@rafads/plugin-openapi 1.5.38

package/dist/providers/microsoft.js

@@ -0,0 +1,1056 @@
+import {
+  AuthenticationSchema,
+  parseEntry,
+  parseHead,
+  parseSmallComponents,
+  structuralSplit
+} from "../chunk-R7TVM3XD.js";
+import {
+  OpenApiParseError
+} from "../chunk-CXFO6TLJ.js";
+
+// src/providers/microsoft/presets.ts
+var svglIcon = (name) => `https://svgl.app/library/${name}.svg`;
+var MICROSOFT_GRAPH_OPENAPI_URL = "https://raw.githubusercontent.com/microsoftgraph/msgraph-metadata/master/openapi/v1.0/openapi.yaml";
+var MICROSOFT_GRAPH_PERMISSIONS_REFERENCE_URL = "https://raw.githubusercontent.com/microsoftgraph/microsoft-graph-docs-contrib/main/concepts/permissions-reference.md";
+var MICROSOFT_GRAPH_BASE_URL = "https://graph.microsoft.com/v1.0";
+var MICROSOFT_AUTHORIZATION_URL = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize";
+var MICROSOFT_TOKEN_URL = "https://login.microsoftonline.com/common/oauth2/v2.0/token";
+var MICROSOFT_AUTH_TEMPLATE_SLUG = "azureAdDelegated";
+var MICROSOFT_CLIENT_CREDENTIALS_AUTH_TEMPLATE_SLUG = "azureAdClientCredentials";
+var MICROSOFT_GRAPH_BASE_SCOPES = ["offline_access"];
+var MICROSOFT_GRAPH_IDENTITY_SCOPE = "User.Read";
+var MICROSOFT_GRAPH_DEFAULT_SCOPE = "https://graph.microsoft.com/.default";
+var MICROSOFT_GRAPH_DELEGATED_DEFAULT_SCOPES = [
+  ...MICROSOFT_GRAPH_BASE_SCOPES,
+  MICROSOFT_GRAPH_IDENTITY_SCOPE,
+  MICROSOFT_GRAPH_DEFAULT_SCOPE
+];
+var MICROSOFT_GRAPH_CLIENT_CREDENTIALS_SCOPES = [
+  MICROSOFT_GRAPH_DEFAULT_SCOPE
+];
+var MICROSOFT_GRAPH_PRESET_ID = "microsoft";
+var microsoftGraphPreset = {
+  id: MICROSOFT_GRAPH_PRESET_ID,
+  name: "Microsoft Graph",
+  summary: "Bundle Microsoft 365 workloads into one Graph integration and one OAuth consent.",
+  featured: true
+};
+var microsoftGraphScopePresets = [
+  {
+    id: "profile",
+    name: "Profile",
+    summary: "Signed-in user profile and photo.",
+    icon: svglIcon("microsoft"),
+    scopes: ["User.Read"],
+    exactPaths: ["/me", "/me/photo", "/me/photo/$value"],
+    featured: true,
+    audience: "productivity"
+  },
+  {
+    id: "me-surface",
+    name: "My Graph Operations",
+    summary: "All operation groups rooted under /me.",
+    icon: svglIcon("microsoft"),
+    scopes: ["User.Read"],
+    pathPrefixes: ["/me"],
+    audience: "productivity"
+  },
+  {
+    id: "mail",
+    name: "Outlook Mail",
+    summary: "Messages, folders, attachments, settings, and send mail.",
+    icon: svglIcon("microsoft-outlook"),
+    scopes: ["Mail.ReadWrite", "Mail.Send", "MailboxSettings.ReadWrite"],
+    pathPrefixes: [
+      "/me/messages",
+      "/me/mailFolders",
+      "/me/sendMail",
+      "/me/getMailTips",
+      "/me/inferenceClassification",
+      "/me/mailboxSettings",
+      "/me/outlook",
+      "/users/{user-id}/messages",
+      "/users/{user-id}/mailFolders",
+      "/users/{user-id}/sendMail",
+      "/users/{user-id}/outlook"
+    ],
+    featured: true,
+    audience: "productivity"
+  },
+  {
+    id: "calendar",
+    name: "Outlook Calendar",
+    summary: "Calendars, events, and scheduling.",
+    icon: svglIcon("microsoft-outlook"),
+    scopes: ["Calendars.ReadWrite"],
+    pathPrefixes: [
+      "/me/calendar",
+      "/me/calendars",
+      "/me/calendarGroups",
+      "/me/calendarView",
+      "/me/events",
+      "/me/findMeetingTimes",
+      "/me/reminderView",
+      "/users/{user-id}/calendar",
+      "/users/{user-id}/calendars",
+      "/users/{user-id}/calendarGroups",
+      "/users/{user-id}/calendarView",
+      "/users/{user-id}/events",
+      "/users/{user-id}/findMeetingTimes",
+      "/users/{user-id}/reminderView"
+    ],
+    featured: true,
+    audience: "productivity"
+  },
+  {
+    id: "contacts",
+    name: "Outlook Contacts",
+    summary: "Contacts, contact folders, and people suggestions.",
+    icon: svglIcon("microsoft-outlook"),
+    scopes: ["Contacts.ReadWrite", "People.Read.All"],
+    pathPrefixes: [
+      "/me/contacts",
+      "/me/contactFolders",
+      "/me/people",
+      "/users/{user-id}/contacts",
+      "/users/{user-id}/contactFolders",
+      "/users/{user-id}/people"
+    ],
+    audience: "productivity"
+  },
+  {
+    id: "tasks",
+    name: "To Do Tasks",
+    summary: "Task lists, tasks, and checklist items.",
+    icon: svglIcon("microsoft-todo"),
+    scopes: ["Tasks.ReadWrite"],
+    pathPrefixes: ["/me/todo", "/users/{user-id}/todo"],
+    audience: "productivity"
+  },
+  {
+    id: "planner",
+    name: "Planner",
+    summary: "Plans, buckets, tasks, assignments, and Planner user data.",
+    icon: svglIcon("microsoft"),
+    scopes: ["Tasks.ReadWrite"],
+    pathPrefixes: [
+      "/planner",
+      "/me/planner",
+      "/users/{user-id}/planner",
+      "/groups/{group-id}/planner"
+    ],
+    audience: "productivity"
+  },
+  {
+    id: "files",
+    name: "OneDrive Files",
+    summary: "Drives, files, folders, sharing links, and permissions.",
+    icon: svglIcon("microsoft-onedrive"),
+    scopes: ["Files.ReadWrite.All", "Sites.ReadWrite.All"],
+    pathPrefixes: [
+      "/me/drive",
+      "/me/drives",
+      "/me/followedSites",
+      "/users/{user-id}/drive",
+      "/users/{user-id}/drives",
+      "/groups/{group-id}/drive",
+      "/groups/{group-id}/drives",
+      "/drives",
+      "/shares"
+    ],
+    featured: true,
+    audience: "files-content"
+  },
+  {
+    id: "excel",
+    name: "Excel Workbooks",
+    summary: "Workbook tables, worksheets, ranges, charts, and sessions.",
+    icon: svglIcon("microsoft-excel"),
+    scopes: ["Files.ReadWrite.All"],
+    pathPrefixes: [
+      "/me/drive/items/{driveItem-id}/workbook",
+      "/users/{user-id}/drive/items/{driveItem-id}/workbook",
+      "/groups/{group-id}/drive/items/{driveItem-id}/workbook",
+      "/drives/{drive-id}/items/{driveItem-id}/workbook"
+    ],
+    audience: "files-content"
+  },
+  {
+    id: "sites",
+    name: "SharePoint Sites",
+    summary: "Sites, lists, pages, columns, content types, and stores.",
+    icon: svglIcon("microsoft-sharepoint"),
+    scopes: ["Sites.ReadWrite.All"],
+    pathPrefixes: ["/sites"],
+    featured: true,
+    audience: "files-content"
+  },
+  {
+    id: "onenote",
+    name: "OneNote",
+    summary: "Notebooks, sections, pages, and page content.",
+    icon: svglIcon("microsoft-onenote"),
+    scopes: ["Notes.ReadWrite"],
+    pathPrefixes: [
+      "/me/onenote",
+      "/users/{user-id}/onenote",
+      "/groups/{group-id}/onenote",
+      "/sites/{site-id}/onenote"
+    ],
+    audience: "files-content"
+  },
+  {
+    id: "teams-chat",
+    name: "Teams Chats",
+    summary: "Chats, chat messages, installed apps, and members.",
+    icon: svglIcon("microsoft-teams"),
+    scopes: ["Chat.ReadWrite"],
+    pathPrefixes: ["/me/chats", "/chats"],
+    audience: "collaboration"
+  },
+  {
+    id: "teams-channels",
+    name: "Teams Channels",
+    summary: "Teams, channels, channel messages, replies, and joined teams.",
+    icon: svglIcon("microsoft-teams"),
+    scopes: [
+      "Team.ReadBasic.All",
+      "Channel.ReadBasic.All",
+      "ChannelMessage.Read.All",
+      "ChannelMessage.Send"
+    ],
+    pathPrefixes: [
+      "/me/joinedTeams",
+      "/groups/{group-id}/team",
+      "/teams",
+      "/teamwork",
+      "/teamsTemplates"
+    ],
+    audience: "collaboration"
+  },
+  {
+    id: "meetings-calls",
+    name: "Meetings and Calls",
+    summary: "Online meetings, calls, call records, and communications APIs.",
+    icon: svglIcon("microsoft-teams"),
+    scopes: ["OnlineMeetings.ReadWrite"],
+    pathPrefixes: ["/communications", "/me/onlineMeetings", "/users/{user-id}/onlineMeetings"],
+    audience: "collaboration"
+  },
+  {
+    id: "users",
+    name: "Users",
+    summary: "User objects plus user-scoped Graph operations.",
+    icon: svglIcon("microsoft"),
+    scopes: ["User.ReadWrite.All", "Directory.Read.All"],
+    pathPrefixes: ["/users", "/users(userPrincipalName='{userPrincipalName}')"],
+    featured: true,
+    audience: "directory-identity"
+  },
+  {
+    id: "groups",
+    name: "Groups",
+    summary: "Groups, settings, lifecycle policies, and group-scoped operations.",
+    icon: svglIcon("microsoft"),
+    scopes: ["Group.ReadWrite.All", "Directory.Read.All"],
+    pathPrefixes: [
+      "/groups",
+      "/groups(uniqueName='{uniqueName}')",
+      "/groupSettings",
+      "/groupSettingTemplates",
+      "/groupLifecyclePolicies"
+    ],
+    audience: "directory-identity"
+  },
+  {
+    id: "directory",
+    name: "Directory",
+    summary: "Directory roles, objects, contacts, contracts, and invitations.",
+    icon: svglIcon("microsoft"),
+    scopes: ["Directory.Read.All"],
+    pathPrefixes: [
+      "/contacts",
+      "/contracts",
+      "/directory",
+      "/directoryObjects",
+      "/directoryRoles",
+      "/directoryRoles(roleTemplateId='{roleTemplateId}')",
+      "/directoryRoleTemplates",
+      "/invitations",
+      "/scopedRoleMemberships"
+    ],
+    audience: "directory-identity"
+  },
+  {
+    id: "applications",
+    name: "Applications",
+    summary: "Applications, service principals, app templates, catalogs, and grants.",
+    icon: svglIcon("microsoft"),
+    scopes: ["Application.ReadWrite.All", "AppRoleAssignment.ReadWrite.All"],
+    pathPrefixes: [
+      "/applications",
+      "/applications(appId='{appId}')",
+      "/applications(uniqueName='{uniqueName}')",
+      "/applicationTemplates",
+      "/appCatalogs",
+      "/oauth2PermissionGrants",
+      "/permissionGrants",
+      "/servicePrincipals",
+      "/servicePrincipals(appId='{appId}')"
+    ],
+    audience: "directory-identity"
+  },
+  {
+    id: "identity",
+    name: "Identity and Governance",
+    summary: "Identity, governance, policies, access reviews, roles, and providers.",
+    icon: svglIcon("microsoft"),
+    scopes: ["Policy.ReadWrite.ConditionalAccess", "RoleManagement.Read.Directory"],
+    pathPrefixes: [
+      "/agreementAcceptances",
+      "/agreements",
+      "/authenticationMethodConfigurations",
+      "/authenticationMethodsPolicy",
+      "/certificateBasedAuthConfiguration",
+      "/identity",
+      "/identityGovernance",
+      "/identityProviders",
+      "/identityProtection",
+      "/policies",
+      "/roleManagement"
+    ],
+    audience: "directory-identity"
+  },
+  {
+    id: "admin-reports",
+    name: "Admin and Reports",
+    summary: "Admin centers, audit logs, domains, reports, organization, and tenants.",
+    icon: svglIcon("microsoft"),
+    scopes: ["AuditLog.Read.All", "Reports.Read.All"],
+    pathPrefixes: [
+      "/admin",
+      "/auditLogs",
+      "/domains",
+      "/domainDnsRecords",
+      "/organization",
+      "/reports",
+      "/subscribedSkus",
+      "/tenantRelationships"
+    ],
+    audience: "admin-security"
+  },
+  {
+    id: "security-compliance",
+    name: "Security and Compliance",
+    summary: "Security, compliance, privacy, information protection, and data policy.",
+    icon: svglIcon("microsoft"),
+    scopes: ["SecurityEvents.Read.All"],
+    pathPrefixes: [
+      "/compliance",
+      "/dataPolicyOperations",
+      "/informationProtection",
+      "/privacy",
+      "/security"
+    ],
+    audience: "admin-security"
+  },
+  {
+    id: "devices",
+    name: "Devices and Intune",
+    summary: "Devices, device management, Intune apps, managed devices, and policies.",
+    icon: svglIcon("microsoft"),
+    scopes: ["DeviceManagementApps.ReadWrite.All", "DeviceManagementManagedDevices.ReadWrite.All"],
+    pathPrefixes: [
+      "/devices",
+      "/devices(deviceId='{deviceId}')",
+      "/deviceAppManagement",
+      "/deviceManagement"
+    ],
+    audience: "admin-security"
+  },
+  {
+    id: "education",
+    name: "Education",
+    summary: "Classes, schools, education users, assignments, and reports.",
+    icon: svglIcon("microsoft"),
+    scopes: [],
+    pathPrefixes: ["/education"],
+    audience: "admin-security"
+  },
+  {
+    id: "search",
+    name: "Microsoft Search",
+    summary: "Search across Microsoft Graph content connectors.",
+    icon: svglIcon("microsoft"),
+    scopes: ["ExternalItem.Read.All", "Acronym.Read.All", "Bookmark.Read.All", "QnA.Read.All"],
+    pathPrefixes: ["/search"],
+    audience: "platform-business"
+  },
+  {
+    id: "external-connections",
+    name: "External Connections",
+    summary: "External connections, schemas, items, and content connectors.",
+    icon: svglIcon("microsoft"),
+    scopes: ["ExternalConnection.ReadWrite.OwnedBy", "ExternalItem.ReadWrite.OwnedBy"],
+    pathPrefixes: ["/connections", "/external"],
+    audience: "platform-business"
+  },
+  {
+    id: "solutions",
+    name: "Solutions and Employee Experience",
+    summary: "Bookings, virtual events, backup, employee experience, and Copilot.",
+    icon: svglIcon("microsoft"),
+    scopes: [],
+    pathPrefixes: ["/copilot", "/employeeExperience", "/solutions"],
+    audience: "platform-business"
+  },
+  {
+    id: "platform-services",
+    name: "Platform Services",
+    summary: "Places, print, storage, subscriptions, functions, filters, and extensions.",
+    icon: svglIcon("microsoft"),
+    scopes: ["Place.Read.All", "Printer.ReadWrite.All"],
+    pathPrefixes: [
+      "/filterOperators",
+      "/functions",
+      "/places",
+      "/print",
+      "/schemaExtensions",
+      "/storage",
+      "/subscriptions"
+    ],
+    audience: "platform-business"
+  }
+];
+var MICROSOFT_GRAPH_DEFAULT_PRESET_IDS = [
+  "profile",
+  "mail",
+  "calendar",
+  "contacts",
+  "tasks",
+  "files",
+  "excel",
+  "sites",
+  "onenote",
+  "teams-chat",
+  "teams-channels",
+  "meetings-calls"
+];
+var MICROSOFT_GRAPH_ALL_PRESET_IDS = microsoftGraphScopePresets.map(
+  (preset) => preset.id
+);
+var orderedUnique = (values) => {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const value of values) {
+    const trimmed = value.trim();
+    if (!trimmed || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    result.push(trimmed);
+  }
+  return result;
+};
+var microsoftGraphPresetForId = (presetId) => microsoftGraphScopePresets.find((preset) => preset.id === presetId);
+var microsoftGraphPresetIdsCoverFullGraph = (presetIds) => {
+  const selected = /* @__PURE__ */ new Set([...presetIds]);
+  return microsoftGraphScopePresets.every((preset) => selected.has(preset.id));
+};
+var microsoftGraphScopesForPresetIds = (presetIds, customScopes = []) => orderedUnique([
+  ...MICROSOFT_GRAPH_BASE_SCOPES,
+  MICROSOFT_GRAPH_IDENTITY_SCOPE,
+  ...[...presetIds].flatMap((presetId) => microsoftGraphPresetForId(presetId)?.scopes ?? []),
+  ...customScopes
+]);
+var microsoftGraphExactPathsForPresetIds = (presetIds) => orderedUnique(
+  [...presetIds].flatMap((presetId) => microsoftGraphPresetForId(presetId)?.exactPaths ?? [])
+);
+var microsoftGraphPathPrefixesForPresetIds = (presetIds) => orderedUnique(
+  [...presetIds].flatMap((presetId) => microsoftGraphPresetForId(presetId)?.pathPrefixes ?? [])
+);
+var microsoftGraphTagPrefixesForPresetIds = (presetIds) => orderedUnique(
+  [...presetIds].flatMap((presetId) => microsoftGraphPresetForId(presetId)?.tagPrefixes ?? [])
+);
+var microsoftServiceSlug = (presetId) => `microsoft_${presetId.replaceAll("-", "_")}`;
+var microsoftGraphCatalogUrl = (presetId) => `${MICROSOFT_GRAPH_OPENAPI_URL}#preset=${encodeURIComponent(presetId)}`;
+var microsoftGraphCatalogAuthTemplate = (preset) => [
+  {
+    slug: MICROSOFT_AUTH_TEMPLATE_SLUG,
+    kind: "oauth2",
+    authorizationUrl: MICROSOFT_AUTHORIZATION_URL,
+    tokenUrl: MICROSOFT_TOKEN_URL,
+    scopes: microsoftGraphScopesForPresetIds([preset.id])
+  },
+  {
+    slug: MICROSOFT_CLIENT_CREDENTIALS_AUTH_TEMPLATE_SLUG,
+    kind: "oauth2",
+    authorizationUrl: MICROSOFT_AUTHORIZATION_URL,
+    tokenUrl: MICROSOFT_TOKEN_URL,
+    scopes: [...MICROSOFT_GRAPH_CLIENT_CREDENTIALS_SCOPES]
+  }
+];
+var microsoftCatalog = microsoftGraphScopePresets.map(
+  (preset) => ({
+    id: `microsoft-${preset.id}`,
+    name: preset.name,
+    summary: preset.summary,
+    url: microsoftGraphCatalogUrl(preset.id),
+    ...preset.icon ? { icon: preset.icon } : {},
+    ...preset.featured ? { featured: preset.featured } : {},
+    family: "microsoft",
+    specFormat: "microsoft-graph",
+    defaultSlug: microsoftServiceSlug(preset.id),
+    authTemplate: microsoftGraphCatalogAuthTemplate(preset),
+    ...preset.id === "profile" ? { healthCheck: { operation: "me.GetUser" } } : {}
+  })
+);
+
+// src/providers/microsoft/graph.ts
+import { Effect, Option, Schema } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/unstable/http";
+import { AuthTemplateSlug } from "@rafads/sdk/core";
+var MicrosoftGraphIntegrationConfigSchema = Schema.Struct({
+  specHash: Schema.optional(Schema.String),
+  specUrl: Schema.optional(Schema.String),
+  baseUrl: Schema.optional(Schema.String),
+  headers: Schema.optional(Schema.Record(Schema.String, Schema.String)),
+  queryParams: Schema.optional(Schema.Record(Schema.String, Schema.String)),
+  authenticationTemplate: Schema.optional(Schema.Array(AuthenticationSchema)),
+  microsoftGraphPresetIds: Schema.optional(Schema.Array(Schema.String)),
+  microsoftGraphCustomScopes: Schema.optional(Schema.Array(Schema.String)),
+  microsoftGraphScopes: Schema.optional(Schema.Array(Schema.String)),
+  microsoftGraphExactPaths: Schema.optional(Schema.Array(Schema.String)),
+  microsoftGraphPathPrefixes: Schema.optional(Schema.Array(Schema.String)),
+  microsoftGraphTagPrefixes: Schema.optional(Schema.Array(Schema.String)),
+  microsoftGraphCoversFullGraph: Schema.optional(Schema.Boolean),
+  microsoftGraphAuthorizationUrl: Schema.optional(Schema.String),
+  microsoftGraphTokenUrl: Schema.optional(Schema.String),
+  microsoftGraphClientCredentialsTokenUrl: Schema.optional(Schema.String)
+});
+var decodeMicrosoftConfig = Schema.decodeUnknownOption(MicrosoftGraphIntegrationConfigSchema);
+var decodeMicrosoftGraphIntegrationConfig = (value) => Option.getOrNull(decodeMicrosoftConfig(value));
+var uniqueStrings = (values) => {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const value of values) {
+    const trimmed = value.trim();
+    if (!trimmed || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    result.push(trimmed);
+  }
+  return result;
+};
+var normalizeSelection = (input) => {
+  const presetIds = uniqueStrings(
+    input.presetIds && input.presetIds.length > 0 ? input.presetIds : MICROSOFT_GRAPH_DEFAULT_PRESET_IDS
+  );
+  const customScopes = uniqueStrings(input.customScopes ?? []);
+  const scopes = microsoftGraphScopesForPresetIds(presetIds, customScopes);
+  const exactPaths = microsoftGraphExactPathsForPresetIds(presetIds);
+  const pathPrefixes = microsoftGraphPathPrefixesForPresetIds(presetIds);
+  const tagPrefixes = microsoftGraphTagPrefixesForPresetIds(presetIds);
+  const coversFullGraph = microsoftGraphPresetIdsCoverFullGraph(presetIds);
+  const specUrl = input.specUrl?.trim() || MICROSOFT_GRAPH_OPENAPI_URL;
+  const baseUrl = input.baseUrl?.trim() || void 0;
+  const authorizationUrl = input.authorizationUrl?.trim() || void 0;
+  const tokenUrl = input.tokenUrl?.trim() || void 0;
+  const clientCredentialsTokenUrl = input.clientCredentialsTokenUrl?.trim() || void 0;
+  return {
+    presetIds,
+    customScopes,
+    scopes,
+    exactPaths,
+    pathPrefixes,
+    tagPrefixes,
+    coversFullGraph,
+    specUrl,
+    baseUrl,
+    authorizationUrl,
+    tokenUrl,
+    clientCredentialsTokenUrl
+  };
+};
+var microsoftOAuthTemplate = (scopes, endpoints) => [
+  {
+    slug: AuthTemplateSlug.make(MICROSOFT_AUTH_TEMPLATE_SLUG),
+    kind: "oauth2",
+    authorizationUrl: endpoints.authorizationUrl,
+    tokenUrl: endpoints.tokenUrl,
+    scopes
+  },
+  {
+    slug: AuthTemplateSlug.make(MICROSOFT_CLIENT_CREDENTIALS_AUTH_TEMPLATE_SLUG),
+    kind: "oauth2",
+    authorizationUrl: endpoints.authorizationUrl,
+    tokenUrl: endpoints.clientCredentialsTokenUrl,
+    scopes: [...MICROSOFT_GRAPH_CLIENT_CREDENTIALS_SCOPES]
+  }
+];
+var isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var HTTP_METHODS = /* @__PURE__ */ new Set(["delete", "get", "patch", "post", "put"]);
+var REQUEST_BASE_SCOPES = /* @__PURE__ */ new Set(["offline_access", "openid", "profile", "email"]);
+var PATH_SCOPE_IGNORED_SCOPES = /* @__PURE__ */ new Set([
+  "offline_access",
+  "openid",
+  "profile",
+  "email",
+  MICROSOFT_GRAPH_IDENTITY_SCOPE
+]);
+var firstString = (values) => values.find((value) => typeof value === "string" && value.trim().length > 0);
+var parseTrustedHttpsUrl = (value) => {
+  if (!URL.canParse(value)) return null;
+  const parsed = new URL(value);
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash) {
+    return null;
+  }
+  return parsed;
+};
+var isLoopbackHostname = (hostname) => {
+  const lower = hostname.toLowerCase();
+  return lower === "localhost" || lower === "127.0.0.1" || lower === "::1" || lower === "[::1]";
+};
+var parseTrustedLoopbackHttpUrl = (value) => {
+  if (!URL.canParse(value)) return null;
+  const parsed = new URL(value);
+  if (parsed.protocol !== "http:" || parsed.username || parsed.password || parsed.hash) {
+    return null;
+  }
+  return isLoopbackHostname(parsed.hostname) ? parsed : null;
+};
+var allowUnsafeUrl = (value, policy) => {
+  if (!value) return void 0;
+  if (policy?.allowUnsafeUrlOverrides !== true) return null;
+  return parseTrustedHttpsUrl(value) || parseTrustedLoopbackHttpUrl(value) ? value : null;
+};
+var normalizeMicrosoftGraphSpecUrl = (value, policy) => {
+  if (value === MICROSOFT_GRAPH_OPENAPI_URL) return value;
+  return allowUnsafeUrl(value, policy) ?? null;
+};
+var MICROSOFT_GRAPH_HOSTS = /* @__PURE__ */ new Set([
+  "graph.microsoft.com",
+  "graph.microsoft.us",
+  "dod-graph.microsoft.us",
+  "microsoftgraph.chinacloudapi.cn"
+]);
+var normalizeMicrosoftGraphBaseUrl = (value, policy) => {
+  const unsafe = allowUnsafeUrl(value, policy);
+  if (unsafe !== null) return unsafe;
+  if (!value) return void 0;
+  const parsed = parseTrustedHttpsUrl(value);
+  if (!parsed || !MICROSOFT_GRAPH_HOSTS.has(parsed.hostname.toLowerCase())) return null;
+  if (!/^\/(?:v1\.0|beta)(?:\/)?$/.test(parsed.pathname)) return null;
+  if (parsed.search) return null;
+  return parsed.toString().replace(/\/$/, "");
+};
+var MICROSOFT_IDENTITY_HOSTS = /* @__PURE__ */ new Set([
+  "login.microsoftonline.com",
+  "login.microsoftonline.us",
+  "login.partner.microsoftonline.cn"
+]);
+var normalizeMicrosoftOAuthEndpointUrl = (value, endpoint, policy) => {
+  const unsafe = allowUnsafeUrl(value, policy);
+  if (unsafe !== null) return unsafe ?? null;
+  const parsed = parseTrustedHttpsUrl(value);
+  if (!parsed || !MICROSOFT_IDENTITY_HOSTS.has(parsed.hostname.toLowerCase())) return null;
+  if (parsed.search) return null;
+  const suffix = endpoint === "authorize" ? "authorize" : "token";
+  return /^\/[^/]+\/oauth2\/v2\.0\/(?:authorize|token)$/.test(parsed.pathname) && parsed.pathname.endsWith(`/${suffix}`) ? parsed.toString() : null;
+};
+var validateSelectionUrls = (selection, policy) => Effect.gen(function* () {
+  const specUrl = normalizeMicrosoftGraphSpecUrl(selection.specUrl, policy);
+  if (!specUrl) {
+    return yield* new OpenApiParseError({
+      message: "Microsoft Graph specUrl must point to the trusted Microsoft Graph OpenAPI spec"
+    });
+  }
+  const baseUrl = normalizeMicrosoftGraphBaseUrl(selection.baseUrl, policy);
+  if (baseUrl === null) {
+    return yield* new OpenApiParseError({
+      message: "Microsoft Graph baseUrl must point to a supported Microsoft Graph endpoint"
+    });
+  }
+  const authorizationUrl = selection.authorizationUrl ? normalizeMicrosoftOAuthEndpointUrl(selection.authorizationUrl, "authorize", policy) : void 0;
+  if (selection.authorizationUrl && !authorizationUrl) {
+    return yield* new OpenApiParseError({
+      message: "Microsoft authorizationUrl must point to a supported Microsoft identity endpoint"
+    });
+  }
+  const tokenUrl = selection.tokenUrl ? normalizeMicrosoftOAuthEndpointUrl(selection.tokenUrl, "token", policy) : void 0;
+  if (selection.tokenUrl && !tokenUrl) {
+    return yield* new OpenApiParseError({
+      message: "Microsoft tokenUrl must point to a supported Microsoft identity endpoint"
+    });
+  }
+  const clientCredentialsTokenUrl = selection.clientCredentialsTokenUrl ? normalizeMicrosoftOAuthEndpointUrl(selection.clientCredentialsTokenUrl, "token", policy) : void 0;
+  if (selection.clientCredentialsTokenUrl && !clientCredentialsTokenUrl) {
+    return yield* new OpenApiParseError({
+      message: "Microsoft clientCredentialsTokenUrl must point to a supported Microsoft identity endpoint"
+    });
+  }
+  return {
+    ...selection,
+    specUrl,
+    ...baseUrl ? { baseUrl } : { baseUrl: void 0 },
+    ...authorizationUrl ? { authorizationUrl } : { authorizationUrl: void 0 },
+    ...tokenUrl ? { tokenUrl } : { tokenUrl: void 0 },
+    ...clientCredentialsTokenUrl ? { clientCredentialsTokenUrl } : { clientCredentialsTokenUrl: void 0 }
+  };
+});
+var validateResolvedOAuthEndpoints = (endpoints, policy) => Effect.gen(function* () {
+  const authorizationUrl = normalizeMicrosoftOAuthEndpointUrl(
+    endpoints.authorizationUrl,
+    "authorize",
+    policy
+  );
+  const tokenUrl = normalizeMicrosoftOAuthEndpointUrl(endpoints.tokenUrl, "token", policy);
+  const clientCredentialsTokenUrl = normalizeMicrosoftOAuthEndpointUrl(
+    endpoints.clientCredentialsTokenUrl,
+    "token",
+    policy
+  );
+  if (!authorizationUrl || !tokenUrl || !clientCredentialsTokenUrl) {
+    return yield* new OpenApiParseError({
+      message: "Microsoft OAuth endpoints must point to supported Microsoft identity endpoints"
+    });
+  }
+  return { authorizationUrl, tokenUrl, clientCredentialsTokenUrl };
+});
+var recordValues = (value) => isRecord(value) ? Object.values(value) : [];
+var firstOAuthFlows = (parsed) => {
+  const components = isRecord(parsed.components) ? parsed.components : {};
+  const securitySchemes = isRecord(components.securitySchemes) ? components.securitySchemes : {};
+  return recordValues(securitySchemes).filter(isRecord).filter((scheme) => scheme.type === "oauth2").flatMap((scheme) => recordValues(scheme.flows).filter(isRecord));
+};
+var resolveOAuthEndpoints = (parsed, overrides) => {
+  const flows = firstOAuthFlows(parsed);
+  const authorizationCode = flows.find((flow) => flow.authorizationUrl !== void 0);
+  const clientCredentials = flows.find(
+    (flow) => flow.tokenUrl !== void 0 && flow.authorizationUrl === void 0
+  );
+  const authorizationUrl = overrides.authorizationUrl ?? (isRecord(authorizationCode) ? firstString([authorizationCode.authorizationUrl]) : void 0) ?? MICROSOFT_AUTHORIZATION_URL;
+  const tokenUrl = overrides.tokenUrl ?? (isRecord(authorizationCode) ? firstString([authorizationCode.tokenUrl]) : void 0) ?? firstString(flows.map((flow) => flow.tokenUrl)) ?? MICROSOFT_TOKEN_URL;
+  const clientCredentialsTokenUrl = overrides.clientCredentialsTokenUrl ?? (isRecord(clientCredentials) ? firstString([clientCredentials.tokenUrl]) : void 0) ?? tokenUrl;
+  return { authorizationUrl, tokenUrl, clientCredentialsTokenUrl };
+};
+var graphPathMatchVariants = (path) => {
+  const withoutVersion = path.replace(/^\/(?:v1\.0|beta)(?=\/)/, "");
+  return withoutVersion === path ? [path, `/v1.0${path}`] : [path, withoutVersion];
+};
+var matchesGraphPath = (path, exactPaths, pathPrefixes) => {
+  const variants = graphPathMatchVariants(path);
+  if (variants.some((variant) => exactPaths.has(variant))) return true;
+  return variants.some(
+    (variant) => pathPrefixes.some(
+      (prefix) => variant === prefix || variant.startsWith(`${prefix}/`) || variant.startsWith(`${prefix}(`)
+    )
+  );
+};
+var isIdentityHealthPath = (path) => graphPathMatchVariants(path).some((variant) => variant === "/me");
+var operationTags = (operation) => Array.isArray(operation.tags) ? operation.tags.filter((tag) => typeof tag === "string") : [];
+var operationMatchesTagPrefix = (operation, tagPrefixes) => tagPrefixes.length > 0 && operationTags(operation).some(
+  (tag) => tagPrefixes.some((prefix) => tag === prefix || tag.startsWith(prefix))
+);
+var isGraphPermissionScope = (value) => value.startsWith("https://graph.microsoft.com/") || /^[A-Z][A-Za-z0-9]*(?:\.[A-Za-z0-9]+)+(?:\.All)?$/.test(value);
+var parseMicrosoftGraphDelegatedScopes = (permissionsReference) => uniqueStrings(
+  permissionsReference.split(/\n(?=###\s+)/).flatMap((section) => {
+    const scope = section.match(/^###\s+([^\n]+)$/m)?.[1]?.trim();
+    if (!scope || !isGraphPermissionScope(scope)) return [];
+    const identifierRow = section.match(/^\|\s*Identifier\s*\|\s*([^|]*)\|\s*([^|]*)\|/m);
+    const delegatedIdentifier = identifierRow?.[2]?.trim();
+    return delegatedIdentifier && delegatedIdentifier !== "-" ? [scope] : [];
+  })
+);
+var collectScopeStrings = (value) => {
+  if (typeof value === "string") return isGraphPermissionScope(value) ? [value] : [];
+  if (Array.isArray(value)) return value.flatMap(collectScopeStrings);
+  if (!isRecord(value)) return [];
+  return Object.values(value).flatMap(collectScopeStrings);
+};
+var securityScopes = (value, options) => {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    if (!isRecord(entry)) return [];
+    return Object.entries(entry).flatMap(([scheme, scopes]) => {
+      const lowerScheme = scheme.toLowerCase();
+      if (options?.delegatedOnly && lowerScheme.includes("app")) return [];
+      if (options?.delegatedOnly && lowerScheme.includes("application")) return [];
+      return Array.isArray(scopes) ? scopes.filter((scope) => typeof scope === "string") : [];
+    });
+  });
+};
+var permissionScopes = (operation, options) => {
+  const xMsPermissions = isRecord(operation["x-ms-permissions"]) ? operation["x-ms-permissions"] : {};
+  const delegatedScopes = options?.delegatedOnly ? collectScopeStrings({
+    delegated: xMsPermissions.delegated,
+    leastPrivilegedDelegated: xMsPermissions.leastPrivilegedDelegated
+  }) : collectScopeStrings(xMsPermissions);
+  return uniqueStrings([...securityScopes(operation.security, options), ...delegatedScopes]);
+};
+var operationMatchesScope = (operation, selectedScopes) => permissionScopes(operation).some(
+  (scope) => selectedScopes.has(scope) && !PATH_SCOPE_IGNORED_SCOPES.has(scope)
+);
+var filterPathItem = (path, pathItem, options) => {
+  const pathMatchesSelection = matchesGraphPath(path, options.exactPaths, options.pathPrefixes);
+  const identityHealthGetOnly = !pathMatchesSelection && isIdentityHealthPath(path);
+  const kept = {};
+  let hasOperation = false;
+  for (const [key, value] of Object.entries(pathItem)) {
+    const lowerKey = key.toLowerCase();
+    if (!HTTP_METHODS.has(lowerKey)) continue;
+    if (!isRecord(value)) continue;
+    if (identityHealthGetOnly && lowerKey !== "get") continue;
+    if (pathMatchesSelection || identityHealthGetOnly || operationMatchesTagPrefix(value, options.tagPrefixes) || operationMatchesScope(value, options.selectedScopes)) {
+      kept[key] = value;
+      hasOperation = true;
+    }
+  }
+  if (!hasOperation) return null;
+  for (const [key, value] of Object.entries(pathItem)) {
+    if (!HTTP_METHODS.has(key.toLowerCase())) kept[key] = value;
+  }
+  return kept;
+};
+var normalizedMediaType = (mediaType) => mediaType.split(";")[0]?.trim().toLowerCase() ?? "";
+var isBinaryStringSchema = (schema) => isRecord(schema) && (schema.type === "string" || Array.isArray(schema.type) && schema.type.includes("string")) && (schema.format === "binary" || schema.format === "byte");
+var isSuccessStatusKey = (status) => /^2\d\d$/.test(status) || /^2xx$/i.test(status);
+var normalizeMicrosoftGraphContentPathItem = (pathItem) => {
+  let changed = false;
+  const next = { ...pathItem };
+  for (const [key, operation] of Object.entries(pathItem)) {
+    if (!HTTP_METHODS.has(key.toLowerCase()) || !isRecord(operation)) continue;
+    const responses = isRecord(operation.responses) ? operation.responses : void 0;
+    if (!responses) continue;
+    let responsesChanged = false;
+    const nextResponses = { ...responses };
+    for (const [status, response] of Object.entries(responses)) {
+      if (!isSuccessStatusKey(status) || !isRecord(response)) continue;
+      const content = isRecord(response.content) ? response.content : void 0;
+      if (!content) continue;
+      let contentChanged = false;
+      const nextContent = { ...content };
+      for (const [mediaType, media] of Object.entries(content)) {
+        if (normalizedMediaType(mediaType) !== "application/octet-stream") continue;
+        const schema = isRecord(media) ? media.schema : void 0;
+        if (isBinaryStringSchema(schema)) continue;
+        nextContent[mediaType] = {
+          ...isRecord(media) ? media : {},
+          schema: { type: "string", format: "binary" }
+        };
+        contentChanged = true;
+      }
+      if (contentChanged) {
+        nextResponses[status] = { ...response, content: nextContent };
+        responsesChanged = true;
+      }
+    }
+    if (responsesChanged) {
+      next[key] = { ...operation, responses: nextResponses };
+      changed = true;
+    }
+  }
+  return changed ? next : pathItem;
+};
+var fetchMicrosoftGraphOpenApiSpec = Effect.fn("Microsoft.fetchGraphOpenApiSpec")(
+  function* (specUrl) {
+    const client = yield* HttpClient.HttpClient;
+    const response = yield* client.execute(
+      HttpClientRequest.get(specUrl).pipe(
+        HttpClientRequest.setHeader("Accept", "application/yaml, text/yaml, */*")
+      )
+    ).pipe(
+      Effect.mapError(
+        () => new OpenApiParseError({
+          message: "Failed to fetch Microsoft Graph OpenAPI document"
+        })
+      )
+    );
+    if (response.status < 200 || response.status >= 300) {
+      return yield* new OpenApiParseError({
+        message: `Failed to fetch Microsoft Graph OpenAPI document: HTTP ${response.status}`
+      });
+    }
+    return yield* response.text.pipe(
+      Effect.mapError(
+        () => new OpenApiParseError({
+          message: "Failed to read Microsoft Graph OpenAPI document body"
+        })
+      )
+    );
+  }
+);
+var fetchMicrosoftGraphPermissionsReference = Effect.fn(
+  "Microsoft.fetchGraphPermissionsReference"
+)(function* () {
+  const client = yield* HttpClient.HttpClient;
+  const response = yield* client.execute(
+    HttpClientRequest.get(MICROSOFT_GRAPH_PERMISSIONS_REFERENCE_URL).pipe(
+      HttpClientRequest.setHeader("Accept", "text/markdown, text/plain, */*")
+    )
+  ).pipe(
+    Effect.mapError(
+      () => new OpenApiParseError({
+        message: "Failed to fetch Microsoft Graph permissions reference"
+      })
+    )
+  );
+  if (response.status < 200 || response.status >= 300) {
+    return yield* new OpenApiParseError({
+      message: `Failed to fetch Microsoft Graph permissions reference: HTTP ${response.status}`
+    });
+  }
+  return yield* response.text.pipe(
+    Effect.mapError(
+      () => new OpenApiParseError({
+        message: "Failed to read Microsoft Graph permissions reference body"
+      })
+    )
+  );
+});
+var microsoftGraphKeepPathItem = (selection) => {
+  const exactPaths = new Set(selection.exactPaths);
+  const selectedScopes = new Set(
+    microsoftGraphScopesForPresetIds(selection.presetIds, selection.customScopes)
+  );
+  return (path, pathItem) => {
+    const kept = selection.coversFullGraph ? pathItem : filterPathItem(path, pathItem, {
+      exactPaths,
+      pathPrefixes: selection.pathPrefixes,
+      tagPrefixes: selection.tagPrefixes,
+      selectedScopes
+    });
+    return kept ? normalizeMicrosoftGraphContentPathItem(kept) : null;
+  };
+};
+var streamSelectedScopes = (structure, requestedScopes, fullGraphScopes, keepPathItem) => {
+  const collected = [
+    ...MICROSOFT_GRAPH_BASE_SCOPES,
+    ...fullGraphScopes,
+    ...requestedScopes.filter((scope) => !REQUEST_BASE_SCOPES.has(scope))
+  ];
+  for (const range of structure.pathItems) {
+    const entry = parseEntry(structure.text, range, 2);
+    if (!entry) continue;
+    const [path, rawItem] = entry;
+    if (!isRecord(rawItem)) continue;
+    const pathItem = keepPathItem ? keepPathItem(path, rawItem) : rawItem;
+    if (!pathItem) continue;
+    for (const [method, operation] of Object.entries(pathItem)) {
+      if (HTTP_METHODS.has(method.toLowerCase()) && isRecord(operation)) {
+        collected.push(...permissionScopes(operation, { delegatedOnly: true }));
+      }
+    }
+  }
+  return uniqueStrings(collected);
+};
+var buildMicrosoftGraphOpenApiSpec = (input, httpClientLayer, urlPolicy) => Effect.gen(function* () {
+  const selection = yield* validateSelectionUrls(normalizeSelection(input), urlPolicy);
+  const sourceText = yield* fetchMicrosoftGraphOpenApiSpec(selection.specUrl).pipe(
+    Effect.provide(httpClientLayer)
+  );
+  const structure = structuralSplit(sourceText);
+  if (!structure) {
+    return yield* new OpenApiParseError({
+      message: "Microsoft Graph OpenAPI document is not in the streamable block-YAML profile; cannot compile it in-band on Workers."
+    });
+  }
+  const headDoc = { ...parseHead(structure), components: parseSmallComponents(structure) };
+  const endpoints = yield* validateResolvedOAuthEndpoints(
+    resolveOAuthEndpoints(headDoc, selection),
+    urlPolicy
+  );
+  const permissionsReference = selection.coversFullGraph === true ? yield* fetchMicrosoftGraphPermissionsReference().pipe(Effect.provide(httpClientLayer)) : void 0;
+  const fullGraphScopes = permissionsReference ? parseMicrosoftGraphDelegatedScopes(permissionsReference) : [];
+  const keepPathItem = microsoftGraphKeepPathItem(selection);
+  const scopes = selection.coversFullGraph === true && selection.customScopes.length === 0 ? [...MICROSOFT_GRAPH_DELEGATED_DEFAULT_SCOPES] : streamSelectedScopes(
+    structure,
+    selection.coversFullGraph === true ? uniqueStrings([...MICROSOFT_GRAPH_BASE_SCOPES, ...selection.customScopes]) : selection.scopes,
+    fullGraphScopes,
+    keepPathItem
+  );
+  return {
+    ...selection,
+    specText: sourceText,
+    scopes,
+    authorizationUrl: endpoints.authorizationUrl,
+    tokenUrl: endpoints.tokenUrl,
+    clientCredentialsTokenUrl: endpoints.clientCredentialsTokenUrl,
+    authenticationTemplate: microsoftOAuthTemplate(scopes, endpoints)
+  };
+});
+
+// src/providers/microsoft/spec-format-adapter.ts
+import { Effect as Effect2 } from "effect";
+var graphCatalogSelection = (rawUrl) => {
+  if (!rawUrl || !URL.canParse(rawUrl)) return rawUrl ? { specUrl: rawUrl } : {};
+  const parsed = new URL(rawUrl);
+  const preset = parsed.hash.startsWith("#preset=") ? decodeURIComponent(parsed.hash.slice("#preset=".length)) : "";
+  parsed.hash = "";
+  return {
+    specUrl: parsed.toString(),
+    ...preset.length > 0 ? { presetIds: [preset] } : {}
+  };
+};
+var microsoftGraphAdapter = {
+  id: "microsoft-graph",
+  fetch: (input) => buildMicrosoftGraphOpenApiSpec(
+    graphCatalogSelection(input.urls[0]),
+    input.httpClientLayer
+  ).pipe(
+    Effect2.map((graphSpec) => ({
+      specText: graphSpec.specText,
+      specUrl: graphSpec.specUrl,
+      baseUrl: graphSpec.baseUrl,
+      authenticationTemplate: graphSpec.authenticationTemplate,
+      // Stream the full Graph source straight to persisted bindings. This is
+      // the measured Workers contention/OOM path from the Microsoft plugin:
+      // structural split stays serial and avoids materializing the 37MB tree.
+      keepPathItem: microsoftGraphKeepPathItem(graphSpec),
+      config: {
+        microsoftGraphPresetIds: graphSpec.presetIds,
+        microsoftGraphCustomScopes: graphSpec.customScopes,
+        microsoftGraphScopes: graphSpec.scopes,
+        microsoftGraphExactPaths: graphSpec.exactPaths,
+        microsoftGraphPathPrefixes: graphSpec.pathPrefixes,
+        microsoftGraphTagPrefixes: graphSpec.tagPrefixes,
+        microsoftGraphCoversFullGraph: graphSpec.coversFullGraph,
+        microsoftGraphAuthorizationUrl: graphSpec.authorizationUrl,
+        microsoftGraphTokenUrl: graphSpec.tokenUrl,
+        microsoftGraphClientCredentialsTokenUrl: graphSpec.clientCredentialsTokenUrl
+      }
+    }))
+  )
+};
+export {
+  MICROSOFT_AUTHORIZATION_URL,
+  MICROSOFT_AUTH_TEMPLATE_SLUG,
+  MICROSOFT_CLIENT_CREDENTIALS_AUTH_TEMPLATE_SLUG,
+  MICROSOFT_GRAPH_ALL_PRESET_IDS,
+  MICROSOFT_GRAPH_BASE_SCOPES,
+  MICROSOFT_GRAPH_BASE_URL,
+  MICROSOFT_GRAPH_CLIENT_CREDENTIALS_SCOPES,
+  MICROSOFT_GRAPH_DEFAULT_PRESET_IDS,
+  MICROSOFT_GRAPH_DEFAULT_SCOPE,
+  MICROSOFT_GRAPH_DELEGATED_DEFAULT_SCOPES,
+  MICROSOFT_GRAPH_OPENAPI_URL,
+  MICROSOFT_GRAPH_PERMISSIONS_REFERENCE_URL,
+  MICROSOFT_GRAPH_PRESET_ID,
+  MICROSOFT_TOKEN_URL,
+  buildMicrosoftGraphOpenApiSpec,
+  decodeMicrosoftGraphIntegrationConfig,
+  fetchMicrosoftGraphOpenApiSpec,
+  fetchMicrosoftGraphPermissionsReference,
+  microsoftCatalog,
+  microsoftGraphAdapter,
+  microsoftGraphExactPathsForPresetIds,
+  microsoftGraphKeepPathItem,
+  microsoftGraphPathPrefixesForPresetIds,
+  microsoftGraphPreset,
+  microsoftGraphPresetForId,
+  microsoftGraphPresetIdsCoverFullGraph,
+  microsoftGraphScopePresets,
+  microsoftGraphScopesForPresetIds,
+  microsoftGraphTagPrefixesForPresetIds,
+  microsoftServiceSlug,
+  parseMicrosoftGraphDelegatedScopes
+};
+//# sourceMappingURL=microsoft.js.map