@open-everywhere/provider-teams 0.0.0-stage → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +201 -0
- package/NOTICE +21 -0
- package/README.md +46 -2
- package/agent/channels/teams-bot-name.ts +162 -0
- package/agent/channels/teams-catch-up.ts +244 -0
- package/agent/channels/teams-connector.ts +183 -0
- package/agent/channels/teams-conversation-ref.ts +398 -0
- package/agent/channels/teams-directory.ts +193 -0
- package/agent/channels/teams-engagement.ts +391 -0
- package/agent/channels/teams-fire-eligibility.ts +152 -0
- package/agent/channels/teams-front.ts +1404 -0
- package/agent/channels/teams-graph-boundary.ts +178 -0
- package/agent/channels/teams-graph-team-id.ts +106 -0
- package/agent/channels/teams-id-restore.ts +131 -0
- package/agent/channels/teams-identity.ts +395 -0
- package/agent/channels/teams-input-response.ts +129 -0
- package/agent/channels/teams-message-ops.ts +79 -0
- package/agent/channels/teams-origin-codec.ts +104 -0
- package/agent/channels/teams-post-arm.ts +323 -0
- package/agent/channels/teams-reaction-feedback.ts +127 -0
- package/agent/channels/teams-read.ts +510 -0
- package/agent/channels/teams-roster.ts +136 -0
- package/agent/channels/teams-stop.ts +319 -0
- package/agent/channels/teams-supervisor.ts +638 -0
- package/agent/channels/teams.ts +270 -0
- package/agent/contributions.ts +31 -0
- package/agent/docs-generated.ts +15 -0
- package/agent/ops.ts +129 -0
- package/agent/provider-events.ts +69 -0
- package/agent/register.ts +219 -0
- package/agent/surface-parity.ts +112 -0
- package/dist/agent/channels/teams-bot-name.d.ts +36 -0
- package/dist/agent/channels/teams-bot-name.d.ts.map +1 -0
- package/dist/agent/channels/teams-bot-name.js +141 -0
- package/dist/agent/channels/teams-bot-name.js.map +1 -0
- package/dist/agent/channels/teams-catch-up.d.ts +53 -0
- package/dist/agent/channels/teams-catch-up.d.ts.map +1 -0
- package/dist/agent/channels/teams-catch-up.js +221 -0
- package/dist/agent/channels/teams-catch-up.js.map +1 -0
- package/dist/agent/channels/teams-connector.d.ts +57 -0
- package/dist/agent/channels/teams-connector.d.ts.map +1 -0
- package/dist/agent/channels/teams-connector.js +132 -0
- package/dist/agent/channels/teams-connector.js.map +1 -0
- package/dist/agent/channels/teams-conversation-ref.d.ts +123 -0
- package/dist/agent/channels/teams-conversation-ref.d.ts.map +1 -0
- package/dist/agent/channels/teams-conversation-ref.js +368 -0
- package/dist/agent/channels/teams-conversation-ref.js.map +1 -0
- package/dist/agent/channels/teams-directory.d.ts +11 -0
- package/dist/agent/channels/teams-directory.d.ts.map +1 -0
- package/dist/agent/channels/teams-directory.js +179 -0
- package/dist/agent/channels/teams-directory.js.map +1 -0
- package/dist/agent/channels/teams-engagement.d.ts +174 -0
- package/dist/agent/channels/teams-engagement.d.ts.map +1 -0
- package/dist/agent/channels/teams-engagement.js +336 -0
- package/dist/agent/channels/teams-engagement.js.map +1 -0
- package/dist/agent/channels/teams-fire-eligibility.d.ts +26 -0
- package/dist/agent/channels/teams-fire-eligibility.d.ts.map +1 -0
- package/dist/agent/channels/teams-fire-eligibility.js +126 -0
- package/dist/agent/channels/teams-fire-eligibility.js.map +1 -0
- package/dist/agent/channels/teams-front.d.ts +249 -0
- package/dist/agent/channels/teams-front.d.ts.map +1 -0
- package/dist/agent/channels/teams-front.js +1143 -0
- package/dist/agent/channels/teams-front.js.map +1 -0
- package/dist/agent/channels/teams-graph-boundary.d.ts +45 -0
- package/dist/agent/channels/teams-graph-boundary.d.ts.map +1 -0
- package/dist/agent/channels/teams-graph-boundary.js +168 -0
- package/dist/agent/channels/teams-graph-boundary.js.map +1 -0
- package/dist/agent/channels/teams-graph-team-id.d.ts +30 -0
- package/dist/agent/channels/teams-graph-team-id.d.ts.map +1 -0
- package/dist/agent/channels/teams-graph-team-id.js +89 -0
- package/dist/agent/channels/teams-graph-team-id.js.map +1 -0
- package/dist/agent/channels/teams-id-restore.d.ts +34 -0
- package/dist/agent/channels/teams-id-restore.d.ts.map +1 -0
- package/dist/agent/channels/teams-id-restore.js +123 -0
- package/dist/agent/channels/teams-id-restore.js.map +1 -0
- package/dist/agent/channels/teams-identity.d.ts +148 -0
- package/dist/agent/channels/teams-identity.d.ts.map +1 -0
- package/dist/agent/channels/teams-identity.js +336 -0
- package/dist/agent/channels/teams-identity.js.map +1 -0
- package/dist/agent/channels/teams-input-response.d.ts +23 -0
- package/dist/agent/channels/teams-input-response.d.ts.map +1 -0
- package/dist/agent/channels/teams-input-response.js +102 -0
- package/dist/agent/channels/teams-input-response.js.map +1 -0
- package/dist/agent/channels/teams-message-ops.d.ts +3 -0
- package/dist/agent/channels/teams-message-ops.d.ts.map +1 -0
- package/dist/agent/channels/teams-message-ops.js +72 -0
- package/dist/agent/channels/teams-message-ops.js.map +1 -0
- package/dist/agent/channels/teams-origin-codec.d.ts +16 -0
- package/dist/agent/channels/teams-origin-codec.d.ts.map +1 -0
- package/dist/agent/channels/teams-origin-codec.js +99 -0
- package/dist/agent/channels/teams-origin-codec.js.map +1 -0
- package/dist/agent/channels/teams-post-arm.d.ts +37 -0
- package/dist/agent/channels/teams-post-arm.d.ts.map +1 -0
- package/dist/agent/channels/teams-post-arm.js +280 -0
- package/dist/agent/channels/teams-post-arm.js.map +1 -0
- package/dist/agent/channels/teams-reaction-feedback.d.ts +22 -0
- package/dist/agent/channels/teams-reaction-feedback.d.ts.map +1 -0
- package/dist/agent/channels/teams-reaction-feedback.js +108 -0
- package/dist/agent/channels/teams-reaction-feedback.js.map +1 -0
- package/dist/agent/channels/teams-read.d.ts +127 -0
- package/dist/agent/channels/teams-read.d.ts.map +1 -0
- package/dist/agent/channels/teams-read.js +424 -0
- package/dist/agent/channels/teams-read.js.map +1 -0
- package/dist/agent/channels/teams-roster.d.ts +54 -0
- package/dist/agent/channels/teams-roster.d.ts.map +1 -0
- package/dist/agent/channels/teams-roster.js +121 -0
- package/dist/agent/channels/teams-roster.js.map +1 -0
- package/dist/agent/channels/teams-stop.d.ts +74 -0
- package/dist/agent/channels/teams-stop.d.ts.map +1 -0
- package/dist/agent/channels/teams-stop.js +252 -0
- package/dist/agent/channels/teams-stop.js.map +1 -0
- package/dist/agent/channels/teams-supervisor.d.ts +351 -0
- package/dist/agent/channels/teams-supervisor.d.ts.map +1 -0
- package/dist/agent/channels/teams-supervisor.js +366 -0
- package/dist/agent/channels/teams-supervisor.js.map +1 -0
- package/dist/agent/channels/teams.d.ts +5 -0
- package/dist/agent/channels/teams.d.ts.map +1 -0
- package/dist/agent/channels/teams.js +246 -0
- package/dist/agent/channels/teams.js.map +1 -0
- package/dist/agent/contributions.d.ts +12 -0
- package/dist/agent/contributions.d.ts.map +1 -0
- package/dist/agent/contributions.js +31 -0
- package/dist/agent/contributions.js.map +1 -0
- package/dist/agent/docs-generated.d.ts +3 -0
- package/dist/agent/docs-generated.d.ts.map +1 -0
- package/dist/agent/docs-generated.js +13 -0
- package/dist/agent/docs-generated.js.map +1 -0
- package/dist/agent/ops.d.ts +14 -0
- package/dist/agent/ops.d.ts.map +1 -0
- package/dist/agent/ops.js +122 -0
- package/dist/agent/ops.js.map +1 -0
- package/dist/agent/provider-events.d.ts +3 -0
- package/dist/agent/provider-events.d.ts.map +1 -0
- package/dist/agent/provider-events.js +67 -0
- package/dist/agent/provider-events.js.map +1 -0
- package/dist/agent/register.d.ts +16 -0
- package/dist/agent/register.d.ts.map +1 -0
- package/dist/agent/register.js +198 -0
- package/dist/agent/register.js.map +1 -0
- package/dist/agent/surface-parity.d.ts +3 -0
- package/dist/agent/surface-parity.d.ts.map +1 -0
- package/dist/agent/surface-parity.js +106 -0
- package/dist/agent/surface-parity.js.map +1 -0
- package/package.json +183 -4
- package/tsconfig.build.json +22 -0
- package/tsconfig.json +15 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"teams-front.js","sourceRoot":"","sources":["../../../agent/channels/teams-front.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,8FAA8F;AAC9F,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,2FAA2F;AAC3F,8FAA8F;AAC9F,8FAA8F;AAC9F,mDAAmD;AACnD,EAAE;AACF,mBAAmB;AACnB,+FAA+F;AAC/F,iGAAiG;AACjG,yFAAyF;AACzF,8FAA8F;AAC9F,+BAA+B;AAC/B,8FAA8F;AAC9F,iGAAiG;AACjG,0DAA0D;AAC1D,oFAAoF;AACpF,iGAAiG;AACjG,0FAA0F;AAC1F,wFAAwF;AACxF,8FAA8F;AAC9F,yFAAyF;AACzF,8FAA8F;AAC9F,8EAA8E;AAC9E,iGAAiG;AACjG,8CAA8C;AAC9C,EAAE;AACF,2FAA2F;AAC3F,8FAA8F;AAC9F,kGAAkG;AAClG,iGAAiG;AACjG,mGAAmG;AACnG,iEAAiE;AACjE,EAAE;AACF,sFAAsF;AACtF,iGAAiG;AACjG,iGAAiG;AACjG,oGAAoG;AACpG,mGAAmG;AACnG,kCAAkC;AAClC,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,iGAAiG;AACjG,gGAAgG;AAChG,6FAA6F;AAC7F,6FAA6F;AAC7F,4FAA4F;AAC5F,EAAE;AACF,gGAAgG;AAChG,oGAAoG;AACpG,qGAAqG;AACrG,gGAAgG;AAEhG,OAAO,EAAE,IAAI,EAAiE,MAAM,cAAc,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,4BAA4B,EAA6B,MAAM,oBAAoB,CAAC;AAChK,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAyB,MAAM,mBAAmB,CAAC;AAC5G,OAAO,EAAE,gCAAgC,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACrI,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAqD,MAAM,iBAAiB,CAAC;AAChI,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,oBAAoB,EACpB,gBAAgB,GAGjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,YAAY,EACZ,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,4BAA4B,EAC5B,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,SAAS,EACT,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,UAAU,EACV,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EASpB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EACf,mBAAmB,EAEnB,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,4CAA4C,CAAC;AAMpD,kGAAkG;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAClD,gGAAgG;AAChG,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,CAAC,GAAG,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;AACtD,CAAC;AAgBD;sFACsF;AACtF,SAAS,UAAU,CAAC,IAAa;IAC/B,MAAM,CAAC,GAAI,IAAwC,EAAE,UAAU,CAAC;IAChE,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,IAAa;IACvC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,uBAAuB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC;AAC5F,CAAC;AAED;;uFAEuF;AACvF,SAAS,iBAAiB,CAAC,IAAa;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAC3E,OAAO,EAAE,QAAQ,EAAE,SAAS,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,CAAuB;IAC9C,OAAO,cAAc,CAAC;QACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;QAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;QACrB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,YAAY,CAAC,QAAQ;QAC/C,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE;QACjC,SAAS,EAAE,CAAC,CAAC,cAAc;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAqCD,KAAK,UAAU,qBAAqB,CAClC,IAAO,EACP,CAAuB,EACvB,QAA8B;IAE9B,MAAM,OAAO,GAAwB,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACjH,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,IAAI,EAAE,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,sCAAsC;IACrD,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,EAAE;AACF,qGAAqG;AACrG,iGAAiG;AACjG,4CAA4C;AAC5C,mGAAmG;AACnG,sGAAsG;AACtG,0BAA0B;AAC1B,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,wFAAwF;AAExF;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,OAAO,qBAAqB,CAAC,yBAAyB,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAa,EAAE,QAA4B;IAC1E,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnI,OAAO;QACL,WAAW,EAAE;YACX,SAAS,EAAE,SAAS,MAAM,EAAE;YAC5B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,+FAA+F;YAC/F,4FAA4F;YAC5F,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,SAAS,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAuB;IACzD,OAAO,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC;AACzD,CAAC;AAaD,MAAM,UAAU,oBAAoB,CAAC,KAepC;IACC,IAAI,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAClH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC9I,OAAO,cAAc,CACnB,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAC7F,KAAK,CAAC,MAAM,CACb;QACC,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,eAAe,CAAC,CAAuB,EAAE,IAAY;IAClE,IAAI,CAAC;QACH,MAAM,0BAA0B,CAC9B,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAChG,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAC5C,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oFAAoF;QACpF,2FAA2F;QAC3F,2FAA2F;QAC3F,sCAAsC;QACtC,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,qFAAqF,GAAG,CAAC,QAAQ,qBAAqB,GAAG,CAAC,QAAQ,MAAM,CAAC,CAAC;QACzJ,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,uDAAuD;IACvE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,6BAA6B,CAAC,CAAuB;IAClE,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,MAAM,eAAe,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB,CAAC,CAAuB,EAAE,GAAW,EAAE,UAAkB;IAC7F,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnI,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC,CAAC,8BAA8B;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,yCAAyC;IACzD,CAAC;IACD,OAAO,MAAM,eAAe,CAAC,CAAC,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,CAAuB,EAAE,QAA8B;IACjG,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC;IAC/D,IAAI,IAA6B,CAAC;IAClC,IAAI,SAAoB,CAAC;IACzB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAC1B,SAAS,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,6FAA6F;QAC7F,iCAAiC;QACjC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACnD,kGAAkG;IAClG,wFAAwF;IACxF,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;QAAE,IAAI,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,2BAA2B,CACvC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAoE,EAAE,EAAE,EAAE,EACpI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAC/B,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAC5B,CAAC;IACF,+FAA+F;IAC/F,6FAA6F;IAC7F,2DAA2D;IAC3D,MAAM,SAAS,GAAG,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC;IACtE,MAAM,OAAO,GAAG,oBAAoB,CAAC;QACnC,MAAM;QACN,gGAAgG;QAChG,2DAA2D;QAC3D,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAC1F,SAAS;QACT,IAAI;QACJ,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACtC,OAAO;QACP,GAAG,iBAAiB,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,kGAAkG;IAClG,iEAAiE;IACjE,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,OAAO,KAAK,oBAAoB;QAAE,eAAe,GAAG,MAAM,6BAA6B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAClH,IAAI,OAAO,KAAK,aAAa;QAAE,eAAe,GAAG,MAAM,uBAAuB,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7H,+FAA+F;IAC/F,8FAA8F;IAC9F,6EAA6E;IAC7E,MAAM,KAAK,GACT,wBAAwB,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAClI,MAAM,WAAW,CAAC;QAChB,GAAG,EAAE,SAAS,CAAC,GAAG,IAAI,aAAa,EAAE;QACrC,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QACtB,MAAM,EAAE,kCAAkC;QAC1C,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE;KACvF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1B,IAAI,CAAC,cAAc,OAAO,6BAA6B,OAAO,GAAG,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAuB;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACzG,MAAM,UAAU,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,0EAA0E;QAC3H,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;QACvD,2FAA2F;QAC3F,gGAAgG;QAChG,yFAAyF;QACzF,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;QACjG,MAAM,KAAK,GAA2B;YACpC,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC;YAClD,QAAQ;YACR,wFAAwF;YACxF,8FAA8F;YAC9F,8FAA8F;YAC9F,sFAAsF;YACtF,6FAA6F;YAC7F,+FAA+F;YAC/F,+FAA+F;YAC/F,wFAAwF;YACxF,qFAAqF;YACrF,wFAAwF;YACxF,gFAAgF;YAChF,mDAAmD;YACnD,EAAE;YACF,8FAA8F;YAC9F,4FAA4F;YAC5F,yFAAyF;YACzF,wFAAwF;YACxF,6FAA6F;YAC7F,+FAA+F;YAC/F,4FAA4F;YAC5F,6FAA6F;YAC7F,iFAAiF;YACjF,2FAA2F;YAC3F,+FAA+F;YAC/F,gDAAgD;YAChD,OAAO,EACL,gBAAgB,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;gBACrH,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,UAAU;SACtC,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,KAAK,EAAE;YAClE,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE;YACjC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,SAAS;YAC5D,QAAQ;YACR,8FAA8F;YAC9F,+FAA+F;YAC/F,6FAA6F;YAC7F,6FAA6F;YAC7F,4EAA4E;YAC5E,GAAG,cAAc,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,gDAAgD;IAC/D,CAAC;AACH,CAAC;AAED,iGAAiG;AAEjG;iGACiG;AACjG;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAoB,EAAE,EAA0B;IACtF,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IAC/B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,OAAO;QACL,KAAK,CAAC,kBAAkB,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK;YACpD,2FAA2F;YAC3F,kFAAkF;YAClF,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7J,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACnJ,2FAA2F;gBAC3F,sFAAsF;gBACtF,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpI,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,EAAiC,EAAE,CAAC;YAC1H,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;gBACtD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;gBACpC,yFAAyF;gBACzF,oFAAoF;gBACpF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC5E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACvJ,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACvF,CAAC;YACD,6FAA6F;YAC7F,4EAA4E;YAC5E,+FAA+F;YAC/F,oEAAoE;YACpE,OAAO;gBACL,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,eAAe,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;gBAC7C,IAAI,EAAE,EAAiC;gBACvC,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;aACxC,CAAC;QACJ,CAAC;QACD,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC;QAC9F,gGAAgG;QAChG,kGAAkG;QAClG,iGAAiG;QACjG,2FAA2F;QAC3F,8FAA8F;QAC9F,mBAAmB;QACnB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC;QAC3C,0FAA0F;QAC1F,oEAAoE;QACpE,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC;QAClF,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE;YAClD,oFAAoF;YACpF,oGAAoG;YACpG,2FAA2F;YAC3F,wFAAwF;YACxF,2FAA2F;YAC3F,6EAA6E;YAC7E,EAAE;YACF,8FAA8F;YAC9F,2FAA2F;YAC3F,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,0CAA0C;YAC1C,MAAM,4BAA4B,CAAC,EAAE,EAAE;gBACrC,OAAO;gBACP,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,KAAK;gBACL,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI,EAAE,IAA2D;aAClE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAiDD,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;AAEpC,gGAAgG;AAChG,iGAAiG;AACjG,MAAM,aAAa,GAAG,EAAE,GAAG,MAAM,CAAC;AAClC,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,GAAW,EAAE,KAAa;IACtE,IAAI,CAAC;QACH,OAAO,MAAM,mBAAmB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,8EAA8E,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;2FAC2F;AAC3F,SAAS,sBAAsB,CAAC,GAAW,EAAE,GAAY;IACvD,KAAK,WAAW,CAAC;QACf,GAAG,EAAE,aAAa,EAAE;QACpB,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS;QACzC,OAAO,EAAE,GAAG;QACZ,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;KAClG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;8EAG8E;AAC9E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,CAAuB,EACvB,IAAoB,EACpB,EAA0B,EAC1B,QAA8B;IAE9B,+FAA+F;IAC/F,gGAAgG;IAChG,qEAAqE;IACrE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAoB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAoE,EAAE,EAAE,EAAE,CAAC;IACtK,sFAAsF;IACtF,2FAA2F;IAC3F,wCAAwC;IACxC,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IACjH,IAAI,cAAgE,CAAC;IACrE,IAAI,CAAC;QACH,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,GAAG,SAAS,CAAC,CAAC,oDAAoD;IAClF,CAAC;IACD,kGAAkG;IAClG,+FAA+F;IAC/F,6EAA6E;IAC7E,+FAA+F;IAC/F,0EAA0E;IAC1E,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChE,+FAA+F;IAC/F,+FAA+F;IAC/F,oEAAoE;IACpE,MAAM,YAAY,GAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7H,MAAM,+BAA+B,CACnC;QACE,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,8FAA8F;QAC9F,4FAA4F;QAC5F,0FAA0F;QAC1F,oCAAoC;QACpC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;QACvC,4FAA4F;QAC5F,yFAAyF;QACzF,uFAAuF;QACvF,0FAA0F;QAC1F,8FAA8F;QAC9F,SAAS,EAAE,CAAC,CAAC,cAAc,IAAI,+BAA+B,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QACjF,6FAA6F;QAC7F,wFAAwF;QACxF,kFAAkF;QAClF,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,2FAA2F;QAC3F,4EAA4E;QAC5E,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,8FAA8F;QAC9F,0FAA0F;QAC1F,EAAE;QACF,wFAAwF;QACxF,gGAAgG;QAChG,iGAAiG;QACjG,qFAAqF;QACrF,0EAA0E;QAC1E,EAAE;QACF,wFAAwF;QACxF,4FAA4F;QAC5F,yFAAyF;QACzF,IAAI,EAAE,sBAAsB,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE;YACjD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,iBAAiB,CAAC,IAAI,CAAC;SAC3B,CAAC;QACF,2FAA2F;QAC3F,QAAQ,EAAE,CAAC,YAAY,CAAC;QACxB,OAAO,EAAE;YACP,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;YACnB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;YACvB,uFAAuF;YACvF,yEAAyE;YACzE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAChC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,2BAA2B;YAC3C,KAAK;SACN;QACD,kFAAkF;QAClF,sFAAsF;QACtF,uCAAuC;QACvC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,4FAA4F;QAC5F,iDAAiD;QACjD,6FAA6F;QAC7F,kFAAkF;QAClF,yFAAyF;QACzF,6FAA6F;QAC7F,6FAA6F;QAC7F,2CAA2C;QAC3C,wFAAwF;QACxF,6FAA6F;QAC7F,uFAAuF;QACvF,6FAA6F;QAC7F,8CAA8C;QAC9C,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,cAAc;QACd,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,EACD,uBAAuB,CAAC,IAAI,EAAE,EAAE,CAAC,CAClC,CAAC;IACF,MAAM,WAAW,CAAC;QAChB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG;QACvB,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;QACnC,OAAO,EAAE,IAAI,CAAC,UAAU;QACxB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QACtB,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE;KACrG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,CAAuB,EACvB,YAAqC,EACrC,SAAoB,EACpB,EAA0B,EAC1B,QAA8B;IAE9B,oGAAoG;IACpG,mGAAmG;IACnG,2FAA2F;IAC3F,8FAA8F;IAC9F,qCAAqC;IACrC,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,+FAA+F;IAC/F,mGAAmG;IACnG,sFAAsF;IACtF,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;IACxC,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;IAEzC,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;IAEjE,oGAAoG;IACpG,mGAAmG;IACnG,iDAAiD;IACjD,MAAM,OAAO,GAAoB;QAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAoE,EAAE,EAAE;KACrG,CAAC;IACF,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IACjH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,sGAAsG;IACtG,yFAAyF;IACzF,iGAAiG;IACjG,kGAAkG;IAClG,iFAAiF;IACjF,MAAM,MAAM,GAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC;IAElG,MAAM,QAAQ,GAAG,UAAU,CACzB,gBAAgB,CAAC;QACf,cAAc;QACd,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE;YACP,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,SAAS;YACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE;YAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;YACnB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,2BAA2B;YAC3C,KAAK;SACN;KACF,CAAC,CACH,CAAC;IACF,MAAM,qBAAqB,CAAC,EAAE,EAAE;QAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,+FAA+F;QAC/F,gGAAgG;QAChG,2EAA2E;QAC3E,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,cAAc,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAA8B;QACrI,oGAAoG;QACpG,+FAA+F;QAC/F,UAAU;QACV,wFAAwF;QACxF,kGAAkG;QAClG,kGAAkG;QAClG,+CAA+C;QAC/C,IAAI,EAAE,sBAAsB,CAC1B,IAA2D,EAC3D,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACpF,EAAE,EAAE,EAAE,IAAI,EAAE,CACb;KACF,CAAC,CAAC;IACH,6FAA6F;IAC7F,6DAA6D;IAC7D,MAAM,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjE,iGAAiG;IACjG,6FAA6F;IAC7F,MAAM,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE;QACrE,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,OAAO,EAAE,uEAAuE;QACtF,KAAK;QACL,6FAA6F;QAC7F,iGAAiG;QACjG,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACtG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QACnB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,SAAS;QACrB,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,UAAU;QACrB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;KACnB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,GAAG;QACH,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,OAAO,EAAE,UAAU;QACnB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QACtB,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE;KACzE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,YAA0B,EAAE,IAAI,GAAsB,EAAE;IAC7F,gGAAgG;IAChG,8FAA8F;IAC9F,iGAAiG;IACjG,kGAAkG;IAClG,8FAA8F;IAC9F,yFAAyF;IACzF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,iBAAiB,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,EAAyB,EAAE,aAAqC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAChK,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,sBAAsB,CAAC;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAuB,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC;IAC9D,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,oBAAoB,CAAC;IACrE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,kBAAkB,CAAC;IAE/D,OAAO,KAAK,EAAE,GAAY,EAAE,IAAsB,EAAqB,EAAE;QACvE,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,OAAO,GAAG,GAAsB,EAAE;YACtC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAChG,OAAO,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC;QAEF,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,EAAE,CAAC,CAAC,yDAAyD;QAC7E,CAAC;QACD,gGAAgG;QAChG,EAAE;QACF,iGAAiG;QACjG,iGAAiG;QACjG,iGAAiG;QACjG,gGAAgG;QAChG,oFAAoF;QACpF,EAAE;QACF,iGAAiG;QACjG,kGAAkG;QAClG,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,CACZ,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,cAAc,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EACjG,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CACjD,CACF,CAAC;YACF,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,OAAO,EAAE,CAAC,CAAC,yEAAyE;QAC7F,CAAC;QAED,4FAA4F;QAC5F,iGAAiG;QACjG,gGAAgG;QAChG,4EAA4E;QAC5E,gGAAgG;QAChG,iGAAiG;QACjG,gFAAgF;QAChF,MAAM,eAAe,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAEvD,iGAAiG;QACjG,EAAE;QACF,gGAAgG;QAChG,gGAAgG;QAChG,gGAAgG;QAChG,wFAAwF;QACxF,EAAE;QACF,+FAA+F;QAC/F,0CAA0C;QAC1C,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,CAAC;QAEpE,gGAAgG;QAChG,EAAE;QACF,iGAAiG;QACjG,6FAA6F;QAC7F,+FAA+F;QAC/F,gGAAgG;QAChG,kEAAkE;QAClE,EAAE;QACF,kGAAkG;QAClG,kGAAkG;QAClG,iGAAiG;QACjG,+FAA+F;QAC/F,4BAA4B;QAC5B,EAAE;QACF,mGAAmG;QACnG,iGAAiG;QACjG,oDAAoD;QACpD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC,SAAS,CACZ,gCAAgC,CAAC;gBAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ;gBAC7D,cAAc,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;gBACxC,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;gBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,gGAAgG;QAChG,EAAE;QACF,2FAA2F;QAC3F,8FAA8F;QAC9F,gGAAgG;QAChG,0FAA0F;QAC1F,EAAE;QACF,0FAA0F;QAC1F,gGAAgG;QAChG,gGAAgG;QAChG,6BAA6B;QAC7B,6FAA6F;QAC7F,gGAAgG;QAChG,qEAAqE;QACrE,8FAA8F;QAC9F,yFAAyF;QACzF,kEAAkE;QAClE,EAAE;QACF,gGAAgG;QAChG,iGAAiG;QACjG,+FAA+F;QAC/F,iGAAiG;QACjG,qFAAqF;QACrF,EAAE;QACF,+FAA+F;QAC/F,6FAA6F;QAC7F,4FAA4F;QAC5F,+FAA+F;QAC/F,4FAA4F;QAC5F,6FAA6F;QAC7F,wEAAwE;QACxE,EAAE;QACF,gGAAgG;QAChG,8FAA8F;QAC9F,iGAAiG;QACjG,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,yEAAyE;QACzE,EAAE;QACF,4FAA4F;QAC5F,wEAAwE;QACxE,MAAM,IAAI,GAAkC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACrH,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,+FAA+F;YAC/F,6FAA6F;YAC7F,6FAA6F;YAC7F,8FAA8F;YAC9F,2FAA2F;YAC3F,2EAA2E;YAC3E,EAAE;YACF,+FAA+F;YAC/F,+FAA+F;YAC/F,8FAA8F;YAC9F,sFAAsF;YACtF,oFAAoF;YACpF,2FAA2F;YAC3F,sEAAsE;YACtE,MAAM,SAAS,GAAG,gBAAgB,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC9B,4FAA4F;gBAC5F,gFAAgF;gBAChF,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;oBAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QACD,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,wFAAwF;YACxF,+FAA+F;YAC/F,uFAAuF;YACvF,gGAAgG;YAChG,oFAAoF;YACpF,IAAI,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,YAAY,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,EAAE,sEAAsE,CAAC,CAAC;gBACnI,OAAO,OAAO,EAAE,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,YAAY,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,EAAE,+DAA+D,CAAC,CAAC;YAC5H,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAED,kGAAkG;QAClG,iGAAiG;QACjG,mGAAmG;QACnG,mGAAmG;QACnG,wFAAwF;QACxF,2FAA2F;QAC3F,iGAAiG;QACjG,mGAAmG;QACnG,6FAA6F;QAC7F,IAAI,QAAQ,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACpE,+FAA+F;YAC/F,kGAAkG;YAClG,IAAI,eAAe;gBAAE,OAAO,EAAE,EAAE,CAAC;YACjC,oFAAoF;YACpF,yFAAyF;YACzF,EAAE;YACF,8FAA8F;YAC9F,sFAAsF;YACtF,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,sFAAsF;YACtF,EAAE;YACF,gGAAgG;YAChG,8FAA8F;YAC9F,wFAAwF;YACxF,8FAA8F;YAC9F,8BAA8B;YAC9B,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,gGAAgG;gBAChG,6FAA6F;gBAC7F,+FAA+F;gBAC/F,+FAA+F;gBAC/F,6FAA6F;gBAC7F,mBAAmB;gBACnB,IAAI,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC3C,IAAI,CAAC,YAAY,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,EAAE,kFAAkF,CAAC,CAAC;oBAC/I,OAAO,OAAO,EAAE,CAAC;gBACnB,CAAC;gBACD,IAAI,CAAC,YAAY,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,EAAE,8BAA8B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxG,OAAO,EAAE,EAAE,CAAC;YACd,CAAC;YACD,kGAAkG;YAClG,0FAA0F;YAC1F,iGAAiG;YACjG,MAAM,KAAK,GAAG,SAAS,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;gBAAE,OAAO,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1B,4FAA4F;YAC5F,+EAA+E;YAC/E,IAAI,EAAkE,CAAC;YACvE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;gBACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBACzG,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,GAAG,IAAI,CAAC;YACZ,CAAC;YACD,IAAI,CAAC,EAAE;gBAAE,OAAO,OAAO,EAAE,CAAC,CAAC,6DAA6D;YACxF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,8CAA8C;YACnG,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAAE,OAAO,EAAE,EAAE,CAAC;YAC/F,IAAI,CAAC,YAAY,QAAQ,CAAC,EAAE,OAAO,WAAW,CAAC,UAAU,mDAAmD,CAAC,CAAC;YAC9G,mGAAmG;YACnG,iFAAiF;YACjF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7G,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAED,6FAA6F;QAC7F,0FAA0F;QAC1F,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,OAAO,OAAO,EAAE,CAAC;QAE5B,4FAA4F;QAC5F,0FAA0F;QAC1F,wFAAwF;QACxF,4EAA4E;QAC5E,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,QAAQ,CAAC,EAAE,OAAO,IAAI,CAAC,UAAU,yEAAyE,CAAC,CAAC;YAC7H,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAED,+FAA+F;QAC/F,EAAE;QACF,0FAA0F;QAC1F,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,iGAAiG;QACjG,iGAAiG;QACjG,+FAA+F;QAC/F,EAAE;QACF,gGAAgG;QAChG,gGAAgG;QAChG,wFAAwF;QACxF,mCAAmC;QACnC,4FAA4F;QAC5F,8FAA8F;QAC9F,EAAE;QACF,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,2EAA2E;QAC3E,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,gBAAgB,CAAC;QAClE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzG,CAAC;aAAM,IAAI,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,+FAA+F;YAC/F,+FAA+F;YAC/F,6DAA6D;YAC7D,IAAI,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,YAAY,QAAQ,CAAC,EAAE,OAAO,IAAI,CAAC,UAAU,2EAA2E,CAAC,CAAC;gBAC/H,OAAO,OAAO,EAAE,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,YAAY,QAAQ,CAAC,EAAE,OAAO,IAAI,CAAC,UAAU,wEAAwE,CAAC,CAAC;YAC5H,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAED,wFAAwF;QACxF,wFAAwF;QACxF,qEAAqE;QACrE,MAAM,GAAG,GAAG,SAAS,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,CAAC;QAEhG,IAAI,CACF,YAAY,QAAQ,CAAC,EAAE,OAAO,IAAI,CAAC,UAAU,wDAAwD;YACnG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,uBAAuB,GAAG,CACjI,CAAC;QACF,yFAAyF;QACzF,gGAAgG;QAChG,4FAA4F;QAC5F,8CAA8C;QAC9C,IAAI,CAAC,aAAa;YAAE,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1H,8FAA8F;QAC9F,6FAA6F;QAC7F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,OAAO,EAAE,EAAE,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAmC,KAAQ,EAAE,IAAI,GAAsB,EAAE;IACxG,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CACjC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAC7F,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,sEAAsE,oBAAoB,IAAI;YAC5F,iBAAiB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AAClF,CAAC"}
|
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
/** Which boundary governs this deployment's Teams channel reads.
|
|
2
|
+
* - `per-team` — Microsoft enforces the team boundary (the RSC path, shipped default).
|
|
3
|
+
* - `tenant-wide` — Microsoft enforces NO team boundary; only OE's domain allowlist remains.
|
|
4
|
+
* - `unknown` — not determined yet, or the minted token did not parse. */
|
|
5
|
+
export type TeamsReadBoundary = "per-team" | "tenant-wide" | "unknown";
|
|
6
|
+
/** The Graph APPLICATION permissions that read Teams channel messages TENANT-WIDE. See the header
|
|
7
|
+
* for why this is a denylist and what it can miss. */
|
|
8
|
+
export declare const TENANT_WIDE_CHANNEL_READ_ROLES: readonly string[];
|
|
9
|
+
/** Where the denylist came from — quoted in the runbook so a future reader can re-verify it. */
|
|
10
|
+
export declare const TEAMS_READ_BOUNDARY_SOURCES: readonly string[];
|
|
11
|
+
/**
|
|
12
|
+
* The `roles` claim of a JWT's payload, or `undefined` when the token does not parse as one.
|
|
13
|
+
*
|
|
14
|
+
* Returns an EMPTY array — not `undefined` — for a token that parses but carries no `roles` claim:
|
|
15
|
+
* that is a real, meaningful state (an app registration with no consented Graph application
|
|
16
|
+
* permissions), and it is exactly the per-team case. Only a genuine parse failure is `undefined`,
|
|
17
|
+
* which is what keeps "malformed" from being reported as "per-team". Pure.
|
|
18
|
+
*/
|
|
19
|
+
export declare function decodeJwtRoles(token: string): readonly string[] | undefined;
|
|
20
|
+
/** The boundary a decoded `roles` claim implies — see the header for the one-sided reasoning.
|
|
21
|
+
* `undefined` roles (a token that did not parse) yield `"unknown"`, never a guess. Pure. */
|
|
22
|
+
export declare function boundaryFromRoles(roles: readonly string[] | undefined): TeamsReadBoundary;
|
|
23
|
+
/** The boundary a minted Graph token implies. Pure; never logs or returns any part of the token. */
|
|
24
|
+
export declare function boundaryOfGraphToken(token: string): TeamsReadBoundary;
|
|
25
|
+
/**
|
|
26
|
+
* The boundary last determined in THIS process, `"unknown"` before the first Graph token mint.
|
|
27
|
+
*
|
|
28
|
+
* Why a process memo and not a store read: the boundary is a property of the app registration, so
|
|
29
|
+
* every read in a process shares one answer, and the refusal path must not make a network call to
|
|
30
|
+
* learn it. A serverless cold start re-determines on its first mint.
|
|
31
|
+
*/
|
|
32
|
+
export declare function teamsReadBoundary(): TeamsReadBoundary;
|
|
33
|
+
/** Test-only reset — drops the held determination. */
|
|
34
|
+
export declare function _resetTeamsReadBoundaryForTest(): void;
|
|
35
|
+
/**
|
|
36
|
+
* Record the boundary a freshly minted token implies, and audit it when it CHANGES (which includes
|
|
37
|
+
* the first determination in the process). Deduped on change rather than written per mint: the app
|
|
38
|
+
* registration changes rarely, an hourly re-mint is not news, and a row that appears is therefore a
|
|
39
|
+
* real signal — the deployment started reading under this boundary, or an operator changed it.
|
|
40
|
+
*
|
|
41
|
+
* Best-effort and never throws: a token mint must not fail because an audit row could not be
|
|
42
|
+
* written. Ids and the verdict only — no token, no message content.
|
|
43
|
+
*/
|
|
44
|
+
export declare function noteTeamsReadBoundary(token: string): Promise<TeamsReadBoundary>;
|
|
45
|
+
//# sourceMappingURL=teams-graph-boundary.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"teams-graph-boundary.d.ts","sourceRoot":"","sources":["../../../agent/channels/teams-graph-boundary.ts"],"names":[],"mappings":"AA0DA;;;+EAG+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAC;AAEvE;uDACuD;AACvD,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAAyE,CAAC;AAEtI,gGAAgG;AAChG,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAIxD,CAAC;AAKF;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAiB3E;AAOD;6FAC6F;AAC7F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,iBAAiB,CAGzF;AAED,oGAAoG;AACpG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAErE;AAOD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,iBAAiB,CAErD;AAED,sDAAsD;AACtD,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwBrF"}
|
|
@@ -0,0 +1,168 @@
|
|
|
1
|
+
// WHICH BOUNDARY GOVERNS A TEAMS CHANNEL READ — the detectable half of OPE-428.
|
|
2
|
+
//
|
|
3
|
+
// THE PROBLEM. teams-read.ts mints ONE app-only Microsoft Graph token and reads channel messages
|
|
4
|
+
// with it. Microsoft accepts that same token under either of two very different authorizations:
|
|
5
|
+
//
|
|
6
|
+
// - the PER-TEAM RSC grant `ChannelMessage.Read.Group` — resource-specific consent, granted by a
|
|
7
|
+
// team owner when the Teams app is installed INTO that team. Microsoft evaluates it per
|
|
8
|
+
// request against the team in the URL, so the app can read that team's channels and no others.
|
|
9
|
+
// This is the shipped default (teams-app/manifest.json declares it).
|
|
10
|
+
// - a TENANT-WIDE application permission on the Entra app registration. Microsoft then applies
|
|
11
|
+
// no team boundary at all: the app can read every channel message in the tenant, and the ONLY
|
|
12
|
+
// remaining fence is Open Everywhere's own domain allowlist (teams-read.ts's
|
|
13
|
+
// assertTeamsChannelAllowed) — app-layer code, not a platform guarantee.
|
|
14
|
+
//
|
|
15
|
+
// Nothing read back which one was in force, so the security page's per-team claim was true for
|
|
16
|
+
// most deployments and silently false for the rest. This module makes the difference detectable.
|
|
17
|
+
//
|
|
18
|
+
// HOW THE DETECTION WORKS (verified against Microsoft's own documentation, 2026-08-13):
|
|
19
|
+
//
|
|
20
|
+
// 1. RSC permissions NEVER appear in the token. Microsoft's RSC page states RSC permissions are
|
|
21
|
+
// "available only to Teams apps installed on the Teams client and not part of the Microsoft
|
|
22
|
+
// Entra admin center" — the grant lives on the TEAM resource, not on the app registration, so
|
|
23
|
+
// a client-credentials token cannot carry it. Field reports agree: an app whose manifest
|
|
24
|
+
// declares `ChannelMessage.Read.Group` mints a token whose `roles` claim does not list it.
|
|
25
|
+
// ⇒ There is NO positive RSC signal to look for. Absence is the only evidence available.
|
|
26
|
+
// 2. Tenant-wide permissions DO appear. `roles` carries exactly the application permissions
|
|
27
|
+
// admin-consented on the Entra app registration.
|
|
28
|
+
//
|
|
29
|
+
// So the predicate is a DENYLIST over `roles`, and it is deliberately one-sided:
|
|
30
|
+
//
|
|
31
|
+
// - a tenant-wide role is PRESENT ⇒ "tenant-wide". The reach exists. It does not matter whether
|
|
32
|
+
// the RSC grant also exists, because Microsoft will not stop a cross-team read either way.
|
|
33
|
+
// - no tenant-wide role ⇒ "per-team". The token cannot reach past a team on its own, so
|
|
34
|
+
// any read that SUCCEEDS did so through the per-team RSC grant, under Microsoft's own
|
|
35
|
+
// per-request check. (A deployment with neither gets Graph 403s, not silent wide reads.)
|
|
36
|
+
// - the token does not parse ⇒ "unknown". Never guessed either way.
|
|
37
|
+
//
|
|
38
|
+
// WHAT THE DENYLIST HOLDS. Microsoft documents THREE application permissions for the two endpoints
|
|
39
|
+
// teams-read.ts calls — `GET /teams/{team}/channels/{channel}/messages` and `.../messages/{id}/
|
|
40
|
+
// replies`. Both list the identical set: least-privileged `ChannelMessage.Read.Group` (the RSC one),
|
|
41
|
+
// higher-privileged `ChannelMessage.Read.All`, `Group.Read.All`, `Group.ReadWrite.All`. The last
|
|
42
|
+
// three are the tenant-wide ones. `Group.Read.All` and `Group.ReadWrite.All` matter as much as
|
|
43
|
+
// `ChannelMessage.Read.All` and are far likelier to be already consented for an unrelated reason —
|
|
44
|
+
// an app that holds one has tenant-wide channel-message reach whether or not anyone meant it to.
|
|
45
|
+
//
|
|
46
|
+
// 🔴 KNOWN LIMIT, STATED RATHER THAN HIDDEN: a denylist reports "per-team" for any FUTURE
|
|
47
|
+
// tenant-wide role Microsoft adds to those endpoints. An allowlist is not available (point 1 —
|
|
48
|
+
// there is nothing positive to match). Re-check the two API pages when Graph changes; the list
|
|
49
|
+
// below is the whole of the claim, and TEAMS_READ_BOUNDARY_SOURCES records where it came from.
|
|
50
|
+
//
|
|
51
|
+
// NO SIGNATURE VERIFICATION, ON PURPOSE. We decode a token WE minted, over TLS, from
|
|
52
|
+
// login.microsoftonline.com, seconds earlier. It is not attacker-supplied, and the decoded value
|
|
53
|
+
// drives REPORTING only — never an authorization decision. Verifying Microsoft's signature would
|
|
54
|
+
// need its JWKS and would buy nothing here. Nothing in this module logs, audits or returns any part
|
|
55
|
+
// of the token itself.
|
|
56
|
+
import { appendAudit, deploymentOrg } from "@open-everywhere/core/agent/adapter-api.js";
|
|
57
|
+
/** The Graph APPLICATION permissions that read Teams channel messages TENANT-WIDE. See the header
|
|
58
|
+
* for why this is a denylist and what it can miss. */
|
|
59
|
+
export const TENANT_WIDE_CHANNEL_READ_ROLES = ["ChannelMessage.Read.All", "Group.Read.All", "Group.ReadWrite.All"];
|
|
60
|
+
/** Where the denylist came from — quoted in the runbook so a future reader can re-verify it. */
|
|
61
|
+
export const TEAMS_READ_BOUNDARY_SOURCES = [
|
|
62
|
+
"https://learn.microsoft.com/en-us/graph/api/channel-list-messages",
|
|
63
|
+
"https://learn.microsoft.com/en-us/graph/api/chatmessage-list-replies",
|
|
64
|
+
"https://learn.microsoft.com/en-us/microsoftteams/platform/graph-api/rsc/resource-specific-consent",
|
|
65
|
+
];
|
|
66
|
+
/** The audit action that records a boundary determination. */
|
|
67
|
+
const TEAMS_READ_BOUNDARY_ACTION = "teams.read_boundary";
|
|
68
|
+
/**
|
|
69
|
+
* The `roles` claim of a JWT's payload, or `undefined` when the token does not parse as one.
|
|
70
|
+
*
|
|
71
|
+
* Returns an EMPTY array — not `undefined` — for a token that parses but carries no `roles` claim:
|
|
72
|
+
* that is a real, meaningful state (an app registration with no consented Graph application
|
|
73
|
+
* permissions), and it is exactly the per-team case. Only a genuine parse failure is `undefined`,
|
|
74
|
+
* which is what keeps "malformed" from being reported as "per-team". Pure.
|
|
75
|
+
*/
|
|
76
|
+
export function decodeJwtRoles(token) {
|
|
77
|
+
const parts = token.split(".");
|
|
78
|
+
if (parts.length !== 3 || parts[1].length === 0)
|
|
79
|
+
return undefined;
|
|
80
|
+
let payload;
|
|
81
|
+
try {
|
|
82
|
+
payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
|
|
83
|
+
}
|
|
84
|
+
catch {
|
|
85
|
+
return undefined;
|
|
86
|
+
}
|
|
87
|
+
// An ARRAY passes `typeof === "object"`, so it needs its own rejection: a JWT payload is a JSON
|
|
88
|
+
// object, and letting an array through would read its absent `roles` as [] — reporting "per-team"
|
|
89
|
+
// for a token that never parsed as a claims set at all.
|
|
90
|
+
if (typeof payload !== "object" || payload === null || Array.isArray(payload))
|
|
91
|
+
return undefined;
|
|
92
|
+
const roles = payload.roles;
|
|
93
|
+
if (roles === undefined)
|
|
94
|
+
return [];
|
|
95
|
+
if (!Array.isArray(roles))
|
|
96
|
+
return undefined;
|
|
97
|
+
return roles.filter((r) => typeof r === "string");
|
|
98
|
+
}
|
|
99
|
+
/** Every tenant-wide role the token actually carries (empty on the per-team path). Pure. */
|
|
100
|
+
function tenantWideRolesIn(roles) {
|
|
101
|
+
return TENANT_WIDE_CHANNEL_READ_ROLES.filter((r) => roles.includes(r));
|
|
102
|
+
}
|
|
103
|
+
/** The boundary a decoded `roles` claim implies — see the header for the one-sided reasoning.
|
|
104
|
+
* `undefined` roles (a token that did not parse) yield `"unknown"`, never a guess. Pure. */
|
|
105
|
+
export function boundaryFromRoles(roles) {
|
|
106
|
+
if (roles === undefined)
|
|
107
|
+
return "unknown";
|
|
108
|
+
return tenantWideRolesIn(roles).length > 0 ? "tenant-wide" : "per-team";
|
|
109
|
+
}
|
|
110
|
+
/** The boundary a minted Graph token implies. Pure; never logs or returns any part of the token. */
|
|
111
|
+
export function boundaryOfGraphToken(token) {
|
|
112
|
+
return boundaryFromRoles(decodeJwtRoles(token));
|
|
113
|
+
}
|
|
114
|
+
// --- the process-held determination + its audit row -------------------------------------------
|
|
115
|
+
let held = "unknown";
|
|
116
|
+
let heldRoles = [];
|
|
117
|
+
/**
|
|
118
|
+
* The boundary last determined in THIS process, `"unknown"` before the first Graph token mint.
|
|
119
|
+
*
|
|
120
|
+
* Why a process memo and not a store read: the boundary is a property of the app registration, so
|
|
121
|
+
* every read in a process shares one answer, and the refusal path must not make a network call to
|
|
122
|
+
* learn it. A serverless cold start re-determines on its first mint.
|
|
123
|
+
*/
|
|
124
|
+
export function teamsReadBoundary() {
|
|
125
|
+
return held;
|
|
126
|
+
}
|
|
127
|
+
/** Test-only reset — drops the held determination. */
|
|
128
|
+
export function _resetTeamsReadBoundaryForTest() {
|
|
129
|
+
held = "unknown";
|
|
130
|
+
heldRoles = [];
|
|
131
|
+
}
|
|
132
|
+
/**
|
|
133
|
+
* Record the boundary a freshly minted token implies, and audit it when it CHANGES (which includes
|
|
134
|
+
* the first determination in the process). Deduped on change rather than written per mint: the app
|
|
135
|
+
* registration changes rarely, an hourly re-mint is not news, and a row that appears is therefore a
|
|
136
|
+
* real signal — the deployment started reading under this boundary, or an operator changed it.
|
|
137
|
+
*
|
|
138
|
+
* Best-effort and never throws: a token mint must not fail because an audit row could not be
|
|
139
|
+
* written. Ids and the verdict only — no token, no message content.
|
|
140
|
+
*/
|
|
141
|
+
export async function noteTeamsReadBoundary(token) {
|
|
142
|
+
const roles = decodeJwtRoles(token);
|
|
143
|
+
const boundary = boundaryFromRoles(roles);
|
|
144
|
+
const tenantWide = tenantWideRolesIn(roles ?? []);
|
|
145
|
+
const changed = boundary !== held || tenantWide.join(",") !== heldRoles.join(",");
|
|
146
|
+
held = boundary;
|
|
147
|
+
heldRoles = tenantWide;
|
|
148
|
+
if (!changed)
|
|
149
|
+
return boundary;
|
|
150
|
+
try {
|
|
151
|
+
await appendAudit({
|
|
152
|
+
org: deploymentOrg(),
|
|
153
|
+
platform: "teams",
|
|
154
|
+
workspace: "unknown",
|
|
155
|
+
action: TEAMS_READ_BOUNDARY_ACTION,
|
|
156
|
+
detail: {
|
|
157
|
+
boundary,
|
|
158
|
+
tenantWideRoles: [...tenantWide],
|
|
159
|
+
enforcedBy: boundary === "tenant-wide" ? "open-everywhere-domain-allowlist" : "microsoft-rsc-per-team",
|
|
160
|
+
},
|
|
161
|
+
});
|
|
162
|
+
}
|
|
163
|
+
catch (err) {
|
|
164
|
+
console.warn(`[open-everywhere:audit] teams read-boundary row was not written: ${String(err)}`);
|
|
165
|
+
}
|
|
166
|
+
return boundary;
|
|
167
|
+
}
|
|
168
|
+
//# sourceMappingURL=teams-graph-boundary.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"teams-graph-boundary.js","sourceRoot":"","sources":["../../../agent/channels/teams-graph-boundary.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,iGAAiG;AACjG,gGAAgG;AAChG,EAAE;AACF,mGAAmG;AACnG,4FAA4F;AAC5F,mGAAmG;AACnG,yEAAyE;AACzE,iGAAiG;AACjG,kGAAkG;AAClG,iFAAiF;AACjF,6EAA6E;AAC7E,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,EAAE;AACF,wFAAwF;AACxF,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,mGAAmG;AACnG,8FAA8F;AAC9F,gGAAgG;AAChG,8FAA8F;AAC9F,8FAA8F;AAC9F,sDAAsD;AACtD,EAAE;AACF,iFAAiF;AACjF,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,oGAAoG;AACpG,0FAA0F;AAC1F,6FAA6F;AAC7F,2EAA2E;AAC3E,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,qGAAqG;AACrG,iGAAiG;AACjG,+FAA+F;AAC/F,mGAAmG;AACnG,iGAAiG;AACjG,EAAE;AACF,0FAA0F;AAC1F,+FAA+F;AAC/F,+FAA+F;AAC/F,+FAA+F;AAC/F,EAAE;AACF,qFAAqF;AACrF,iGAAiG;AACjG,iGAAiG;AACjG,oGAAoG;AACpG,uBAAuB;AAEvB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAQxF;uDACuD;AACvD,MAAM,CAAC,MAAM,8BAA8B,GAAsB,CAAC,yBAAyB,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;AAEtI,gGAAgG;AAChG,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,mEAAmE;IACnE,sEAAsE;IACtE,mGAAmG;CACpG,CAAC;AAEF,8DAA8D;AAC9D,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,gGAAgG;IAChG,kGAAkG;IAClG,wDAAwD;IACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAChG,MAAM,KAAK,GAAI,OAA+B,CAAC,KAAK,CAAC;IACrD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,4FAA4F;AAC5F,SAAS,iBAAiB,CAAC,KAAwB;IACjD,OAAO,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;6FAC6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,KAAoC;IACpE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;AAC1E,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,iBAAiB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,iGAAiG;AAEjG,IAAI,IAAI,GAAsB,SAAS,CAAC;AACxC,IAAI,SAAS,GAAsB,EAAE,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,8BAA8B;IAC5C,IAAI,GAAG,SAAS,CAAC;IACjB,SAAS,GAAG,EAAE,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACvD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,IAAI,GAAG,QAAQ,CAAC;IAChB,SAAS,GAAG,UAAU,CAAC;IACvB,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,WAAW,CAAC;YAChB,GAAG,EAAE,aAAa,EAAE;YACpB,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE;gBACN,QAAQ;gBACR,eAAe,EAAE,CAAC,GAAG,UAAU,CAAC;gBAChC,UAAU,EAAE,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,wBAAwB;aACvG;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,oEAAoE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
/** The subset of eve's `TeamsApiResponse` this read takes — the ENVELOPE, not the parsed body. The
|
|
2
|
+
* shape is typed rather than cast (the `teams-roster.ts` discipline): a cast to `unknown` here would
|
|
3
|
+
* let a reader take `aadGroupId` off the envelope, where it is never present, and `tsc` would say
|
|
4
|
+
* nothing. */
|
|
5
|
+
export interface TeamsTeamDetailsResponse {
|
|
6
|
+
readonly ok: boolean;
|
|
7
|
+
readonly body: unknown;
|
|
8
|
+
}
|
|
9
|
+
/** The Connector GET this module needs, injected so the test drives it with no network. */
|
|
10
|
+
export interface TeamsGraphTeamIdDeps {
|
|
11
|
+
readonly request: (args: {
|
|
12
|
+
readonly serviceUrl: string;
|
|
13
|
+
readonly path: string;
|
|
14
|
+
}) => Promise<TeamsTeamDetailsResponse>;
|
|
15
|
+
}
|
|
16
|
+
/**
|
|
17
|
+
* The MICROSOFT GRAPH team id for one inbound activity's team, or undefined when it cannot be
|
|
18
|
+
* resolved. `botTeamId` is the activity's own `channelData.team.id`; `serviceUrl` is the activity's
|
|
19
|
+
* regional Connector endpoint, which the Connector call is addressed to.
|
|
20
|
+
*
|
|
21
|
+
* A `botTeamId` that is ALREADY a group id passes straight through — a deployment whose activities
|
|
22
|
+
* carry one costs no Connector call, and neither does any later wake on a team already resolved.
|
|
23
|
+
*/
|
|
24
|
+
export declare function teamsGraphTeamId(botTeamId: string | undefined, serviceUrl: string | undefined, deps?: TeamsGraphTeamIdDeps): Promise<string | undefined>;
|
|
25
|
+
/** Drop the resolved-id cache (tests only — it is process-global, like every other warm cache here). */
|
|
26
|
+
export declare function _resetTeamsGraphTeamIdCache(): void;
|
|
27
|
+
/** Seed one mapping (tests only), so a suite driving a read can bind the Connector-spelled team id a
|
|
28
|
+
* live turn really carries WITHOUT reaching the Connector for it. */
|
|
29
|
+
export declare function _seedTeamsGraphTeamIdForTest(botTeamId: string, graphTeamId: string): void;
|
|
30
|
+
//# sourceMappingURL=teams-graph-team-id.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"teams-graph-team-id.d.ts","sourceRoot":"","sources":["../../../agent/channels/teams-graph-team-id.ts"],"names":[],"mappings":"AA2CA;;;eAGe;AACf,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,2FAA2F;AAC3F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACvH;AAMD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,GAAE,oBAA+B,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB7B;AAED,wGAAwG;AACxG,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;sEACsE;AACtE,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAEzF"}
|
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
// teams-graph-team-id — the ONE place the Bot Connector's team id becomes the team id MICROSOFT
|
|
2
|
+
// GRAPH takes (OPE-1808).
|
|
3
|
+
//
|
|
4
|
+
// 🔴 TEAMS HAS TWO TEAM IDS AND THEY ARE NOT INTERCHANGEABLE. An inbound activity carries
|
|
5
|
+
// `channelData.team.id`, which is the BOT CONNECTOR's id for the team — a `19:…@thread.tacv2`
|
|
6
|
+
// string. Every Graph URL under `/teams/{team-id}/…` takes the team's MICROSOFT 365 GROUP id
|
|
7
|
+
// instead, a GUID: Graph's own `team` resource states that "the group has the same ID as the team",
|
|
8
|
+
// and keeps the `19:` spelling in a separate `internalId` property. So handing the activity's team
|
|
9
|
+
// id straight to Graph addresses nothing, and Graph answers 404.
|
|
10
|
+
//
|
|
11
|
+
// WHAT THAT COST. `channels/teams-catch-up.ts` builds its read URL from the id the wake carries, and
|
|
12
|
+
// its fetch is fail-soft: a 404 there becomes an EMPTY window, so the seat is woken with no context
|
|
13
|
+
// and no statement that it could not read — indistinguishable from a quiet channel. Ship #204's
|
|
14
|
+
// `J-ENGAGED-teams` catch-up gate red exactly this way: the seat woke on the re-addressing and the
|
|
15
|
+
// envelope carried nothing, while the same journey's GitHub twin passed.
|
|
16
|
+
//
|
|
17
|
+
// THE MAPPING IS THE VENDOR'S OWN. The Bot Connector answers `GET {serviceUrl}/v3/teams/{teamId}`
|
|
18
|
+
// with the team's details, `aadGroupId` among them — the Entra group id, which is the Graph team id.
|
|
19
|
+
// The bot already holds the Connector credential it takes, so this is the same transport the roster
|
|
20
|
+
// and directory reads use, not a new one.
|
|
21
|
+
//
|
|
22
|
+
// FAIL-SOFT TO UNDEFINED, NEVER TO A GUESS. An unresolvable team id answers `undefined`, and the
|
|
23
|
+
// wake path then states the bound (`catchUpUnavailableReason`) instead of reading an empty window.
|
|
24
|
+
// A stated "I could not read this" is the answer this whole mechanism exists to produce; a silent
|
|
25
|
+
// empty read is the one it exists to refuse.
|
|
26
|
+
import { callTeamsConnectorApi } from "eve/channels/teams";
|
|
27
|
+
/** An Entra group id — the shape Graph's `/teams/{team-id}` segment takes. */
|
|
28
|
+
const GRAPH_TEAM_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
|
|
29
|
+
/**
|
|
30
|
+
* RESOLVED IDS ONLY, and the reason the cache holds no failures: a Connector call that failed says
|
|
31
|
+
* nothing about the team, so caching that answer would freeze one network blip into a permanently
|
|
32
|
+
* unreadable surface. A team's group id never changes, so a success is cacheable for the life of the
|
|
33
|
+
* process.
|
|
34
|
+
* 🔴 THE COST OF THAT CHOICE, STATED: a team that RESOLVES is read once per process, and a team that
|
|
35
|
+
* does NOT is re-read on every wake. That is the intended trade — a repeated read is cheaper than a
|
|
36
|
+
* surface that stays unreadable until a redeploy — but it is a Connector read with no backoff
|
|
37
|
+
* (scripts/teams-connector-seam-test.ts §3 tracks it), so it is a bound worth knowing.
|
|
38
|
+
*/
|
|
39
|
+
const RESOLVED = new Map();
|
|
40
|
+
const liveDeps = {
|
|
41
|
+
request: ({ serviceUrl, path }) => callTeamsConnectorApi({ serviceUrl, path, method: "GET" }),
|
|
42
|
+
};
|
|
43
|
+
/**
|
|
44
|
+
* The MICROSOFT GRAPH team id for one inbound activity's team, or undefined when it cannot be
|
|
45
|
+
* resolved. `botTeamId` is the activity's own `channelData.team.id`; `serviceUrl` is the activity's
|
|
46
|
+
* regional Connector endpoint, which the Connector call is addressed to.
|
|
47
|
+
*
|
|
48
|
+
* A `botTeamId` that is ALREADY a group id passes straight through — a deployment whose activities
|
|
49
|
+
* carry one costs no Connector call, and neither does any later wake on a team already resolved.
|
|
50
|
+
*/
|
|
51
|
+
export async function teamsGraphTeamId(botTeamId, serviceUrl, deps = liveDeps) {
|
|
52
|
+
if (!botTeamId)
|
|
53
|
+
return undefined;
|
|
54
|
+
if (GRAPH_TEAM_ID.test(botTeamId))
|
|
55
|
+
return botTeamId;
|
|
56
|
+
const cached = RESOLVED.get(botTeamId);
|
|
57
|
+
if (cached !== undefined)
|
|
58
|
+
return cached;
|
|
59
|
+
if (!serviceUrl)
|
|
60
|
+
return undefined;
|
|
61
|
+
try {
|
|
62
|
+
const res = await deps.request({ serviceUrl, path: `/v3/teams/${encodeURIComponent(botTeamId)}` });
|
|
63
|
+
// The Connector answers a non-ok STATUS rather than throwing, so the refusal arm is read off the
|
|
64
|
+
// envelope; `aadGroupId` lives in the BODY, one level in.
|
|
65
|
+
if (!res.ok)
|
|
66
|
+
return undefined;
|
|
67
|
+
const aadGroupId = res.body?.aadGroupId;
|
|
68
|
+
// The GUID check is not decoration: the Connector answers 200 with a body that omits
|
|
69
|
+
// `aadGroupId` on a team it cannot report one for, and passing that through would put a
|
|
70
|
+
// non-address in a Graph URL — the same defect this module removes, one field along.
|
|
71
|
+
if (typeof aadGroupId !== "string" || !GRAPH_TEAM_ID.test(aadGroupId))
|
|
72
|
+
return undefined;
|
|
73
|
+
RESOLVED.set(botTeamId, aadGroupId);
|
|
74
|
+
return aadGroupId;
|
|
75
|
+
}
|
|
76
|
+
catch {
|
|
77
|
+
return undefined; // a Connector failure is not a statement about the team
|
|
78
|
+
}
|
|
79
|
+
}
|
|
80
|
+
/** Drop the resolved-id cache (tests only — it is process-global, like every other warm cache here). */
|
|
81
|
+
export function _resetTeamsGraphTeamIdCache() {
|
|
82
|
+
RESOLVED.clear();
|
|
83
|
+
}
|
|
84
|
+
/** Seed one mapping (tests only), so a suite driving a read can bind the Connector-spelled team id a
|
|
85
|
+
* live turn really carries WITHOUT reaching the Connector for it. */
|
|
86
|
+
export function _seedTeamsGraphTeamIdForTest(botTeamId, graphTeamId) {
|
|
87
|
+
RESOLVED.set(botTeamId, graphTeamId);
|
|
88
|
+
}
|
|
89
|
+
//# sourceMappingURL=teams-graph-team-id.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"teams-graph-team-id.js","sourceRoot":"","sources":["../../../agent/channels/teams-graph-team-id.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,0BAA0B;AAC1B,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,6FAA6F;AAC7F,oGAAoG;AACpG,mGAAmG;AACnG,iEAAiE;AACjE,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,gGAAgG;AAChG,mGAAmG;AACnG,yEAAyE;AACzE,EAAE;AACF,kGAAkG;AAClG,qGAAqG;AACrG,oGAAoG;AACpG,0CAA0C;AAC1C,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,kGAAkG;AAClG,6CAA6C;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,8EAA8E;AAC9E,MAAM,aAAa,GAAG,iEAAiE,CAAC;AAExF;;;;;;;;;GASG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;AAgB3C,MAAM,QAAQ,GAAyB;IACrC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;CAC9F,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAA6B,EAC7B,UAA8B,EAC9B,IAAI,GAAyB,QAAQ;IAErC,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,iGAAiG;QACjG,0DAA0D;QAC1D,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,UAAU,GAAI,GAAG,CAAC,IAAsD,EAAE,UAAU,CAAC;QAC3F,qFAAqF;QACrF,wFAAwF;QACxF,qFAAqF;QACrF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,SAAS,CAAC;QACxF,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACpC,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,wDAAwD;IAC5E,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,2BAA2B;IACzC,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;sEACsE;AACtE,MAAM,UAAU,4BAA4B,CAAC,SAAiB,EAAE,WAAmB;IACjF,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACvC,CAAC"}
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
import { type ProactiveAddress } from "@open-everywhere/core/agent/adapter-api.js";
|
|
2
|
+
/** The `kind` of a conversation-id index row — keyed on the surface-key spelling of a Teams
|
|
3
|
+
* conversation id. Distinct from the `conversation` ADDRESS row (teams-conversation-ref.ts), which
|
|
4
|
+
* is keyed on the raw id and carries a `serviceUrl`. This row carries no address and makes no
|
|
5
|
+
* reachability claim; it says only "this spelling came from that id". */
|
|
6
|
+
export declare const TEAMS_CONVERSATION_KEY_KIND = "conversation-key";
|
|
7
|
+
/** The `kind` of a person-id index row — keyed on the surface-key spelling of a Bot Framework
|
|
8
|
+
* `from.id`. Written for EVERY scope, unlike the `personal` address row: a person seen only in a
|
|
9
|
+
* channel still has one true spelling, and knowing it is not a claim that we can reach them. The DM
|
|
10
|
+
* arm's own two-outcome refusal decides that, and it decides it on the raw id this row restores. */
|
|
11
|
+
export declare const TEAMS_PERSON_KEY_KIND = "person-key";
|
|
12
|
+
/** The two index species, as a type. Narrow on purpose: passing an ADDRESS kind (`conversation`,
|
|
13
|
+
* `personal`, `team`) to the builder or the lookup below would key an index row on a row species
|
|
14
|
+
* that stores something else entirely, and a bare `string` cannot say no to that. */
|
|
15
|
+
export type TeamsIdIndexKind = typeof TEAMS_CONVERSATION_KEY_KIND | typeof TEAMS_PERSON_KEY_KIND;
|
|
16
|
+
/**
|
|
17
|
+
* The index row for one raw id, or `undefined` when there is nothing to index.
|
|
18
|
+
*
|
|
19
|
+
* TWO ABSENCES, both real answers rather than failures:
|
|
20
|
+
* • an id that cleans to nothing has no spelling at all;
|
|
21
|
+
* • an id that EQUALS its own spelling needs no row — the restore path returns such an id
|
|
22
|
+
* unchanged without reading anything, so a row would be dead weight on every Slack-shaped id.
|
|
23
|
+
*
|
|
24
|
+
* PURE, so the whole write decision is testable without a store — the same split
|
|
25
|
+
* `teamsAddressRowsFor` makes, and the reason it is the caller.
|
|
26
|
+
*/
|
|
27
|
+
export declare function teamsIdIndexRow(kind: TeamsIdIndexKind, rawId: string, tenantId: string, updatedAt: string): ProactiveAddress | undefined;
|
|
28
|
+
/** The raw Bot Framework CONVERSATION id behind a granted `teams:channel/<id>` address, or the
|
|
29
|
+
* caller's own id when it is already raw or unknown here. */
|
|
30
|
+
export declare function restoreTeamsConversationId(id: string): Promise<string>;
|
|
31
|
+
/** The raw Bot Framework PERSON id (`29:…`) behind a granted `teams:person/<id>` address, or the
|
|
32
|
+
* caller's own id when it is already raw or unknown here. */
|
|
33
|
+
export declare function restoreTeamsPersonId(id: string): Promise<string>;
|
|
34
|
+
//# sourceMappingURL=teams-id-restore.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"teams-id-restore.d.ts","sourceRoot":"","sources":["../../../agent/channels/teams-id-restore.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAyD,KAAK,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAE1I;;;0EAG0E;AAC1E,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAE9D;;;qGAGqG;AACrG,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GAAG,OAAO,2BAA2B,GAAG,OAAO,qBAAqB,CAAC;AAKjG;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAYxI;AAwBD;8DAC8D;AAC9D,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEtE;AAED;8DAC8D;AAC9D,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEhE"}
|
|
@@ -0,0 +1,123 @@
|
|
|
1
|
+
// THE TEAMS ID-RESTORATION SEAM (OPE-1078) — the join between the id this deployment NAMES a Teams
|
|
2
|
+
// container or person by, and the id the Bot Framework will accept.
|
|
3
|
+
//
|
|
4
|
+
// ─── THE TWO SPELLINGS, AND WHY BOTH ARE RIGHT ──────────────────────────────────────────────────
|
|
5
|
+
//
|
|
6
|
+
// A Teams conversation id is `19:x@thread.tacv2`; a Teams person id is `29:1abc`. Neither is inside
|
|
7
|
+
// the surface-key charset (`[^a-zA-Z0-9._-]`, identity/binding.ts), so everything in this deployment
|
|
8
|
+
// that names one names it in its SURFACE-KEY SPELLING — `19-x-thread.tacv2`, `29-1abc`. The surface
|
|
9
|
+
// key does, the memory partition does, the `memory/config/domains.ts` roster does
|
|
10
|
+
// (docs/deploy/surfaces/teams.md tells operators to write that form), every audit row does, and
|
|
11
|
+
// since OPE-1078 a resource-grant address does too, because the address grammar admits nothing else.
|
|
12
|
+
//
|
|
13
|
+
// The Bot Framework accepts only the RAW id. `teams-conversation-ref.ts` looks a conversation
|
|
14
|
+
// reference up on the EXACT inbound id, and `POST /v3/conversations` takes the raw `29:` id in its
|
|
15
|
+
// members list. So a granted address arrives at the transport in the one spelling the transport
|
|
16
|
+
// cannot use, and this module is what closes that gap.
|
|
17
|
+
//
|
|
18
|
+
// ─── HOW IT CLOSES IT: AN INDEX, NEVER A RECONSTRUCTION ─────────────────────────────────────────
|
|
19
|
+
//
|
|
20
|
+
// Every inbound activity that writes a conversation reference also writes an INDEX row here:
|
|
21
|
+
// spelling → the raw id it came from. A restore is one point lookup, and a miss returns the caller's
|
|
22
|
+
// own string unchanged, so the caller's existing refusal fires with its own message.
|
|
23
|
+
//
|
|
24
|
+
// A CHANNEL ACTIVITY WRITES TWO CONVERSATION ROWS (OPE-1093), because it arrives at the reply-chain
|
|
25
|
+
// grain (`;messageid=<root>`) while a roster entry and a grant address name the CHANNEL grain. One
|
|
26
|
+
// row per grain, each with its own address row behind it — see `teams-conversation-ref.ts`'s
|
|
27
|
+
// CHANNEL-GRAIN TWIN block. With only the reply-chain row, the one address the container fence could
|
|
28
|
+
// admit was the one this index could never hold, and every Teams container grant refused.
|
|
29
|
+
//
|
|
30
|
+
// 🔴 IT DOES NOT REBUILD THE RAW ID BY GRAMMAR, and that is the whole design choice. Turning
|
|
31
|
+
// `19-x-thread.tacv2` back into `19:x@thread.tacv2` means asserting where the colon and the `@` sat,
|
|
32
|
+
// which is a guess about a vendor id shape. A shape this tree has not seen — a meeting chat, a new
|
|
33
|
+
// grain, a reply-chain suffix in another position — would rebuild into an id that addresses a
|
|
34
|
+
// DIFFERENT conversation or none, and a chat WRITE is the worst place to be wrong. The index maps
|
|
35
|
+
// back only ids this deployment has actually received.
|
|
36
|
+
//
|
|
37
|
+
// ─── A RAW CALLER PAYS NOTHING ──────────────────────────────────────────────────────────────────
|
|
38
|
+
//
|
|
39
|
+
// `surfaceKeySegment` is idempotent, so `spelling(id) !== id` proves the id is already raw. Every
|
|
40
|
+
// pre-existing caller (a live binding, a frozen wake origin, a stop acknowledgement) hands over a raw
|
|
41
|
+
// id and is answered without a store read. Only a grant address — the one caller that holds a
|
|
42
|
+
// spelling — reaches the lookup.
|
|
43
|
+
//
|
|
44
|
+
// ─── THE BOUND, STATED ──────────────────────────────────────────────────────────────────────────
|
|
45
|
+
//
|
|
46
|
+
// Two raw ids that share a spelling are ALREADY one id to this deployment: they share a surface key,
|
|
47
|
+
// a memory partition and a roster entry, so the read plane cannot tell them apart either. This index
|
|
48
|
+
// inherits that identity rather than creating it, and answers with the raw id last seen. The one
|
|
49
|
+
// place the spelling actually loses information is `seg`'s 100-character clamp, so an alias needs two
|
|
50
|
+
// ids that agree for 100 characters after cleaning. No Bot Framework id shape does that.
|
|
51
|
+
import { getOperationalStore, deploymentOrg, surfaceKeySegment } from "@open-everywhere/core/agent/adapter-api.js";
|
|
52
|
+
/** The `kind` of a conversation-id index row — keyed on the surface-key spelling of a Teams
|
|
53
|
+
* conversation id. Distinct from the `conversation` ADDRESS row (teams-conversation-ref.ts), which
|
|
54
|
+
* is keyed on the raw id and carries a `serviceUrl`. This row carries no address and makes no
|
|
55
|
+
* reachability claim; it says only "this spelling came from that id". */
|
|
56
|
+
export const TEAMS_CONVERSATION_KEY_KIND = "conversation-key";
|
|
57
|
+
/** The `kind` of a person-id index row — keyed on the surface-key spelling of a Bot Framework
|
|
58
|
+
* `from.id`. Written for EVERY scope, unlike the `personal` address row: a person seen only in a
|
|
59
|
+
* channel still has one true spelling, and knowing it is not a claim that we can reach them. The DM
|
|
60
|
+
* arm's own two-outcome refusal decides that, and it decides it on the raw id this row restores. */
|
|
61
|
+
export const TEAMS_PERSON_KEY_KIND = "person-key";
|
|
62
|
+
/** The one field an index row's bag carries: the raw platform id. One name for both kinds. */
|
|
63
|
+
const RAW_ID_FIELD = "rawId";
|
|
64
|
+
/**
|
|
65
|
+
* The index row for one raw id, or `undefined` when there is nothing to index.
|
|
66
|
+
*
|
|
67
|
+
* TWO ABSENCES, both real answers rather than failures:
|
|
68
|
+
* • an id that cleans to nothing has no spelling at all;
|
|
69
|
+
* • an id that EQUALS its own spelling needs no row — the restore path returns such an id
|
|
70
|
+
* unchanged without reading anything, so a row would be dead weight on every Slack-shaped id.
|
|
71
|
+
*
|
|
72
|
+
* PURE, so the whole write decision is testable without a store — the same split
|
|
73
|
+
* `teamsAddressRowsFor` makes, and the reason it is the caller.
|
|
74
|
+
*/
|
|
75
|
+
export function teamsIdIndexRow(kind, rawId, tenantId, updatedAt) {
|
|
76
|
+
const id = rawId.trim();
|
|
77
|
+
const spelling = surfaceKeySegment(id);
|
|
78
|
+
if (spelling.length === 0 || spelling === id)
|
|
79
|
+
return undefined;
|
|
80
|
+
return {
|
|
81
|
+
platform: "teams",
|
|
82
|
+
kind,
|
|
83
|
+
refKey: spelling,
|
|
84
|
+
tenant: tenantId,
|
|
85
|
+
address: { [RAW_ID_FIELD]: id },
|
|
86
|
+
updatedAt,
|
|
87
|
+
};
|
|
88
|
+
}
|
|
89
|
+
/**
|
|
90
|
+
* Restore the raw platform id behind one id of either spelling.
|
|
91
|
+
*
|
|
92
|
+
* TOTAL AND FAIL-SOFT. An already-raw id comes back untouched with no store read. A spelling with no
|
|
93
|
+
* row, and a store that will not answer, both come back untouched too — the caller then fails on its
|
|
94
|
+
* own honest path ("no conversation reference for …", "no account id"), which names the id it could
|
|
95
|
+
* not resolve. Throwing here would replace that message with a less useful one.
|
|
96
|
+
*/
|
|
97
|
+
async function restoreTeamsId(kind, id) {
|
|
98
|
+
const given = id.trim();
|
|
99
|
+
if (given.length === 0)
|
|
100
|
+
return id;
|
|
101
|
+
if (surfaceKeySegment(given) !== given)
|
|
102
|
+
return given; // already raw — see the header
|
|
103
|
+
try {
|
|
104
|
+
const row = await getOperationalStore().proactiveAddress(deploymentOrg(), "teams", kind, given);
|
|
105
|
+
const raw = row?.address[RAW_ID_FIELD];
|
|
106
|
+
return typeof raw === "string" && raw.trim().length > 0 ? raw.trim() : given;
|
|
107
|
+
}
|
|
108
|
+
catch (err) {
|
|
109
|
+
console.log(`[open-everywhere:teams-id-restore] could not read the ${kind} index: ${err?.message ?? String(err)}`);
|
|
110
|
+
return given;
|
|
111
|
+
}
|
|
112
|
+
}
|
|
113
|
+
/** The raw Bot Framework CONVERSATION id behind a granted `teams:channel/<id>` address, or the
|
|
114
|
+
* caller's own id when it is already raw or unknown here. */
|
|
115
|
+
export function restoreTeamsConversationId(id) {
|
|
116
|
+
return restoreTeamsId(TEAMS_CONVERSATION_KEY_KIND, id);
|
|
117
|
+
}
|
|
118
|
+
/** The raw Bot Framework PERSON id (`29:…`) behind a granted `teams:person/<id>` address, or the
|
|
119
|
+
* caller's own id when it is already raw or unknown here. */
|
|
120
|
+
export function restoreTeamsPersonId(id) {
|
|
121
|
+
return restoreTeamsId(TEAMS_PERSON_KEY_KIND, id);
|
|
122
|
+
}
|
|
123
|
+
//# sourceMappingURL=teams-id-restore.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"teams-id-restore.js","sourceRoot":"","sources":["../../../agent/channels/teams-id-restore.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,oEAAoE;AACpE,EAAE;AACF,mGAAmG;AACnG,EAAE;AACF,oGAAoG;AACpG,qGAAqG;AACrG,oGAAoG;AACpG,kFAAkF;AAClF,gGAAgG;AAChG,qGAAqG;AACrG,EAAE;AACF,8FAA8F;AAC9F,mGAAmG;AACnG,gGAAgG;AAChG,uDAAuD;AACvD,EAAE;AACF,mGAAmG;AACnG,EAAE;AACF,6FAA6F;AAC7F,qGAAqG;AACrG,qFAAqF;AACrF,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,6FAA6F;AAC7F,qGAAqG;AACrG,0FAA0F;AAC1F,EAAE;AACF,6FAA6F;AAC7F,qGAAqG;AACrG,mGAAmG;AACnG,8FAA8F;AAC9F,kGAAkG;AAClG,uDAAuD;AACvD,EAAE;AACF,mGAAmG;AACnG,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,8FAA8F;AAC9F,iCAAiC;AACjC,EAAE;AACF,mGAAmG;AACnG,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,iGAAiG;AACjG,sGAAsG;AACtG,yFAAyF;AAEzF,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAyB,MAAM,4CAA4C,CAAC;AAE1I;;;0EAG0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AAE9D;;;qGAGqG;AACrG,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAOlD,8FAA8F;AAC9F,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,IAAsB,EAAE,KAAa,EAAE,QAAgB,EAAE,SAAiB;IACxG,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,IAAI;QACJ,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE;QAC/B,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,IAAsB,EAAE,EAAU;IAC9D,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,iBAAiB,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IACrF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChG,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,yDAAyD,IAAI,WAAY,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9H,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;8DAC8D;AAC9D,MAAM,UAAU,0BAA0B,CAAC,EAAU;IACnD,OAAO,cAAc,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;8DAC8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,OAAO,cAAc,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC"}
|