@rafads/plugin-openapi 1.5.38

package/dist/providers/microsoft.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/providers/microsoft/presets.ts","../../src/providers/microsoft/graph.ts","../../src/providers/microsoft/spec-format-adapter.ts"],"sourcesContent":["import type { IntegrationPreset } from \"@rafads/sdk/core\";\n\nexport interface MicrosoftGraphPreset {\n  readonly id: string;\n  readonly name: string;\n  readonly summary: string;\n  readonly icon?: string;\n  readonly featured?: boolean;\n}\n\nexport type MicrosoftGraphScopeAudience =\n  | \"productivity\"\n  | \"files-content\"\n  | \"collaboration\"\n  | \"directory-identity\"\n  | \"admin-security\"\n  | \"platform-business\";\n\nexport interface MicrosoftGraphScopePreset {\n  readonly id: string;\n  readonly name: string;\n  readonly summary: string;\n  readonly icon?: string;\n  readonly scopes: readonly string[];\n  readonly exactPaths?: readonly string[];\n  readonly pathPrefixes?: readonly string[];\n  readonly tagPrefixes?: readonly string[];\n  readonly featured?: boolean;\n  readonly audience: MicrosoftGraphScopeAudience;\n}\n\nconst svglIcon = (name: string) => `https://svgl.app/library/${name}.svg`;\n\nexport const MICROSOFT_GRAPH_OPENAPI_URL =\n  \"https://raw.githubusercontent.com/microsoftgraph/msgraph-metadata/master/openapi/v1.0/openapi.yaml\";\nexport const MICROSOFT_GRAPH_PERMISSIONS_REFERENCE_URL =\n  \"https://raw.githubusercontent.com/microsoftgraph/microsoft-graph-docs-contrib/main/concepts/permissions-reference.md\";\nexport const MICROSOFT_GRAPH_BASE_URL = \"https://graph.microsoft.com/v1.0\";\nexport const MICROSOFT_AUTHORIZATION_URL =\n  \"https://login.microsoftonline.com/common/oauth2/v2.0/authorize\";\nexport const MICROSOFT_TOKEN_URL = \"https://login.microsoftonline.com/common/oauth2/v2.0/token\";\nexport const MICROSOFT_AUTH_TEMPLATE_SLUG = \"azureAdDelegated\";\nexport const MICROSOFT_CLIENT_CREDENTIALS_AUTH_TEMPLATE_SLUG = \"azureAdClientCredentials\";\nexport const MICROSOFT_GRAPH_BASE_SCOPES: readonly string[] = [\"offline_access\"];\nexport const MICROSOFT_GRAPH_IDENTITY_SCOPE = \"User.Read\";\nexport const MICROSOFT_GRAPH_DEFAULT_SCOPE = \"https://graph.microsoft.com/.default\";\nexport const MICROSOFT_GRAPH_DELEGATED_DEFAULT_SCOPES: readonly string[] = [\n  ...MICROSOFT_GRAPH_BASE_SCOPES,\n  MICROSOFT_GRAPH_IDENTITY_SCOPE,\n  MICROSOFT_GRAPH_DEFAULT_SCOPE,\n];\nexport const MICROSOFT_GRAPH_CLIENT_CREDENTIALS_SCOPES: readonly string[] = [\n  MICROSOFT_GRAPH_DEFAULT_SCOPE,\n];\n\nexport const MICROSOFT_GRAPH_PRESET_ID = \"microsoft\";\n\nexport const microsoftGraphPreset: MicrosoftGraphPreset = {\n  id: MICROSOFT_GRAPH_PRESET_ID,\n  name: \"Microsoft Graph\",\n  summary: \"Bundle Microsoft 365 workloads into one Graph integration and one OAuth consent.\",\n  featured: true,\n};\n\nexport const microsoftGraphScopePresets: readonly MicrosoftGraphScopePreset[] = [\n  {\n    id: \"profile\",\n    name: \"Profile\",\n    summary: \"Signed-in user profile and photo.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"User.Read\"],\n    exactPaths: [\"/me\", \"/me/photo\", \"/me/photo/$value\"],\n    featured: true,\n    audience: \"productivity\",\n  },\n  {\n    id: \"me-surface\",\n    name: \"My Graph Operations\",\n    summary: \"All operation groups rooted under /me.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"User.Read\"],\n    pathPrefixes: [\"/me\"],\n    audience: \"productivity\",\n  },\n  {\n    id: \"mail\",\n    name: \"Outlook Mail\",\n    summary: \"Messages, folders, attachments, settings, and send mail.\",\n    icon: svglIcon(\"microsoft-outlook\"),\n    scopes: [\"Mail.ReadWrite\", \"Mail.Send\", \"MailboxSettings.ReadWrite\"],\n    pathPrefixes: [\n      \"/me/messages\",\n      \"/me/mailFolders\",\n      \"/me/sendMail\",\n      \"/me/getMailTips\",\n      \"/me/inferenceClassification\",\n      \"/me/mailboxSettings\",\n      \"/me/outlook\",\n      \"/users/{user-id}/messages\",\n      \"/users/{user-id}/mailFolders\",\n      \"/users/{user-id}/sendMail\",\n      \"/users/{user-id}/outlook\",\n    ],\n    featured: true,\n    audience: \"productivity\",\n  },\n  {\n    id: \"calendar\",\n    name: \"Outlook Calendar\",\n    summary: \"Calendars, events, and scheduling.\",\n    icon: svglIcon(\"microsoft-outlook\"),\n    scopes: [\"Calendars.ReadWrite\"],\n    pathPrefixes: [\n      \"/me/calendar\",\n      \"/me/calendars\",\n      \"/me/calendarGroups\",\n      \"/me/calendarView\",\n      \"/me/events\",\n      \"/me/findMeetingTimes\",\n      \"/me/reminderView\",\n      \"/users/{user-id}/calendar\",\n      \"/users/{user-id}/calendars\",\n      \"/users/{user-id}/calendarGroups\",\n      \"/users/{user-id}/calendarView\",\n      \"/users/{user-id}/events\",\n      \"/users/{user-id}/findMeetingTimes\",\n      \"/users/{user-id}/reminderView\",\n    ],\n    featured: true,\n    audience: \"productivity\",\n  },\n  {\n    id: \"contacts\",\n    name: \"Outlook Contacts\",\n    summary: \"Contacts, contact folders, and people suggestions.\",\n    icon: svglIcon(\"microsoft-outlook\"),\n    scopes: [\"Contacts.ReadWrite\", \"People.Read.All\"],\n    pathPrefixes: [\n      \"/me/contacts\",\n      \"/me/contactFolders\",\n      \"/me/people\",\n      \"/users/{user-id}/contacts\",\n      \"/users/{user-id}/contactFolders\",\n      \"/users/{user-id}/people\",\n    ],\n    audience: \"productivity\",\n  },\n  {\n    id: \"tasks\",\n    name: \"To Do Tasks\",\n    summary: \"Task lists, tasks, and checklist items.\",\n    icon: svglIcon(\"microsoft-todo\"),\n    scopes: [\"Tasks.ReadWrite\"],\n    pathPrefixes: [\"/me/todo\", \"/users/{user-id}/todo\"],\n    audience: \"productivity\",\n  },\n  {\n    id: \"planner\",\n    name: \"Planner\",\n    summary: \"Plans, buckets, tasks, assignments, and Planner user data.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"Tasks.ReadWrite\"],\n    pathPrefixes: [\n      \"/planner\",\n      \"/me/planner\",\n      \"/users/{user-id}/planner\",\n      \"/groups/{group-id}/planner\",\n    ],\n    audience: \"productivity\",\n  },\n  {\n    id: \"files\",\n    name: \"OneDrive Files\",\n    summary: \"Drives, files, folders, sharing links, and permissions.\",\n    icon: svglIcon(\"microsoft-onedrive\"),\n    scopes: [\"Files.ReadWrite.All\", \"Sites.ReadWrite.All\"],\n    pathPrefixes: [\n      \"/me/drive\",\n      \"/me/drives\",\n      \"/me/followedSites\",\n      \"/users/{user-id}/drive\",\n      \"/users/{user-id}/drives\",\n      \"/groups/{group-id}/drive\",\n      \"/groups/{group-id}/drives\",\n      \"/drives\",\n      \"/shares\",\n    ],\n    featured: true,\n    audience: \"files-content\",\n  },\n  {\n    id: \"excel\",\n    name: \"Excel Workbooks\",\n    summary: \"Workbook tables, worksheets, ranges, charts, and sessions.\",\n    icon: svglIcon(\"microsoft-excel\"),\n    scopes: [\"Files.ReadWrite.All\"],\n    pathPrefixes: [\n      \"/me/drive/items/{driveItem-id}/workbook\",\n      \"/users/{user-id}/drive/items/{driveItem-id}/workbook\",\n      \"/groups/{group-id}/drive/items/{driveItem-id}/workbook\",\n      \"/drives/{drive-id}/items/{driveItem-id}/workbook\",\n    ],\n    audience: \"files-content\",\n  },\n  {\n    id: \"sites\",\n    name: \"SharePoint Sites\",\n    summary: \"Sites, lists, pages, columns, content types, and stores.\",\n    icon: svglIcon(\"microsoft-sharepoint\"),\n    scopes: [\"Sites.ReadWrite.All\"],\n    pathPrefixes: [\"/sites\"],\n    featured: true,\n    audience: \"files-content\",\n  },\n  {\n    id: \"onenote\",\n    name: \"OneNote\",\n    summary: \"Notebooks, sections, pages, and page content.\",\n    icon: svglIcon(\"microsoft-onenote\"),\n    scopes: [\"Notes.ReadWrite\"],\n    pathPrefixes: [\n      \"/me/onenote\",\n      \"/users/{user-id}/onenote\",\n      \"/groups/{group-id}/onenote\",\n      \"/sites/{site-id}/onenote\",\n    ],\n    audience: \"files-content\",\n  },\n  {\n    id: \"teams-chat\",\n    name: \"Teams Chats\",\n    summary: \"Chats, chat messages, installed apps, and members.\",\n    icon: svglIcon(\"microsoft-teams\"),\n    scopes: [\"Chat.ReadWrite\"],\n    pathPrefixes: [\"/me/chats\", \"/chats\"],\n    audience: \"collaboration\",\n  },\n  {\n    id: \"teams-channels\",\n    name: \"Teams Channels\",\n    summary: \"Teams, channels, channel messages, replies, and joined teams.\",\n    icon: svglIcon(\"microsoft-teams\"),\n    scopes: [\n      \"Team.ReadBasic.All\",\n      \"Channel.ReadBasic.All\",\n      \"ChannelMessage.Read.All\",\n      \"ChannelMessage.Send\",\n    ],\n    pathPrefixes: [\n      \"/me/joinedTeams\",\n      \"/groups/{group-id}/team\",\n      \"/teams\",\n      \"/teamwork\",\n      \"/teamsTemplates\",\n    ],\n    audience: \"collaboration\",\n  },\n  {\n    id: \"meetings-calls\",\n    name: \"Meetings and Calls\",\n    summary: \"Online meetings, calls, call records, and communications APIs.\",\n    icon: svglIcon(\"microsoft-teams\"),\n    scopes: [\"OnlineMeetings.ReadWrite\"],\n    pathPrefixes: [\"/communications\", \"/me/onlineMeetings\", \"/users/{user-id}/onlineMeetings\"],\n    audience: \"collaboration\",\n  },\n  {\n    id: \"users\",\n    name: \"Users\",\n    summary: \"User objects plus user-scoped Graph operations.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"User.ReadWrite.All\", \"Directory.Read.All\"],\n    pathPrefixes: [\"/users\", \"/users(userPrincipalName='{userPrincipalName}')\"],\n    featured: true,\n    audience: \"directory-identity\",\n  },\n  {\n    id: \"groups\",\n    name: \"Groups\",\n    summary: \"Groups, settings, lifecycle policies, and group-scoped operations.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"Group.ReadWrite.All\", \"Directory.Read.All\"],\n    pathPrefixes: [\n      \"/groups\",\n      \"/groups(uniqueName='{uniqueName}')\",\n      \"/groupSettings\",\n      \"/groupSettingTemplates\",\n      \"/groupLifecyclePolicies\",\n    ],\n    audience: \"directory-identity\",\n  },\n  {\n    id: \"directory\",\n    name: \"Directory\",\n    summary: \"Directory roles, objects, contacts, contracts, and invitations.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"Directory.Read.All\"],\n    pathPrefixes: [\n      \"/contacts\",\n      \"/contracts\",\n      \"/directory\",\n      \"/directoryObjects\",\n      \"/directoryRoles\",\n      \"/directoryRoles(roleTemplateId='{roleTemplateId}')\",\n      \"/directoryRoleTemplates\",\n      \"/invitations\",\n      \"/scopedRoleMemberships\",\n    ],\n    audience: \"directory-identity\",\n  },\n  {\n    id: \"applications\",\n    name: \"Applications\",\n    summary: \"Applications, service principals, app templates, catalogs, and grants.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"Application.ReadWrite.All\", \"AppRoleAssignment.ReadWrite.All\"],\n    pathPrefixes: [\n      \"/applications\",\n      \"/applications(appId='{appId}')\",\n      \"/applications(uniqueName='{uniqueName}')\",\n      \"/applicationTemplates\",\n      \"/appCatalogs\",\n      \"/oauth2PermissionGrants\",\n      \"/permissionGrants\",\n      \"/servicePrincipals\",\n      \"/servicePrincipals(appId='{appId}')\",\n    ],\n    audience: \"directory-identity\",\n  },\n  {\n    id: \"identity\",\n    name: \"Identity and Governance\",\n    summary: \"Identity, governance, policies, access reviews, roles, and providers.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"Policy.ReadWrite.ConditionalAccess\", \"RoleManagement.Read.Directory\"],\n    pathPrefixes: [\n      \"/agreementAcceptances\",\n      \"/agreements\",\n      \"/authenticationMethodConfigurations\",\n      \"/authenticationMethodsPolicy\",\n      \"/certificateBasedAuthConfiguration\",\n      \"/identity\",\n      \"/identityGovernance\",\n      \"/identityProviders\",\n      \"/identityProtection\",\n      \"/policies\",\n      \"/roleManagement\",\n    ],\n    audience: \"directory-identity\",\n  },\n  {\n    id: \"admin-reports\",\n    name: \"Admin and Reports\",\n    summary: \"Admin centers, audit logs, domains, reports, organization, and tenants.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"AuditLog.Read.All\", \"Reports.Read.All\"],\n    pathPrefixes: [\n      \"/admin\",\n      \"/auditLogs\",\n      \"/domains\",\n      \"/domainDnsRecords\",\n      \"/organization\",\n      \"/reports\",\n      \"/subscribedSkus\",\n      \"/tenantRelationships\",\n    ],\n    audience: \"admin-security\",\n  },\n  {\n    id: \"security-compliance\",\n    name: \"Security and Compliance\",\n    summary: \"Security, compliance, privacy, information protection, and data policy.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"SecurityEvents.Read.All\"],\n    pathPrefixes: [\n      \"/compliance\",\n      \"/dataPolicyOperations\",\n      \"/informationProtection\",\n      \"/privacy\",\n      \"/security\",\n    ],\n    audience: \"admin-security\",\n  },\n  {\n    id: \"devices\",\n    name: \"Devices and Intune\",\n    summary: \"Devices, device management, Intune apps, managed devices, and policies.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"DeviceManagementApps.ReadWrite.All\", \"DeviceManagementManagedDevices.ReadWrite.All\"],\n    pathPrefixes: [\n      \"/devices\",\n      \"/devices(deviceId='{deviceId}')\",\n      \"/deviceAppManagement\",\n      \"/deviceManagement\",\n    ],\n    audience: \"admin-security\",\n  },\n  {\n    id: \"education\",\n    name: \"Education\",\n    summary: \"Classes, schools, education users, assignments, and reports.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [],\n    pathPrefixes: [\"/education\"],\n    audience: \"admin-security\",\n  },\n  {\n    id: \"search\",\n    name: \"Microsoft Search\",\n    summary: \"Search across Microsoft Graph content connectors.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"ExternalItem.Read.All\", \"Acronym.Read.All\", \"Bookmark.Read.All\", \"QnA.Read.All\"],\n    pathPrefixes: [\"/search\"],\n    audience: \"platform-business\",\n  },\n  {\n    id: \"external-connections\",\n    name: \"External Connections\",\n    summary: \"External connections, schemas, items, and content connectors.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"ExternalConnection.ReadWrite.OwnedBy\", \"ExternalItem.ReadWrite.OwnedBy\"],\n    pathPrefixes: [\"/connections\", \"/external\"],\n    audience: \"platform-business\",\n  },\n  {\n    id: \"solutions\",\n    name: \"Solutions and Employee Experience\",\n    summary: \"Bookings, virtual events, backup, employee experience, and Copilot.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [],\n    pathPrefixes: [\"/copilot\", \"/employeeExperience\", \"/solutions\"],\n    audience: \"platform-business\",\n  },\n  {\n    id: \"platform-services\",\n    name: \"Platform Services\",\n    summary: \"Places, print, storage, subscriptions, functions, filters, and extensions.\",\n    icon: svglIcon(\"microsoft\"),\n    scopes: [\"Place.Read.All\", \"Printer.ReadWrite.All\"],\n    pathPrefixes: [\n      \"/filterOperators\",\n      \"/functions\",\n      \"/places\",\n      \"/print\",\n      \"/schemaExtensions\",\n      \"/storage\",\n      \"/subscriptions\",\n    ],\n    audience: \"platform-business\",\n  },\n];\n\nexport const MICROSOFT_GRAPH_DEFAULT_PRESET_IDS: readonly string[] = [\n  \"profile\",\n  \"mail\",\n  \"calendar\",\n  \"contacts\",\n  \"tasks\",\n  \"files\",\n  \"excel\",\n  \"sites\",\n  \"onenote\",\n  \"teams-chat\",\n  \"teams-channels\",\n  \"meetings-calls\",\n];\n\nexport const MICROSOFT_GRAPH_ALL_PRESET_IDS: readonly string[] = microsoftGraphScopePresets.map(\n  (preset) => preset.id,\n);\n\nconst orderedUnique = (values: Iterable<string>): readonly string[] => {\n  const seen = new Set<string>();\n  const result: string[] = [];\n  for (const value of values) {\n    const trimmed = value.trim();\n    if (!trimmed || seen.has(trimmed)) continue;\n    seen.add(trimmed);\n    result.push(trimmed);\n  }\n  return result;\n};\n\nexport const microsoftGraphPresetForId = (\n  presetId: string,\n): MicrosoftGraphScopePreset | undefined =>\n  microsoftGraphScopePresets.find((preset) => preset.id === presetId);\n\nexport const microsoftGraphPresetIdsCoverFullGraph = (presetIds: Iterable<string>): boolean => {\n  const selected = new Set([...presetIds]);\n  return microsoftGraphScopePresets.every((preset) => selected.has(preset.id));\n};\n\nexport const microsoftGraphScopesForPresetIds = (\n  presetIds: Iterable<string>,\n  customScopes: Iterable<string> = [],\n): readonly string[] =>\n  orderedUnique([\n    ...MICROSOFT_GRAPH_BASE_SCOPES,\n    MICROSOFT_GRAPH_IDENTITY_SCOPE,\n    ...[...presetIds].flatMap((presetId) => microsoftGraphPresetForId(presetId)?.scopes ?? []),\n    ...customScopes,\n  ]);\n\nexport const microsoftGraphExactPathsForPresetIds = (\n  presetIds: Iterable<string>,\n): readonly string[] =>\n  orderedUnique(\n    [...presetIds].flatMap((presetId) => microsoftGraphPresetForId(presetId)?.exactPaths ?? []),\n  );\n\nexport const microsoftGraphPathPrefixesForPresetIds = (\n  presetIds: Iterable<string>,\n): readonly string[] =>\n  orderedUnique(\n    [...presetIds].flatMap((presetId) => microsoftGraphPresetForId(presetId)?.pathPrefixes ?? []),\n  );\n\nexport const microsoftGraphTagPrefixesForPresetIds = (\n  presetIds: Iterable<string>,\n): readonly string[] =>\n  orderedUnique(\n    [...presetIds].flatMap((presetId) => microsoftGraphPresetForId(presetId)?.tagPrefixes ?? []),\n  );\n\nexport const microsoftServiceSlug = (presetId: string): string =>\n  `microsoft_${presetId.replaceAll(\"-\", \"_\")}`;\n\nconst microsoftGraphCatalogUrl = (presetId: string): string =>\n  `${MICROSOFT_GRAPH_OPENAPI_URL}#preset=${encodeURIComponent(presetId)}`;\n\nconst microsoftGraphCatalogAuthTemplate = (preset: MicrosoftGraphScopePreset) => [\n  {\n    slug: MICROSOFT_AUTH_TEMPLATE_SLUG,\n    kind: \"oauth2\" as const,\n    authorizationUrl: MICROSOFT_AUTHORIZATION_URL,\n    tokenUrl: MICROSOFT_TOKEN_URL,\n    scopes: microsoftGraphScopesForPresetIds([preset.id]),\n  },\n  {\n    slug: MICROSOFT_CLIENT_CREDENTIALS_AUTH_TEMPLATE_SLUG,\n    kind: \"oauth2\" as const,\n    authorizationUrl: MICROSOFT_AUTHORIZATION_URL,\n    tokenUrl: MICROSOFT_TOKEN_URL,\n    scopes: [...MICROSOFT_GRAPH_CLIENT_CREDENTIALS_SCOPES],\n  },\n];\n\nexport const microsoftCatalog: readonly IntegrationPreset[] = microsoftGraphScopePresets.map(\n  (preset) => ({\n    id: `microsoft-${preset.id}`,\n    name: preset.name,\n    summary: preset.summary,\n    url: microsoftGraphCatalogUrl(preset.id),\n    ...(preset.icon ? { icon: preset.icon } : {}),\n    ...(preset.featured ? { featured: preset.featured } : {}),\n    family: \"microsoft\",\n    specFormat: \"microsoft-graph\",\n    defaultSlug: microsoftServiceSlug(preset.id),\n    authTemplate: microsoftGraphCatalogAuthTemplate(preset),\n    ...(preset.id === \"profile\" ? { healthCheck: { operation: \"me.GetUser\" } } : {}),\n  }),\n);\n","import { Effect, Option, Schema } from \"effect\";\nimport type { Layer } from \"effect\";\nimport { HttpClient, HttpClientRequest } from \"effect/unstable/http\";\n\nimport { AuthTemplateSlug } from \"@rafads/sdk/core\";\nimport { AuthenticationSchema, type OpenApiIntegrationConfig } from \"../../sdk/config\";\nimport { OpenApiParseError } from \"../../sdk/errors\";\nimport {\n  parseEntry,\n  parseHead,\n  parseSmallComponents,\n  structuralSplit,\n  type KeepPathItem,\n  type SpecStructure,\n} from \"../../sdk/split\";\nimport type { Authentication } from \"../../sdk/types\";\n\nimport {\n  MICROSOFT_AUTHORIZATION_URL,\n  MICROSOFT_AUTH_TEMPLATE_SLUG,\n  MICROSOFT_CLIENT_CREDENTIALS_AUTH_TEMPLATE_SLUG,\n  MICROSOFT_GRAPH_BASE_SCOPES,\n  MICROSOFT_GRAPH_CLIENT_CREDENTIALS_SCOPES,\n  MICROSOFT_GRAPH_DELEGATED_DEFAULT_SCOPES,\n  MICROSOFT_GRAPH_DEFAULT_PRESET_IDS,\n  MICROSOFT_GRAPH_IDENTITY_SCOPE,\n  MICROSOFT_GRAPH_OPENAPI_URL,\n  MICROSOFT_GRAPH_PERMISSIONS_REFERENCE_URL,\n  MICROSOFT_TOKEN_URL,\n  microsoftGraphExactPathsForPresetIds,\n  microsoftGraphPathPrefixesForPresetIds,\n  microsoftGraphPresetIdsCoverFullGraph,\n  microsoftGraphScopesForPresetIds,\n  microsoftGraphTagPrefixesForPresetIds,\n} from \"./presets\";\n\nexport interface MicrosoftGraphSelectionInput {\n  readonly presetIds?: readonly string[];\n  readonly customScopes?: readonly string[];\n  readonly baseUrl?: string;\n  readonly specUrl?: string;\n  readonly authorizationUrl?: string;\n  readonly tokenUrl?: string;\n  readonly clientCredentialsTokenUrl?: string;\n}\n\nexport interface MicrosoftGraphSpecBuild {\n  readonly specText: string;\n  readonly specUrl: string;\n  readonly baseUrl?: string;\n  readonly authorizationUrl: string;\n  readonly tokenUrl: string;\n  readonly clientCredentialsTokenUrl: string;\n  readonly presetIds: readonly string[];\n  readonly customScopes: readonly string[];\n  readonly scopes: readonly string[];\n  readonly exactPaths: readonly string[];\n  readonly pathPrefixes: readonly string[];\n  readonly tagPrefixes: readonly string[];\n  readonly coversFullGraph: boolean;\n  readonly authenticationTemplate: readonly Authentication[];\n}\n\nexport interface MicrosoftGraphUrlPolicy {\n  /**\n   * When true, spec/base/OAuth endpoint URLs may point anywhere a trusted\n   * https URL could, plus plain http on loopback (local Graph emulators).\n   * Every other host is still rejected. Off by default — production leaves\n   * this unset so only the pinned Microsoft Graph URLs are accepted.\n   */\n  readonly allowUnsafeUrlOverrides?: boolean;\n}\n\nexport type MicrosoftGraphIntegrationConfig = OpenApiIntegrationConfig & {\n  readonly microsoftGraphPresetIds?: readonly string[];\n  readonly microsoftGraphCustomScopes?: readonly string[];\n  readonly microsoftGraphScopes?: readonly string[];\n  readonly microsoftGraphExactPaths?: readonly string[];\n  readonly microsoftGraphPathPrefixes?: readonly string[];\n  readonly microsoftGraphTagPrefixes?: readonly string[];\n  readonly microsoftGraphCoversFullGraph?: boolean;\n  readonly microsoftGraphAuthorizationUrl?: string;\n  readonly microsoftGraphTokenUrl?: string;\n  readonly microsoftGraphClientCredentialsTokenUrl?: string;\n};\n\nconst MicrosoftGraphIntegrationConfigSchema = Schema.Struct({\n  specHash: Schema.optional(Schema.String),\n  specUrl: Schema.optional(Schema.String),\n  baseUrl: Schema.optional(Schema.String),\n  headers: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n  queryParams: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n  authenticationTemplate: Schema.optional(Schema.Array(AuthenticationSchema)),\n  microsoftGraphPresetIds: Schema.optional(Schema.Array(Schema.String)),\n  microsoftGraphCustomScopes: Schema.optional(Schema.Array(Schema.String)),\n  microsoftGraphScopes: Schema.optional(Schema.Array(Schema.String)),\n  microsoftGraphExactPaths: Schema.optional(Schema.Array(Schema.String)),\n  microsoftGraphPathPrefixes: Schema.optional(Schema.Array(Schema.String)),\n  microsoftGraphTagPrefixes: Schema.optional(Schema.Array(Schema.String)),\n  microsoftGraphCoversFullGraph: Schema.optional(Schema.Boolean),\n  microsoftGraphAuthorizationUrl: Schema.optional(Schema.String),\n  microsoftGraphTokenUrl: Schema.optional(Schema.String),\n  microsoftGraphClientCredentialsTokenUrl: Schema.optional(Schema.String),\n});\n\nconst decodeMicrosoftConfig = Schema.decodeUnknownOption(MicrosoftGraphIntegrationConfigSchema);\n\nexport const decodeMicrosoftGraphIntegrationConfig = (\n  value: unknown,\n): MicrosoftGraphIntegrationConfig | null =>\n  Option.getOrNull(decodeMicrosoftConfig(value)) as MicrosoftGraphIntegrationConfig | null;\n\nconst uniqueStrings = (values: Iterable<string>): readonly string[] => {\n  const seen = new Set<string>();\n  const result: string[] = [];\n  for (const value of values) {\n    const trimmed = value.trim();\n    if (!trimmed || seen.has(trimmed)) continue;\n    seen.add(trimmed);\n    result.push(trimmed);\n  }\n  return result;\n};\n\nconst normalizeSelection = (input: MicrosoftGraphSelectionInput) => {\n  const presetIds = uniqueStrings(\n    input.presetIds && input.presetIds.length > 0\n      ? input.presetIds\n      : MICROSOFT_GRAPH_DEFAULT_PRESET_IDS,\n  );\n  const customScopes = uniqueStrings(input.customScopes ?? []);\n  const scopes = microsoftGraphScopesForPresetIds(presetIds, customScopes);\n  const exactPaths = microsoftGraphExactPathsForPresetIds(presetIds);\n  const pathPrefixes = microsoftGraphPathPrefixesForPresetIds(presetIds);\n  const tagPrefixes = microsoftGraphTagPrefixesForPresetIds(presetIds);\n  const coversFullGraph = microsoftGraphPresetIdsCoverFullGraph(presetIds);\n  const specUrl = input.specUrl?.trim() || MICROSOFT_GRAPH_OPENAPI_URL;\n  const baseUrl = input.baseUrl?.trim() || undefined;\n  const authorizationUrl = input.authorizationUrl?.trim() || undefined;\n  const tokenUrl = input.tokenUrl?.trim() || undefined;\n  const clientCredentialsTokenUrl = input.clientCredentialsTokenUrl?.trim() || undefined;\n  return {\n    presetIds,\n    customScopes,\n    scopes,\n    exactPaths,\n    pathPrefixes,\n    tagPrefixes,\n    coversFullGraph,\n    specUrl,\n    baseUrl,\n    authorizationUrl,\n    tokenUrl,\n    clientCredentialsTokenUrl,\n  };\n};\n\ninterface MicrosoftOAuthEndpoints {\n  readonly authorizationUrl: string;\n  readonly tokenUrl: string;\n  readonly clientCredentialsTokenUrl: string;\n}\n\nconst microsoftOAuthTemplate = (\n  scopes: readonly string[],\n  endpoints: MicrosoftOAuthEndpoints,\n): readonly Authentication[] => [\n  {\n    slug: AuthTemplateSlug.make(MICROSOFT_AUTH_TEMPLATE_SLUG),\n    kind: \"oauth2\",\n    authorizationUrl: endpoints.authorizationUrl,\n    tokenUrl: endpoints.tokenUrl,\n    scopes,\n  },\n  {\n    slug: AuthTemplateSlug.make(MICROSOFT_CLIENT_CREDENTIALS_AUTH_TEMPLATE_SLUG),\n    kind: \"oauth2\",\n    authorizationUrl: endpoints.authorizationUrl,\n    tokenUrl: endpoints.clientCredentialsTokenUrl,\n    scopes: [...MICROSOFT_GRAPH_CLIENT_CREDENTIALS_SCOPES],\n  },\n];\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value);\n\nconst HTTP_METHODS = new Set([\"delete\", \"get\", \"patch\", \"post\", \"put\"]);\nconst REQUEST_BASE_SCOPES = new Set([\"offline_access\", \"openid\", \"profile\", \"email\"]);\nconst PATH_SCOPE_IGNORED_SCOPES = new Set([\n  \"offline_access\",\n  \"openid\",\n  \"profile\",\n  \"email\",\n  MICROSOFT_GRAPH_IDENTITY_SCOPE,\n]);\n\nconst firstString = (values: readonly unknown[]): string | undefined =>\n  values.find((value): value is string => typeof value === \"string\" && value.trim().length > 0);\n\nconst parseTrustedHttpsUrl = (value: string): URL | null => {\n  if (!URL.canParse(value)) return null;\n  const parsed = new URL(value);\n  if (parsed.protocol !== \"https:\" || parsed.username || parsed.password || parsed.hash) {\n    return null;\n  }\n  return parsed;\n};\n\n// Local emulators (microsoft-emulator.test.ts, `microsoft.emulators.dev` run\n// locally) serve plain http on loopback. Only these three hostnames count —\n// this is not a general SSRF-safe \"is this private\" check, just a narrow\n// allowance for the dev machine talking to itself.\nconst isLoopbackHostname = (hostname: string): boolean => {\n  const lower = hostname.toLowerCase();\n  return lower === \"localhost\" || lower === \"127.0.0.1\" || lower === \"::1\" || lower === \"[::1]\";\n};\n\nconst parseTrustedLoopbackHttpUrl = (value: string): URL | null => {\n  if (!URL.canParse(value)) return null;\n  const parsed = new URL(value);\n  if (parsed.protocol !== \"http:\" || parsed.username || parsed.password || parsed.hash) {\n    return null;\n  }\n  return isLoopbackHostname(parsed.hostname) ? parsed : null;\n};\n\n/**\n * Under `allowUnsafeUrlOverrides`, accept either a trusted https URL or a\n * plain-http URL on loopback (local emulators have no TLS). Every other URL\n * shape is still rejected, override or not.\n */\nconst allowUnsafeUrl = (\n  value: string | undefined,\n  policy: MicrosoftGraphUrlPolicy | undefined,\n): string | undefined | null => {\n  if (!value) return undefined;\n  if (policy?.allowUnsafeUrlOverrides !== true) return null;\n  return parseTrustedHttpsUrl(value) || parseTrustedLoopbackHttpUrl(value) ? value : null;\n};\n\nconst normalizeMicrosoftGraphSpecUrl = (\n  value: string,\n  policy?: MicrosoftGraphUrlPolicy,\n): string | null => {\n  if (value === MICROSOFT_GRAPH_OPENAPI_URL) return value;\n  return allowUnsafeUrl(value, policy) ?? null;\n};\n\nconst MICROSOFT_GRAPH_HOSTS = new Set([\n  \"graph.microsoft.com\",\n  \"graph.microsoft.us\",\n  \"dod-graph.microsoft.us\",\n  \"microsoftgraph.chinacloudapi.cn\",\n]);\n\nconst normalizeMicrosoftGraphBaseUrl = (\n  value: string | undefined,\n  policy?: MicrosoftGraphUrlPolicy,\n): string | undefined | null => {\n  const unsafe = allowUnsafeUrl(value, policy);\n  if (unsafe !== null) return unsafe;\n  if (!value) return undefined;\n  const parsed = parseTrustedHttpsUrl(value);\n  if (!parsed || !MICROSOFT_GRAPH_HOSTS.has(parsed.hostname.toLowerCase())) return null;\n  if (!/^\\/(?:v1\\.0|beta)(?:\\/)?$/.test(parsed.pathname)) return null;\n  if (parsed.search) return null;\n  return parsed.toString().replace(/\\/$/, \"\");\n};\n\nconst MICROSOFT_IDENTITY_HOSTS = new Set([\n  \"login.microsoftonline.com\",\n  \"login.microsoftonline.us\",\n  \"login.partner.microsoftonline.cn\",\n]);\n\nconst normalizeMicrosoftOAuthEndpointUrl = (\n  value: string,\n  endpoint: \"authorize\" | \"token\",\n  policy?: MicrosoftGraphUrlPolicy,\n): string | null => {\n  const unsafe = allowUnsafeUrl(value, policy);\n  if (unsafe !== null) return unsafe ?? null;\n  const parsed = parseTrustedHttpsUrl(value);\n  if (!parsed || !MICROSOFT_IDENTITY_HOSTS.has(parsed.hostname.toLowerCase())) return null;\n  if (parsed.search) return null;\n  const suffix = endpoint === \"authorize\" ? \"authorize\" : \"token\";\n  return /^\\/[^/]+\\/oauth2\\/v2\\.0\\/(?:authorize|token)$/.test(parsed.pathname) &&\n    parsed.pathname.endsWith(`/${suffix}`)\n    ? parsed.toString()\n    : null;\n};\n\nconst validateSelectionUrls = (\n  selection: ReturnType<typeof normalizeSelection>,\n  policy?: MicrosoftGraphUrlPolicy,\n): Effect.Effect<ReturnType<typeof normalizeSelection>, OpenApiParseError> =>\n  Effect.gen(function* () {\n    const specUrl = normalizeMicrosoftGraphSpecUrl(selection.specUrl, policy);\n    if (!specUrl) {\n      return yield* new OpenApiParseError({\n        message: \"Microsoft Graph specUrl must point to the trusted Microsoft Graph OpenAPI spec\",\n      });\n    }\n    const baseUrl = normalizeMicrosoftGraphBaseUrl(selection.baseUrl, policy);\n    if (baseUrl === null) {\n      return yield* new OpenApiParseError({\n        message: \"Microsoft Graph baseUrl must point to a supported Microsoft Graph endpoint\",\n      });\n    }\n    const authorizationUrl = selection.authorizationUrl\n      ? normalizeMicrosoftOAuthEndpointUrl(selection.authorizationUrl, \"authorize\", policy)\n      : undefined;\n    if (selection.authorizationUrl && !authorizationUrl) {\n      return yield* new OpenApiParseError({\n        message: \"Microsoft authorizationUrl must point to a supported Microsoft identity endpoint\",\n      });\n    }\n    const tokenUrl = selection.tokenUrl\n      ? normalizeMicrosoftOAuthEndpointUrl(selection.tokenUrl, \"token\", policy)\n      : undefined;\n    if (selection.tokenUrl && !tokenUrl) {\n      return yield* new OpenApiParseError({\n        message: \"Microsoft tokenUrl must point to a supported Microsoft identity endpoint\",\n      });\n    }\n    const clientCredentialsTokenUrl = selection.clientCredentialsTokenUrl\n      ? normalizeMicrosoftOAuthEndpointUrl(selection.clientCredentialsTokenUrl, \"token\", policy)\n      : undefined;\n    if (selection.clientCredentialsTokenUrl && !clientCredentialsTokenUrl) {\n      return yield* new OpenApiParseError({\n        message:\n          \"Microsoft clientCredentialsTokenUrl must point to a supported Microsoft identity endpoint\",\n      });\n    }\n    return {\n      ...selection,\n      specUrl,\n      ...(baseUrl ? { baseUrl } : { baseUrl: undefined }),\n      ...(authorizationUrl ? { authorizationUrl } : { authorizationUrl: undefined }),\n      ...(tokenUrl ? { tokenUrl } : { tokenUrl: undefined }),\n      ...(clientCredentialsTokenUrl\n        ? { clientCredentialsTokenUrl }\n        : { clientCredentialsTokenUrl: undefined }),\n    };\n  });\n\nconst validateResolvedOAuthEndpoints = (\n  endpoints: MicrosoftOAuthEndpoints,\n  policy?: MicrosoftGraphUrlPolicy,\n): Effect.Effect<MicrosoftOAuthEndpoints, OpenApiParseError> =>\n  Effect.gen(function* () {\n    const authorizationUrl = normalizeMicrosoftOAuthEndpointUrl(\n      endpoints.authorizationUrl,\n      \"authorize\",\n      policy,\n    );\n    const tokenUrl = normalizeMicrosoftOAuthEndpointUrl(endpoints.tokenUrl, \"token\", policy);\n    const clientCredentialsTokenUrl = normalizeMicrosoftOAuthEndpointUrl(\n      endpoints.clientCredentialsTokenUrl,\n      \"token\",\n      policy,\n    );\n    if (!authorizationUrl || !tokenUrl || !clientCredentialsTokenUrl) {\n      return yield* new OpenApiParseError({\n        message: \"Microsoft OAuth endpoints must point to supported Microsoft identity endpoints\",\n      });\n    }\n    return { authorizationUrl, tokenUrl, clientCredentialsTokenUrl };\n  });\n\nconst recordValues = (value: unknown): readonly unknown[] =>\n  isRecord(value) ? Object.values(value) : [];\n\nconst firstOAuthFlows = (parsed: Record<string, unknown>): readonly Record<string, unknown>[] => {\n  const components = isRecord(parsed.components) ? parsed.components : {};\n  const securitySchemes = isRecord(components.securitySchemes) ? components.securitySchemes : {};\n  return recordValues(securitySchemes)\n    .filter(isRecord)\n    .filter((scheme) => scheme.type === \"oauth2\")\n    .flatMap((scheme) => recordValues(scheme.flows).filter(isRecord));\n};\n\nconst resolveOAuthEndpoints = (\n  parsed: Record<string, unknown>,\n  overrides: {\n    readonly authorizationUrl?: string;\n    readonly tokenUrl?: string;\n    readonly clientCredentialsTokenUrl?: string;\n  },\n): MicrosoftOAuthEndpoints => {\n  const flows = firstOAuthFlows(parsed);\n  const authorizationCode = flows.find((flow) => flow.authorizationUrl !== undefined);\n  const clientCredentials = flows.find(\n    (flow) => flow.tokenUrl !== undefined && flow.authorizationUrl === undefined,\n  );\n  const authorizationUrl =\n    overrides.authorizationUrl ??\n    (isRecord(authorizationCode) ? firstString([authorizationCode.authorizationUrl]) : undefined) ??\n    MICROSOFT_AUTHORIZATION_URL;\n  const tokenUrl =\n    overrides.tokenUrl ??\n    (isRecord(authorizationCode) ? firstString([authorizationCode.tokenUrl]) : undefined) ??\n    firstString(flows.map((flow) => flow.tokenUrl)) ??\n    MICROSOFT_TOKEN_URL;\n  const clientCredentialsTokenUrl =\n    overrides.clientCredentialsTokenUrl ??\n    (isRecord(clientCredentials) ? firstString([clientCredentials.tokenUrl]) : undefined) ??\n    tokenUrl;\n  return { authorizationUrl, tokenUrl, clientCredentialsTokenUrl };\n};\n\nconst graphPathMatchVariants = (path: string): readonly string[] => {\n  const withoutVersion = path.replace(/^\\/(?:v1\\.0|beta)(?=\\/)/, \"\");\n  return withoutVersion === path ? [path, `/v1.0${path}`] : [path, withoutVersion];\n};\n\nconst matchesGraphPath = (\n  path: string,\n  exactPaths: ReadonlySet<string>,\n  pathPrefixes: readonly string[],\n): boolean => {\n  const variants = graphPathMatchVariants(path);\n  if (variants.some((variant) => exactPaths.has(variant))) return true;\n  return variants.some((variant) =>\n    pathPrefixes.some(\n      (prefix) =>\n        variant === prefix || variant.startsWith(`${prefix}/`) || variant.startsWith(`${prefix}(`),\n    ),\n  );\n};\n\nconst isIdentityHealthPath = (path: string): boolean =>\n  graphPathMatchVariants(path).some((variant) => variant === \"/me\");\n\nconst operationTags = (operation: Record<string, unknown>): readonly string[] =>\n  Array.isArray(operation.tags)\n    ? operation.tags.filter((tag): tag is string => typeof tag === \"string\")\n    : [];\n\nconst operationMatchesTagPrefix = (\n  operation: Record<string, unknown>,\n  tagPrefixes: readonly string[],\n): boolean =>\n  tagPrefixes.length > 0 &&\n  operationTags(operation).some((tag) =>\n    tagPrefixes.some((prefix) => tag === prefix || tag.startsWith(prefix)),\n  );\n\nconst isGraphPermissionScope = (value: string): boolean =>\n  value.startsWith(\"https://graph.microsoft.com/\") ||\n  /^[A-Z][A-Za-z0-9]*(?:\\.[A-Za-z0-9]+)+(?:\\.All)?$/.test(value);\n\nexport const parseMicrosoftGraphDelegatedScopes = (\n  permissionsReference: string,\n): readonly string[] =>\n  uniqueStrings(\n    permissionsReference.split(/\\n(?=###\\s+)/).flatMap((section) => {\n      const scope = section.match(/^###\\s+([^\\n]+)$/m)?.[1]?.trim();\n      if (!scope || !isGraphPermissionScope(scope)) return [];\n      const identifierRow = section.match(/^\\|\\s*Identifier\\s*\\|\\s*([^|]*)\\|\\s*([^|]*)\\|/m);\n      const delegatedIdentifier = identifierRow?.[2]?.trim();\n      return delegatedIdentifier && delegatedIdentifier !== \"-\" ? [scope] : [];\n    }),\n  );\n\nconst collectScopeStrings = (value: unknown): readonly string[] => {\n  if (typeof value === \"string\") return isGraphPermissionScope(value) ? [value] : [];\n  if (Array.isArray(value)) return value.flatMap(collectScopeStrings);\n  if (!isRecord(value)) return [];\n  return Object.values(value).flatMap(collectScopeStrings);\n};\n\nconst securityScopes = (\n  value: unknown,\n  options?: { readonly delegatedOnly?: boolean },\n): readonly string[] => {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap((entry) => {\n    if (!isRecord(entry)) return [];\n    return Object.entries(entry).flatMap(([scheme, scopes]) => {\n      const lowerScheme = scheme.toLowerCase();\n      if (options?.delegatedOnly && lowerScheme.includes(\"app\")) return [];\n      if (options?.delegatedOnly && lowerScheme.includes(\"application\")) return [];\n      return Array.isArray(scopes)\n        ? scopes.filter((scope): scope is string => typeof scope === \"string\")\n        : [];\n    });\n  });\n};\n\nconst permissionScopes = (\n  operation: Record<string, unknown>,\n  options?: { readonly delegatedOnly?: boolean },\n): readonly string[] => {\n  const xMsPermissions = isRecord(operation[\"x-ms-permissions\"])\n    ? operation[\"x-ms-permissions\"]\n    : {};\n  const delegatedScopes = options?.delegatedOnly\n    ? collectScopeStrings({\n        delegated: xMsPermissions.delegated,\n        leastPrivilegedDelegated: xMsPermissions.leastPrivilegedDelegated,\n      })\n    : collectScopeStrings(xMsPermissions);\n  return uniqueStrings([...securityScopes(operation.security, options), ...delegatedScopes]);\n};\n\nconst operationMatchesScope = (\n  operation: Record<string, unknown>,\n  selectedScopes: ReadonlySet<string>,\n): boolean =>\n  permissionScopes(operation).some(\n    (scope) => selectedScopes.has(scope) && !PATH_SCOPE_IGNORED_SCOPES.has(scope),\n  );\n\nconst filterPathItem = (\n  path: string,\n  pathItem: Record<string, unknown>,\n  options: {\n    readonly exactPaths: ReadonlySet<string>;\n    readonly pathPrefixes: readonly string[];\n    readonly tagPrefixes: readonly string[];\n    readonly selectedScopes: ReadonlySet<string>;\n  },\n): Record<string, unknown> | null => {\n  // Always keep bare /me: the default identity health check depends on GET /me\n  // even when the profile workload is unchecked.\n  const pathMatchesSelection = matchesGraphPath(path, options.exactPaths, options.pathPrefixes);\n  const identityHealthGetOnly = !pathMatchesSelection && isIdentityHealthPath(path);\n  const kept: Record<string, unknown> = {};\n  let hasOperation = false;\n\n  for (const [key, value] of Object.entries(pathItem)) {\n    const lowerKey = key.toLowerCase();\n    if (!HTTP_METHODS.has(lowerKey)) continue;\n    if (!isRecord(value)) continue;\n    if (identityHealthGetOnly && lowerKey !== \"get\") continue;\n    if (\n      pathMatchesSelection ||\n      identityHealthGetOnly ||\n      operationMatchesTagPrefix(value, options.tagPrefixes) ||\n      operationMatchesScope(value, options.selectedScopes)\n    ) {\n      kept[key] = value;\n      hasOperation = true;\n    }\n  }\n\n  if (!hasOperation) return null;\n  for (const [key, value] of Object.entries(pathItem)) {\n    if (!HTTP_METHODS.has(key.toLowerCase())) kept[key] = value;\n  }\n  return kept;\n};\n\nconst normalizedMediaType = (mediaType: string): string =>\n  mediaType.split(\";\")[0]?.trim().toLowerCase() ?? \"\";\n\nconst isBinaryStringSchema = (schema: unknown): boolean =>\n  isRecord(schema) &&\n  (schema.type === \"string\" || (Array.isArray(schema.type) && schema.type.includes(\"string\"))) &&\n  (schema.format === \"binary\" || schema.format === \"byte\");\n\n// Graph declares success responses with the OpenAPI wildcard status key \"2XX\",\n// never numeric codes like \"200\" (only \"204\" appears numerically in the spec).\nconst isSuccessStatusKey = (status: string): boolean =>\n  /^2\\d\\d$/.test(status) || /^2xx$/i.test(status);\n\n// Rewrite any success response whose `application/octet-stream` media carries a\n// non-binary schema (report-style Graph endpoints declare `type: object` with a\n// `value` property there) to a plain binary string, so the OpenAPI extractor\n// emits a `binaryResponse` file hint. Already-binary media and all other media\n// types and response fields are left untouched.\nconst normalizeMicrosoftGraphContentPathItem = (\n  pathItem: Record<string, unknown>,\n): Record<string, unknown> => {\n  let changed = false;\n  const next: Record<string, unknown> = { ...pathItem };\n\n  for (const [key, operation] of Object.entries(pathItem)) {\n    if (!HTTP_METHODS.has(key.toLowerCase()) || !isRecord(operation)) continue;\n    const responses = isRecord(operation.responses) ? operation.responses : undefined;\n    if (!responses) continue;\n\n    let responsesChanged = false;\n    const nextResponses: Record<string, unknown> = { ...responses };\n    for (const [status, response] of Object.entries(responses)) {\n      if (!isSuccessStatusKey(status) || !isRecord(response)) continue;\n      const content = isRecord(response.content) ? response.content : undefined;\n      if (!content) continue;\n\n      let contentChanged = false;\n      const nextContent: Record<string, unknown> = { ...content };\n      for (const [mediaType, media] of Object.entries(content)) {\n        if (normalizedMediaType(mediaType) !== \"application/octet-stream\") continue;\n        const schema = isRecord(media) ? media.schema : undefined;\n        if (isBinaryStringSchema(schema)) continue;\n        nextContent[mediaType] = {\n          ...(isRecord(media) ? media : {}),\n          schema: { type: \"string\", format: \"binary\" },\n        };\n        contentChanged = true;\n      }\n\n      if (contentChanged) {\n        nextResponses[status] = { ...response, content: nextContent };\n        responsesChanged = true;\n      }\n    }\n\n    if (responsesChanged) {\n      next[key] = { ...operation, responses: nextResponses };\n      changed = true;\n    }\n  }\n\n  return changed ? next : pathItem;\n};\n\nexport const fetchMicrosoftGraphOpenApiSpec = Effect.fn(\"Microsoft.fetchGraphOpenApiSpec\")(\n  function* (specUrl: string) {\n    const client = yield* HttpClient.HttpClient;\n    const response = yield* client\n      .execute(\n        HttpClientRequest.get(specUrl).pipe(\n          HttpClientRequest.setHeader(\"Accept\", \"application/yaml, text/yaml, */*\"),\n        ),\n      )\n      .pipe(\n        Effect.mapError(\n          () =>\n            new OpenApiParseError({\n              message: \"Failed to fetch Microsoft Graph OpenAPI document\",\n            }),\n        ),\n      );\n    if (response.status < 200 || response.status >= 300) {\n      return yield* new OpenApiParseError({\n        message: `Failed to fetch Microsoft Graph OpenAPI document: HTTP ${response.status}`,\n      });\n    }\n    return yield* response.text.pipe(\n      Effect.mapError(\n        () =>\n          new OpenApiParseError({\n            message: \"Failed to read Microsoft Graph OpenAPI document body\",\n          }),\n      ),\n    );\n  },\n);\n\nexport const fetchMicrosoftGraphPermissionsReference = Effect.fn(\n  \"Microsoft.fetchGraphPermissionsReference\",\n)(function* () {\n  const client = yield* HttpClient.HttpClient;\n  const response = yield* client\n    .execute(\n      HttpClientRequest.get(MICROSOFT_GRAPH_PERMISSIONS_REFERENCE_URL).pipe(\n        HttpClientRequest.setHeader(\"Accept\", \"text/markdown, text/plain, */*\"),\n      ),\n    )\n    .pipe(\n      Effect.mapError(\n        () =>\n          new OpenApiParseError({\n            message: \"Failed to fetch Microsoft Graph permissions reference\",\n          }),\n      ),\n    );\n  if (response.status < 200 || response.status >= 300) {\n    return yield* new OpenApiParseError({\n      message: `Failed to fetch Microsoft Graph permissions reference: HTTP ${response.status}`,\n    });\n  }\n  return yield* response.text.pipe(\n    Effect.mapError(\n      () =>\n        new OpenApiParseError({\n          message: \"Failed to read Microsoft Graph permissions reference body\",\n        }),\n    ),\n  );\n});\n\n/**\n * Build the per-path-item filter that the streaming compile applies to each\n * path-item as it parses the 37MB source. Full-graph selections keep every\n * path-item, but still pass through this transform so octet-stream success\n * responses are normalized to binary before the OpenAPI extractor runs. The\n * selection predicate is identical to the old two-pass filter: the selected\n * scopes are derived from the PRESET scopes (`microsoftGraphScopesForPresetIds`),\n * not the expanded OAuth scopes, so the kept operation set matches regardless\n * of caller.\n */\nexport const microsoftGraphKeepPathItem = (selection: {\n  readonly coversFullGraph: boolean;\n  readonly presetIds: readonly string[];\n  readonly customScopes: readonly string[];\n  readonly exactPaths: readonly string[];\n  readonly pathPrefixes: readonly string[];\n  readonly tagPrefixes: readonly string[];\n}): KeepPathItem => {\n  const exactPaths = new Set(selection.exactPaths);\n  const selectedScopes = new Set(\n    microsoftGraphScopesForPresetIds(selection.presetIds, selection.customScopes),\n  );\n  return (path, pathItem) => {\n    const kept = selection.coversFullGraph\n      ? pathItem\n      : filterPathItem(path, pathItem, {\n          exactPaths,\n          pathPrefixes: selection.pathPrefixes,\n          tagPrefixes: selection.tagPrefixes,\n          selectedScopes,\n        });\n    return kept ? normalizeMicrosoftGraphContentPathItem(kept) : null;\n  };\n};\n\n/**\n * Compute the OAuth scopes for the selection by streaming the source path-items\n * once (never materializing the whole tree). Mirrors the old\n * `selectedOAuthScopesForPaths`: base scopes + full-graph scopes + requested\n * scopes + the delegated permission scopes of every kept operation. `keepPathItem`\n * (when present) restricts the walk to the filtered operation set, exactly as the\n * old code computed scopes over the already-filtered paths.\n */\nconst streamSelectedScopes = (\n  structure: SpecStructure,\n  requestedScopes: readonly string[],\n  fullGraphScopes: readonly string[],\n  keepPathItem?: KeepPathItem,\n): readonly string[] => {\n  const collected = [\n    ...MICROSOFT_GRAPH_BASE_SCOPES,\n    ...fullGraphScopes,\n    ...requestedScopes.filter((scope) => !REQUEST_BASE_SCOPES.has(scope)),\n  ];\n  for (const range of structure.pathItems) {\n    const entry = parseEntry(structure.text, range, 2);\n    if (!entry) continue;\n    const [path, rawItem] = entry;\n    if (!isRecord(rawItem)) continue;\n    const pathItem = keepPathItem ? keepPathItem(path, rawItem) : rawItem;\n    if (!pathItem) continue;\n    for (const [method, operation] of Object.entries(pathItem)) {\n      if (HTTP_METHODS.has(method.toLowerCase()) && isRecord(operation)) {\n        collected.push(...permissionScopes(operation, { delegatedOnly: true }));\n      }\n    }\n  }\n  return uniqueStrings(collected);\n};\n\nexport const buildMicrosoftGraphOpenApiSpec = (\n  input: MicrosoftGraphSelectionInput,\n  httpClientLayer: Layer.Layer<HttpClient.HttpClient, never, never>,\n  urlPolicy?: MicrosoftGraphUrlPolicy,\n): Effect.Effect<MicrosoftGraphSpecBuild, OpenApiParseError> =>\n  Effect.gen(function* () {\n    const selection = yield* validateSelectionUrls(normalizeSelection(input), urlPolicy);\n    const sourceText = yield* fetchMicrosoftGraphOpenApiSpec(selection.specUrl).pipe(\n      Effect.provide(httpClientLayer),\n    );\n\n    // Structural split is the only entry point: parsing the whole 37MB tree\n    // OOMs the 128MB Workers isolate (measured: HTTP 503). No fallback. A spec\n    // outside the streamable block-YAML profile is a hard error on this path;\n    // arbitrary user specs still go through the generic openapi plugin.\n    const structure = structuralSplit(sourceText);\n    if (!structure) {\n      return yield* new OpenApiParseError({\n        message:\n          \"Microsoft Graph OpenAPI document is not in the streamable block-YAML profile; cannot compile it in-band on Workers.\",\n      });\n    }\n\n    // Head + small components (servers + securitySchemes) parse cheaply and\n    // carry everything `resolveOAuthEndpoints` needs.\n    const headDoc = { ...parseHead(structure), components: parseSmallComponents(structure) };\n    const endpoints = yield* validateResolvedOAuthEndpoints(\n      resolveOAuthEndpoints(headDoc, selection),\n      urlPolicy,\n    );\n\n    const permissionsReference =\n      selection.coversFullGraph === true\n        ? yield* fetchMicrosoftGraphPermissionsReference().pipe(Effect.provide(httpClientLayer))\n        : undefined;\n    const fullGraphScopes = permissionsReference\n      ? parseMicrosoftGraphDelegatedScopes(permissionsReference)\n      : [];\n\n    const keepPathItem = microsoftGraphKeepPathItem(selection);\n    const scopes =\n      selection.coversFullGraph === true && selection.customScopes.length === 0\n        ? [...MICROSOFT_GRAPH_DELEGATED_DEFAULT_SCOPES]\n        : streamSelectedScopes(\n            structure,\n            selection.coversFullGraph === true\n              ? uniqueStrings([...MICROSOFT_GRAPH_BASE_SCOPES, ...selection.customScopes])\n              : selection.scopes,\n            fullGraphScopes,\n            keepPathItem,\n          );\n\n    return {\n      ...selection,\n      specText: sourceText,\n      scopes,\n      authorizationUrl: endpoints.authorizationUrl,\n      tokenUrl: endpoints.tokenUrl,\n      clientCredentialsTokenUrl: endpoints.clientCredentialsTokenUrl,\n      authenticationTemplate: microsoftOAuthTemplate(scopes, endpoints),\n    };\n  });\n","import { Effect } from \"effect\";\n\nimport type { SpecFormatAdapter } from \"../../sdk/spec-format\";\n\nimport { buildMicrosoftGraphOpenApiSpec, microsoftGraphKeepPathItem } from \"./graph\";\n\nconst graphCatalogSelection = (\n  rawUrl: string | undefined,\n): { readonly specUrl?: string; readonly presetIds?: readonly string[] } => {\n  if (!rawUrl || !URL.canParse(rawUrl)) return rawUrl ? { specUrl: rawUrl } : {};\n  const parsed = new URL(rawUrl);\n  const preset = parsed.hash.startsWith(\"#preset=\")\n    ? decodeURIComponent(parsed.hash.slice(\"#preset=\".length))\n    : \"\";\n  parsed.hash = \"\";\n  return {\n    specUrl: parsed.toString(),\n    ...(preset.length > 0 ? { presetIds: [preset] } : {}),\n  };\n};\n\nexport const microsoftGraphAdapter: SpecFormatAdapter = {\n  id: \"microsoft-graph\",\n  fetch: (input) =>\n    buildMicrosoftGraphOpenApiSpec(\n      graphCatalogSelection(input.urls[0]),\n      input.httpClientLayer,\n    ).pipe(\n      Effect.map((graphSpec) => ({\n        specText: graphSpec.specText,\n        specUrl: graphSpec.specUrl,\n        baseUrl: graphSpec.baseUrl,\n        authenticationTemplate: graphSpec.authenticationTemplate,\n        // Stream the full Graph source straight to persisted bindings. This is\n        // the measured Workers contention/OOM path from the Microsoft plugin:\n        // structural split stays serial and avoids materializing the 37MB tree.\n        keepPathItem: microsoftGraphKeepPathItem(graphSpec),\n        config: {\n          microsoftGraphPresetIds: graphSpec.presetIds,\n          microsoftGraphCustomScopes: graphSpec.customScopes,\n          microsoftGraphScopes: graphSpec.scopes,\n          microsoftGraphExactPaths: graphSpec.exactPaths,\n          microsoftGraphPathPrefixes: graphSpec.pathPrefixes,\n          microsoftGraphTagPrefixes: graphSpec.tagPrefixes,\n          microsoftGraphCoversFullGraph: graphSpec.coversFullGraph,\n          microsoftGraphAuthorizationUrl: graphSpec.authorizationUrl,\n          microsoftGraphTokenUrl: graphSpec.tokenUrl,\n          microsoftGraphClientCredentialsTokenUrl: graphSpec.clientCredentialsTokenUrl,\n        },\n      })),\n    ),\n};\n"],"mappings":";;;;;;;;;;;;AA+BA,IAAM,WAAW,CAAC,SAAiB,4BAA4B,IAAI;AAE5D,IAAM,8BACX;AACK,IAAM,4CACX;AACK,IAAM,2BAA2B;AACjC,IAAM,8BACX;AACK,IAAM,sBAAsB;AAC5B,IAAM,+BAA+B;AACrC,IAAM,kDAAkD;AACxD,IAAM,8BAAiD,CAAC,gBAAgB;AACxE,IAAM,iCAAiC;AACvC,IAAM,gCAAgC;AACtC,IAAM,2CAA8D;AAAA,EACzE,GAAG;AAAA,EACH;AAAA,EACA;AACF;AACO,IAAM,4CAA+D;AAAA,EAC1E;AACF;AAEO,IAAM,4BAA4B;AAElC,IAAM,uBAA6C;AAAA,EACxD,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,SAAS;AAAA,EACT,UAAU;AACZ;AAEO,IAAM,6BAAmE;AAAA,EAC9E;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,WAAW;AAAA,IACpB,YAAY,CAAC,OAAO,aAAa,kBAAkB;AAAA,IACnD,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,WAAW;AAAA,IACpB,cAAc,CAAC,KAAK;AAAA,IACpB,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,mBAAmB;AAAA,IAClC,QAAQ,CAAC,kBAAkB,aAAa,2BAA2B;AAAA,IACnE,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,mBAAmB;AAAA,IAClC,QAAQ,CAAC,qBAAqB;AAAA,IAC9B,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,mBAAmB;AAAA,IAClC,QAAQ,CAAC,sBAAsB,iBAAiB;AAAA,IAChD,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,gBAAgB;AAAA,IAC/B,QAAQ,CAAC,iBAAiB;AAAA,IAC1B,cAAc,CAAC,YAAY,uBAAuB;AAAA,IAClD,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,iBAAiB;AAAA,IAC1B,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,oBAAoB;AAAA,IACnC,QAAQ,CAAC,uBAAuB,qBAAqB;AAAA,IACrD,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,iBAAiB;AAAA,IAChC,QAAQ,CAAC,qBAAqB;AAAA,IAC9B,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,sBAAsB;AAAA,IACrC,QAAQ,CAAC,qBAAqB;AAAA,IAC9B,cAAc,CAAC,QAAQ;AAAA,IACvB,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,mBAAmB;AAAA,IAClC,QAAQ,CAAC,iBAAiB;AAAA,IAC1B,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,iBAAiB;AAAA,IAChC,QAAQ,CAAC,gBAAgB;AAAA,IACzB,cAAc,CAAC,aAAa,QAAQ;AAAA,IACpC,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,iBAAiB;AAAA,IAChC,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,iBAAiB;AAAA,IAChC,QAAQ,CAAC,0BAA0B;AAAA,IACnC,cAAc,CAAC,mBAAmB,sBAAsB,iCAAiC;AAAA,IACzF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,sBAAsB,oBAAoB;AAAA,IACnD,cAAc,CAAC,UAAU,iDAAiD;AAAA,IAC1E,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,uBAAuB,oBAAoB;AAAA,IACpD,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,oBAAoB;AAAA,IAC7B,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,6BAA6B,iCAAiC;AAAA,IACvE,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,sCAAsC,+BAA+B;AAAA,IAC9E,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,qBAAqB,kBAAkB;AAAA,IAChD,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,yBAAyB;AAAA,IAClC,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,sCAAsC,8CAA8C;AAAA,IAC7F,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC;AAAA,IACT,cAAc,CAAC,YAAY;AAAA,IAC3B,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,yBAAyB,oBAAoB,qBAAqB,cAAc;AAAA,IACzF,cAAc,CAAC,SAAS;AAAA,IACxB,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,wCAAwC,gCAAgC;AAAA,IACjF,cAAc,CAAC,gBAAgB,WAAW;AAAA,IAC1C,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC;AAAA,IACT,cAAc,CAAC,YAAY,uBAAuB,YAAY;AAAA,IAC9D,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,SAAS,WAAW;AAAA,IAC1B,QAAQ,CAAC,kBAAkB,uBAAuB;AAAA,IAClD,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AACF;AAEO,IAAM,qCAAwD;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,iCAAoD,2BAA2B;AAAA,EAC1F,CAAC,WAAW,OAAO;AACrB;AAEA,IAAM,gBAAgB,CAAC,WAAgD;AACrE,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,KAAK,IAAI,OAAO,EAAG;AACnC,SAAK,IAAI,OAAO;AAChB,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEO,IAAM,4BAA4B,CACvC,aAEA,2BAA2B,KAAK,CAAC,WAAW,OAAO,OAAO,QAAQ;AAE7D,IAAM,wCAAwC,CAAC,cAAyC;AAC7F,QAAM,WAAW,oBAAI,IAAI,CAAC,GAAG,SAAS,CAAC;AACvC,SAAO,2BAA2B,MAAM,CAAC,WAAW,SAAS,IAAI,OAAO,EAAE,CAAC;AAC7E;AAEO,IAAM,mCAAmC,CAC9C,WACA,eAAiC,CAAC,MAElC,cAAc;AAAA,EACZ,GAAG;AAAA,EACH;AAAA,EACA,GAAG,CAAC,GAAG,SAAS,EAAE,QAAQ,CAAC,aAAa,0BAA0B,QAAQ,GAAG,UAAU,CAAC,CAAC;AAAA,EACzF,GAAG;AACL,CAAC;AAEI,IAAM,uCAAuC,CAClD,cAEA;AAAA,EACE,CAAC,GAAG,SAAS,EAAE,QAAQ,CAAC,aAAa,0BAA0B,QAAQ,GAAG,cAAc,CAAC,CAAC;AAC5F;AAEK,IAAM,yCAAyC,CACpD,cAEA;AAAA,EACE,CAAC,GAAG,SAAS,EAAE,QAAQ,CAAC,aAAa,0BAA0B,QAAQ,GAAG,gBAAgB,CAAC,CAAC;AAC9F;AAEK,IAAM,wCAAwC,CACnD,cAEA;AAAA,EACE,CAAC,GAAG,SAAS,EAAE,QAAQ,CAAC,aAAa,0BAA0B,QAAQ,GAAG,eAAe,CAAC,CAAC;AAC7F;AAEK,IAAM,uBAAuB,CAAC,aACnC,aAAa,SAAS,WAAW,KAAK,GAAG,CAAC;AAE5C,IAAM,2BAA2B,CAAC,aAChC,GAAG,2BAA2B,WAAW,mBAAmB,QAAQ,CAAC;AAEvE,IAAM,oCAAoC,CAAC,WAAsC;AAAA,EAC/E;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,QAAQ,iCAAiC,CAAC,OAAO,EAAE,CAAC;AAAA,EACtD;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,QAAQ,CAAC,GAAG,yCAAyC;AAAA,EACvD;AACF;AAEO,IAAM,mBAAiD,2BAA2B;AAAA,EACvF,CAAC,YAAY;AAAA,IACX,IAAI,aAAa,OAAO,EAAE;AAAA,IAC1B,MAAM,OAAO;AAAA,IACb,SAAS,OAAO;AAAA,IAChB,KAAK,yBAAyB,OAAO,EAAE;AAAA,IACvC,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,IAC3C,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,IACvD,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,aAAa,qBAAqB,OAAO,EAAE;AAAA,IAC3C,cAAc,kCAAkC,MAAM;AAAA,IACtD,GAAI,OAAO,OAAO,YAAY,EAAE,aAAa,EAAE,WAAW,aAAa,EAAE,IAAI,CAAC;AAAA,EAChF;AACF;;;ACljBA,SAAS,QAAQ,QAAQ,cAAc;AAEvC,SAAS,YAAY,yBAAyB;AAE9C,SAAS,wBAAwB;AAkFjC,IAAM,wCAAwC,OAAO,OAAO;AAAA,EAC1D,UAAU,OAAO,SAAS,OAAO,MAAM;AAAA,EACvC,SAAS,OAAO,SAAS,OAAO,MAAM;AAAA,EACtC,SAAS,OAAO,SAAS,OAAO,MAAM;AAAA,EACtC,SAAS,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,CAAC;AAAA,EACpE,aAAa,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,CAAC;AAAA,EACxE,wBAAwB,OAAO,SAAS,OAAO,MAAM,oBAAoB,CAAC;AAAA,EAC1E,yBAAyB,OAAO,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC;AAAA,EACpE,4BAA4B,OAAO,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC;AAAA,EACvE,sBAAsB,OAAO,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC;AAAA,EACjE,0BAA0B,OAAO,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC;AAAA,EACrE,4BAA4B,OAAO,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC;AAAA,EACvE,2BAA2B,OAAO,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC;AAAA,EACtE,+BAA+B,OAAO,SAAS,OAAO,OAAO;AAAA,EAC7D,gCAAgC,OAAO,SAAS,OAAO,MAAM;AAAA,EAC7D,wBAAwB,OAAO,SAAS,OAAO,MAAM;AAAA,EACrD,yCAAyC,OAAO,SAAS,OAAO,MAAM;AACxE,CAAC;AAED,IAAM,wBAAwB,OAAO,oBAAoB,qCAAqC;AAEvF,IAAM,wCAAwC,CACnD,UAEA,OAAO,UAAU,sBAAsB,KAAK,CAAC;AAE/C,IAAM,gBAAgB,CAAC,WAAgD;AACrE,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,KAAK,IAAI,OAAO,EAAG;AACnC,SAAK,IAAI,OAAO;AAChB,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEA,IAAM,qBAAqB,CAAC,UAAwC;AAClE,QAAM,YAAY;AAAA,IAChB,MAAM,aAAa,MAAM,UAAU,SAAS,IACxC,MAAM,YACN;AAAA,EACN;AACA,QAAM,eAAe,cAAc,MAAM,gBAAgB,CAAC,CAAC;AAC3D,QAAM,SAAS,iCAAiC,WAAW,YAAY;AACvE,QAAM,aAAa,qCAAqC,SAAS;AACjE,QAAM,eAAe,uCAAuC,SAAS;AACrE,QAAM,cAAc,sCAAsC,SAAS;AACnE,QAAM,kBAAkB,sCAAsC,SAAS;AACvE,QAAM,UAAU,MAAM,SAAS,KAAK,KAAK;AACzC,QAAM,UAAU,MAAM,SAAS,KAAK,KAAK;AACzC,QAAM,mBAAmB,MAAM,kBAAkB,KAAK,KAAK;AAC3D,QAAM,WAAW,MAAM,UAAU,KAAK,KAAK;AAC3C,QAAM,4BAA4B,MAAM,2BAA2B,KAAK,KAAK;AAC7E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAQA,IAAM,yBAAyB,CAC7B,QACA,cAC8B;AAAA,EAC9B;AAAA,IACE,MAAM,iBAAiB,KAAK,4BAA4B;AAAA,IACxD,MAAM;AAAA,IACN,kBAAkB,UAAU;AAAA,IAC5B,UAAU,UAAU;AAAA,IACpB;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM,iBAAiB,KAAK,+CAA+C;AAAA,IAC3E,MAAM;AAAA,IACN,kBAAkB,UAAU;AAAA,IAC5B,UAAU,UAAU;AAAA,IACpB,QAAQ,CAAC,GAAG,yCAAyC;AAAA,EACvD;AACF;AAEA,IAAM,WAAW,CAAC,UAChB,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAErE,IAAM,eAAe,oBAAI,IAAI,CAAC,UAAU,OAAO,SAAS,QAAQ,KAAK,CAAC;AACtE,IAAM,sBAAsB,oBAAI,IAAI,CAAC,kBAAkB,UAAU,WAAW,OAAO,CAAC;AACpF,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,cAAc,CAAC,WACnB,OAAO,KAAK,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC;AAE9F,IAAM,uBAAuB,CAAC,UAA8B;AAC1D,MAAI,CAAC,IAAI,SAAS,KAAK,EAAG,QAAO;AACjC,QAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,MAAI,OAAO,aAAa,YAAY,OAAO,YAAY,OAAO,YAAY,OAAO,MAAM;AACrF,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAMA,IAAM,qBAAqB,CAAC,aAA8B;AACxD,QAAM,QAAQ,SAAS,YAAY;AACnC,SAAO,UAAU,eAAe,UAAU,eAAe,UAAU,SAAS,UAAU;AACxF;AAEA,IAAM,8BAA8B,CAAC,UAA8B;AACjE,MAAI,CAAC,IAAI,SAAS,KAAK,EAAG,QAAO;AACjC,QAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,MAAI,OAAO,aAAa,WAAW,OAAO,YAAY,OAAO,YAAY,OAAO,MAAM;AACpF,WAAO;AAAA,EACT;AACA,SAAO,mBAAmB,OAAO,QAAQ,IAAI,SAAS;AACxD;AAOA,IAAM,iBAAiB,CACrB,OACA,WAC8B;AAC9B,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,QAAQ,4BAA4B,KAAM,QAAO;AACrD,SAAO,qBAAqB,KAAK,KAAK,4BAA4B,KAAK,IAAI,QAAQ;AACrF;AAEA,IAAM,iCAAiC,CACrC,OACA,WACkB;AAClB,MAAI,UAAU,4BAA6B,QAAO;AAClD,SAAO,eAAe,OAAO,MAAM,KAAK;AAC1C;AAEA,IAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,iCAAiC,CACrC,OACA,WAC8B;AAC9B,QAAM,SAAS,eAAe,OAAO,MAAM;AAC3C,MAAI,WAAW,KAAM,QAAO;AAC5B,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS,qBAAqB,KAAK;AACzC,MAAI,CAAC,UAAU,CAAC,sBAAsB,IAAI,OAAO,SAAS,YAAY,CAAC,EAAG,QAAO;AACjF,MAAI,CAAC,4BAA4B,KAAK,OAAO,QAAQ,EAAG,QAAO;AAC/D,MAAI,OAAO,OAAQ,QAAO;AAC1B,SAAO,OAAO,SAAS,EAAE,QAAQ,OAAO,EAAE;AAC5C;AAEA,IAAM,2BAA2B,oBAAI,IAAI;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,qCAAqC,CACzC,OACA,UACA,WACkB;AAClB,QAAM,SAAS,eAAe,OAAO,MAAM;AAC3C,MAAI,WAAW,KAAM,QAAO,UAAU;AACtC,QAAM,SAAS,qBAAqB,KAAK;AACzC,MAAI,CAAC,UAAU,CAAC,yBAAyB,IAAI,OAAO,SAAS,YAAY,CAAC,EAAG,QAAO;AACpF,MAAI,OAAO,OAAQ,QAAO;AAC1B,QAAM,SAAS,aAAa,cAAc,cAAc;AACxD,SAAO,gDAAgD,KAAK,OAAO,QAAQ,KACzE,OAAO,SAAS,SAAS,IAAI,MAAM,EAAE,IACnC,OAAO,SAAS,IAChB;AACN;AAEA,IAAM,wBAAwB,CAC5B,WACA,WAEA,OAAO,IAAI,aAAa;AACtB,QAAM,UAAU,+BAA+B,UAAU,SAAS,MAAM;AACxE,MAAI,CAAC,SAAS;AACZ,WAAO,OAAO,IAAI,kBAAkB;AAAA,MAClC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,UAAU,+BAA+B,UAAU,SAAS,MAAM;AACxE,MAAI,YAAY,MAAM;AACpB,WAAO,OAAO,IAAI,kBAAkB;AAAA,MAClC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,mBAAmB,UAAU,mBAC/B,mCAAmC,UAAU,kBAAkB,aAAa,MAAM,IAClF;AACJ,MAAI,UAAU,oBAAoB,CAAC,kBAAkB;AACnD,WAAO,OAAO,IAAI,kBAAkB;AAAA,MAClC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,WAAW,UAAU,WACvB,mCAAmC,UAAU,UAAU,SAAS,MAAM,IACtE;AACJ,MAAI,UAAU,YAAY,CAAC,UAAU;AACnC,WAAO,OAAO,IAAI,kBAAkB;AAAA,MAClC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,4BAA4B,UAAU,4BACxC,mCAAmC,UAAU,2BAA2B,SAAS,MAAM,IACvF;AACJ,MAAI,UAAU,6BAA6B,CAAC,2BAA2B;AACrE,WAAO,OAAO,IAAI,kBAAkB;AAAA,MAClC,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,GAAI,UAAU,EAAE,QAAQ,IAAI,EAAE,SAAS,OAAU;AAAA,IACjD,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,EAAE,kBAAkB,OAAU;AAAA,IAC5E,GAAI,WAAW,EAAE,SAAS,IAAI,EAAE,UAAU,OAAU;AAAA,IACpD,GAAI,4BACA,EAAE,0BAA0B,IAC5B,EAAE,2BAA2B,OAAU;AAAA,EAC7C;AACF,CAAC;AAEH,IAAM,iCAAiC,CACrC,WACA,WAEA,OAAO,IAAI,aAAa;AACtB,QAAM,mBAAmB;AAAA,IACvB,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,mCAAmC,UAAU,UAAU,SAAS,MAAM;AACvF,QAAM,4BAA4B;AAAA,IAChC,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,2BAA2B;AAChE,WAAO,OAAO,IAAI,kBAAkB;AAAA,MAClC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO,EAAE,kBAAkB,UAAU,0BAA0B;AACjE,CAAC;AAEH,IAAM,eAAe,CAAC,UACpB,SAAS,KAAK,IAAI,OAAO,OAAO,KAAK,IAAI,CAAC;AAE5C,IAAM,kBAAkB,CAAC,WAAwE;AAC/F,QAAM,aAAa,SAAS,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;AACtE,QAAM,kBAAkB,SAAS,WAAW,eAAe,IAAI,WAAW,kBAAkB,CAAC;AAC7F,SAAO,aAAa,eAAe,EAChC,OAAO,QAAQ,EACf,OAAO,CAAC,WAAW,OAAO,SAAS,QAAQ,EAC3C,QAAQ,CAAC,WAAW,aAAa,OAAO,KAAK,EAAE,OAAO,QAAQ,CAAC;AACpE;AAEA,IAAM,wBAAwB,CAC5B,QACA,cAK4B;AAC5B,QAAM,QAAQ,gBAAgB,MAAM;AACpC,QAAM,oBAAoB,MAAM,KAAK,CAAC,SAAS,KAAK,qBAAqB,MAAS;AAClF,QAAM,oBAAoB,MAAM;AAAA,IAC9B,CAAC,SAAS,KAAK,aAAa,UAAa,KAAK,qBAAqB;AAAA,EACrE;AACA,QAAM,mBACJ,UAAU,qBACT,SAAS,iBAAiB,IAAI,YAAY,CAAC,kBAAkB,gBAAgB,CAAC,IAAI,WACnF;AACF,QAAM,WACJ,UAAU,aACT,SAAS,iBAAiB,IAAI,YAAY,CAAC,kBAAkB,QAAQ,CAAC,IAAI,WAC3E,YAAY,MAAM,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,KAC9C;AACF,QAAM,4BACJ,UAAU,8BACT,SAAS,iBAAiB,IAAI,YAAY,CAAC,kBAAkB,QAAQ,CAAC,IAAI,WAC3E;AACF,SAAO,EAAE,kBAAkB,UAAU,0BAA0B;AACjE;AAEA,IAAM,yBAAyB,CAAC,SAAoC;AAClE,QAAM,iBAAiB,KAAK,QAAQ,2BAA2B,EAAE;AACjE,SAAO,mBAAmB,OAAO,CAAC,MAAM,QAAQ,IAAI,EAAE,IAAI,CAAC,MAAM,cAAc;AACjF;AAEA,IAAM,mBAAmB,CACvB,MACA,YACA,iBACY;AACZ,QAAM,WAAW,uBAAuB,IAAI;AAC5C,MAAI,SAAS,KAAK,CAAC,YAAY,WAAW,IAAI,OAAO,CAAC,EAAG,QAAO;AAChE,SAAO,SAAS;AAAA,IAAK,CAAC,YACpB,aAAa;AAAA,MACX,CAAC,WACC,YAAY,UAAU,QAAQ,WAAW,GAAG,MAAM,GAAG,KAAK,QAAQ,WAAW,GAAG,MAAM,GAAG;AAAA,IAC7F;AAAA,EACF;AACF;AAEA,IAAM,uBAAuB,CAAC,SAC5B,uBAAuB,IAAI,EAAE,KAAK,CAAC,YAAY,YAAY,KAAK;AAElE,IAAM,gBAAgB,CAAC,cACrB,MAAM,QAAQ,UAAU,IAAI,IACxB,UAAU,KAAK,OAAO,CAAC,QAAuB,OAAO,QAAQ,QAAQ,IACrE,CAAC;AAEP,IAAM,4BAA4B,CAChC,WACA,gBAEA,YAAY,SAAS,KACrB,cAAc,SAAS,EAAE;AAAA,EAAK,CAAC,QAC7B,YAAY,KAAK,CAAC,WAAW,QAAQ,UAAU,IAAI,WAAW,MAAM,CAAC;AACvE;AAEF,IAAM,yBAAyB,CAAC,UAC9B,MAAM,WAAW,8BAA8B,KAC/C,mDAAmD,KAAK,KAAK;AAExD,IAAM,qCAAqC,CAChD,yBAEA;AAAA,EACE,qBAAqB,MAAM,cAAc,EAAE,QAAQ,CAAC,YAAY;AAC9D,UAAM,QAAQ,QAAQ,MAAM,mBAAmB,IAAI,CAAC,GAAG,KAAK;AAC5D,QAAI,CAAC,SAAS,CAAC,uBAAuB,KAAK,EAAG,QAAO,CAAC;AACtD,UAAM,gBAAgB,QAAQ,MAAM,gDAAgD;AACpF,UAAM,sBAAsB,gBAAgB,CAAC,GAAG,KAAK;AACrD,WAAO,uBAAuB,wBAAwB,MAAM,CAAC,KAAK,IAAI,CAAC;AAAA,EACzE,CAAC;AACH;AAEF,IAAM,sBAAsB,CAAC,UAAsC;AACjE,MAAI,OAAO,UAAU,SAAU,QAAO,uBAAuB,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AACjF,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,QAAQ,mBAAmB;AAClE,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO,CAAC;AAC9B,SAAO,OAAO,OAAO,KAAK,EAAE,QAAQ,mBAAmB;AACzD;AAEA,IAAM,iBAAiB,CACrB,OACA,YACsB;AACtB,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,QAAQ,CAAC,UAAU;AAC9B,QAAI,CAAC,SAAS,KAAK,EAAG,QAAO,CAAC;AAC9B,WAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,MAAM,MAAM;AACzD,YAAM,cAAc,OAAO,YAAY;AACvC,UAAI,SAAS,iBAAiB,YAAY,SAAS,KAAK,EAAG,QAAO,CAAC;AACnE,UAAI,SAAS,iBAAiB,YAAY,SAAS,aAAa,EAAG,QAAO,CAAC;AAC3E,aAAO,MAAM,QAAQ,MAAM,IACvB,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IACnE,CAAC;AAAA,IACP,CAAC;AAAA,EACH,CAAC;AACH;AAEA,IAAM,mBAAmB,CACvB,WACA,YACsB;AACtB,QAAM,iBAAiB,SAAS,UAAU,kBAAkB,CAAC,IACzD,UAAU,kBAAkB,IAC5B,CAAC;AACL,QAAM,kBAAkB,SAAS,gBAC7B,oBAAoB;AAAA,IAClB,WAAW,eAAe;AAAA,IAC1B,0BAA0B,eAAe;AAAA,EAC3C,CAAC,IACD,oBAAoB,cAAc;AACtC,SAAO,cAAc,CAAC,GAAG,eAAe,UAAU,UAAU,OAAO,GAAG,GAAG,eAAe,CAAC;AAC3F;AAEA,IAAM,wBAAwB,CAC5B,WACA,mBAEA,iBAAiB,SAAS,EAAE;AAAA,EAC1B,CAAC,UAAU,eAAe,IAAI,KAAK,KAAK,CAAC,0BAA0B,IAAI,KAAK;AAC9E;AAEF,IAAM,iBAAiB,CACrB,MACA,UACA,YAMmC;AAGnC,QAAM,uBAAuB,iBAAiB,MAAM,QAAQ,YAAY,QAAQ,YAAY;AAC5F,QAAM,wBAAwB,CAAC,wBAAwB,qBAAqB,IAAI;AAChF,QAAM,OAAgC,CAAC;AACvC,MAAI,eAAe;AAEnB,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAM,WAAW,IAAI,YAAY;AACjC,QAAI,CAAC,aAAa,IAAI,QAAQ,EAAG;AACjC,QAAI,CAAC,SAAS,KAAK,EAAG;AACtB,QAAI,yBAAyB,aAAa,MAAO;AACjD,QACE,wBACA,yBACA,0BAA0B,OAAO,QAAQ,WAAW,KACpD,sBAAsB,OAAO,QAAQ,cAAc,GACnD;AACA,WAAK,GAAG,IAAI;AACZ,qBAAe;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,CAAC,aAAc,QAAO;AAC1B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,QAAI,CAAC,aAAa,IAAI,IAAI,YAAY,CAAC,EAAG,MAAK,GAAG,IAAI;AAAA,EACxD;AACA,SAAO;AACT;AAEA,IAAM,sBAAsB,CAAC,cAC3B,UAAU,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY,KAAK;AAEnD,IAAM,uBAAuB,CAAC,WAC5B,SAAS,MAAM,MACd,OAAO,SAAS,YAAa,MAAM,QAAQ,OAAO,IAAI,KAAK,OAAO,KAAK,SAAS,QAAQ,OACxF,OAAO,WAAW,YAAY,OAAO,WAAW;AAInD,IAAM,qBAAqB,CAAC,WAC1B,UAAU,KAAK,MAAM,KAAK,SAAS,KAAK,MAAM;AAOhD,IAAM,yCAAyC,CAC7C,aAC4B;AAC5B,MAAI,UAAU;AACd,QAAM,OAAgC,EAAE,GAAG,SAAS;AAEpD,aAAW,CAAC,KAAK,SAAS,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACvD,QAAI,CAAC,aAAa,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,SAAS,SAAS,EAAG;AAClE,UAAM,YAAY,SAAS,UAAU,SAAS,IAAI,UAAU,YAAY;AACxE,QAAI,CAAC,UAAW;AAEhB,QAAI,mBAAmB;AACvB,UAAM,gBAAyC,EAAE,GAAG,UAAU;AAC9D,eAAW,CAAC,QAAQ,QAAQ,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC1D,UAAI,CAAC,mBAAmB,MAAM,KAAK,CAAC,SAAS,QAAQ,EAAG;AACxD,YAAM,UAAU,SAAS,SAAS,OAAO,IAAI,SAAS,UAAU;AAChE,UAAI,CAAC,QAAS;AAEd,UAAI,iBAAiB;AACrB,YAAM,cAAuC,EAAE,GAAG,QAAQ;AAC1D,iBAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AACxD,YAAI,oBAAoB,SAAS,MAAM,2BAA4B;AACnE,cAAM,SAAS,SAAS,KAAK,IAAI,MAAM,SAAS;AAChD,YAAI,qBAAqB,MAAM,EAAG;AAClC,oBAAY,SAAS,IAAI;AAAA,UACvB,GAAI,SAAS,KAAK,IAAI,QAAQ,CAAC;AAAA,UAC/B,QAAQ,EAAE,MAAM,UAAU,QAAQ,SAAS;AAAA,QAC7C;AACA,yBAAiB;AAAA,MACnB;AAEA,UAAI,gBAAgB;AAClB,sBAAc,MAAM,IAAI,EAAE,GAAG,UAAU,SAAS,YAAY;AAC5D,2BAAmB;AAAA,MACrB;AAAA,IACF;AAEA,QAAI,kBAAkB;AACpB,WAAK,GAAG,IAAI,EAAE,GAAG,WAAW,WAAW,cAAc;AACrD,gBAAU;AAAA,IACZ;AAAA,EACF;AAEA,SAAO,UAAU,OAAO;AAC1B;AAEO,IAAM,iCAAiC,OAAO,GAAG,iCAAiC;AAAA,EACvF,WAAW,SAAiB;AAC1B,UAAM,SAAS,OAAO,WAAW;AACjC,UAAM,WAAW,OAAO,OACrB;AAAA,MACC,kBAAkB,IAAI,OAAO,EAAE;AAAA,QAC7B,kBAAkB,UAAU,UAAU,kCAAkC;AAAA,MAC1E;AAAA,IACF,EACC;AAAA,MACC,OAAO;AAAA,QACL,MACE,IAAI,kBAAkB;AAAA,UACpB,SAAS;AAAA,QACX,CAAC;AAAA,MACL;AAAA,IACF;AACF,QAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AACnD,aAAO,OAAO,IAAI,kBAAkB;AAAA,QAClC,SAAS,0DAA0D,SAAS,MAAM;AAAA,MACpF,CAAC;AAAA,IACH;AACA,WAAO,OAAO,SAAS,KAAK;AAAA,MAC1B,OAAO;AAAA,QACL,MACE,IAAI,kBAAkB;AAAA,UACpB,SAAS;AAAA,QACX,CAAC;AAAA,MACL;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,0CAA0C,OAAO;AAAA,EAC5D;AACF,EAAE,aAAa;AACb,QAAM,SAAS,OAAO,WAAW;AACjC,QAAM,WAAW,OAAO,OACrB;AAAA,IACC,kBAAkB,IAAI,yCAAyC,EAAE;AAAA,MAC/D,kBAAkB,UAAU,UAAU,gCAAgC;AAAA,IACxE;AAAA,EACF,EACC;AAAA,IACC,OAAO;AAAA,MACL,MACE,IAAI,kBAAkB;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACL;AAAA,EACF;AACF,MAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AACnD,WAAO,OAAO,IAAI,kBAAkB;AAAA,MAClC,SAAS,+DAA+D,SAAS,MAAM;AAAA,IACzF,CAAC;AAAA,EACH;AACA,SAAO,OAAO,SAAS,KAAK;AAAA,IAC1B,OAAO;AAAA,MACL,MACE,IAAI,kBAAkB;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACL;AAAA,EACF;AACF,CAAC;AAYM,IAAM,6BAA6B,CAAC,cAOvB;AAClB,QAAM,aAAa,IAAI,IAAI,UAAU,UAAU;AAC/C,QAAM,iBAAiB,IAAI;AAAA,IACzB,iCAAiC,UAAU,WAAW,UAAU,YAAY;AAAA,EAC9E;AACA,SAAO,CAAC,MAAM,aAAa;AACzB,UAAM,OAAO,UAAU,kBACnB,WACA,eAAe,MAAM,UAAU;AAAA,MAC7B;AAAA,MACA,cAAc,UAAU;AAAA,MACxB,aAAa,UAAU;AAAA,MACvB;AAAA,IACF,CAAC;AACL,WAAO,OAAO,uCAAuC,IAAI,IAAI;AAAA,EAC/D;AACF;AAUA,IAAM,uBAAuB,CAC3B,WACA,iBACA,iBACA,iBACsB;AACtB,QAAM,YAAY;AAAA,IAChB,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG,gBAAgB,OAAO,CAAC,UAAU,CAAC,oBAAoB,IAAI,KAAK,CAAC;AAAA,EACtE;AACA,aAAW,SAAS,UAAU,WAAW;AACvC,UAAM,QAAQ,WAAW,UAAU,MAAM,OAAO,CAAC;AACjD,QAAI,CAAC,MAAO;AACZ,UAAM,CAAC,MAAM,OAAO,IAAI;AACxB,QAAI,CAAC,SAAS,OAAO,EAAG;AACxB,UAAM,WAAW,eAAe,aAAa,MAAM,OAAO,IAAI;AAC9D,QAAI,CAAC,SAAU;AACf,eAAW,CAAC,QAAQ,SAAS,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC1D,UAAI,aAAa,IAAI,OAAO,YAAY,CAAC,KAAK,SAAS,SAAS,GAAG;AACjE,kBAAU,KAAK,GAAG,iBAAiB,WAAW,EAAE,eAAe,KAAK,CAAC,CAAC;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AACA,SAAO,cAAc,SAAS;AAChC;AAEO,IAAM,iCAAiC,CAC5C,OACA,iBACA,cAEA,OAAO,IAAI,aAAa;AACtB,QAAM,YAAY,OAAO,sBAAsB,mBAAmB,KAAK,GAAG,SAAS;AACnF,QAAM,aAAa,OAAO,+BAA+B,UAAU,OAAO,EAAE;AAAA,IAC1E,OAAO,QAAQ,eAAe;AAAA,EAChC;AAMA,QAAM,YAAY,gBAAgB,UAAU;AAC5C,MAAI,CAAC,WAAW;AACd,WAAO,OAAO,IAAI,kBAAkB;AAAA,MAClC,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AAIA,QAAM,UAAU,EAAE,GAAG,UAAU,SAAS,GAAG,YAAY,qBAAqB,SAAS,EAAE;AACvF,QAAM,YAAY,OAAO;AAAA,IACvB,sBAAsB,SAAS,SAAS;AAAA,IACxC;AAAA,EACF;AAEA,QAAM,uBACJ,UAAU,oBAAoB,OAC1B,OAAO,wCAAwC,EAAE,KAAK,OAAO,QAAQ,eAAe,CAAC,IACrF;AACN,QAAM,kBAAkB,uBACpB,mCAAmC,oBAAoB,IACvD,CAAC;AAEL,QAAM,eAAe,2BAA2B,SAAS;AACzD,QAAM,SACJ,UAAU,oBAAoB,QAAQ,UAAU,aAAa,WAAW,IACpE,CAAC,GAAG,wCAAwC,IAC5C;AAAA,IACE;AAAA,IACA,UAAU,oBAAoB,OAC1B,cAAc,CAAC,GAAG,6BAA6B,GAAG,UAAU,YAAY,CAAC,IACzE,UAAU;AAAA,IACd;AAAA,IACA;AAAA,EACF;AAEN,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU;AAAA,IACV;AAAA,IACA,kBAAkB,UAAU;AAAA,IAC5B,UAAU,UAAU;AAAA,IACpB,2BAA2B,UAAU;AAAA,IACrC,wBAAwB,uBAAuB,QAAQ,SAAS;AAAA,EAClE;AACF,CAAC;;;AC/yBH,SAAS,UAAAA,eAAc;AAMvB,IAAM,wBAAwB,CAC5B,WAC0E;AAC1E,MAAI,CAAC,UAAU,CAAC,IAAI,SAAS,MAAM,EAAG,QAAO,SAAS,EAAE,SAAS,OAAO,IAAI,CAAC;AAC7E,QAAM,SAAS,IAAI,IAAI,MAAM;AAC7B,QAAM,SAAS,OAAO,KAAK,WAAW,UAAU,IAC5C,mBAAmB,OAAO,KAAK,MAAM,WAAW,MAAM,CAAC,IACvD;AACJ,SAAO,OAAO;AACd,SAAO;AAAA,IACL,SAAS,OAAO,SAAS;AAAA,IACzB,GAAI,OAAO,SAAS,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;AAAA,EACrD;AACF;AAEO,IAAM,wBAA2C;AAAA,EACtD,IAAI;AAAA,EACJ,OAAO,CAAC,UACN;AAAA,IACE,sBAAsB,MAAM,KAAK,CAAC,CAAC;AAAA,IACnC,MAAM;AAAA,EACR,EAAE;AAAA,IACAC,QAAO,IAAI,CAAC,eAAe;AAAA,MACzB,UAAU,UAAU;AAAA,MACpB,SAAS,UAAU;AAAA,MACnB,SAAS,UAAU;AAAA,MACnB,wBAAwB,UAAU;AAAA;AAAA;AAAA;AAAA,MAIlC,cAAc,2BAA2B,SAAS;AAAA,MAClD,QAAQ;AAAA,QACN,yBAAyB,UAAU;AAAA,QACnC,4BAA4B,UAAU;AAAA,QACtC,sBAAsB,UAAU;AAAA,QAChC,0BAA0B,UAAU;AAAA,QACpC,4BAA4B,UAAU;AAAA,QACtC,2BAA2B,UAAU;AAAA,QACrC,+BAA+B,UAAU;AAAA,QACzC,gCAAgC,UAAU;AAAA,QAC1C,wBAAwB,UAAU;AAAA,QAClC,yCAAyC,UAAU;AAAA,MACrD;AAAA,IACF,EAAE;AAAA,EACJ;AACJ;","names":["Effect","Effect"]}

package/dist/react/AddOpenApiIntegration.d.ts

@@ -0,0 +1,22 @@
+import { type HealthCheckCandidate, type HealthCheckSpec } from "@rafads/sdk/shared";
+export declare const baseUrlFromSpecInput: (input: string) => string;
+export declare const openApiPreviewFailureMessage: (message: string | null | undefined) => string;
+export declare function AddOpenApiHealthCheckSection(props: {
+    readonly presetHealthCheck?: HealthCheckSpec;
+    readonly candidates: readonly HealthCheckCandidate[];
+    readonly selected: HealthCheckCandidate | null;
+    readonly operation: string;
+    readonly onOperationChange: (operation: string) => void;
+    readonly identityField: string;
+    readonly onIdentityFieldChange: (field: string) => void;
+    readonly args: Record<string, string>;
+    readonly onArgChange: (name: string, value: string) => void;
+    readonly disabled: boolean;
+}): import("react/jsx-runtime").JSX.Element | null;
+export default function AddOpenApiIntegration(props: {
+    onComplete: (slug?: string) => void;
+    onCancel: () => void;
+    initialUrl?: string;
+    initialPreset?: string;
+    initialNamespace?: string;
+}): import("react/jsx-runtime").JSX.Element;

package/dist/react/AddOpenApiIntegration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/react/OpenApiAccountsPanel.d.ts

@@ -0,0 +1,6 @@
+import type { IntegrationAccountHandoff } from "@rafads/sdk/client";
+export default function OpenApiAccountsPanel(props: {
+    readonly integrationId: string;
+    readonly integrationName: string;
+    readonly accountHandoff?: IntegrationAccountHandoff | null;
+}): import("react/jsx-runtime").JSX.Element;

package/dist/react/OpenApiIntegrationDetailsFields.d.ts

@@ -0,0 +1,25 @@
+import { type FreeformComboboxOption } from "@rafads/react/components/combobox";
+import { type IntegrationIdentity } from "@rafads/react/plugins/integration-identity";
+export declare function OpenApiIntegrationDetailsFields(props: {
+    readonly title: string;
+    readonly subtitle?: string;
+    readonly identity: IntegrationIdentity;
+    /** The integration's agent-visible description (prefilled from the spec). */
+    readonly description?: string;
+    readonly onDescriptionChange?: (value: string) => void;
+    readonly baseUrl: string;
+    readonly onBaseUrlChange: (value: string) => void;
+    readonly baseUrlOptions?: readonly FreeformComboboxOption[];
+    readonly baseUrlLabel?: string;
+    readonly baseUrlPlaceholder?: string;
+    readonly baseUrlHint?: string;
+    readonly specUrl?: string;
+    readonly onSpecUrlChange?: (value: string) => void;
+    readonly faviconIcon?: string | null;
+    readonly faviconUrl?: string;
+    readonly namespaceReadOnly?: boolean;
+    readonly specUrlDisabled?: boolean;
+    readonly saveState?: "idle" | "saving" | "saved";
+    readonly baseUrlMissingMessage?: string;
+    readonly footer?: string;
+}): import("react/jsx-runtime").JSX.Element;

package/dist/react/UpdateSpecSection.d.ts

@@ -0,0 +1,2 @@
+import type { EditSheetSectionProps } from "@rafads/sdk/client";
+export default function UpdateSpecSection(props: EditSheetSectionProps): import("react/jsx-runtime").JSX.Element | null;

package/dist/react/atoms.d.ts

@@ -0,0 +1,317 @@
+import type { IntegrationSlug } from "@rafads/sdk/shared";
+import * as Atom from "effect/unstable/reactivity/Atom";
+export declare const openApiIntegrationAtom: (slug: IntegrationSlug) => Atom.Atom<import("effect/unstable/reactivity/AsyncResult").AsyncResult<{
+    readonly description: string;
+    readonly slug: string & import("effect/Brand").Brand<"IntegrationSlug">;
+    readonly kind: string;
+    readonly canRemove: boolean;
+    readonly canRefresh: boolean;
+} | null, import("@rafads/sdk").IntegrationAlreadyExistsError | import("@rafads/sdk").InternalError | import("../sdk").OpenApiParseError | import("../sdk").OpenApiExtractionError | import("../sdk").OpenApiOAuthError>>;
+export declare const openApiConfigAtom: (slug: IntegrationSlug) => Atom.Atom<import("effect/unstable/reactivity/AsyncResult").AsyncResult<{
+    readonly specUrl?: string | undefined;
+    readonly headers?: {
+        readonly [x: string]: string;
+    } | undefined;
+    readonly queryParams?: {
+        readonly [x: string]: string;
+    } | undefined;
+    readonly baseUrl?: string | undefined;
+    readonly authenticationTemplate?: readonly ({
+        readonly slug: string;
+        readonly kind: "apikey";
+        readonly placements: readonly {
+            readonly name: string;
+            readonly carrier: "header" | "query";
+            readonly variable?: string | undefined;
+            readonly prefix?: string | undefined;
+            readonly literal?: string | undefined;
+        }[];
+        readonly label?: string | undefined;
+    } | {
+        readonly slug: string;
+        readonly kind: "oauth2";
+        readonly authorizationUrl: string;
+        readonly tokenUrl: string;
+        readonly scopes: readonly string[];
+        readonly resource?: string | null | undefined;
+        readonly supportsClientIdMetadataDocument?: boolean | undefined;
+    })[] | undefined;
+} | null, import("@rafads/sdk").IntegrationAlreadyExistsError | import("@rafads/sdk").InternalError | import("../sdk").OpenApiParseError | import("../sdk").OpenApiExtractionError | import("../sdk").OpenApiOAuthError>>;
+export declare const previewOpenApiSpec: Atom.AtomResultFn<{
+    readonly payload: {
+        readonly spec: string;
+        readonly specFormat?: string | undefined;
+    };
+    readonly responseMode?: "decoded-only" | undefined;
+    readonly reactivityKeys?: readonly unknown[] | import("effect/Record").ReadonlyRecord<string, readonly unknown[]> | undefined;
+}, {
+    readonly version: import("effect/Option").Option<string>;
+    readonly description: import("effect/Option").Option<string>;
+    readonly title: import("effect/Option").Option<string>;
+    readonly servers: readonly {
+        readonly description: import("effect/Option").Option<string>;
+        readonly url: string;
+        readonly variables: import("effect/Option").Option<{
+            readonly [x: string]: {
+                readonly default: string;
+                readonly description: import("effect/Option").Option<string>;
+                readonly enum: import("effect/Option").Option<readonly string[]>;
+            };
+        }>;
+    }[];
+    readonly tags: readonly string[];
+    readonly securitySchemes: readonly {
+        readonly name: string;
+        readonly type: "oauth2" | "apiKey" | "http" | "openIdConnect";
+        readonly in: import("effect/Option").Option<"header" | "query" | "cookie">;
+        readonly description: import("effect/Option").Option<string>;
+        readonly scheme: import("effect/Option").Option<string>;
+        readonly bearerFormat: import("effect/Option").Option<string>;
+        readonly headerName: import("effect/Option").Option<string>;
+        readonly flows: import("effect/Option").Option<{
+            readonly authorizationCode: import("effect/Option").Option<{
+                readonly authorizationUrl: string;
+                readonly tokenUrl: string;
+                readonly scopes: {
+                    readonly [x: string]: string;
+                };
+                readonly refreshUrl: import("effect/Option").Option<string>;
+            }>;
+            readonly clientCredentials: import("effect/Option").Option<{
+                readonly tokenUrl: string;
+                readonly scopes: {
+                    readonly [x: string]: string;
+                };
+                readonly refreshUrl: import("effect/Option").Option<string>;
+            }>;
+        }>;
+        readonly openIdConnectUrl: import("effect/Option").Option<string>;
+    }[];
+    readonly authStrategies: readonly {
+        readonly schemes: readonly string[];
+    }[];
+    readonly headerPresets: readonly {
+        readonly label: string;
+        readonly headers: {
+            readonly [x: string]: string | null;
+        };
+        readonly secretHeaders: readonly string[];
+    }[];
+    readonly oauth2Presets: readonly {
+        readonly resource: import("effect/Option").Option<string>;
+        readonly label: string;
+        readonly authorizationUrl: import("effect/Option").Option<string>;
+        readonly tokenUrl: string;
+        readonly scopes: {
+            readonly [x: string]: string;
+        };
+        readonly refreshUrl: import("effect/Option").Option<string>;
+        readonly flow: "authorizationCode" | "clientCredentials";
+        readonly identityScopes: false | "auto" | readonly string[];
+        readonly securitySchemeName: string;
+        readonly supportsClientIdMetadataDocument?: boolean | undefined;
+    }[];
+    readonly healthCheckCandidates: readonly {
+        readonly operation: string;
+        readonly method: string;
+        readonly requiredArgCount: number;
+        readonly destructive: boolean;
+        readonly summary?: string | undefined;
+        readonly parameters?: readonly {
+            readonly name: string;
+            readonly required: boolean;
+            readonly location: string;
+            readonly description?: string | undefined;
+        }[] | undefined;
+        readonly responseFields?: readonly {
+            readonly type: string;
+            readonly path: string;
+        }[] | undefined;
+    }[];
+    readonly operationCount: number;
+}, import("@rafads/sdk").IntegrationAlreadyExistsError | import("@rafads/sdk").InternalError | import("../sdk").OpenApiParseError | import("../sdk").OpenApiExtractionError | import("../sdk").OpenApiOAuthError>;
+export declare const addOpenApiSpec: Atom.AtomResultFn<{
+    readonly payload: {
+        readonly spec: {
+            readonly kind: "url";
+            readonly url: string;
+        } | {
+            readonly value: string;
+            readonly kind: "blob";
+        };
+        readonly name?: string | undefined;
+        readonly description?: string | undefined;
+        readonly slug?: string | undefined;
+        readonly headers?: {
+            readonly [x: string]: string;
+        } | undefined;
+        readonly family?: string | undefined;
+        readonly queryParams?: {
+            readonly [x: string]: string;
+        } | undefined;
+        readonly baseUrl?: string | undefined;
+        readonly specFormat?: string | undefined;
+        readonly authenticationTemplate?: readonly ({
+            readonly type: "apiKey";
+            readonly slug?: string | undefined;
+            readonly label?: string | undefined;
+            readonly headers?: {
+                readonly [x: string]: string | readonly (string | {
+                    readonly name: string;
+                    readonly type: "variable";
+                })[];
+            } | undefined;
+            readonly queryParams?: {
+                readonly [x: string]: string | readonly (string | {
+                    readonly name: string;
+                    readonly type: "variable";
+                })[];
+            } | undefined;
+        } | {
+            readonly slug: string;
+            readonly kind: "oauth2";
+            readonly authorizationUrl: string;
+            readonly tokenUrl: string;
+            readonly scopes: readonly string[];
+            readonly resource?: string | null | undefined;
+            readonly supportsClientIdMetadataDocument?: boolean | undefined;
+        })[] | undefined;
+        readonly healthCheck?: {
+            readonly operation: string;
+            readonly args?: {
+                readonly [x: string]: unknown;
+            } | undefined;
+            readonly identityField?: string | undefined;
+        } | undefined;
+    };
+    readonly responseMode?: "decoded-only" | undefined;
+    readonly reactivityKeys?: readonly unknown[] | import("effect/Record").ReadonlyRecord<string, readonly unknown[]> | undefined;
+}, {
+    readonly slug: string & import("effect/Brand").Brand<"IntegrationSlug">;
+    readonly toolCount: number;
+}, import("@rafads/sdk").IntegrationAlreadyExistsError | import("@rafads/sdk").InternalError | import("../sdk").OpenApiParseError | import("../sdk").OpenApiExtractionError | import("../sdk").OpenApiOAuthError>;
+export declare const removeOpenApiSpec: Atom.AtomResultFn<{
+    readonly params: {
+        readonly slug: string;
+    };
+    readonly responseMode?: "decoded-only" | undefined;
+    readonly reactivityKeys?: readonly unknown[] | import("effect/Record").ReadonlyRecord<string, readonly unknown[]> | undefined;
+}, void, import("@rafads/sdk").IntegrationAlreadyExistsError | import("@rafads/sdk").InternalError | import("../sdk").OpenApiParseError | import("../sdk").OpenApiExtractionError | import("../sdk").OpenApiOAuthError>;
+/** Re-fetch (or replace) the integration's spec and rebuild its tools in
+ *  place — connections, policies, and the description survive. Pass
+ *  `reactivityKeys: integrationWriteKeys` at the call site. */
+export declare const updateOpenApiSpec: Atom.AtomResultFn<{
+    readonly params: {
+        readonly slug: string;
+    };
+    readonly payload: {
+        readonly spec?: {
+            readonly kind: "url";
+            readonly url: string;
+        } | {
+            readonly value: string;
+            readonly kind: "blob";
+        } | undefined;
+    };
+    readonly responseMode?: "decoded-only" | undefined;
+    readonly reactivityKeys?: readonly unknown[] | import("effect/Record").ReadonlyRecord<string, readonly unknown[]> | undefined;
+}, {
+    readonly slug: string & import("effect/Brand").Brand<"IntegrationSlug">;
+    readonly toolCount: number;
+    readonly addedTools: readonly string[];
+    readonly removedTools: readonly string[];
+}, import("@rafads/sdk").IntegrationNotFoundError | import("@rafads/sdk").InternalError | import("../sdk").OpenApiParseError | import("../sdk").OpenApiExtractionError | import("../sdk").OpenApiOAuthError>;
+export declare const openapiConfigure: Atom.AtomResultFn<{
+    readonly params: {
+        readonly slug: string;
+    };
+    readonly payload: {
+        readonly mode?: "replace" | "merge" | undefined;
+        readonly baseUrl?: string | undefined;
+        readonly authenticationTemplate?: readonly ({
+            readonly type: "apiKey";
+            readonly slug?: string | undefined;
+            readonly label?: string | undefined;
+            readonly headers?: {
+                readonly [x: string]: string | readonly (string | {
+                    readonly name: string;
+                    readonly type: "variable";
+                })[];
+            } | undefined;
+            readonly queryParams?: {
+                readonly [x: string]: string | readonly (string | {
+                    readonly name: string;
+                    readonly type: "variable";
+                })[];
+            } | undefined;
+        } | {
+            readonly slug: string;
+            readonly kind: "oauth2";
+            readonly authorizationUrl: string;
+            readonly tokenUrl: string;
+            readonly scopes: readonly string[];
+            readonly resource?: string | null | undefined;
+            readonly supportsClientIdMetadataDocument?: boolean | undefined;
+        })[] | undefined;
+    };
+    readonly responseMode?: "decoded-only" | undefined;
+    readonly reactivityKeys?: readonly unknown[] | import("effect/Record").ReadonlyRecord<string, readonly unknown[]> | undefined;
+}, {
+    readonly authenticationTemplate: readonly ({
+        readonly slug: string;
+        readonly kind: "apikey";
+        readonly placements: readonly {
+            readonly name: string;
+            readonly carrier: "header" | "query";
+            readonly variable?: string | undefined;
+            readonly prefix?: string | undefined;
+            readonly literal?: string | undefined;
+        }[];
+        readonly label?: string | undefined;
+    } | {
+        readonly slug: string;
+        readonly kind: "oauth2";
+        readonly authorizationUrl: string;
+        readonly tokenUrl: string;
+        readonly scopes: readonly string[];
+        readonly resource?: string | null | undefined;
+        readonly supportsClientIdMetadataDocument?: boolean | undefined;
+    })[];
+}, import("@rafads/sdk").IntegrationAlreadyExistsError | import("@rafads/sdk").InternalError | import("../sdk").OpenApiParseError | import("../sdk").OpenApiExtractionError | import("../sdk").OpenApiOAuthError>;
+export declare const openApiIntegrationFamily: (arg: string & import("effect/Brand").Brand<"IntegrationSlug">) => Atom.Atom<import("effect/unstable/reactivity/AsyncResult").AsyncResult<{
+    readonly description: string;
+    readonly slug: string & import("effect/Brand").Brand<"IntegrationSlug">;
+    readonly kind: string;
+    readonly canRemove: boolean;
+    readonly canRefresh: boolean;
+} | null, import("@rafads/sdk").IntegrationAlreadyExistsError | import("@rafads/sdk").InternalError | import("../sdk").OpenApiParseError | import("../sdk").OpenApiExtractionError | import("../sdk").OpenApiOAuthError>>;
+export declare const openApiConfigFamily: (arg: string & import("effect/Brand").Brand<"IntegrationSlug">) => Atom.Atom<import("effect/unstable/reactivity/AsyncResult").AsyncResult<{
+    readonly specUrl?: string | undefined;
+    readonly headers?: {
+        readonly [x: string]: string;
+    } | undefined;
+    readonly queryParams?: {
+        readonly [x: string]: string;
+    } | undefined;
+    readonly baseUrl?: string | undefined;
+    readonly authenticationTemplate?: readonly ({
+        readonly slug: string;
+        readonly kind: "apikey";
+        readonly placements: readonly {
+            readonly name: string;
+            readonly carrier: "header" | "query";
+            readonly variable?: string | undefined;
+            readonly prefix?: string | undefined;
+            readonly literal?: string | undefined;
+        }[];
+        readonly label?: string | undefined;
+    } | {
+        readonly slug: string;
+        readonly kind: "oauth2";
+        readonly authorizationUrl: string;
+        readonly tokenUrl: string;
+        readonly scopes: readonly string[];
+        readonly resource?: string | null | undefined;
+        readonly supportsClientIdMetadataDocument?: boolean | undefined;
+    })[] | undefined;
+} | null, import("@rafads/sdk").IntegrationAlreadyExistsError | import("@rafads/sdk").InternalError | import("../sdk").OpenApiParseError | import("../sdk").OpenApiExtractionError | import("../sdk").OpenApiOAuthError>>;

package/dist/react/auth-method-config.d.ts

@@ -0,0 +1,18 @@
+import type { AuthMethod, Placement } from "@rafads/react/lib/auth-placements";
+import type { AuthTemplateEditorValue } from "@rafads/react/components/auth-template-editor";
+import type { APIKeyAuthentication, Authentication, AuthenticationInput } from "../sdk/types";
+/** Serialize a canonical method into the wire input union (apikey → the
+ *  request-shaped dialect; oauth passes through). */
+export declare const openApiWireAuthInput: (method: Authentication) => AuthenticationInput;
+export declare const placementsFromApiKey: (template: APIKeyAuthentication) => readonly Placement[];
+/** Map each stored auth template to a generic `AuthMethod`. */
+export declare function authMethodsFromConfig(templates: readonly Authentication[]): AuthMethod[];
+/** Build an apikey method from generic placements. When `slug` is omitted the
+ *  backend assigns a `custom_<id>` slug. */
+export declare function templateFromPlacements(placements: readonly Placement[], slug?: string): APIKeyAuthentication;
+/** Convert one stored `Authentication` template into a generic editor value. */
+export declare function editorValueFromAuthentication(template: Authentication): AuthTemplateEditorValue;
+/** Convert one generic editor value back into a stored `Authentication`, or
+ *  `null` for `none` (no method to register). The optional `slug` names the
+ *  template; when omitted the backend backfills `custom_<id>`. */
+export declare function authenticationFromEditorValue(value: AuthTemplateEditorValue, slug?: string): Authentication | null;

package/dist/react/auth-method-config.test.d.ts

@@ -0,0 +1 @@
+export {};