domain Security Policy Permissions > add each domain below",
+        "Search: Activate Pending Security Policy Changes > Comment: {brand.microsoft.appName} > OK > Confirm > OK"
+      ],
+      "permissions": true
+    },
+    {
+      "title": "Register an API client for integrations",
+      "body": "Register an API client for integrations named \"{brand.microsoft.appName}\" with non-expiring refresh tokens and these functional area scopes. Copy the client ID and secret: Workday shows the secret only once.",
+      "click": [
+        "Search: Register API Client for Integrations > Client Name: {brand.microsoft.appName} > Non-Expiring Refresh Tokens: on > Scope (Functional Areas): the areas below > OK"
+      ],
+      "copy": ["{scope}"]
+    },
+    {
+      "title": "Make its refresh token",
+      "body": "Make a refresh token that signs the API client in as the integration system user, and copy it. Also copy the Workday REST API Endpoint shown at the top of View API Clients; it names your tenant.",
+      "click": [
+        "Search: View API Clients > API Clients for Integrations > {brand.microsoft.appName} > Related Actions > API Client > Manage Refresh Tokens for Integrations",
+        "Workday Account: {brand.microsoft.appName} > Generate New Refresh Token: on > OK > copy the refresh token"
+      ]
+    },
+    {
+      "title": "Add reports (optional)",
+      "body": "Most companies keep their own data, such as open job requisitions, headcount or cost centers, in custom reports. For each report agents may run: make it an advanced report enabled as a web service, share it with the integration system user, and copy its JSON link. Any prompts the report has become filters agents can set. Agents see every column the report has, so leave out pay, national IDs and anything else they should not read.",
+      "click": [
+        "The report > Related Actions > Custom Report > Edit > Advanced > Enable As Web Service: on",
+        "Share > Share with specific authorized groups and users: {brand.microsoft.appName} > OK",
+        "The report > Related Actions > Web Service > View URLs > JSON > copy the link"
+      ]
+    }
+  ],
+  "afterConnect": [],
+  "fields": [
+    {
+      "id": "endpoint",
+      "label": "Workday REST API endpoint",
+      "help": "Shown at the top of View API Clients in Workday.",
+      "placeholder": "https://wd5-services1.myworkday.com/ccx/api/v1/acme",
+      "secret": false
+    },
+    {
+      "id": "client_id",
+      "label": "Client ID",
+      "secret": false
+    },
+    {
+      "id": "client_secret",
+      "label": "Client secret",
+      "secret": true
+    },
+    {
+      "id": "refresh_token",
+      "label": "Refresh token",
+      "secret": true
+    },
+    {
+      "id": "reports",
+      "label": "Reports",
+      "help": "Optional. Each report's JSON link from Workday, separated by spaces or new lines. Leave empty for none.",
+      "placeholder": "https://wd5-services1.myworkday.com/ccx/service/customreport2/acme/jsmith/Open_Requisitions?format=json",
+      "secret": false
+    },
+    {
+      "id": "report_org_column",
+      "label": "Organization column in reports",
+      "help": "Optional. The column holding each row's organization Workday ID, in every report above. Agents narrowed to some organizations see only their rows, and cannot run reports while this is empty.",
+      "placeholder": "Supervisory_Organization_ID",
+      "secret": false
+    }
+  ],
+  "capabilities": [
+    {
+      "id": "workers",
+      "label": "Look up workers",
+      "description": "Find workers and read their title, organization, location, work email, manager chain and direct reports, and read supervisory organizations. No pay or personal data.",
+      "required": true,
+      "scopes": ["Staffing", "Organizations and Roles"],
+      "permissions": [
+        "Worker Data: Public Worker Reports (View)",
+        "Reports: Organization (View)",
+        "Reports: Manager (View)"
+      ],
+      "forbidden": "The integration system user's security group needs View on Worker Data: Public Worker Reports, Reports: Organization and Reports: Manager, and the API client the Staffing and Organizations and Roles scopes.",
+      "tools": [
+        "workday_search_workers",
+        "workday_get_worker",
+        "workday_list_direct_reports",
+        "workday_get_management_chain",
+        "workday_get_organization",
+        "workday_list_organization_workers"
+      ]
+    },
+    {
+      "id": "time_off",
+      "label": "Read time off",
+      "description": "Read workers' time off balances and their requested, approved and taken time off.",
+      "scopes": ["Time Off and Leave"],
+      "permissions": [
+        "Worker Data: Time Off (Time Off) (View)",
+        "Worker Data: Time Off (Time Off Balances) (View)"
+      ],
+      "forbidden": "The integration system user's security group needs View on Worker Data: Time Off (Time Off) and Worker Data: Time Off (Time Off Balances), and the API client the Time Off and Leave scope.",
+      "tools": ["workday_get_time_off_balances", "workday_list_time_off"]
+    },
+    {
+      "id": "request_time_off",
+      "label": "Request time off",
+      "description": "Submit time off requests for workers. Each request goes through your Request Time Off approvals as if the worker had asked.",
+      "note": "Agents with this can submit requests in any allowed worker's name. Keep each agent to the organizations it needs.",
+      "scopes": ["Time Off and Leave"],
+      "permissions": [
+        "Request Time Off (REST Service) (Modify)",
+        "Request Time Off business process: let the security group initiate it"
+      ],
+      "forbidden": "The integration system user's security group needs Modify on Request Time Off (REST Service) and may need to be allowed to initiate the Request Time Off business process.",
+      "tools": ["workday_list_time_off_types", "workday_request_time_off"]
+    },
+    {
+      "id": "reports",
+      "label": "Run reports",
+      "description": "Run the reports added to this connection, filtered by their prompts.",
+      "scopes": [],
+      "permissions": [
+        "Each report shared with the integration system user, and View on the domains securing its data"
+      ],
+      "forbidden": "Share the report with the integration system user, enable it as a web service, and give its security group View on the domains securing the report's data.",
+      "tools": ["workday_list_reports", "workday_run_report"]
+    }
+  ],
+  "limits": [
+    {
+      "id": "organizations",
+      "label": "Organizations",
+      "help": "Workday IDs of supervisory organizations (their sub-organizations included) or companies. The agent reaches only workers in them. Find an ID on the organization: Related Actions > Integration IDs > View Reference IDs (the Workday ID). Leave empty to allow every worker the account can see.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[0-9a-f]{32}$"
+    },
+    {
+      "id": "reports",
+      "label": "Reports",
+      "help": "Leave empty to allow every report added to this connection.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[A-Za-z0-9_.-]{1,200}$"
+    }
+  ],
+  "verify": {
+    "label": "Workday tenant reached",
+    "check": "tenant"
+  },
+  "discover": {
+    "label": "Reports agents can run",
+    "check": "reports"
+  },
+  "revoke": "In Workday, open View API Clients, then API Clients for Integrations, then {brand.microsoft.appName}, and revoke its refresh token under Manage Refresh Tokens for Integrations, or inactivate the integration system user."
+}

package/dist/connectors/workday/index.d.ts

@@ -0,0 +1,8 @@
+declare const _default: {
+    id: string;
+    create: () => {
+        vendor: import("../../packages/connector-kit/src/types.js").Vendor;
+        toolset: import("../../packages/connector-kit/src/common.js").Toolset;
+    };
+};
+export default _default;

package/dist/connectors/workday/index.js

@@ -0,0 +1,7 @@
+import { workdayTools } from "./tools.js";
+import { workdayVendor } from "./vendor.js";
+export default {
+    id: "workday",
+    create: () => ({ vendor: workdayVendor(), toolset: workdayTools }),
+};
+//# sourceMappingURL=index.js.map

package/dist/connectors/workday/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../connectors/workday/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,eAAe;IACb,EAAE,EAAE,SAAS;IACb,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;CACzC,CAAC"}

package/dist/connectors/workday/tools.d.ts

@@ -0,0 +1,33 @@
+import { type ToolContext, type Toolset } from "../../packages/connector-kit/src/common.js";
+type Mark = (status: number) => void;
+export declare function workdayError(res: {
+    status: number;
+    data: unknown;
+}): string;
+export declare function worker(w: any): {
+    is_manager?: any;
+    id: any;
+    name: any;
+    worker_id: any;
+    title: any;
+    job_profile: any;
+    organization: {
+        id: string;
+        name: string | null;
+    } | null;
+    location: any;
+    worker_type: any;
+    email: any;
+};
+export declare function scope(ctx: ToolContext, mark: Mark): {
+    limited: boolean;
+    org: (id: string | undefined) => Promise<boolean>;
+    worker: (w: any) => Promise<boolean>;
+    read: (id: string) => Promise<any>;
+    chart: (id: string) => Promise<any>;
+};
+export declare const workdayTools: Toolset;
+export declare function trimRow(row: Record<string, unknown>): {
+    [k: string]: string | number | boolean | null;
+};
+export {};

package/dist/connectors/workday/tools.js

@@ -0,0 +1,410 @@
+import { z } from "zod";
+import { connectedReports } from "./vendor.js";
+import { audited, Denied, json, listLimit, VendorFailed, } from "../../packages/connector-kit/src/common.js";
+// Workday REST (staffing v7, common v1, absenceManagement v5) and custom reports. Paths are
+// Workday's REST directory; answer fields follow CData's tables generated from Workday's specs
+// (Workers, WorkersDirectReports, WorkersOrganizations, SupervisoryOrganizations,
+// SupervisoryOrganizationsOrgChart, Balances, WorkersTimeOffDetails,
+// WorkersEligibleAbsenceTypes, WorkersRequestTimeOff; read October 27, 2026).
+const WID = /^[0-9a-f]{32}$/;
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+// Workday's submit action for a business process (CData's WorkersRequestTimeOff).
+const SUBMIT = "d9e4223e446c11de98360015c5e6daf6";
+// Supervisory levels walked up for a management chain or an organization limit.
+const MAX_LEVELS = 12;
+const MAX_ROWS = 200;
+const OUTSIDE = "This agent may not look up that worker";
+const api = (ctx, service, rest) => `/ccx/api/${service}/${ctx.config.tenant}${rest}`;
+export function workdayError(res) {
+    const d = res.data;
+    const detail = typeof d === "string"
+        ? d.slice(0, 200)
+        : [d?.error, ...(Array.isArray(d?.errors) ? d.errors.map((e) => e?.error) : [])]
+            .filter((e) => typeof e === "string")
+            .join("; ")
+            .slice(0, 500);
+    return `Workday answered ${res.status}${detail ? `: ${detail}` : ""}`;
+}
+async function ok(ctx, mark, path, body, hintTool) {
+    const res = await ctx.call(body === undefined ? { method: "GET", path } : { method: "POST", path, body });
+    mark(res.status);
+    if (res.status < 200 || res.status >= 300)
+        throw new VendorFailed(res.status, workdayError(res), hintTool);
+    return res.data;
+}
+const ref = (r) => (r?.id ? { id: r.id, name: r.descriptor ?? null } : null);
+// Staffing's worker (primaryJob, person) and common's summary (direct reports) share these.
+export function worker(w) {
+    return {
+        id: w.id,
+        name: w.descriptor ?? null,
+        worker_id: w.workerId ?? null,
+        title: w.primaryJob?.businessTitle ?? w.businessTitle ?? null,
+        job_profile: w.primaryJob?.jobProfile?.descriptor ?? null,
+        organization: ref(w.primaryJob?.supervisoryOrganization ?? w.primarySupervisoryOrganization),
+        location: w.primaryJob?.location?.descriptor ?? null,
+        worker_type: w.workerType?.descriptor ?? null,
+        email: w.person?.email ?? w.primaryWorkEmail ?? null,
+        ...(typeof w.isManager === "boolean" ? { is_manager: w.isManager } : {}),
+    };
+}
+const page = (data, offset, limit) => {
+    const total = typeof data?.total === "number" ? data.total : 0;
+    return offset + limit < total ? String(offset + limit) : null;
+};
+const offsetOf = (cursor) => {
+    if (cursor === undefined)
+        return 0;
+    if (!/^\d{1,6}$/.test(cursor))
+        throw new Denied("Pass back the cursor a listing returned");
+    return Number(cursor);
+};
+// The key's organizations limit: Workday IDs of supervisory organizations (their
+// sub-organizations included) or of any other organization a worker belongs to, e.g. a company.
+// Memoized per call.
+export function scope(ctx, mark) {
+    const limit = listLimit(ctx.limits, "organizations");
+    const charts = new Map();
+    // Staffing's org chart of a supervisory organization: its superior and subordinates. null
+    // when the id is not a supervisory organization.
+    const chart = (id) => {
+        if (!charts.has(id))
+            charts.set(id, (async () => {
+                const res = await ctx.call({
+                    method: "GET",
+                    path: api(ctx, "staffing/v7", `/supervisoryOrganizations/${id}/orgChart`),
+                });
+                mark(res.status);
+                if (res.status === 400 || res.status === 404)
+                    return null;
+                if (res.status < 200 || res.status >= 300)
+                    throw new VendorFailed(res.status, workdayError(res));
+                return res.data?.data?.[0] ?? null;
+            })());
+        return charts.get(id);
+    };
+    async function org(id) {
+        if (!limit)
+            return true;
+        for (let level = 0; id && WID.test(id) && level < MAX_LEVELS; level++) {
+            if (limit.includes(id))
+                return true;
+            id = (await chart(id))?.superior?.id;
+        }
+        return false;
+    }
+    async function worker(w) {
+        if (!limit)
+            return true;
+        const supervisory = (w.primaryJob?.supervisoryOrganization ?? w.primarySupervisoryOrganization)
+            ?.id;
+        if (await org(supervisory))
+            return true;
+        const orgs = await ok(ctx, mark, api(ctx, "common/v1", `/workers/${w.id}/organizations?limit=100`));
+        return (orgs?.data ?? []).some((o) => o?.id && limit.includes(o.id));
+    }
+    // A worker read by id, refused (as if not found) when outside the key's organizations. It is
+    // the worker lookup capability's permission, whichever tool reads.
+    async function read(id) {
+        if (!WID.test(id))
+            throw new Denied("Give a worker's Workday ID (32 letters and digits)");
+        const res = await ctx.call({ method: "GET", path: api(ctx, "staffing/v7", `/workers/${id}`) });
+        mark(res.status);
+        if (limit && res.status === 404)
+            throw new Denied(OUTSIDE);
+        if (res.status < 200 || res.status >= 300)
+            throw new VendorFailed(res.status, workdayError(res), "workday_get_worker");
+        if (!(await worker(res.data)))
+            throw new Denied(OUTSIDE);
+        return res.data;
+    }
+    return { limited: limit !== null, org, worker, read, chart };
+}
+const wid = (what) => z.string().describe(`The ${what}'s Workday ID (32 letters and digits).`);
+const cursor = z.string().optional().describe("The `next` value of the previous page.");
+export const workdayTools = {
+    names: [
+        "workday_search_workers",
+        "workday_get_worker",
+        "workday_list_direct_reports",
+        "workday_get_management_chain",
+        "workday_get_organization",
+        "workday_list_organization_workers",
+        "workday_get_time_off_balances",
+        "workday_list_time_off",
+        "workday_list_time_off_types",
+        "workday_request_time_off",
+        "workday_list_reports",
+        "workday_run_report",
+    ],
+    register(server, ctx, allowed) {
+        const readOnly = { readOnlyHint: true, openWorldHint: true };
+        const tool = (name, description, inputSchema, target, run, annotations = readOnly) => {
+            if (allowed.has(name))
+                server.registerTool(name, { description, inputSchema, annotations }, (args) => audited(ctx, name, target(args), async (mark, retarget) => json(await run(args, mark, retarget))));
+        };
+        tool("workday_search_workers", "Find workers by name or worker ID (Workday's search: case-insensitive, space-separated words match any). Returns name, title, organization, location and work email; never pay or personal data.", z.object({
+            query: z.string().min(1).max(100),
+            max_results: z.number().int().min(1).max(50).default(10),
+            cursor,
+        }), (a) => a.query, async ({ query, max_results, cursor: c }, mark) => {
+            const offset = offsetOf(c);
+            const s = scope(ctx, mark);
+            const q = new URLSearchParams({
+                search: query,
+                limit: String(max_results),
+                offset: String(offset),
+            });
+            const data = await ok(ctx, mark, api(ctx, "staffing/v7", `/workers?${q}`));
+            const found = [];
+            for (const w of data?.data ?? [])
+                if (await s.worker(w))
+                    found.push(worker(w));
+            return { workers: found, next: page(data, offset, max_results) };
+        });
+        tool("workday_get_worker", "Read one worker: name, worker ID, title, job profile, supervisory organization, location, worker type and work email.", z.object({ worker_id: wid("worker") }), (a) => a.worker_id, async ({ worker_id }, mark) => worker(await scope(ctx, mark).read(worker_id)));
+        tool("workday_list_direct_reports", "List a worker's direct reports.", z.object({ worker_id: wid("manager"), cursor }), (a) => a.worker_id, async ({ worker_id, cursor: c }, mark) => {
+            const offset = offsetOf(c);
+            const s = scope(ctx, mark);
+            await s.read(worker_id);
+            const data = await ok(ctx, mark, api(ctx, "common/v1", `/workers/${worker_id}/directReports?limit=100&offset=${offset}`));
+            const reports = [];
+            for (const w of data?.data ?? [])
+                if (await s.worker(w))
+                    reports.push(worker(w));
+            return { direct_reports: reports, next: page(data, offset, 100) };
+        });
+        tool("workday_get_management_chain", "A worker's managers, nearest first, up the supervisory organizations. Stops at the top, or where this agent's organizations end.", z.object({ worker_id: wid("worker") }), (a) => a.worker_id, async ({ worker_id }, mark) => {
+            const s = scope(ctx, mark);
+            const w = await s.read(worker_id);
+            const chain = [];
+            let orgId = w.primaryJob?.supervisoryOrganization?.id;
+            for (let level = 0; orgId && WID.test(orgId) && level < MAX_LEVELS; level++) {
+                if (!(await s.org(orgId)))
+                    break;
+                const o = await ok(ctx, mark, api(ctx, "staffing/v7", `/supervisoryOrganizations/${orgId}`));
+                const m = o?.manager;
+                const last = chain.length ? chain[chain.length - 1].id : worker_id;
+                if (m?.id && m.id !== last)
+                    chain.push({ id: m.id, name: m.descriptor ?? null, organization: ref(o) });
+                orgId = (await s.chart(orgId))?.superior?.id;
+            }
+            return { worker: ref(w), managers: chain };
+        });
+        tool("workday_get_organization", "Read a supervisory organization: its name, code, manager, superior organization and sub-organizations.", z.object({ org_id: wid("supervisory organization") }), (a) => a.org_id, async ({ org_id }, mark) => {
+            if (!WID.test(org_id))
+                throw new Denied("Give an organization's Workday ID");
+            const s = scope(ctx, mark);
+            if (!(await s.org(org_id)))
+                throw new Denied("This agent may not look up that organization");
+            const o = await ok(ctx, mark, api(ctx, "staffing/v7", `/supervisoryOrganizations/${org_id}`));
+            const c = await s.chart(org_id);
+            const superior = c?.superior?.id && (await s.org(c.superior.id)) ? ref(c.superior) : null;
+            return {
+                id: o.id,
+                name: o.name ?? o.descriptor ?? null,
+                code: o.code ?? null,
+                manager: ref(o.manager),
+                superior,
+                sub_organizations: (c?.subordinates ?? []).map((x) => ({
+                    id: x.id,
+                    name: x.name ?? x.descriptor ?? null,
+                    code: x.code ?? null,
+                    inactive: x.inactive ?? false,
+                    managers: (x.managers ?? []).map(ref).filter(Boolean),
+                })),
+            };
+        });
+        tool("workday_list_organization_workers", "List the workers in a supervisory organization.", z.object({ org_id: wid("supervisory organization"), cursor }), (a) => a.org_id, async ({ org_id, cursor: c }, mark) => {
+            if (!WID.test(org_id))
+                throw new Denied("Give an organization's Workday ID");
+            const offset = offsetOf(c);
+            if (!(await scope(ctx, mark).org(org_id)))
+                throw new Denied("This agent may not look up that organization");
+            const data = await ok(ctx, mark, api(ctx, "common/v1", `/supervisoryOrganizations/${org_id}/workers?limit=100&offset=${offset}`));
+            return { workers: (data?.data ?? []).map(worker), next: page(data, offset, 100) };
+        });
+        tool("workday_get_time_off_balances", "A worker's time off and leave balances, per plan, as of today or a given date.", z.object({
+            worker_id: wid("worker"),
+            as_of: z.string().optional().describe("YYYY-MM-DD; today when left out."),
+        }), (a) => a.worker_id, async ({ worker_id, as_of }, mark) => {
+            if (as_of !== undefined && !DATE.test(as_of))
+                throw new Denied("Give as_of as YYYY-MM-DD");
+            await scope(ctx, mark).read(worker_id);
+            const q = new URLSearchParams({
+                worker: worker_id,
+                limit: "100",
+                ...(as_of ? { effective: as_of } : {}),
+            });
+            const data = await ok(ctx, mark, api(ctx, "absenceManagement/v5", `/balances?${q}`));
+            const rows = (data?.data ?? []);
+            // The filter is Workday's; an answer about anyone else is never passed on.
+            if (rows.some((b) => b?.worker?.id !== worker_id))
+                throw new Denied("Workday answered with another worker's balances");
+            return {
+                balances: rows.map((b) => ({
+                    plan: b.absencePlan?.descriptor ?? null,
+                    category: b.category?.descriptor ?? null,
+                    balance: b.quantity ?? null,
+                    unit: b.unit?.descriptor ?? null,
+                    as_of: b.effectiveDate ?? null,
+                })),
+            };
+        });
+        tool("workday_list_time_off", "A worker's time off entries (requested, approved and taken) between two dates, at most a year apart.", z.object({
+            worker_id: wid("worker"),
+            from: z.string().describe("YYYY-MM-DD"),
+            to: z.string().describe("YYYY-MM-DD"),
+            cursor,
+        }), (a) => `${a.worker_id} ${a.from}..${a.to}`, async ({ worker_id, from, to, cursor: c }, mark) => {
+            if (!DATE.test(from) || !DATE.test(to))
+                throw new Denied("Give from and to as YYYY-MM-DD");
+            const days = (Date.parse(to) - Date.parse(from)) / 86_400_000;
+            if (!(days >= 0 && days <= 366))
+                throw new Denied("from must be before to, at most a year apart");
+            const offset = offsetOf(c);
+            await scope(ctx, mark).read(worker_id);
+            const q = new URLSearchParams({
+                fromDate: from,
+                toDate: to,
+                limit: "100",
+                offset: String(offset),
+            });
+            const data = await ok(ctx, mark, api(ctx, "absenceManagement/v5", `/workers/${worker_id}/timeOffDetails?${q}`));
+            return {
+                entries: (data?.data ?? []).map((e) => ({
+                    date: e.date ?? null,
+                    type: e.timeOffType?.descriptor ?? null,
+                    quantity: e.quantity ?? null,
+                    unit: e.unit?.descriptor ?? null,
+                    status: e.status?.descriptor ?? null,
+                    comment: e.comment ?? null,
+                })),
+                next: page(data, offset, 100),
+            };
+        });
+        tool("workday_list_time_off_types", "The time off types a worker may request, with their ids for workday_request_time_off, unit and default daily quantity.", z.object({ worker_id: wid("worker") }), (a) => a.worker_id, async ({ worker_id }, mark) => {
+            await scope(ctx, mark).read(worker_id);
+            const data = await ok(ctx, mark, api(ctx, "absenceManagement/v5", `/workers/${worker_id}/eligibleAbsenceTypes?limit=100`));
+            return {
+                types: (data?.data ?? []).map((t) => ({
+                    id: t.id,
+                    name: t.descriptor ?? null,
+                    group: t.absenceTypeGroup?.descriptor ?? null,
+                    unit: t.unitOfTime?.descriptor ?? null,
+                    daily_default: t.dailyDefaultQuantity ?? null,
+                    reason_required: t.reasonRequired ?? false,
+                    start_and_end_time_required: t.startAndEndTimeRequired ?? false,
+                })),
+            };
+        });
+        tool("workday_request_time_off", "Submit a time off request for a worker. It starts Workday's Request Time Off approval, as the worker's request; the worker and their manager are notified as Workday is set up to do. Get type ids from workday_list_time_off_types.", z.object({
+            worker_id: wid("worker"),
+            days: z
+                .array(z.object({
+                date: z.string().describe("YYYY-MM-DD"),
+                time_off_type_id: z.string(),
+                quantity: z
+                    .number()
+                    .positive()
+                    .max(24)
+                    .describe("Hours or days, in the type's unit."),
+                comment: z.string().max(500).optional(),
+            }))
+                .min(1)
+                .max(31),
+            comment: z.string().max(1000).optional().describe("A comment on the whole request."),
+        }), (a) => a.worker_id, async ({ worker_id, days, comment }, mark, retarget) => {
+            for (const d of days) {
+                if (!DATE.test(d.date))
+                    throw new Denied("Give each date as YYYY-MM-DD");
+                if (!WID.test(d.time_off_type_id))
+                    throw new Denied("Give a time off type id from workday_list_time_off_types");
+            }
+            await scope(ctx, mark).read(worker_id);
+            retarget(`${worker_id} ${days.map((d) => d.date).join(",")}`.slice(0, 300));
+            const data = await ok(ctx, mark, api(ctx, "absenceManagement/v5", `/workers/${worker_id}/requestTimeOff`), {
+                businessProcessParameters: {
+                    action: { id: SUBMIT },
+                    ...(comment ? { comment } : {}),
+                },
+                days: days.map((d) => ({
+                    date: d.date,
+                    dailyQuantity: d.quantity,
+                    timeOffType: { id: d.time_off_type_id },
+                    ...(d.comment ? { comment: d.comment } : {}),
+                })),
+            });
+            const bp = data?.businessProcessParameters;
+            return {
+                submitted: true,
+                status: bp?.overallStatus ?? bp?.transactionStatus?.descriptor ?? null,
+                process: ref(bp?.overallBusinessProcess),
+                days: days.length,
+            };
+        }, { readOnlyHint: false, destructiveHint: false, openWorldHint: true });
+        const reports = () => {
+            const limit = listLimit(ctx.limits, "reports");
+            return connectedReports(ctx.config).filter((r) => !limit || limit.includes(r.name));
+        };
+        tool("workday_list_reports", "The Workday reports this agent may run, with each report's prompts (filters) and their types.", z.object({}), () => null, async () => ({
+            reports: reports().map((r) => ({ report: r.name, prompts: r.prompts })),
+        }));
+        tool("workday_run_report", "Run one of the Workday reports from workday_list_reports, with values for any of its prompts (dates as YYYY-MM-DD). Returns its rows, at most max_rows.", z.object({
+            report: z.string(),
+            prompts: z.record(z.string(), z.string().max(200)).default({}),
+            max_rows: z.number().int().min(1).max(MAX_ROWS).default(50),
+        }), (a) => a.report, async ({ report, prompts, max_rows }, mark, retarget) => {
+            const r = reports().find((x) => x.name === report);
+            if (!r)
+                throw new Denied(`${report} is not a report this agent may run`);
+            const q = new URLSearchParams();
+            for (const [name, value] of Object.entries(prompts)) {
+                const p = r.prompts.find((x) => x.name === name);
+                if (!p)
+                    throw new Denied(`${report} has no prompt ${name}. Its prompts: ${r.prompts.map((x) => x.name).join(", ") || "none"}`);
+                if (p.type === "date" && !DATE.test(value))
+                    throw new Denied(`Give ${name} as YYYY-MM-DD`);
+                q.append(name, value);
+            }
+            q.set("format", "json");
+            const s = scope(ctx, mark);
+            const column = ctx.config.reportOrgColumn;
+            if (s.limited && !column)
+                throw new Denied("This agent is limited to some organizations, and reports have no organization column set, so it may not run reports");
+            retarget(`${report}?${q}`.slice(0, 300));
+            const enc = encodeURIComponent;
+            const data = await ok(ctx, mark, `/ccx/service/customreport2/${ctx.config.tenant}/${enc(r.owner)}/${enc(r.report)}?${q}`);
+            if (!Array.isArray(data?.Report_Entry))
+                throw new VendorFailed(200, "Workday's answer was not a JSON report");
+            const rows = [];
+            for (const row of data.Report_Entry) {
+                if (s.limited) {
+                    const v = row[column];
+                    const ids = (Array.isArray(v) ? v : [v]).filter((x) => typeof x === "string");
+                    let inside = false;
+                    for (const id of ids)
+                        if ((inside = await s.org(id)))
+                            break;
+                    if (!inside)
+                        continue;
+                }
+                rows.push(trimRow(row));
+                if (rows.length === max_rows)
+                    break;
+            }
+            return { report, rows, truncated: rows.length === max_rows };
+        });
+    },
+};
+export function trimRow(row) {
+    return Object.fromEntries(Object.entries(row).map(([k, v]) => [
+        k,
+        typeof v === "string"
+            ? v.slice(0, 500)
+            : typeof v === "number" || typeof v === "boolean" || v === null
+                ? v
+                : JSON.stringify(v).slice(0, 500),
+    ]));
+}
+//# sourceMappingURL=tools.js.map