@rawdash/connector-entra-id 0.1.0 → 0.28.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -146,7 +146,7 @@ Microsoft Graph applies per-app and per-tenant throttling. The shared HTTP clien
 
 ## Links
 
-- [Rawdash docs](https://rawdash.dev/docs/connectors/)
+- [Rawdash docs](https://rawdash.dev/docs/connectors)
 - [Microsoft Entra ID API docs](https://learn.microsoft.com/en-us/graph/api/resources/signin)
 - [GitHub](https://github.com/rawdash/rawdash)
 

package/dist/index.d.ts

@@ -505,10 +505,7 @@ declare class EntraIdConnector extends BaseConnector<EntraIdSettings, EntraIdCre
             auth: "required";
         };
     };
-    private accessToken;
-    private accessTokenExpiry;
-    private tokenUrl;
-    private refreshAccessToken;
+    private tokenCache;
     private getAccessToken;
     private apiGet;
     private signinsSince;

package/dist/index.js

@@ -1,9 +1,364 @@
-// ../../connector-shared/dist/index.js
+// ../azure-shared/dist/index.js
+import { BaseConnector } from "@rawdash/core";
+var HttpClientError = class extends Error {
+  response;
+  constructor(message, response) {
+    super(message);
+    this.name = new.target.name;
+    this.response = response;
+  }
+};
+var TransientError = class extends HttpClientError {
+  kind = "transient";
+};
+var RateLimitError = class extends HttpClientError {
+  kind = "rate_limit";
+  retryAfter;
+  constructor(message, response, retryAfter) {
+    super(message, response);
+    this.retryAfter = retryAfter;
+  }
+};
+var AuthError = class extends HttpClientError {
+  kind = "auth";
+};
+var UpstreamBugError = class extends HttpClientError {
+  kind = "upstream_bug";
+};
+var ClientBugError = class extends HttpClientError {
+  kind = "client_bug";
+};
+function classifyStatus(status) {
+  if (status === 429) {
+    return "rate_limit";
+  }
+  if (status === 401 || status === 403) {
+    return "auth";
+  }
+  if (status === 408) {
+    return "transient";
+  }
+  if (status >= 500) {
+    return "upstream_bug";
+  }
+  if (status >= 400) {
+    return "client_bug";
+  }
+  return "client_bug";
+}
+function errorForStatus(message, response, retryAfter) {
+  const kind = classifyStatus(response.status);
+  switch (kind) {
+    case "rate_limit":
+      return new RateLimitError(message, response, retryAfter);
+    case "auth":
+      return new AuthError(message, response);
+    case "transient":
+      return new TransientError(message, response);
+    case "upstream_bug":
+      return new UpstreamBugError(message, response);
+    case "client_bug":
+      return new ClientBugError(message, response);
+  }
+}
+var defaultRetryOn = (status, err) => {
+  if (err instanceof RateLimitError) {
+    return true;
+  }
+  if (err instanceof TransientError) {
+    return true;
+  }
+  if (status === null) {
+    return err instanceof Error && !(err instanceof HttpClientError);
+  }
+  if (status === 408 || status === 429) {
+    return true;
+  }
+  if (status >= 500) {
+    return true;
+  }
+  return false;
+};
+function parseRetryAfter(headerValue, now = /* @__PURE__ */ new Date()) {
+  if (!headerValue) {
+    return void 0;
+  }
+  const trimmed = headerValue.trim();
+  if (/^\d+$/.test(trimmed)) {
+    return new Date(now.getTime() + Number(trimmed) * 1e3);
+  }
+  const parsed = Date.parse(trimmed);
+  if (Number.isNaN(parsed)) {
+    return void 0;
+  }
+  return new Date(parsed);
+}
+function sleep(ms, signal) {
+  if (signal?.aborted) {
+    return Promise.reject(signal.reason ?? new Error("Aborted"));
+  }
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal.reason ?? new Error("Aborted"));
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
 var HTTP_CLIENT_VERSION = "0.0.0";
 var DEFAULT_USER_AGENT = `rawdash-connector/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;
 function connectorUserAgent(connectorId) {
   return `rawdash-connector-${connectorId}/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;
 }
+var DEFAULT_TIMEOUT_MS = 1e4;
+var DEFAULT_MAX_ATTEMPTS = 3;
+var DEFAULT_INITIAL_DELAY_MS = 1e3;
+var DEFAULT_MAX_DELAY_MS = 6e4;
+var OBSERVER_TIMEOUT_MS = 250;
+async function notifyObserver(observer, event) {
+  let result;
+  try {
+    result = observer(event);
+  } catch (err) {
+    console.warn("[connector-shared] request observer threw:", err);
+    return;
+  }
+  if (!(result instanceof Promise)) {
+    return;
+  }
+  const guarded = result.catch((err) => {
+    console.warn("[connector-shared] request observer rejected:", err);
+  });
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(resolve, OBSERVER_TIMEOUT_MS);
+  });
+  try {
+    await Promise.race([guarded, timeout]);
+  } finally {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  }
+}
+function newRequestId() {
+  const c = globalThis.crypto;
+  if (c?.randomUUID) {
+    return c.randomUUID();
+  }
+  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+function mergeHeaders(defaults, overrides) {
+  const merged = {};
+  for (const [k, v] of Object.entries(defaults)) {
+    merged[k.toLowerCase()] = v;
+  }
+  if (overrides) {
+    for (const [k, v] of Object.entries(overrides)) {
+      merged[k.toLowerCase()] = v;
+    }
+  }
+  return merged;
+}
+function linkTimeoutSignal(parent, timeoutMs) {
+  const controller = new AbortController();
+  const onParentAbort = () => {
+    controller.abort(parent?.reason);
+  };
+  if (parent) {
+    if (parent.aborted) {
+      controller.abort(parent.reason);
+    } else {
+      parent.addEventListener("abort", onParentAbort, { once: true });
+    }
+  }
+  const timer = setTimeout(() => {
+    controller.abort(new Error(`Request timed out after ${timeoutMs}ms`));
+  }, timeoutMs);
+  return {
+    signal: controller.signal,
+    cancel: () => {
+      clearTimeout(timer);
+      if (parent) {
+        parent.removeEventListener("abort", onParentAbort);
+      }
+    }
+  };
+}
+async function readBody(res, parseJson) {
+  if (res.status === 204 || res.status === 205) {
+    return null;
+  }
+  const contentType = res.headers.get("content-type") ?? "";
+  if (parseJson && contentType.includes("application/json")) {
+    const text = await res.text();
+    if (text.length === 0) {
+      return null;
+    }
+    return JSON.parse(text);
+  }
+  return res.text();
+}
+async function request(req, options) {
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  const retry = req.retry ?? {};
+  const maxAttempts = retry.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+  const initialDelayMs = retry.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS;
+  const maxDelayMs = retry.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+  const retryOn = retry.retryOn ?? defaultRetryOn;
+  const timeoutMs = req.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const parseJson = req.parseJson ?? true;
+  const headers = mergeHeaders(
+    {
+      "User-Agent": DEFAULT_USER_AGENT,
+      Accept: "application/json"
+    },
+    req.headers
+  );
+  let lastErr;
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    req.signal?.throwIfAborted();
+    const { signal, cancel } = linkTimeoutSignal(req.signal, timeoutMs);
+    let res;
+    try {
+      res = await fetchImpl(req.url, {
+        method: req.method ?? "GET",
+        headers,
+        body: req.body,
+        signal
+      });
+    } catch (err2) {
+      cancel();
+      if (req.signal?.aborted) {
+        throw req.signal.reason ?? err2;
+      }
+      const error = err2 instanceof Error ? err2 : new Error(String(err2));
+      lastErr = error;
+      if (attempt < maxAttempts - 1 && retryOn(null, error)) {
+        const delay = computeDelay(attempt, initialDelayMs, maxDelayMs);
+        await sleep(delay, req.signal);
+        continue;
+      }
+      throw new TransientError(error.message);
+    }
+    cancel();
+    const body = await readBody(res, parseJson);
+    const httpResponse = {
+      status: res.status,
+      headers: res.headers,
+      body
+    };
+    if (req.rateLimit) {
+      const state = req.rateLimit.parse(res.headers);
+      if (state) {
+        httpResponse.rateLimitState = state;
+      }
+    }
+    if (options.observer) {
+      await notifyObserver(options.observer, {
+        url: req.url,
+        method: req.method ?? "GET",
+        status: res.status,
+        resource: options.resource,
+        requestId: options.requestId ?? newRequestId(),
+        body
+      });
+    }
+    if (res.ok) {
+      return httpResponse;
+    }
+    const retryAfter = parseRetryAfter(res.headers.get("retry-after"));
+    const message = `HTTP ${res.status} ${res.statusText} for ${req.method ?? "GET"} ${req.url}`;
+    const err = errorForStatus(message, httpResponse, retryAfter);
+    if (attempt < maxAttempts - 1 && retryOn(res.status, err) && !(err instanceof AuthError) && !(err instanceof ClientBugError)) {
+      lastErr = err;
+      let delay = computeDelay(attempt, initialDelayMs, maxDelayMs);
+      if (err instanceof RateLimitError && retryAfter) {
+        const wait = retryAfter.getTime() - Date.now();
+        if (wait > 0) {
+          delay = Math.min(wait, maxDelayMs);
+        }
+      }
+      await sleep(delay, req.signal);
+      continue;
+    }
+    throw err;
+  }
+  throw lastErr ?? new UpstreamBugError("Exhausted retry attempts");
+}
+function computeDelay(attempt, initialDelayMs, maxDelayMs) {
+  const base = initialDelayMs * 2 ** attempt;
+  const jitter = base * 0.25 * Math.random();
+  return Math.min(base + jitter, maxDelayMs);
+}
+var TOKEN_HOST = "login.microsoftonline.com";
+var TOKEN_TTL_BUFFER_MS = 6e4;
+async function fetchEntraAccessToken(input, signal) {
+  const params = new URLSearchParams();
+  params.set("grant_type", "client_credentials");
+  params.set("client_id", input.clientId);
+  params.set("client_secret", input.clientSecret);
+  params.set("scope", input.scope);
+  let res;
+  try {
+    res = await request(
+      {
+        url: `https://${TOKEN_HOST}/${encodeURIComponent(input.tenantId)}/oauth2/v2.0/token`,
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json",
+          "User-Agent": connectorUserAgent(input.connectorId)
+        },
+        body: params.toString(),
+        signal
+      },
+      { resource: "oauth_token" }
+    );
+  } catch (err) {
+    throw classifyTokenError(err);
+  }
+  const access = res.body.access_token;
+  const expiresIn = res.body.expires_in;
+  if (typeof access !== "string" || access.length === 0) {
+    throw new AuthError(
+      "Entra ID token response did not include an access_token"
+    );
+  }
+  const ttlMs = typeof expiresIn === "number" && Number.isFinite(expiresIn) ? expiresIn * 1e3 : 60 * 60 * 1e3;
+  return {
+    token: access,
+    expiresAt: Date.now() + ttlMs - TOKEN_TTL_BUFFER_MS
+  };
+}
+function classifyTokenError(err) {
+  if (!(err instanceof Error) || !("kind" in err)) {
+    return err;
+  }
+  const httpErr = err;
+  const status = httpErr.response?.status ?? 0;
+  if (status === 400 || status === 401 || status === 403) {
+    return new AuthError(httpErr.message, httpErr.response);
+  }
+  if (status >= 500) {
+    return new TransientError(httpErr.message, httpErr.response);
+  }
+  return err;
+}
+function isTokenFresh(cache, now = Date.now()) {
+  return cache !== null && now < cache.expiresAt;
+}
+
+// ../../connector-shared/dist/index.js
+var HTTP_CLIENT_VERSION2 = "0.0.0";
+var DEFAULT_USER_AGENT2 = `rawdash-connector/${HTTP_CLIENT_VERSION2} (+https://rawdash.dev)`;
+function connectorUserAgent2(connectorId) {
+  return `rawdash-connector-${connectorId}/${HTTP_CLIENT_VERSION2} (+https://rawdash.dev)`;
+}
 function standardRateLimitPolicy(config) {
   const { remainingHeader, resetHeader, resetUnit, resetFallbackMs } = config;
   const multiplier = resetUnit === "s" ? 1e3 : 1;
@@ -81,7 +436,7 @@ function parseEpoch(value, unit) {
 
 // src/entra-id.ts
 import {
-  BaseConnector,
+  BaseConnector as BaseConnector2,
   defineConfigFields,
   defineConnectorDoc,
   defineResources,
@@ -92,7 +447,6 @@ import {
 } from "@rawdash/core";
 import { z } from "zod";
 var GRAPH_HOST = "graph.microsoft.com";
-var LOGIN_HOST = "login.microsoftonline.com";
 var API_VERSION = "v1.0";
 var TENANT_ID_PATTERN = /^[a-zA-Z0-9.-]{1,256}$/;
 var configFields = defineConfigFields(
@@ -408,7 +762,7 @@ var entraIdResources = defineResources({
 });
 var id = "entra-id";
 function signinStatus(errorCode) {
-  return errorCode === 0 || errorCode === null || errorCode === void 0 ? "success" : "failure";
+  return errorCode === 0 ? "success" : "failure";
 }
 function pageRequestPath(phase) {
   switch (phase) {
@@ -427,7 +781,7 @@ function sanitizeGraphUrl(url, phase) {
     pathname: pageRequestPath(phase)
   });
 }
-var EntraIdConnector = class _EntraIdConnector extends BaseConnector {
+var EntraIdConnector = class _EntraIdConnector extends BaseConnector2 {
   static id = id;
   static resources = entraIdResources;
   static schemas = schemasFromResources(entraIdResources);
@@ -448,58 +802,35 @@ var EntraIdConnector = class _EntraIdConnector extends BaseConnector {
   }
   id = id;
   credentials = entraIdCredentials;
-  accessToken = null;
-  accessTokenExpiry = 0;
-  tokenUrl() {
-    return `https://${LOGIN_HOST}/${encodeURIComponent(this.settings.tenantId)}/oauth2/v2.0/token`;
-  }
-  async refreshAccessToken(signal) {
-    const body = new URLSearchParams({
-      grant_type: "client_credentials",
-      client_id: this.creds.clientId,
-      client_secret: this.creds.clientSecret,
-      scope: `https://${GRAPH_HOST}/.default`
-    });
-    const res = await this.post(this.tokenUrl(), {
-      resource: "oauth_token",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        Accept: "application/json",
-        "User-Agent": connectorUserAgent("entra-id")
-      },
-      body: body.toString(),
-      signal
-    });
-    const token = res.body.access_token;
-    const expiresIn = res.body.expires_in ?? 3600;
-    this.accessToken = token;
-    this.accessTokenExpiry = Date.now() + (expiresIn - 60) * 1e3;
-    return token;
-  }
+  tokenCache = null;
   async getAccessToken(signal) {
-    if (!this.accessToken || Date.now() >= this.accessTokenExpiry) {
-      return this.refreshAccessToken(signal);
+    if (isTokenFresh(this.tokenCache)) {
+      return this.tokenCache.token;
     }
-    return this.accessToken;
+    this.tokenCache = await fetchEntraAccessToken(
+      {
+        tenantId: this.settings.tenantId,
+        clientId: this.creds.clientId,
+        clientSecret: this.creds.clientSecret,
+        scope: `https://${GRAPH_HOST}/.default`,
+        connectorId: "entra-id"
+      },
+      signal
+    );
+    return this.tokenCache.token;
   }
-  async apiGet(url, resource, signal, retried = false) {
+  async apiGet(url, resource, signal) {
     const token = await this.getAccessToken(signal);
-    const res = await this.get(url, {
+    return this.get(url, {
       resource,
       headers: {
         Authorization: `Bearer ${token}`,
         Accept: "application/json",
-        "User-Agent": connectorUserAgent("entra-id")
+        "User-Agent": connectorUserAgent2("entra-id")
       },
       rateLimit: entraIdRateLimit,
       signal
     });
-    if (res.status === 401 && !retried) {
-      this.accessToken = null;
-      this.accessTokenExpiry = 0;
-      return this.apiGet(url, resource, signal, true);
-    }
-    return res;
   }
   signinsSince(options) {
     if (options.since) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../connector-shared/src/errors.ts","../../../connector-shared/src/retry.ts","../../../connector-shared/src/version.ts","../../../connector-shared/src/request.ts","../../../connector-shared/src/rate-limit.ts","../../../connector-shared/src/map-concurrent.ts","../../../connector-shared/src/sanitize.ts","../../../connector-shared/src/epoch.ts","../../../connector-shared/src/pagination.ts","../../../connector-shared/src/logger.ts","../src/entra-id.ts","../src/index.ts"],"sourcesContent":["import type { HttpResponse } from './types';\n\nexport type HttpErrorKind =\n  | 'transient'\n  | 'rate_limit'\n  | 'auth'\n  | 'upstream_bug'\n  | 'client_bug';\n\nexport abstract class HttpClientError extends Error {\n  abstract readonly kind: HttpErrorKind;\n  readonly response?: HttpResponse;\n\n  constructor(message: string, response?: HttpResponse) {\n    super(message);\n    this.name = new.target.name;\n    this.response = response;\n  }\n}\n\nexport class TransientError extends HttpClientError {\n  readonly kind = 'transient' as const;\n}\n\nexport class RateLimitError extends HttpClientError {\n  readonly kind = 'rate_limit' as const;\n  readonly retryAfter?: Date;\n\n  constructor(message: string, response?: HttpResponse, retryAfter?: Date) {\n    super(message, response);\n    this.retryAfter = retryAfter;\n  }\n}\n\nexport class AuthError extends HttpClientError {\n  readonly kind = 'auth' as const;\n}\n\nexport class UpstreamBugError extends HttpClientError {\n  readonly kind = 'upstream_bug' as const;\n}\n\nexport class ClientBugError extends HttpClientError {\n  readonly kind = 'client_bug' as const;\n}\n\nexport function classifyStatus(status: number): HttpErrorKind {\n  if (status === 429) {\n    return 'rate_limit';\n  }\n  if (status === 401 || status === 403) {\n    return 'auth';\n  }\n  if (status === 408) {\n    return 'transient';\n  }\n  if (status >= 500) {\n    return 'upstream_bug';\n  }\n  if (status >= 400) {\n    return 'client_bug';\n  }\n  return 'client_bug';\n}\n\nexport function errorForStatus(\n  message: string,\n  response: HttpResponse,\n  retryAfter?: Date,\n): HttpClientError {\n  const kind = classifyStatus(response.status);\n  switch (kind) {\n    case 'rate_limit':\n      return new RateLimitError(message, response, retryAfter);\n    case 'auth':\n      return new AuthError(message, response);\n    case 'transient':\n      return new TransientError(message, response);\n    case 'upstream_bug':\n      return new UpstreamBugError(message, response);\n    case 'client_bug':\n      return new ClientBugError(message, response);\n  }\n}\n","import { HttpClientError, RateLimitError, TransientError } from './errors';\n\nexport interface RetryPolicy {\n  maxAttempts?: number;\n  initialDelayMs?: number;\n  maxDelayMs?: number;\n  retryOn?: (status: number | null, err?: Error) => boolean;\n}\n\nexport const defaultRetryOn = (status: number | null, err?: Error): boolean => {\n  if (err instanceof RateLimitError) {\n    return true;\n  }\n  if (err instanceof TransientError) {\n    return true;\n  }\n  if (status === null) {\n    return err instanceof Error && !(err instanceof HttpClientError);\n  }\n  if (status === 408 || status === 429) {\n    return true;\n  }\n  if (status >= 500) {\n    return true;\n  }\n  return false;\n};\n\nexport function backoffDelayMs(\n  attempt: number,\n  policy: Required<Pick<RetryPolicy, 'initialDelayMs' | 'maxDelayMs'>>,\n): number {\n  const base = policy.initialDelayMs * 2 ** attempt;\n  const jitter = base * 0.25 * Math.random();\n  return Math.min(base + jitter, policy.maxDelayMs);\n}\n\nexport function parseRetryAfter(\n  headerValue: string | null,\n  now: Date = new Date(),\n): Date | undefined {\n  if (!headerValue) {\n    return undefined;\n  }\n  const trimmed = headerValue.trim();\n  if (/^\\d+$/.test(trimmed)) {\n    return new Date(now.getTime() + Number(trimmed) * 1000);\n  }\n  const parsed = Date.parse(trimmed);\n  if (Number.isNaN(parsed)) {\n    return undefined;\n  }\n  return new Date(parsed);\n}\n\nexport function sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  if (signal?.aborted) {\n    return Promise.reject(signal.reason ?? new Error('Aborted'));\n  }\n  return new Promise<void>((resolve, reject) => {\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(signal!.reason ?? new Error('Aborted'));\n    };\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n","export const HTTP_CLIENT_VERSION = '0.0.0';\n\nexport const DEFAULT_USER_AGENT = `rawdash-connector/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;\n\nexport function connectorUserAgent(connectorId: string): string {\n  return `rawdash-connector-${connectorId}/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;\n}\n","import {\n  AuthError,\n  ClientBugError,\n  HttpClientError,\n  RateLimitError,\n  TransientError,\n  UpstreamBugError,\n  errorForStatus,\n} from './errors';\nimport { defaultRetryOn, parseRetryAfter, sleep } from './retry';\nimport type { FetchLike, HttpMethod, HttpRequest, HttpResponse } from './types';\nimport { DEFAULT_USER_AGENT } from './version';\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst DEFAULT_MAX_ATTEMPTS = 3;\nconst DEFAULT_INITIAL_DELAY_MS = 1000;\nconst DEFAULT_MAX_DELAY_MS = 60_000;\nconst OBSERVER_TIMEOUT_MS = 250;\n\nexport interface RequestObservation {\n  url: string;\n  method: HttpMethod;\n  status: number;\n  resource: string;\n  requestId: string;\n  body: unknown;\n}\n\nexport type RequestObserver = (\n  event: RequestObservation,\n) => void | Promise<void>;\n\nexport interface RequestOptions {\n  fetch?: FetchLike;\n  observer?: RequestObserver;\n  resource: string;\n  requestId?: string;\n}\n\nasync function notifyObserver(\n  observer: RequestObserver,\n  event: RequestObservation,\n): Promise<void> {\n  let result: void | Promise<void>;\n  try {\n    result = observer(event);\n  } catch (err) {\n    console.warn('[connector-shared] request observer threw:', err);\n    return;\n  }\n  if (!(result instanceof Promise)) {\n    return;\n  }\n  const guarded = result.catch((err) => {\n    console.warn('[connector-shared] request observer rejected:', err);\n  });\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<void>((resolve) => {\n    timer = setTimeout(resolve, OBSERVER_TIMEOUT_MS);\n  });\n  try {\n    await Promise.race([guarded, timeout]);\n  } finally {\n    if (timer) {\n      clearTimeout(timer);\n    }\n  }\n}\n\nfunction newRequestId(): string {\n  const c = (globalThis as { crypto?: { randomUUID?: () => string } }).crypto;\n  if (c?.randomUUID) {\n    return c.randomUUID();\n  }\n  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;\n}\n\nfunction mergeHeaders(\n  defaults: Record<string, string>,\n  overrides: Record<string, string> | undefined,\n): Record<string, string> {\n  const merged: Record<string, string> = {};\n  for (const [k, v] of Object.entries(defaults)) {\n    merged[k.toLowerCase()] = v;\n  }\n  if (overrides) {\n    for (const [k, v] of Object.entries(overrides)) {\n      merged[k.toLowerCase()] = v;\n    }\n  }\n  return merged;\n}\n\nfunction linkTimeoutSignal(\n  parent: AbortSignal | undefined,\n  timeoutMs: number,\n): { signal: AbortSignal; cancel: () => void } {\n  const controller = new AbortController();\n  const onParentAbort = () => {\n    controller.abort(parent?.reason);\n  };\n  if (parent) {\n    if (parent.aborted) {\n      controller.abort(parent.reason);\n    } else {\n      parent.addEventListener('abort', onParentAbort, { once: true });\n    }\n  }\n  const timer = setTimeout(() => {\n    controller.abort(new Error(`Request timed out after ${timeoutMs}ms`));\n  }, timeoutMs);\n  return {\n    signal: controller.signal,\n    cancel: () => {\n      clearTimeout(timer);\n      if (parent) {\n        parent.removeEventListener('abort', onParentAbort);\n      }\n    },\n  };\n}\n\nasync function readBody(res: Response, parseJson: boolean): Promise<unknown> {\n  if (res.status === 204 || res.status === 205) {\n    return null;\n  }\n  const contentType = res.headers.get('content-type') ?? '';\n  if (parseJson && contentType.includes('application/json')) {\n    const text = await res.text();\n    if (text.length === 0) {\n      return null;\n    }\n    return JSON.parse(text);\n  }\n  return res.text();\n}\n\nexport async function request<T = unknown>(\n  req: HttpRequest,\n  options: RequestOptions,\n): Promise<HttpResponse<T>> {\n  const fetchImpl: FetchLike = options.fetch ?? (globalThis.fetch as FetchLike);\n  const retry = req.retry ?? {};\n  const maxAttempts = retry.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;\n  const initialDelayMs = retry.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS;\n  const maxDelayMs = retry.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;\n  const retryOn = retry.retryOn ?? defaultRetryOn;\n  const timeoutMs = req.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const parseJson = req.parseJson ?? true;\n\n  const headers = mergeHeaders(\n    {\n      'User-Agent': DEFAULT_USER_AGENT,\n      Accept: 'application/json',\n    },\n    req.headers,\n  );\n\n  let lastErr: Error | undefined;\n\n  for (let attempt = 0; attempt < maxAttempts; attempt++) {\n    req.signal?.throwIfAborted();\n\n    const { signal, cancel } = linkTimeoutSignal(req.signal, timeoutMs);\n    let res: Response;\n    try {\n      res = await fetchImpl(req.url, {\n        method: req.method ?? 'GET',\n        headers,\n        body: req.body as RequestInit['body'],\n        signal,\n      });\n    } catch (err) {\n      cancel();\n      if (req.signal?.aborted) {\n        throw req.signal.reason ?? err;\n      }\n      const error = err instanceof Error ? err : new Error(String(err));\n      lastErr = error;\n      if (attempt < maxAttempts - 1 && retryOn(null, error)) {\n        const delay = computeDelay(attempt, initialDelayMs, maxDelayMs);\n        await sleep(delay, req.signal);\n        continue;\n      }\n      throw new TransientError(error.message);\n    }\n    cancel();\n\n    const body = await readBody(res, parseJson);\n    const httpResponse: HttpResponse<T> = {\n      status: res.status,\n      headers: res.headers,\n      body: body as T,\n    };\n    if (req.rateLimit) {\n      const state = req.rateLimit.parse(res.headers);\n      if (state) {\n        httpResponse.rateLimitState = state;\n      }\n    }\n\n    if (options.observer) {\n      await notifyObserver(options.observer, {\n        url: req.url,\n        method: req.method ?? 'GET',\n        status: res.status,\n        resource: options.resource,\n        requestId: options.requestId ?? newRequestId(),\n        body,\n      });\n    }\n\n    if (res.ok) {\n      return httpResponse;\n    }\n\n    const retryAfter = parseRetryAfter(res.headers.get('retry-after'));\n    const message = `HTTP ${res.status} ${res.statusText} for ${req.method ?? 'GET'} ${req.url}`;\n    const err = errorForStatus(message, httpResponse, retryAfter);\n\n    if (\n      attempt < maxAttempts - 1 &&\n      retryOn(res.status, err) &&\n      !(err instanceof AuthError) &&\n      !(err instanceof ClientBugError)\n    ) {\n      lastErr = err;\n      let delay = computeDelay(attempt, initialDelayMs, maxDelayMs);\n      if (err instanceof RateLimitError && retryAfter) {\n        const wait = retryAfter.getTime() - Date.now();\n        if (wait > 0) {\n          delay = Math.min(wait, maxDelayMs);\n        }\n      }\n      await sleep(delay, req.signal);\n      continue;\n    }\n\n    throw err;\n  }\n\n  throw lastErr ?? new UpstreamBugError('Exhausted retry attempts');\n}\n\nfunction computeDelay(\n  attempt: number,\n  initialDelayMs: number,\n  maxDelayMs: number,\n): number {\n  const base = initialDelayMs * 2 ** attempt;\n  const jitter = base * 0.25 * Math.random();\n  return Math.min(base + jitter, maxDelayMs);\n}\n\nexport { HttpClientError };\n","export interface RateLimitState {\n  remaining: number;\n  resetAt: Date;\n}\n\nexport interface RateLimitPolicy {\n  parse(headers: Headers): RateLimitState | null;\n}\n\nexport interface StandardRateLimitPolicyConfig {\n  remainingHeader: string;\n  resetHeader: string;\n  resetUnit: 's' | 'ms';\n  resetFallbackMs?: number;\n}\n\nexport function standardRateLimitPolicy(\n  config: StandardRateLimitPolicyConfig,\n): RateLimitPolicy {\n  const { remainingHeader, resetHeader, resetUnit, resetFallbackMs } = config;\n  const multiplier = resetUnit === 's' ? 1000 : 1;\n  return {\n    parse(h) {\n      const remainingRaw = h.get(remainingHeader);\n      if (remainingRaw === null || remainingRaw.trim() === '') {\n        return null;\n      }\n      const remaining = Number(remainingRaw);\n      if (!Number.isFinite(remaining)) {\n        return null;\n      }\n      const resetRaw = h.get(resetHeader);\n      if (resetRaw === null) {\n        if (resetFallbackMs === undefined) {\n          return null;\n        }\n        return {\n          remaining,\n          resetAt: new Date(Date.now() + resetFallbackMs),\n        };\n      }\n      if (resetRaw.trim() === '') {\n        return null;\n      }\n      const reset = Number(resetRaw);\n      if (!Number.isFinite(reset) || reset < 0) {\n        return null;\n      }\n      const resetMs = reset * multiplier;\n      if (!Number.isFinite(resetMs)) {\n        return null;\n      }\n      return { remaining, resetAt: new Date(resetMs) };\n    },\n  };\n}\n","export async function mapWithConcurrency<T, R>(\n  items: readonly T[],\n  concurrency: number,\n  fn: (item: T, index: number) => Promise<R>,\n): Promise<R[]> {\n  const results = new Array<R>(items.length);\n  if (items.length === 0) {\n    return results;\n  }\n  const normalized = Number.isFinite(concurrency) ? Math.floor(concurrency) : 1;\n  const limit = Math.max(1, Math.min(normalized, items.length));\n  let next = 0;\n  let failed = false;\n\n  async function worker(): Promise<void> {\n    while (!failed) {\n      const i = next++;\n      if (i >= items.length) {\n        return;\n      }\n      try {\n        results[i] = await fn(items[i]!, i);\n      } catch (err) {\n        failed = true;\n        throw err;\n      }\n    }\n  }\n\n  const workers: Promise<void>[] = [];\n  for (let w = 0; w < limit; w++) {\n    workers.push(worker());\n  }\n  await Promise.all(workers);\n  return results;\n}\n","export interface SanitizeAllowedUrlOptions {\n  url: string | null;\n  host: string;\n  pathname: string;\n  protocol?: 'https:' | 'http:';\n}\n\nexport function sanitizeAllowedUrl(\n  options: SanitizeAllowedUrlOptions,\n): string | null {\n  const { url, host, pathname, protocol = 'https:' } = options;\n  if (url === null) {\n    return null;\n  }\n  try {\n    const u = new URL(url);\n    if (u.protocol !== protocol || u.host !== host || u.pathname !== pathname) {\n      return null;\n    }\n    return u.toString();\n  } catch {\n    return null;\n  }\n}\n","export type EpochUnit = 'ms' | 's' | 'iso';\n\nexport function parseEpoch(\n  value: number | string | null | undefined,\n  unit: EpochUnit,\n): number | null {\n  if (value === null || value === undefined) {\n    return null;\n  }\n  if (unit === 'iso') {\n    if (typeof value !== 'string') {\n      return null;\n    }\n    const ms = new Date(value).getTime();\n    return Number.isFinite(ms) ? ms : null;\n  }\n  if (typeof value === 'string' && value.trim() === '') {\n    return null;\n  }\n  const n = typeof value === 'number' ? value : Number(value);\n  if (!Number.isFinite(n)) {\n    return null;\n  }\n  const result = unit === 's' ? n * 1000 : n;\n  return Number.isFinite(result) ? result : null;\n}\n","import { request } from './request';\nimport type { HttpRequest } from './types';\n\nexport function parseLinkHeader(header: string | null): Record<string, string> {\n  if (!header) {\n    return {};\n  }\n  const result: Record<string, string> = {};\n  for (const part of header.split(',')) {\n    const match = part.match(/<([^>]+)>\\s*;\\s*rel=\"([^\"]+)\"/);\n    if (match) {\n      result[match[2]!] = match[1]!;\n    }\n  }\n  return result;\n}\n\nexport async function* paginateLink<T>(\n  initial: HttpRequest,\n  parse: (body: unknown) => T[],\n  options: { resource: string },\n): AsyncIterable<T> {\n  let next: string | null = initial.url;\n  while (next) {\n    const res: Awaited<ReturnType<typeof request>> = await request(\n      {\n        ...initial,\n        url: next,\n      },\n      { resource: options.resource },\n    );\n    for (const item of parse(res.body)) {\n      yield item;\n    }\n    const links = parseLinkHeader(res.headers.get('link'));\n    next = links['next'] ?? null;\n  }\n}\n\nexport async function* paginateCursor<T>(\n  initial: HttpRequest,\n  parse: (body: unknown) => { items: T[]; nextCursor: string | null },\n  buildNext: (req: HttpRequest, cursor: string) => HttpRequest,\n  options: { resource: string },\n): AsyncIterable<T> {\n  let req: HttpRequest = initial;\n  while (true) {\n    const res = await request(req, { resource: options.resource });\n    const { items, nextCursor } = parse(res.body);\n    for (const item of items) {\n      yield item;\n    }\n    if (!nextCursor) {\n      return;\n    }\n    req = buildNext(req, nextCursor);\n  }\n}\n\nexport async function* paginatePage<T>(\n  initial: HttpRequest,\n  parse: (body: unknown) => { items: T[]; hasMore: boolean },\n  buildPage: (req: HttpRequest, page: number) => HttpRequest,\n  options: { resource: string },\n): AsyncIterable<T> {\n  let page = 1;\n  while (true) {\n    const req = page === 1 ? initial : buildPage(initial, page);\n    const res = await request(req, { resource: options.resource });\n    const { items, hasMore } = parse(res.body);\n    for (const item of items) {\n      yield item;\n    }\n    if (!hasMore || items.length === 0) {\n      return;\n    }\n    page++;\n  }\n}\n","export type LogFields = Record<string, unknown>;\n\nexport interface ConnectorLogger {\n  info(event: string, fields?: LogFields): void;\n  warn(event: string, fields?: LogFields): void;\n}\n\nexport interface ConnectorLoggerOptions {\n  scope: string;\n}\n\nconst MAX_VALUE_LEN = 120;\n\nfunction truncate(s: string, max = MAX_VALUE_LEN): string {\n  if (s.length <= max) {\n    return s;\n  }\n  return `${s.slice(0, max - 1)}…`;\n}\n\nfunction formatValue(value: unknown): string {\n  if (value === null) {\n    return 'null';\n  }\n  if (value === undefined) {\n    return '';\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') {\n    return String(value);\n  }\n  if (typeof value === 'string') {\n    const t = truncate(value);\n    if (/[\\s\"=]/.test(t)) {\n      return JSON.stringify(t);\n    }\n    return t;\n  }\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  let json: string | undefined;\n  try {\n    json = JSON.stringify(value);\n  } catch {\n    json = undefined;\n  }\n  return truncate(json ?? String(value));\n}\n\nexport function formatLogFields(fields?: LogFields): string {\n  if (!fields) {\n    return '';\n  }\n  const parts: string[] = [];\n  for (const [k, v] of Object.entries(fields)) {\n    if (v === undefined) {\n      continue;\n    }\n    parts.push(`${k}=${formatValue(v)}`);\n  }\n  return parts.length > 0 ? ` ${parts.join(' ')}` : '';\n}\n\nexport function formatLogLine(\n  scope: string,\n  event: string,\n  fields?: LogFields,\n): string {\n  return `[${scope}] ${event}${formatLogFields(fields)}`;\n}\n\nexport function createDefaultConnectorLogger(\n  opts: ConnectorLoggerOptions,\n): ConnectorLogger {\n  return {\n    info(event, fields) {\n      console.info(formatLogLine(opts.scope, event, fields));\n    },\n    warn(event, fields) {\n      console.warn(formatLogLine(opts.scope, event, fields));\n    },\n  };\n}\n\nconst NOOP_LOGGER: ConnectorLogger = {\n  info() {},\n  warn() {},\n};\n\nexport function noopConnectorLogger(): ConnectorLogger {\n  return NOOP_LOGGER;\n}\n","import {\n  type HttpResponse,\n  connectorUserAgent,\n  parseEpoch,\n  sanitizeAllowedUrl,\n  standardRateLimitPolicy,\n} from '@rawdash/connector-shared';\nimport {\n  BaseConnector,\n  type ChunkedSyncCursor,\n  type ConnectorContext,\n  type ConnectorDoc,\n  type CredentialsSchema,\n  type StorageHandle,\n  type SyncOptions,\n  type SyncResult,\n  defineConfigFields,\n  defineConnectorDoc,\n  defineResources,\n  makeChunkedCursorGuard,\n  paginateChunked,\n  schemasFromResources,\n  selectActivePhases,\n} from '@rawdash/core';\nimport { z } from 'zod';\n\nconst GRAPH_HOST = 'graph.microsoft.com';\nconst LOGIN_HOST = 'login.microsoftonline.com';\nconst API_VERSION = 'v1.0';\n\n// Entra tenant identifier: GUID, or a verified domain like contoso.onmicrosoft.com,\n// or one of the well-known values (common, organizations, consumers). Reject\n// anything containing a slash or whitespace so the token URL stays anchored.\nconst TENANT_ID_PATTERN = /^[a-zA-Z0-9.-]{1,256}$/;\n\nexport const configFields = defineConfigFields(\n  z.object({\n    tenantId: z\n      .string()\n      .trim()\n      .min(1)\n      .regex(\n        TENANT_ID_PATTERN,\n        'Use the tenant GUID, a verified domain (e.g. \"contoso.onmicrosoft.com\"), or one of the well-known values \"common\" / \"organizations\" / \"consumers\".',\n      )\n      .meta({\n        label: 'Tenant ID',\n        description:\n          'Microsoft Entra tenant identifier. Either the directory (tenant) GUID from the Azure portal, or a verified domain such as \"contoso.onmicrosoft.com\".',\n        placeholder: '00000000-0000-0000-0000-000000000000',\n      }),\n    clientId: z.string().min(1).meta({\n      label: 'Application (client) ID',\n      description:\n        'Application (client) ID of the Entra app registration used to call Microsoft Graph.',\n      placeholder: '00000000-0000-0000-0000-000000000000',\n    }),\n    clientSecret: z.object({ $secret: z.string().min(1) }).meta({\n      label: 'Client secret',\n      description:\n        'Client secret value (not the secret ID) from the app registration. Stored as a secret.',\n      placeholder: 'ENTRA_CLIENT_SECRET',\n      secret: true,\n    }),\n    resources: z\n      .array(z.enum(['users', 'signins', 'risky_users']))\n      .nonempty()\n      .optional()\n      .meta({\n        label: 'Resources',\n        description:\n          'Which Entra ID resources to sync. Omit to sync all of them. The app registration only needs the Microsoft Graph application permissions for the resources listed here (User.Read.All, AuditLog.Read.All, IdentityRiskyUser.Read.All).',\n      }),\n    signinsLookbackDays: z.number().int().positive().max(30).optional().meta({\n      label: 'Sign-ins lookback (days)',\n      description:\n        'How many days of sign-in events to backfill on a full sync. Defaults to 7. Microsoft Graph retains sign-in logs for 30 days on the Premium tiers required to call the API.',\n      placeholder: '7',\n    }),\n  }),\n);\n\nexport const doc: ConnectorDoc = defineConnectorDoc({\n  displayName: 'Microsoft Entra ID',\n  category: 'security',\n  brandColor: '#0078D4',\n  tagline:\n    'Sync users, sign-in events, and risky users from a Microsoft Entra ID (formerly Azure AD) tenant for sign-in volume, failed-sign-in rate, and identity-risk dashboards.',\n  vendor: {\n    name: 'Microsoft Entra ID',\n    domain: 'microsoft.com',\n    apiDocs: 'https://learn.microsoft.com/en-us/graph/api/resources/signin',\n    website:\n      'https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id',\n  },\n  auth: {\n    summary:\n      'OAuth 2.0 client-credentials flow against the Microsoft identity platform, using an Entra app registration with Microsoft Graph application permissions.',\n    setup: [\n      'In the Azure portal, open Microsoft Entra ID -> App registrations and create a new registration (single tenant).',\n      'Under API permissions, add Microsoft Graph Application permissions for the resources you want to sync: User.Read.All (users), AuditLog.Read.All (signins), IdentityRiskyUser.Read.All (risky_users). Grant admin consent.',\n      'Under Certificates & secrets, add a new client secret and copy the Value (not the Secret ID) immediately - Azure only shows it once.',\n      'Copy the Directory (tenant) ID and Application (client) ID from the registration overview.',\n      'Store the client secret as a rawdash secret and reference it from the connector config as `clientSecret: secret(\"ENTRA_CLIENT_SECRET\")`.',\n    ],\n  },\n  rateLimit:\n    'Microsoft Graph applies per-app and per-tenant throttling. The shared HTTP client backs off on 429 using Retry-After and the standard rate-limit policy.',\n  limitations: [\n    'The sign-in logs and risky-users endpoints require Entra ID P1 or P2; tenants on the free tier cannot call them and the connector will surface a 4xx from Microsoft Graph.',\n    'Sign-in logs are retained by Microsoft for 30 days; backfills beyond that window return no data.',\n    'Conditional Access, application assignments, and audit logs (admin activity) are out of scope.',\n  ],\n});\n\nexport type EntraIdResource = 'users' | 'signins' | 'risky_users';\n\nexport interface EntraIdSettings {\n  tenantId: string;\n  resources?: readonly EntraIdResource[];\n  signinsLookbackDays?: number;\n}\n\nconst entraIdCredentials = {\n  clientId: {\n    description: 'Entra app registration application (client) ID',\n    auth: 'required' as const,\n  },\n  clientSecret: {\n    description: 'Entra app registration client secret value',\n    auth: 'required' as const,\n  },\n} satisfies CredentialsSchema;\n\ntype EntraIdCredentials = typeof entraIdCredentials;\n\nconst entraIdRateLimit = standardRateLimitPolicy({\n  remainingHeader: 'ratelimit-remaining',\n  resetHeader: 'ratelimit-reset',\n  resetUnit: 's',\n});\n\nconst PHASE_ORDER = ['users', 'signins', 'risky_users'] as const;\n\ntype EntraIdPhase = (typeof PHASE_ORDER)[number];\n\ntype EntraIdSyncCursor = ChunkedSyncCursor<EntraIdPhase, string>;\n\nconst isEntraIdSyncCursor = makeChunkedCursorGuard(PHASE_ORDER);\n\nconst USER_ENTITY = 'entra_user';\nconst SIGNIN_EVENT = 'entra_signin_event';\nconst RISKY_USER_ENTITY = 'entra_risky_user';\n\nconst USERS_PAGE_SIZE = 500;\nconst SIGNINS_PAGE_SIZE = 1000;\nconst RISKY_USERS_PAGE_SIZE = 500;\nconst DEFAULT_SIGNINS_LOOKBACK_DAYS = 7;\n\nconst oauthTokenSchema = z.object({\n  access_token: z.string().min(1),\n  token_type: z.string().optional(),\n  expires_in: z.number().optional(),\n});\n\nconst userSchema = z.object({\n  id: z.string().min(1),\n  displayName: z.string().nullish(),\n  userPrincipalName: z.string().nullish(),\n  mail: z.string().nullish(),\n  accountEnabled: z.boolean().nullish(),\n  userType: z.string().nullish(),\n  createdDateTime: z.string().nullish(),\n});\n\nconst usersResponseSchema = z.object({\n  '@odata.nextLink': z.string().nullish(),\n  value: z.array(userSchema),\n});\n\nconst signinStatusSchema = z.object({\n  errorCode: z.number().nullish(),\n  failureReason: z.string().nullish(),\n  additionalDetails: z.string().nullish(),\n});\n\nconst signinLocationSchema = z.object({\n  city: z.string().nullish(),\n  state: z.string().nullish(),\n  countryOrRegion: z.string().nullish(),\n});\n\nconst signinSchema = z.object({\n  id: z.string().min(1),\n  createdDateTime: z.string(),\n  userId: z.string().nullish(),\n  userPrincipalName: z.string().nullish(),\n  userDisplayName: z.string().nullish(),\n  appId: z.string().nullish(),\n  appDisplayName: z.string().nullish(),\n  ipAddress: z.string().nullish(),\n  clientAppUsed: z.string().nullish(),\n  conditionalAccessStatus: z.string().nullish(),\n  riskLevelAggregated: z.string().nullish(),\n  riskLevelDuringSignIn: z.string().nullish(),\n  riskState: z.string().nullish(),\n  riskDetail: z.string().nullish(),\n  status: signinStatusSchema.nullish(),\n  location: signinLocationSchema.nullish(),\n});\n\nconst signinsResponseSchema = z.object({\n  '@odata.nextLink': z.string().nullish(),\n  value: z.array(signinSchema),\n});\n\nconst riskyUserSchema = z.object({\n  id: z.string().min(1),\n  userPrincipalName: z.string().nullish(),\n  userDisplayName: z.string().nullish(),\n  riskLevel: z.string().nullish(),\n  riskState: z.string().nullish(),\n  riskDetail: z.string().nullish(),\n  riskLastUpdatedDateTime: z.string().nullish(),\n  isProcessing: z.boolean().nullish(),\n  isDeleted: z.boolean().nullish(),\n});\n\nconst riskyUsersResponseSchema = z.object({\n  '@odata.nextLink': z.string().nullish(),\n  value: z.array(riskyUserSchema),\n});\n\nexport const entraIdResources = defineResources({\n  [USER_ENTITY]: {\n    shape: 'entity',\n    filterable: [\n      { field: 'accountEnabled', ops: ['eq'], values: ['true', 'false'] },\n      {\n        field: 'userType',\n        ops: ['eq'],\n        values: ['Member', 'Guest'],\n      },\n    ],\n    description:\n      'Entra ID users with display name, principal name, mail, account-enabled flag, and user type.',\n    endpoint: 'GET /v1.0/users',\n    notes:\n      'Fully enumerated on every sync; @odata.nextLink pages are followed within the chunked sync loop.',\n    fields: [\n      { name: 'displayName', description: 'Display name from the directory.' },\n      {\n        name: 'userPrincipalName',\n        description: 'User principal name (e.g. alice@contoso.com).',\n      },\n      { name: 'mail', description: 'Primary SMTP address (may be null).' },\n      {\n        name: 'accountEnabled',\n        description:\n          'Whether the account is enabled (sign-in allowed when true).',\n      },\n      {\n        name: 'userType',\n        description: 'Either \"Member\" (in-tenant) or \"Guest\" (B2B invitee).',\n      },\n      {\n        name: 'createdAt',\n        description: 'When the user was created (Unix ms).',\n      },\n    ],\n    responses: {\n      oauth_token: oauthTokenSchema,\n      users: usersResponseSchema,\n    },\n  },\n  [SIGNIN_EVENT]: {\n    shape: 'event',\n    filterable: [\n      { field: 'status', ops: ['eq'], values: ['success', 'failure'] },\n      {\n        field: 'riskLevel',\n        ops: ['eq'],\n        values: [\n          'none',\n          'low',\n          'medium',\n          'high',\n          'hidden',\n          'unknownFutureValue',\n        ],\n      },\n      { field: 'appDisplayName', ops: ['eq'] },\n    ],\n    description:\n      'Sign-in events from the Entra ID audit logs (`/auditLogs/signIns`). One event per interactive sign-in attempt with user, app, IP, location, and risk fields.',\n    endpoint: 'GET /v1.0/auditLogs/signIns',\n    notes:\n      'Backfill window defaults to 7 days and is capped at the Microsoft Graph 30-day retention. Incremental syncs filter on `createdDateTime`.',\n    fields: [\n      {\n        name: 'status',\n        description:\n          'Aggregated status: \"success\" when the sign-in completed without error, otherwise \"failure\".',\n      },\n      {\n        name: 'errorCode',\n        description: 'Microsoft Graph signInStatus.errorCode (0 on success).',\n      },\n      {\n        name: 'failureReason',\n        description: 'Human-readable failure reason (null on success).',\n      },\n      { name: 'userId', description: 'Directory object id of the actor.' },\n      {\n        name: 'userPrincipalName',\n        description: 'User principal name at sign-in time.',\n      },\n      { name: 'appId', description: 'Application (client) id signed into.' },\n      {\n        name: 'appDisplayName',\n        description: 'Display name of the application signed into.',\n      },\n      { name: 'ipAddress', description: 'Client IP recorded by Entra.' },\n      {\n        name: 'countryOrRegion',\n        description: 'Geographic country/region from location.countryOrRegion.',\n      },\n      {\n        name: 'city',\n        description: 'City from location.city (may be null).',\n      },\n      {\n        name: 'riskLevel',\n        description:\n          'Aggregated risk level (none / low / medium / high / hidden / unknownFutureValue).',\n      },\n      {\n        name: 'riskState',\n        description:\n          'Risk state (none / confirmedSafe / remediated / dismissed / atRisk / confirmedCompromised).',\n      },\n      {\n        name: 'clientAppUsed',\n        description:\n          'Client app type (Browser, Mobile Apps and Desktop clients, etc.).',\n      },\n      {\n        name: 'conditionalAccessStatus',\n        description:\n          'Outcome of conditional-access policy evaluation (success / failure / notApplied / unknownFutureValue).',\n      },\n    ],\n    responses: { signins: signinsResponseSchema },\n  },\n  [RISKY_USER_ENTITY]: {\n    shape: 'entity',\n    filterable: [\n      {\n        field: 'riskLevel',\n        ops: ['eq'],\n        values: ['low', 'medium', 'high', 'hidden', 'unknownFutureValue'],\n      },\n      {\n        field: 'riskState',\n        ops: ['eq'],\n        values: [\n          'none',\n          'confirmedSafe',\n          'remediated',\n          'dismissed',\n          'atRisk',\n          'confirmedCompromised',\n          'unknownFutureValue',\n        ],\n      },\n    ],\n    description:\n      'Users currently flagged by Entra Identity Protection, with their risk level, risk state, and last-updated timestamp.',\n    endpoint: 'GET /v1.0/identityProtection/riskyUsers',\n    notes:\n      'Fully enumerated on every sync; @odata.nextLink pages are followed within the chunked sync loop.',\n    fields: [\n      {\n        name: 'userPrincipalName',\n        description: 'User principal name of the risky user.',\n      },\n      { name: 'displayName', description: 'Display name of the risky user.' },\n      {\n        name: 'riskLevel',\n        description:\n          'Identity Protection risk level (low / medium / high / hidden / unknownFutureValue).',\n      },\n      {\n        name: 'riskState',\n        description:\n          'Risk state (none / confirmedSafe / remediated / dismissed / atRisk / confirmedCompromised / unknownFutureValue).',\n      },\n      {\n        name: 'riskDetail',\n        description:\n          'Latest risk detail string (the specific reason for the flag).',\n      },\n      {\n        name: 'riskLastUpdatedAt',\n        description: 'When the risk was last refreshed (Unix ms).',\n      },\n    ],\n    responses: { risky_users: riskyUsersResponseSchema },\n  },\n});\n\nexport const id = 'entra-id';\n\ntype UsersResponse = z.infer<typeof usersResponseSchema>;\ntype SigninsResponse = z.infer<typeof signinsResponseSchema>;\ntype RiskyUsersResponse = z.infer<typeof riskyUsersResponseSchema>;\ntype OauthTokenResponse = z.infer<typeof oauthTokenSchema>;\ntype EntraUser = z.infer<typeof userSchema>;\ntype EntraSignin = z.infer<typeof signinSchema>;\ntype EntraRiskyUser = z.infer<typeof riskyUserSchema>;\n\nfunction signinStatus(\n  errorCode: number | null | undefined,\n): 'success' | 'failure' {\n  return errorCode === 0 || errorCode === null || errorCode === undefined\n    ? 'success'\n    : 'failure';\n}\n\nfunction pageRequestPath(phase: EntraIdPhase): string {\n  switch (phase) {\n    case 'users':\n      return `/${API_VERSION}/users`;\n    case 'signins':\n      return `/${API_VERSION}/auditLogs/signIns`;\n    case 'risky_users':\n      return `/${API_VERSION}/identityProtection/riskyUsers`;\n  }\n}\n\nfunction sanitizeGraphUrl(\n  url: string | null,\n  phase: EntraIdPhase,\n): string | null {\n  return sanitizeAllowedUrl({\n    url,\n    host: GRAPH_HOST,\n    pathname: pageRequestPath(phase),\n  });\n}\n\nexport class EntraIdConnector extends BaseConnector<\n  EntraIdSettings,\n  EntraIdCredentials\n> {\n  static readonly id = id;\n\n  static readonly resources = entraIdResources;\n\n  static readonly schemas = schemasFromResources(entraIdResources);\n\n  static create(input: unknown, ctx?: ConnectorContext): EntraIdConnector {\n    const parsed = configFields.parse(input);\n    return new EntraIdConnector(\n      {\n        tenantId: parsed.tenantId,\n        resources: parsed.resources,\n        signinsLookbackDays: parsed.signinsLookbackDays,\n      },\n      {\n        clientId: parsed.clientId,\n        clientSecret: parsed.clientSecret,\n      },\n      ctx,\n    );\n  }\n\n  readonly id = id;\n  override readonly credentials = entraIdCredentials;\n\n  private accessToken: string | null = null;\n  private accessTokenExpiry: number = 0;\n\n  private tokenUrl(): string {\n    return `https://${LOGIN_HOST}/${encodeURIComponent(this.settings.tenantId)}/oauth2/v2.0/token`;\n  }\n\n  private async refreshAccessToken(signal?: AbortSignal): Promise<string> {\n    const body = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: this.creds.clientId,\n      client_secret: this.creds.clientSecret,\n      scope: `https://${GRAPH_HOST}/.default`,\n    });\n    const res = await this.post<OauthTokenResponse>(this.tokenUrl(), {\n      resource: 'oauth_token',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Accept: 'application/json',\n        'User-Agent': connectorUserAgent('entra-id'),\n      },\n      body: body.toString(),\n      signal,\n    });\n    const token = res.body.access_token;\n    const expiresIn = res.body.expires_in ?? 3600;\n    this.accessToken = token;\n    this.accessTokenExpiry = Date.now() + (expiresIn - 60) * 1000;\n    return token;\n  }\n\n  private async getAccessToken(signal?: AbortSignal): Promise<string> {\n    if (!this.accessToken || Date.now() >= this.accessTokenExpiry) {\n      return this.refreshAccessToken(signal);\n    }\n    return this.accessToken;\n  }\n\n  private async apiGet<T>(\n    url: string,\n    resource: string,\n    signal?: AbortSignal,\n    retried = false,\n  ): Promise<HttpResponse<T>> {\n    const token = await this.getAccessToken(signal);\n    const res = await this.get<T>(url, {\n      resource,\n      headers: {\n        Authorization: `Bearer ${token}`,\n        Accept: 'application/json',\n        'User-Agent': connectorUserAgent('entra-id'),\n      },\n      rateLimit: entraIdRateLimit,\n      signal,\n    });\n    if (res.status === 401 && !retried) {\n      this.accessToken = null;\n      this.accessTokenExpiry = 0;\n      return this.apiGet<T>(url, resource, signal, true);\n    }\n    return res;\n  }\n\n  private signinsSince(options: SyncOptions): string {\n    if (options.since) {\n      return options.since;\n    }\n    const lookback =\n      this.settings.signinsLookbackDays ?? DEFAULT_SIGNINS_LOOKBACK_DAYS;\n    const since = new Date(Date.now() - lookback * 24 * 60 * 60 * 1000);\n    return since.toISOString();\n  }\n\n  private buildInitialUrl(phase: EntraIdPhase, options: SyncOptions): string {\n    const u = new URL(`https://${GRAPH_HOST}${pageRequestPath(phase)}`);\n    switch (phase) {\n      case 'users':\n        u.searchParams.set(\n          '$select',\n          'id,displayName,userPrincipalName,mail,accountEnabled,userType,createdDateTime',\n        );\n        u.searchParams.set('$top', String(USERS_PAGE_SIZE));\n        return u.toString();\n      case 'signins': {\n        const since = this.signinsSince(options);\n        u.searchParams.set('$filter', `createdDateTime ge ${since}`);\n        u.searchParams.set('$orderby', 'createdDateTime asc');\n        u.searchParams.set('$top', String(SIGNINS_PAGE_SIZE));\n        return u.toString();\n      }\n      case 'risky_users':\n        u.searchParams.set('$top', String(RISKY_USERS_PAGE_SIZE));\n        return u.toString();\n    }\n  }\n\n  private async fetchPhasePage(\n    phase: EntraIdPhase,\n    page: string | null,\n    options: SyncOptions,\n    signal: AbortSignal | undefined,\n  ): Promise<{ items: unknown[]; next: string | null }> {\n    const url = page ?? this.buildInitialUrl(phase, options);\n    switch (phase) {\n      case 'users': {\n        const res = await this.apiGet<UsersResponse>(url, 'users', signal);\n        const next = sanitizeGraphUrl(\n          res.body['@odata.nextLink'] ?? null,\n          phase,\n        );\n        return { items: res.body.value, next };\n      }\n      case 'signins': {\n        const res = await this.apiGet<SigninsResponse>(url, 'signins', signal);\n        const next = sanitizeGraphUrl(\n          res.body['@odata.nextLink'] ?? null,\n          phase,\n        );\n        return { items: res.body.value, next };\n      }\n      case 'risky_users': {\n        const res = await this.apiGet<RiskyUsersResponse>(\n          url,\n          'risky_users',\n          signal,\n        );\n        const next = sanitizeGraphUrl(\n          res.body['@odata.nextLink'] ?? null,\n          phase,\n        );\n        return { items: res.body.value, next };\n      }\n    }\n  }\n\n  private async writeUsers(\n    storage: StorageHandle,\n    items: EntraUser[],\n  ): Promise<void> {\n    for (const u of items) {\n      const createdMs = parseEpoch(u.createdDateTime ?? null, 'iso');\n      await storage.entity({\n        type: USER_ENTITY,\n        id: u.id,\n        attributes: {\n          displayName: u.displayName ?? null,\n          userPrincipalName: u.userPrincipalName ?? null,\n          mail: u.mail ?? null,\n          accountEnabled: u.accountEnabled ?? null,\n          userType: u.userType ?? null,\n          createdAt: createdMs,\n        },\n        updated_at: createdMs ?? 0,\n      });\n    }\n  }\n\n  private async writeSignins(\n    storage: StorageHandle,\n    items: EntraSignin[],\n    sinceMs: number | null,\n  ): Promise<void> {\n    for (const s of items) {\n      const ts = parseEpoch(s.createdDateTime, 'iso');\n      if (ts === null) {\n        continue;\n      }\n      if (sinceMs !== null && ts <= sinceMs) {\n        continue;\n      }\n      const errorCode = s.status?.errorCode ?? null;\n      await storage.event({\n        name: SIGNIN_EVENT,\n        start_ts: ts,\n        end_ts: null,\n        attributes: {\n          signinId: s.id,\n          status: signinStatus(errorCode),\n          errorCode,\n          failureReason: s.status?.failureReason ?? null,\n          userId: s.userId ?? null,\n          userPrincipalName: s.userPrincipalName ?? null,\n          userDisplayName: s.userDisplayName ?? null,\n          appId: s.appId ?? null,\n          appDisplayName: s.appDisplayName ?? null,\n          ipAddress: s.ipAddress ?? null,\n          clientAppUsed: s.clientAppUsed ?? null,\n          city: s.location?.city ?? null,\n          state: s.location?.state ?? null,\n          countryOrRegion: s.location?.countryOrRegion ?? null,\n          riskLevel: s.riskLevelAggregated ?? null,\n          riskLevelDuringSignIn: s.riskLevelDuringSignIn ?? null,\n          riskState: s.riskState ?? null,\n          riskDetail: s.riskDetail ?? null,\n          conditionalAccessStatus: s.conditionalAccessStatus ?? null,\n        },\n      });\n    }\n  }\n\n  private async writeRiskyUsers(\n    storage: StorageHandle,\n    items: EntraRiskyUser[],\n  ): Promise<void> {\n    for (const r of items) {\n      const updatedMs = parseEpoch(r.riskLastUpdatedDateTime ?? null, 'iso');\n      await storage.entity({\n        type: RISKY_USER_ENTITY,\n        id: r.id,\n        attributes: {\n          userPrincipalName: r.userPrincipalName ?? null,\n          displayName: r.userDisplayName ?? null,\n          riskLevel: r.riskLevel ?? null,\n          riskState: r.riskState ?? null,\n          riskDetail: r.riskDetail ?? null,\n          riskLastUpdatedAt: updatedMs,\n          isProcessing: r.isProcessing ?? null,\n          isDeleted: r.isDeleted ?? null,\n        },\n        updated_at: updatedMs ?? 0,\n      });\n    }\n  }\n\n  private async writePhase(\n    storage: StorageHandle,\n    phase: EntraIdPhase,\n    items: unknown[],\n    sinceMs: number | null,\n  ): Promise<void> {\n    switch (phase) {\n      case 'users':\n        return this.writeUsers(storage, items as EntraUser[]);\n      case 'signins':\n        return this.writeSignins(storage, items as EntraSignin[], sinceMs);\n      case 'risky_users':\n        return this.writeRiskyUsers(storage, items as EntraRiskyUser[]);\n    }\n  }\n\n  private async clearScopeOnFirstPage(\n    storage: StorageHandle,\n    phase: EntraIdPhase,\n    isFull: boolean,\n  ): Promise<void> {\n    if (!isFull) {\n      return;\n    }\n    switch (phase) {\n      case 'users':\n        await storage.entities([], { types: [USER_ENTITY] });\n        return;\n      case 'signins':\n        await storage.events([], { names: [SIGNIN_EVENT] });\n        return;\n      case 'risky_users':\n        await storage.entities([], { types: [RISKY_USER_ENTITY] });\n        return;\n    }\n  }\n\n  private resolveCursor(cursor: unknown): EntraIdSyncCursor | undefined {\n    if (!isEntraIdSyncCursor(cursor)) {\n      return undefined;\n    }\n    return {\n      phase: cursor.phase,\n      page: sanitizeGraphUrl(cursor.page, cursor.phase),\n    };\n  }\n\n  async sync(\n    options: SyncOptions,\n    storage: StorageHandle,\n    signal?: AbortSignal,\n  ): Promise<SyncResult> {\n    const cursor = this.resolveCursor(options.cursor);\n    const isFull = options.mode === 'full';\n    const sinceMsRaw = options.since ? Date.parse(options.since) : null;\n    const sinceMs =\n      sinceMsRaw !== null && Number.isFinite(sinceMsRaw) ? sinceMsRaw : null;\n\n    const phases = selectActivePhases<EntraIdResource, EntraIdPhase>(\n      (r) => r,\n      PHASE_ORDER,\n      this.settings.resources,\n    );\n\n    return paginateChunked<EntraIdPhase, string>({\n      phases,\n      cursor,\n      signal,\n      logger: this.logger,\n      fetchPage: async (phase, page, sig) =>\n        this.fetchPhasePage(phase, page, options, sig),\n      writeBatch: async (phase, items, page) => {\n        if (page === null) {\n          await this.clearScopeOnFirstPage(storage, phase, isFull);\n        }\n        await this.writePhase(storage, phase, items, sinceMs);\n      },\n    });\n  }\n}\n","import { EntraIdConnector } from './entra-id';\n\nexport {\n  EntraIdConnector,\n  entraIdResources as resources,\n  configFields,\n  doc,\n  id,\n} from './entra-id';\nexport type { EntraIdResource, EntraIdSettings } from './entra-id';\nexport default EntraIdConnector;\n"],"mappings":";AEAO,IAAM,sBAAsB;AAE5B,IAAM,qBAAqB,qBAAqB,mBAAmB;AAEnE,SAAS,mBAAmB,aAA6B;AAC9D,SAAO,qBAAqB,WAAW,IAAI,mBAAmB;AAChE;AEUO,SAAS,wBACd,QACiB;AACjB,QAAM,EAAE,iBAAiB,aAAa,WAAW,gBAAgB,IAAI;AACrE,QAAM,aAAa,cAAc,MAAM,MAAO;AAC9C,SAAO;IACL,MAAM,GAAG;AACP,YAAM,eAAe,EAAE,IAAI,eAAe;AAC1C,UAAI,iBAAiB,QAAQ,aAAa,KAAK,MAAM,IAAI;AACvD,eAAO;MACT;AACA,YAAM,YAAY,OAAO,YAAY;AACrC,UAAI,CAAC,OAAO,SAAS,SAAS,GAAG;AAC/B,eAAO;MACT;AACA,YAAM,WAAW,EAAE,IAAI,WAAW;AAClC,UAAI,aAAa,MAAM;AACrB,YAAI,oBAAoB,QAAW;AACjC,iBAAO;QACT;AACA,eAAO;UACL;UACA,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe;QAChD;MACF;AACA,UAAI,SAAS,KAAK,MAAM,IAAI;AAC1B,eAAO;MACT;AACA,YAAM,QAAQ,OAAO,QAAQ;AAC7B,UAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GAAG;AACxC,eAAO;MACT;AACA,YAAM,UAAU,QAAQ;AACxB,UAAI,CAAC,OAAO,SAAS,OAAO,GAAG;AAC7B,eAAO;MACT;AACA,aAAO,EAAE,WAAW,SAAS,IAAI,KAAK,OAAO,EAAE;IACjD;EACF;AACF;AEhDO,SAAS,mBACd,SACe;AACf,QAAM,EAAE,KAAK,MAAM,UAAU,WAAW,SAAS,IAAI;AACrD,MAAI,QAAQ,MAAM;AAChB,WAAO;EACT;AACA,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,GAAG;AACrB,QAAI,EAAE,aAAa,YAAY,EAAE,SAAS,QAAQ,EAAE,aAAa,UAAU;AACzE,aAAO;IACT;AACA,WAAO,EAAE,SAAS;EACpB,QAAQ;AACN,WAAO;EACT;AACF;ACrBO,SAAS,WACd,OACA,MACe;AACf,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO;EACT;AACA,MAAI,SAAS,OAAO;AAClB,QAAI,OAAO,UAAU,UAAU;AAC7B,aAAO;IACT;AACA,UAAM,KAAK,IAAI,KAAK,KAAK,EAAE,QAAQ;AACnC,WAAO,OAAO,SAAS,EAAE,IAAI,KAAK;EACpC;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAAI;AACpD,WAAO;EACT;AACA,QAAM,IAAI,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK;AAC1D,MAAI,CAAC,OAAO,SAAS,CAAC,GAAG;AACvB,WAAO;EACT;AACA,QAAM,SAAS,SAAS,MAAM,IAAI,MAAO;AACzC,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;;;AGlBA;AAAA,EACE;AAAA,EAQA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS;AAElB,IAAM,aAAa;AACnB,IAAM,aAAa;AACnB,IAAM,cAAc;AAKpB,IAAM,oBAAoB;AAEnB,IAAM,eAAe;AAAA,EAC1B,EAAE,OAAO;AAAA,IACP,UAAU,EACP,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL;AAAA,MACC;AAAA,MACA;AAAA,IACF,EACC,KAAK;AAAA,MACJ,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,IACf,CAAC;AAAA,IACH,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,KAAK;AAAA,MAC/B,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,IACf,CAAC;AAAA,IACD,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK;AAAA,MAC1D,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,MACb,QAAQ;AAAA,IACV,CAAC;AAAA,IACD,WAAW,EACR,MAAM,EAAE,KAAK,CAAC,SAAS,WAAW,aAAa,CAAC,CAAC,EACjD,SAAS,EACT,SAAS,EACT,KAAK;AAAA,MACJ,OAAO;AAAA,MACP,aACE;AAAA,IACJ,CAAC;AAAA,IACH,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK;AAAA,MACvE,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,IACf,CAAC;AAAA,EACH,CAAC;AACH;AAEO,IAAM,MAAoB,mBAAmB;AAAA,EAClD,aAAa;AAAA,EACb,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,SACE;AAAA,EACF,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SACE;AAAA,EACJ;AAAA,EACA,MAAM;AAAA,IACJ,SACE;AAAA,IACF,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,WACE;AAAA,EACF,aAAa;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,CAAC;AAUD,IAAM,qBAAqB;AAAA,EACzB,UAAU;AAAA,IACR,aAAa;AAAA,IACb,MAAM;AAAA,EACR;AAAA,EACA,cAAc;AAAA,IACZ,aAAa;AAAA,IACb,MAAM;AAAA,EACR;AACF;AAIA,IAAM,mBAAmB,wBAAwB;AAAA,EAC/C,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,WAAW;AACb,CAAC;AAED,IAAM,cAAc,CAAC,SAAS,WAAW,aAAa;AAMtD,IAAM,sBAAsB,uBAAuB,WAAW;AAE9D,IAAM,cAAc;AACpB,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAE1B,IAAM,kBAAkB;AACxB,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,gCAAgC;AAEtC,IAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAED,IAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,QAAQ;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,QAAQ;AAAA,EACzB,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AACtC,CAAC;AAED,IAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,OAAO,EAAE,MAAM,UAAU;AAC3B,CAAC;AAED,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,QAAQ;AAAA,EAClC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AACxC,CAAC;AAED,IAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,QAAQ;AAAA,EACzB,OAAO,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC1B,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AACtC,CAAC;AAED,IAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACpC,OAAO,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,QAAQ;AAAA,EAClC,yBAAyB,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC5C,qBAAqB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACxC,uBAAuB,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC/B,QAAQ,mBAAmB,QAAQ;AAAA,EACnC,UAAU,qBAAqB,QAAQ;AACzC,CAAC;AAED,IAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,OAAO,EAAE,MAAM,YAAY;AAC7B,CAAC;AAED,IAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC/B,yBAAyB,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC5C,cAAc,EAAE,QAAQ,EAAE,QAAQ;AAAA,EAClC,WAAW,EAAE,QAAQ,EAAE,QAAQ;AACjC,CAAC;AAED,IAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,OAAO,EAAE,MAAM,eAAe;AAChC,CAAC;AAEM,IAAM,mBAAmB,gBAAgB;AAAA,EAC9C,CAAC,WAAW,GAAG;AAAA,IACb,OAAO;AAAA,IACP,YAAY;AAAA,MACV,EAAE,OAAO,kBAAkB,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,OAAO,EAAE;AAAA,MAClE;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ,CAAC,UAAU,OAAO;AAAA,MAC5B;AAAA,IACF;AAAA,IACA,aACE;AAAA,IACF,UAAU;AAAA,IACV,OACE;AAAA,IACF,QAAQ;AAAA,MACN,EAAE,MAAM,eAAe,aAAa,mCAAmC;AAAA,MACvE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,QAAQ,aAAa,sCAAsC;AAAA,MACnE;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,CAAC,YAAY,GAAG;AAAA,IACd,OAAO;AAAA,IACP,YAAY;AAAA,MACV,EAAE,OAAO,UAAU,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,WAAW,SAAS,EAAE;AAAA,MAC/D;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,OAAO,kBAAkB,KAAK,CAAC,IAAI,EAAE;AAAA,IACzC;AAAA,IACA,aACE;AAAA,IACF,UAAU;AAAA,IACV,OACE;AAAA,IACF,QAAQ;AAAA,MACN;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,MACnE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,SAAS,aAAa,uCAAuC;AAAA,MACrE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,aAAa,aAAa,+BAA+B;AAAA,MACjE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,IACF;AAAA,IACA,WAAW,EAAE,SAAS,sBAAsB;AAAA,EAC9C;AAAA,EACA,CAAC,iBAAiB,GAAG;AAAA,IACnB,OAAO;AAAA,IACP,YAAY;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ,CAAC,OAAO,UAAU,QAAQ,UAAU,oBAAoB;AAAA,MAClE;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,aACE;AAAA,IACF,UAAU;AAAA,IACV,OACE;AAAA,IACF,QAAQ;AAAA,MACN;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,eAAe,aAAa,kCAAkC;AAAA,MACtE;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,WAAW,EAAE,aAAa,yBAAyB;AAAA,EACrD;AACF,CAAC;AAEM,IAAM,KAAK;AAUlB,SAAS,aACP,WACuB;AACvB,SAAO,cAAc,KAAK,cAAc,QAAQ,cAAc,SAC1D,YACA;AACN;AAEA,SAAS,gBAAgB,OAA6B;AACpD,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO,IAAI,WAAW;AAAA,IACxB,KAAK;AACH,aAAO,IAAI,WAAW;AAAA,IACxB,KAAK;AACH,aAAO,IAAI,WAAW;AAAA,EAC1B;AACF;AAEA,SAAS,iBACP,KACA,OACe;AACf,SAAO,mBAAmB;AAAA,IACxB;AAAA,IACA,MAAM;AAAA,IACN,UAAU,gBAAgB,KAAK;AAAA,EACjC,CAAC;AACH;AAEO,IAAM,mBAAN,MAAM,0BAAyB,cAGpC;AAAA,EACA,OAAgB,KAAK;AAAA,EAErB,OAAgB,YAAY;AAAA,EAE5B,OAAgB,UAAU,qBAAqB,gBAAgB;AAAA,EAE/D,OAAO,OAAO,OAAgB,KAA0C;AACtE,UAAM,SAAS,aAAa,MAAM,KAAK;AACvC,WAAO,IAAI;AAAA,MACT;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,qBAAqB,OAAO;AAAA,MAC9B;AAAA,MACA;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,cAAc,OAAO;AAAA,MACvB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAES,KAAK;AAAA,EACI,cAAc;AAAA,EAExB,cAA6B;AAAA,EAC7B,oBAA4B;AAAA,EAE5B,WAAmB;AACzB,WAAO,WAAW,UAAU,IAAI,mBAAmB,KAAK,SAAS,QAAQ,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAc,mBAAmB,QAAuC;AACtE,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MACZ,WAAW,KAAK,MAAM;AAAA,MACtB,eAAe,KAAK,MAAM;AAAA,MAC1B,OAAO,WAAW,UAAU;AAAA,IAC9B,CAAC;AACD,UAAM,MAAM,MAAM,KAAK,KAAyB,KAAK,SAAS,GAAG;AAAA,MAC/D,UAAU;AAAA,MACV,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,cAAc,mBAAmB,UAAU;AAAA,MAC7C;AAAA,MACA,MAAM,KAAK,SAAS;AAAA,MACpB;AAAA,IACF,CAAC;AACD,UAAM,QAAQ,IAAI,KAAK;AACvB,UAAM,YAAY,IAAI,KAAK,cAAc;AACzC,SAAK,cAAc;AACnB,SAAK,oBAAoB,KAAK,IAAI,KAAK,YAAY,MAAM;AACzD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,eAAe,QAAuC;AAClE,QAAI,CAAC,KAAK,eAAe,KAAK,IAAI,KAAK,KAAK,mBAAmB;AAC7D,aAAO,KAAK,mBAAmB,MAAM;AAAA,IACvC;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,OACZ,KACA,UACA,QACA,UAAU,OACgB;AAC1B,UAAM,QAAQ,MAAM,KAAK,eAAe,MAAM;AAC9C,UAAM,MAAM,MAAM,KAAK,IAAO,KAAK;AAAA,MACjC;AAAA,MACA,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,QAAQ;AAAA,QACR,cAAc,mBAAmB,UAAU;AAAA,MAC7C;AAAA,MACA,WAAW;AAAA,MACX;AAAA,IACF,CAAC;AACD,QAAI,IAAI,WAAW,OAAO,CAAC,SAAS;AAClC,WAAK,cAAc;AACnB,WAAK,oBAAoB;AACzB,aAAO,KAAK,OAAU,KAAK,UAAU,QAAQ,IAAI;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA8B;AACjD,QAAI,QAAQ,OAAO;AACjB,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,WACJ,KAAK,SAAS,uBAAuB;AACvC,UAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW,KAAK,KAAK,KAAK,GAAI;AAClE,WAAO,MAAM,YAAY;AAAA,EAC3B;AAAA,EAEQ,gBAAgB,OAAqB,SAA8B;AACzE,UAAM,IAAI,IAAI,IAAI,WAAW,UAAU,GAAG,gBAAgB,KAAK,CAAC,EAAE;AAClE,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,UAAE,aAAa;AAAA,UACb;AAAA,UACA;AAAA,QACF;AACA,UAAE,aAAa,IAAI,QAAQ,OAAO,eAAe,CAAC;AAClD,eAAO,EAAE,SAAS;AAAA,MACpB,KAAK,WAAW;AACd,cAAM,QAAQ,KAAK,aAAa,OAAO;AACvC,UAAE,aAAa,IAAI,WAAW,sBAAsB,KAAK,EAAE;AAC3D,UAAE,aAAa,IAAI,YAAY,qBAAqB;AACpD,UAAE,aAAa,IAAI,QAAQ,OAAO,iBAAiB,CAAC;AACpD,eAAO,EAAE,SAAS;AAAA,MACpB;AAAA,MACA,KAAK;AACH,UAAE,aAAa,IAAI,QAAQ,OAAO,qBAAqB,CAAC;AACxD,eAAO,EAAE,SAAS;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAc,eACZ,OACA,MACA,SACA,QACoD;AACpD,UAAM,MAAM,QAAQ,KAAK,gBAAgB,OAAO,OAAO;AACvD,YAAQ,OAAO;AAAA,MACb,KAAK,SAAS;AACZ,cAAM,MAAM,MAAM,KAAK,OAAsB,KAAK,SAAS,MAAM;AACjE,cAAM,OAAO;AAAA,UACX,IAAI,KAAK,iBAAiB,KAAK;AAAA,UAC/B;AAAA,QACF;AACA,eAAO,EAAE,OAAO,IAAI,KAAK,OAAO,KAAK;AAAA,MACvC;AAAA,MACA,KAAK,WAAW;AACd,cAAM,MAAM,MAAM,KAAK,OAAwB,KAAK,WAAW,MAAM;AACrE,cAAM,OAAO;AAAA,UACX,IAAI,KAAK,iBAAiB,KAAK;AAAA,UAC/B;AAAA,QACF;AACA,eAAO,EAAE,OAAO,IAAI,KAAK,OAAO,KAAK;AAAA,MACvC;AAAA,MACA,KAAK,eAAe;AAClB,cAAM,MAAM,MAAM,KAAK;AAAA,UACrB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,cAAM,OAAO;AAAA,UACX,IAAI,KAAK,iBAAiB,KAAK;AAAA,UAC/B;AAAA,QACF;AACA,eAAO,EAAE,OAAO,IAAI,KAAK,OAAO,KAAK;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,WACZ,SACA,OACe;AACf,eAAW,KAAK,OAAO;AACrB,YAAM,YAAY,WAAW,EAAE,mBAAmB,MAAM,KAAK;AAC7D,YAAM,QAAQ,OAAO;AAAA,QACnB,MAAM;AAAA,QACN,IAAI,EAAE;AAAA,QACN,YAAY;AAAA,UACV,aAAa,EAAE,eAAe;AAAA,UAC9B,mBAAmB,EAAE,qBAAqB;AAAA,UAC1C,MAAM,EAAE,QAAQ;AAAA,UAChB,gBAAgB,EAAE,kBAAkB;AAAA,UACpC,UAAU,EAAE,YAAY;AAAA,UACxB,WAAW;AAAA,QACb;AAAA,QACA,YAAY,aAAa;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,SACA,OACA,SACe;AACf,eAAW,KAAK,OAAO;AACrB,YAAM,KAAK,WAAW,EAAE,iBAAiB,KAAK;AAC9C,UAAI,OAAO,MAAM;AACf;AAAA,MACF;AACA,UAAI,YAAY,QAAQ,MAAM,SAAS;AACrC;AAAA,MACF;AACA,YAAM,YAAY,EAAE,QAAQ,aAAa;AACzC,YAAM,QAAQ,MAAM;AAAA,QAClB,MAAM;AAAA,QACN,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,YAAY;AAAA,UACV,UAAU,EAAE;AAAA,UACZ,QAAQ,aAAa,SAAS;AAAA,UAC9B;AAAA,UACA,eAAe,EAAE,QAAQ,iBAAiB;AAAA,UAC1C,QAAQ,EAAE,UAAU;AAAA,UACpB,mBAAmB,EAAE,qBAAqB;AAAA,UAC1C,iBAAiB,EAAE,mBAAmB;AAAA,UACtC,OAAO,EAAE,SAAS;AAAA,UAClB,gBAAgB,EAAE,kBAAkB;AAAA,UACpC,WAAW,EAAE,aAAa;AAAA,UAC1B,eAAe,EAAE,iBAAiB;AAAA,UAClC,MAAM,EAAE,UAAU,QAAQ;AAAA,UAC1B,OAAO,EAAE,UAAU,SAAS;AAAA,UAC5B,iBAAiB,EAAE,UAAU,mBAAmB;AAAA,UAChD,WAAW,EAAE,uBAAuB;AAAA,UACpC,uBAAuB,EAAE,yBAAyB;AAAA,UAClD,WAAW,EAAE,aAAa;AAAA,UAC1B,YAAY,EAAE,cAAc;AAAA,UAC5B,yBAAyB,EAAE,2BAA2B;AAAA,QACxD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,gBACZ,SACA,OACe;AACf,eAAW,KAAK,OAAO;AACrB,YAAM,YAAY,WAAW,EAAE,2BAA2B,MAAM,KAAK;AACrE,YAAM,QAAQ,OAAO;AAAA,QACnB,MAAM;AAAA,QACN,IAAI,EAAE;AAAA,QACN,YAAY;AAAA,UACV,mBAAmB,EAAE,qBAAqB;AAAA,UAC1C,aAAa,EAAE,mBAAmB;AAAA,UAClC,WAAW,EAAE,aAAa;AAAA,UAC1B,WAAW,EAAE,aAAa;AAAA,UAC1B,YAAY,EAAE,cAAc;AAAA,UAC5B,mBAAmB;AAAA,UACnB,cAAc,EAAE,gBAAgB;AAAA,UAChC,WAAW,EAAE,aAAa;AAAA,QAC5B;AAAA,QACA,YAAY,aAAa;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,WACZ,SACA,OACA,OACA,SACe;AACf,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,KAAK,WAAW,SAAS,KAAoB;AAAA,MACtD,KAAK;AACH,eAAO,KAAK,aAAa,SAAS,OAAwB,OAAO;AAAA,MACnE,KAAK;AACH,eAAO,KAAK,gBAAgB,SAAS,KAAyB;AAAA,IAClE;AAAA,EACF;AAAA,EAEA,MAAc,sBACZ,SACA,OACA,QACe;AACf,QAAI,CAAC,QAAQ;AACX;AAAA,IACF;AACA,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,cAAM,QAAQ,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;AACnD;AAAA,MACF,KAAK;AACH,cAAM,QAAQ,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;AAClD;AAAA,MACF,KAAK;AACH,cAAM,QAAQ,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;AACzD;AAAA,IACJ;AAAA,EACF;AAAA,EAEQ,cAAc,QAAgD;AACpE,QAAI,CAAC,oBAAoB,MAAM,GAAG;AAChC,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd,MAAM,iBAAiB,OAAO,MAAM,OAAO,KAAK;AAAA,IAClD;AAAA,EACF;AAAA,EAEA,MAAM,KACJ,SACA,SACA,QACqB;AACrB,UAAM,SAAS,KAAK,cAAc,QAAQ,MAAM;AAChD,UAAM,SAAS,QAAQ,SAAS;AAChC,UAAM,aAAa,QAAQ,QAAQ,KAAK,MAAM,QAAQ,KAAK,IAAI;AAC/D,UAAM,UACJ,eAAe,QAAQ,OAAO,SAAS,UAAU,IAAI,aAAa;AAEpE,UAAM,SAAS;AAAA,MACb,CAAC,MAAM;AAAA,MACP;AAAA,MACA,KAAK,SAAS;AAAA,IAChB;AAEA,WAAO,gBAAsC;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,WAAW,OAAO,OAAO,MAAM,QAC7B,KAAK,eAAe,OAAO,MAAM,SAAS,GAAG;AAAA,MAC/C,YAAY,OAAO,OAAO,OAAO,SAAS;AACxC,YAAI,SAAS,MAAM;AACjB,gBAAM,KAAK,sBAAsB,SAAS,OAAO,MAAM;AAAA,QACzD;AACA,cAAM,KAAK,WAAW,SAAS,OAAO,OAAO,OAAO;AAAA,MACtD;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;ACrwBA,IAAO,gBAAQ;","names":[]}
+{"version":3,"sources":["../../../connector-shared/src/errors.ts","../../../connector-shared/src/retry.ts","../../../connector-shared/src/version.ts","../../../connector-shared/src/request.ts","../../../connector-shared/src/rate-limit.ts","../../../connector-shared/src/map-concurrent.ts","../../../connector-shared/src/sanitize.ts","../../../connector-shared/src/epoch.ts","../../../connector-shared/src/pagination.ts","../../../connector-shared/src/logger.ts","../../azure-shared/src/auth.ts","../../azure-shared/src/arm.ts","../../azure-shared/src/base-azure-connector.ts","../../../connector-shared/src/errors.ts","../../../connector-shared/src/retry.ts","../../../connector-shared/src/version.ts","../../../connector-shared/src/request.ts","../../../connector-shared/src/rate-limit.ts","../../../connector-shared/src/map-concurrent.ts","../../../connector-shared/src/sanitize.ts","../../../connector-shared/src/epoch.ts","../../../connector-shared/src/pagination.ts","../../../connector-shared/src/logger.ts","../src/entra-id.ts","../src/index.ts"],"sourcesContent":["import type { HttpResponse } from './types';\n\nexport type HttpErrorKind =\n  | 'transient'\n  | 'rate_limit'\n  | 'auth'\n  | 'upstream_bug'\n  | 'client_bug';\n\nexport abstract class HttpClientError extends Error {\n  abstract readonly kind: HttpErrorKind;\n  readonly response?: HttpResponse;\n\n  constructor(message: string, response?: HttpResponse) {\n    super(message);\n    this.name = new.target.name;\n    this.response = response;\n  }\n}\n\nexport class TransientError extends HttpClientError {\n  readonly kind = 'transient' as const;\n}\n\nexport class RateLimitError extends HttpClientError {\n  readonly kind = 'rate_limit' as const;\n  readonly retryAfter?: Date;\n\n  constructor(message: string, response?: HttpResponse, retryAfter?: Date) {\n    super(message, response);\n    this.retryAfter = retryAfter;\n  }\n}\n\nexport class AuthError extends HttpClientError {\n  readonly kind = 'auth' as const;\n}\n\nexport class UpstreamBugError extends HttpClientError {\n  readonly kind = 'upstream_bug' as const;\n}\n\nexport class ClientBugError extends HttpClientError {\n  readonly kind = 'client_bug' as const;\n}\n\nexport function classifyStatus(status: number): HttpErrorKind {\n  if (status === 429) {\n    return 'rate_limit';\n  }\n  if (status === 401 || status === 403) {\n    return 'auth';\n  }\n  if (status === 408) {\n    return 'transient';\n  }\n  if (status >= 500) {\n    return 'upstream_bug';\n  }\n  if (status >= 400) {\n    return 'client_bug';\n  }\n  return 'client_bug';\n}\n\nexport function errorForStatus(\n  message: string,\n  response: HttpResponse,\n  retryAfter?: Date,\n): HttpClientError {\n  const kind = classifyStatus(response.status);\n  switch (kind) {\n    case 'rate_limit':\n      return new RateLimitError(message, response, retryAfter);\n    case 'auth':\n      return new AuthError(message, response);\n    case 'transient':\n      return new TransientError(message, response);\n    case 'upstream_bug':\n      return new UpstreamBugError(message, response);\n    case 'client_bug':\n      return new ClientBugError(message, response);\n  }\n}\n","import { HttpClientError, RateLimitError, TransientError } from './errors';\n\nexport interface RetryPolicy {\n  maxAttempts?: number;\n  initialDelayMs?: number;\n  maxDelayMs?: number;\n  retryOn?: (status: number | null, err?: Error) => boolean;\n}\n\nexport const defaultRetryOn = (status: number | null, err?: Error): boolean => {\n  if (err instanceof RateLimitError) {\n    return true;\n  }\n  if (err instanceof TransientError) {\n    return true;\n  }\n  if (status === null) {\n    return err instanceof Error && !(err instanceof HttpClientError);\n  }\n  if (status === 408 || status === 429) {\n    return true;\n  }\n  if (status >= 500) {\n    return true;\n  }\n  return false;\n};\n\nexport function backoffDelayMs(\n  attempt: number,\n  policy: Required<Pick<RetryPolicy, 'initialDelayMs' | 'maxDelayMs'>>,\n): number {\n  const base = policy.initialDelayMs * 2 ** attempt;\n  const jitter = base * 0.25 * Math.random();\n  return Math.min(base + jitter, policy.maxDelayMs);\n}\n\nexport function parseRetryAfter(\n  headerValue: string | null,\n  now: Date = new Date(),\n): Date | undefined {\n  if (!headerValue) {\n    return undefined;\n  }\n  const trimmed = headerValue.trim();\n  if (/^\\d+$/.test(trimmed)) {\n    return new Date(now.getTime() + Number(trimmed) * 1000);\n  }\n  const parsed = Date.parse(trimmed);\n  if (Number.isNaN(parsed)) {\n    return undefined;\n  }\n  return new Date(parsed);\n}\n\nexport function sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  if (signal?.aborted) {\n    return Promise.reject(signal.reason ?? new Error('Aborted'));\n  }\n  return new Promise<void>((resolve, reject) => {\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(signal!.reason ?? new Error('Aborted'));\n    };\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n","export const HTTP_CLIENT_VERSION = '0.0.0';\n\nexport const DEFAULT_USER_AGENT = `rawdash-connector/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;\n\nexport function connectorUserAgent(connectorId: string): string {\n  return `rawdash-connector-${connectorId}/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;\n}\n","import {\n  AuthError,\n  ClientBugError,\n  HttpClientError,\n  RateLimitError,\n  TransientError,\n  UpstreamBugError,\n  errorForStatus,\n} from './errors';\nimport { defaultRetryOn, parseRetryAfter, sleep } from './retry';\nimport type { FetchLike, HttpMethod, HttpRequest, HttpResponse } from './types';\nimport { DEFAULT_USER_AGENT } from './version';\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst DEFAULT_MAX_ATTEMPTS = 3;\nconst DEFAULT_INITIAL_DELAY_MS = 1000;\nconst DEFAULT_MAX_DELAY_MS = 60_000;\nconst OBSERVER_TIMEOUT_MS = 250;\n\nexport interface RequestObservation {\n  url: string;\n  method: HttpMethod;\n  status: number;\n  resource: string;\n  requestId: string;\n  body: unknown;\n}\n\nexport type RequestObserver = (\n  event: RequestObservation,\n) => void | Promise<void>;\n\nexport interface RequestOptions {\n  fetch?: FetchLike;\n  observer?: RequestObserver;\n  resource: string;\n  requestId?: string;\n}\n\nasync function notifyObserver(\n  observer: RequestObserver,\n  event: RequestObservation,\n): Promise<void> {\n  let result: void | Promise<void>;\n  try {\n    result = observer(event);\n  } catch (err) {\n    console.warn('[connector-shared] request observer threw:', err);\n    return;\n  }\n  if (!(result instanceof Promise)) {\n    return;\n  }\n  const guarded = result.catch((err) => {\n    console.warn('[connector-shared] request observer rejected:', err);\n  });\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<void>((resolve) => {\n    timer = setTimeout(resolve, OBSERVER_TIMEOUT_MS);\n  });\n  try {\n    await Promise.race([guarded, timeout]);\n  } finally {\n    if (timer) {\n      clearTimeout(timer);\n    }\n  }\n}\n\nfunction newRequestId(): string {\n  const c = (globalThis as { crypto?: { randomUUID?: () => string } }).crypto;\n  if (c?.randomUUID) {\n    return c.randomUUID();\n  }\n  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;\n}\n\nfunction mergeHeaders(\n  defaults: Record<string, string>,\n  overrides: Record<string, string> | undefined,\n): Record<string, string> {\n  const merged: Record<string, string> = {};\n  for (const [k, v] of Object.entries(defaults)) {\n    merged[k.toLowerCase()] = v;\n  }\n  if (overrides) {\n    for (const [k, v] of Object.entries(overrides)) {\n      merged[k.toLowerCase()] = v;\n    }\n  }\n  return merged;\n}\n\nfunction linkTimeoutSignal(\n  parent: AbortSignal | undefined,\n  timeoutMs: number,\n): { signal: AbortSignal; cancel: () => void } {\n  const controller = new AbortController();\n  const onParentAbort = () => {\n    controller.abort(parent?.reason);\n  };\n  if (parent) {\n    if (parent.aborted) {\n      controller.abort(parent.reason);\n    } else {\n      parent.addEventListener('abort', onParentAbort, { once: true });\n    }\n  }\n  const timer = setTimeout(() => {\n    controller.abort(new Error(`Request timed out after ${timeoutMs}ms`));\n  }, timeoutMs);\n  return {\n    signal: controller.signal,\n    cancel: () => {\n      clearTimeout(timer);\n      if (parent) {\n        parent.removeEventListener('abort', onParentAbort);\n      }\n    },\n  };\n}\n\nasync function readBody(res: Response, parseJson: boolean): Promise<unknown> {\n  if (res.status === 204 || res.status === 205) {\n    return null;\n  }\n  const contentType = res.headers.get('content-type') ?? '';\n  if (parseJson && contentType.includes('application/json')) {\n    const text = await res.text();\n    if (text.length === 0) {\n      return null;\n    }\n    return JSON.parse(text);\n  }\n  return res.text();\n}\n\nexport async function request<T = unknown>(\n  req: HttpRequest,\n  options: RequestOptions,\n): Promise<HttpResponse<T>> {\n  const fetchImpl: FetchLike = options.fetch ?? (globalThis.fetch as FetchLike);\n  const retry = req.retry ?? {};\n  const maxAttempts = retry.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;\n  const initialDelayMs = retry.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS;\n  const maxDelayMs = retry.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;\n  const retryOn = retry.retryOn ?? defaultRetryOn;\n  const timeoutMs = req.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const parseJson = req.parseJson ?? true;\n\n  const headers = mergeHeaders(\n    {\n      'User-Agent': DEFAULT_USER_AGENT,\n      Accept: 'application/json',\n    },\n    req.headers,\n  );\n\n  let lastErr: Error | undefined;\n\n  for (let attempt = 0; attempt < maxAttempts; attempt++) {\n    req.signal?.throwIfAborted();\n\n    const { signal, cancel } = linkTimeoutSignal(req.signal, timeoutMs);\n    let res: Response;\n    try {\n      res = await fetchImpl(req.url, {\n        method: req.method ?? 'GET',\n        headers,\n        body: req.body as RequestInit['body'],\n        signal,\n      });\n    } catch (err) {\n      cancel();\n      if (req.signal?.aborted) {\n        throw req.signal.reason ?? err;\n      }\n      const error = err instanceof Error ? err : new Error(String(err));\n      lastErr = error;\n      if (attempt < maxAttempts - 1 && retryOn(null, error)) {\n        const delay = computeDelay(attempt, initialDelayMs, maxDelayMs);\n        await sleep(delay, req.signal);\n        continue;\n      }\n      throw new TransientError(error.message);\n    }\n    cancel();\n\n    const body = await readBody(res, parseJson);\n    const httpResponse: HttpResponse<T> = {\n      status: res.status,\n      headers: res.headers,\n      body: body as T,\n    };\n    if (req.rateLimit) {\n      const state = req.rateLimit.parse(res.headers);\n      if (state) {\n        httpResponse.rateLimitState = state;\n      }\n    }\n\n    if (options.observer) {\n      await notifyObserver(options.observer, {\n        url: req.url,\n        method: req.method ?? 'GET',\n        status: res.status,\n        resource: options.resource,\n        requestId: options.requestId ?? newRequestId(),\n        body,\n      });\n    }\n\n    if (res.ok) {\n      return httpResponse;\n    }\n\n    const retryAfter = parseRetryAfter(res.headers.get('retry-after'));\n    const message = `HTTP ${res.status} ${res.statusText} for ${req.method ?? 'GET'} ${req.url}`;\n    const err = errorForStatus(message, httpResponse, retryAfter);\n\n    if (\n      attempt < maxAttempts - 1 &&\n      retryOn(res.status, err) &&\n      !(err instanceof AuthError) &&\n      !(err instanceof ClientBugError)\n    ) {\n      lastErr = err;\n      let delay = computeDelay(attempt, initialDelayMs, maxDelayMs);\n      if (err instanceof RateLimitError && retryAfter) {\n        const wait = retryAfter.getTime() - Date.now();\n        if (wait > 0) {\n          delay = Math.min(wait, maxDelayMs);\n        }\n      }\n      await sleep(delay, req.signal);\n      continue;\n    }\n\n    throw err;\n  }\n\n  throw lastErr ?? new UpstreamBugError('Exhausted retry attempts');\n}\n\nfunction computeDelay(\n  attempt: number,\n  initialDelayMs: number,\n  maxDelayMs: number,\n): number {\n  const base = initialDelayMs * 2 ** attempt;\n  const jitter = base * 0.25 * Math.random();\n  return Math.min(base + jitter, maxDelayMs);\n}\n\nexport { HttpClientError };\n","export interface RateLimitState {\n  remaining: number;\n  resetAt: Date;\n}\n\nexport interface RateLimitPolicy {\n  parse(headers: Headers): RateLimitState | null;\n}\n\nexport interface StandardRateLimitPolicyConfig {\n  remainingHeader: string;\n  resetHeader: string;\n  resetUnit: 's' | 'ms';\n  resetFallbackMs?: number;\n}\n\nexport function standardRateLimitPolicy(\n  config: StandardRateLimitPolicyConfig,\n): RateLimitPolicy {\n  const { remainingHeader, resetHeader, resetUnit, resetFallbackMs } = config;\n  const multiplier = resetUnit === 's' ? 1000 : 1;\n  return {\n    parse(h) {\n      const remainingRaw = h.get(remainingHeader);\n      if (remainingRaw === null || remainingRaw.trim() === '') {\n        return null;\n      }\n      const remaining = Number(remainingRaw);\n      if (!Number.isFinite(remaining)) {\n        return null;\n      }\n      const resetRaw = h.get(resetHeader);\n      if (resetRaw === null) {\n        if (resetFallbackMs === undefined) {\n          return null;\n        }\n        return {\n          remaining,\n          resetAt: new Date(Date.now() + resetFallbackMs),\n        };\n      }\n      if (resetRaw.trim() === '') {\n        return null;\n      }\n      const reset = Number(resetRaw);\n      if (!Number.isFinite(reset) || reset < 0) {\n        return null;\n      }\n      const resetMs = reset * multiplier;\n      if (!Number.isFinite(resetMs)) {\n        return null;\n      }\n      return { remaining, resetAt: new Date(resetMs) };\n    },\n  };\n}\n","export async function mapWithConcurrency<T, R>(\n  items: readonly T[],\n  concurrency: number,\n  fn: (item: T, index: number) => Promise<R>,\n): Promise<R[]> {\n  const results = new Array<R>(items.length);\n  if (items.length === 0) {\n    return results;\n  }\n  const normalized = Number.isFinite(concurrency) ? Math.floor(concurrency) : 1;\n  const limit = Math.max(1, Math.min(normalized, items.length));\n  let next = 0;\n  let failed = false;\n\n  async function worker(): Promise<void> {\n    while (!failed) {\n      const i = next++;\n      if (i >= items.length) {\n        return;\n      }\n      try {\n        results[i] = await fn(items[i]!, i);\n      } catch (err) {\n        failed = true;\n        throw err;\n      }\n    }\n  }\n\n  const workers: Promise<void>[] = [];\n  for (let w = 0; w < limit; w++) {\n    workers.push(worker());\n  }\n  await Promise.all(workers);\n  return results;\n}\n","export interface SanitizeAllowedUrlOptions {\n  url: string | null;\n  host: string;\n  pathname: string;\n  protocol?: 'https:' | 'http:';\n}\n\nexport function sanitizeAllowedUrl(\n  options: SanitizeAllowedUrlOptions,\n): string | null {\n  const { url, host, pathname, protocol = 'https:' } = options;\n  if (url === null) {\n    return null;\n  }\n  try {\n    const u = new URL(url);\n    if (u.protocol !== protocol || u.host !== host || u.pathname !== pathname) {\n      return null;\n    }\n    return u.toString();\n  } catch {\n    return null;\n  }\n}\n","export type EpochUnit = 'ms' | 's' | 'iso';\n\nexport function parseEpoch(\n  value: number | string | null | undefined,\n  unit: EpochUnit,\n): number | null {\n  if (value === null || value === undefined) {\n    return null;\n  }\n  if (unit === 'iso') {\n    if (typeof value !== 'string') {\n      return null;\n    }\n    const ms = new Date(value).getTime();\n    return Number.isFinite(ms) ? ms : null;\n  }\n  if (typeof value === 'string' && value.trim() === '') {\n    return null;\n  }\n  const n = typeof value === 'number' ? value : Number(value);\n  if (!Number.isFinite(n)) {\n    return null;\n  }\n  const result = unit === 's' ? n * 1000 : n;\n  return Number.isFinite(result) ? result : null;\n}\n","import { request } from './request';\nimport type { HttpRequest } from './types';\n\nexport function parseLinkHeader(header: string | null): Record<string, string> {\n  if (!header) {\n    return {};\n  }\n  const result: Record<string, string> = {};\n  for (const part of header.split(',')) {\n    const match = part.match(/<([^>]+)>\\s*;\\s*rel=\"([^\"]+)\"/);\n    if (match) {\n      result[match[2]!] = match[1]!;\n    }\n  }\n  return result;\n}\n\nexport async function* paginateLink<T>(\n  initial: HttpRequest,\n  parse: (body: unknown) => T[],\n  options: { resource: string },\n): AsyncIterable<T> {\n  let next: string | null = initial.url;\n  while (next) {\n    const res: Awaited<ReturnType<typeof request>> = await request(\n      {\n        ...initial,\n        url: next,\n      },\n      { resource: options.resource },\n    );\n    for (const item of parse(res.body)) {\n      yield item;\n    }\n    const links = parseLinkHeader(res.headers.get('link'));\n    next = links['next'] ?? null;\n  }\n}\n\nexport async function* paginateCursor<T>(\n  initial: HttpRequest,\n  parse: (body: unknown) => { items: T[]; nextCursor: string | null },\n  buildNext: (req: HttpRequest, cursor: string) => HttpRequest,\n  options: { resource: string },\n): AsyncIterable<T> {\n  let req: HttpRequest = initial;\n  while (true) {\n    const res = await request(req, { resource: options.resource });\n    const { items, nextCursor } = parse(res.body);\n    for (const item of items) {\n      yield item;\n    }\n    if (!nextCursor) {\n      return;\n    }\n    req = buildNext(req, nextCursor);\n  }\n}\n\nexport async function* paginatePage<T>(\n  initial: HttpRequest,\n  parse: (body: unknown) => { items: T[]; hasMore: boolean },\n  buildPage: (req: HttpRequest, page: number) => HttpRequest,\n  options: { resource: string },\n): AsyncIterable<T> {\n  let page = 1;\n  while (true) {\n    const req = page === 1 ? initial : buildPage(initial, page);\n    const res = await request(req, { resource: options.resource });\n    const { items, hasMore } = parse(res.body);\n    for (const item of items) {\n      yield item;\n    }\n    if (!hasMore || items.length === 0) {\n      return;\n    }\n    page++;\n  }\n}\n","export type LogFields = Record<string, unknown>;\n\nexport interface ConnectorLogger {\n  info(event: string, fields?: LogFields): void;\n  warn(event: string, fields?: LogFields): void;\n}\n\nexport interface ConnectorLoggerOptions {\n  scope: string;\n}\n\nconst MAX_VALUE_LEN = 120;\n\nfunction truncate(s: string, max = MAX_VALUE_LEN): string {\n  if (s.length <= max) {\n    return s;\n  }\n  return `${s.slice(0, max - 1)}…`;\n}\n\nfunction formatValue(value: unknown): string {\n  if (value === null) {\n    return 'null';\n  }\n  if (value === undefined) {\n    return '';\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') {\n    return String(value);\n  }\n  if (typeof value === 'string') {\n    const t = truncate(value);\n    if (/[\\s\"=]/.test(t)) {\n      return JSON.stringify(t);\n    }\n    return t;\n  }\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  let json: string | undefined;\n  try {\n    json = JSON.stringify(value);\n  } catch {\n    json = undefined;\n  }\n  return truncate(json ?? String(value));\n}\n\nexport function formatLogFields(fields?: LogFields): string {\n  if (!fields) {\n    return '';\n  }\n  const parts: string[] = [];\n  for (const [k, v] of Object.entries(fields)) {\n    if (v === undefined) {\n      continue;\n    }\n    parts.push(`${k}=${formatValue(v)}`);\n  }\n  return parts.length > 0 ? ` ${parts.join(' ')}` : '';\n}\n\nexport function formatLogLine(\n  scope: string,\n  event: string,\n  fields?: LogFields,\n): string {\n  return `[${scope}] ${event}${formatLogFields(fields)}`;\n}\n\nexport function createDefaultConnectorLogger(\n  opts: ConnectorLoggerOptions,\n): ConnectorLogger {\n  return {\n    info(event, fields) {\n      console.info(formatLogLine(opts.scope, event, fields));\n    },\n    warn(event, fields) {\n      console.warn(formatLogLine(opts.scope, event, fields));\n    },\n  };\n}\n\nconst NOOP_LOGGER: ConnectorLogger = {\n  info() {},\n  warn() {},\n};\n\nexport function noopConnectorLogger(): ConnectorLogger {\n  return NOOP_LOGGER;\n}\n","import {\n  AuthError,\n  type HttpResponse,\n  TransientError,\n  connectorUserAgent,\n  request as sharedRequest,\n} from '@rawdash/connector-shared';\n\nconst TOKEN_HOST = 'login.microsoftonline.com';\nconst TOKEN_TTL_BUFFER_MS = 60_000;\n\nexport interface EntraAuthInput {\n  tenantId: string;\n  clientId: string;\n  clientSecret: string;\n  scope: string;\n  connectorId: string;\n}\n\ninterface TokenResponse {\n  access_token?: string;\n  expires_in?: number;\n  token_type?: string;\n}\n\nexport interface TokenCacheEntry {\n  token: string;\n  expiresAt: number;\n}\n\nexport async function fetchEntraAccessToken(\n  input: EntraAuthInput,\n  signal?: AbortSignal,\n): Promise<TokenCacheEntry> {\n  const params = new URLSearchParams();\n  params.set('grant_type', 'client_credentials');\n  params.set('client_id', input.clientId);\n  params.set('client_secret', input.clientSecret);\n  params.set('scope', input.scope);\n\n  let res: HttpResponse<TokenResponse>;\n  try {\n    res = await sharedRequest<TokenResponse>(\n      {\n        url: `https://${TOKEN_HOST}/${encodeURIComponent(input.tenantId)}/oauth2/v2.0/token`,\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n          Accept: 'application/json',\n          'User-Agent': connectorUserAgent(input.connectorId),\n        },\n        body: params.toString(),\n        signal,\n      },\n      { resource: 'oauth_token' },\n    );\n  } catch (err) {\n    throw classifyTokenError(err);\n  }\n\n  const access = res.body.access_token;\n  const expiresIn = res.body.expires_in;\n  if (typeof access !== 'string' || access.length === 0) {\n    throw new AuthError(\n      'Entra ID token response did not include an access_token',\n    );\n  }\n  const ttlMs =\n    typeof expiresIn === 'number' && Number.isFinite(expiresIn)\n      ? expiresIn * 1000\n      : 60 * 60 * 1000;\n  return {\n    token: access,\n    expiresAt: Date.now() + ttlMs - TOKEN_TTL_BUFFER_MS,\n  };\n}\n\nfunction classifyTokenError(err: unknown): unknown {\n  if (!(err instanceof Error) || !('kind' in err)) {\n    return err;\n  }\n  const httpErr = err as Error & { response?: HttpResponse };\n  const status = httpErr.response?.status ?? 0;\n  // Entra ID returns 400 for invalid_client / invalid_grant; treat all auth\n  // failures as AuthError so the host stops retrying on a broken secret.\n  if (status === 400 || status === 401 || status === 403) {\n    return new AuthError(httpErr.message, httpErr.response);\n  }\n  if (status >= 500) {\n    return new TransientError(httpErr.message, httpErr.response);\n  }\n  return err;\n}\n\nexport function isTokenFresh(\n  cache: TokenCacheEntry | null,\n  now: number = Date.now(),\n): boolean {\n  return cache !== null && now < cache.expiresAt;\n}\n","import {\n  AuthError,\n  type HttpResponse,\n  RateLimitError,\n  TransientError,\n} from '@rawdash/connector-shared';\n\nexport const ARM_HOST = 'https://management.azure.com';\n\n// nextLink can be a fully-qualified URL Azure hands back; sanitize before reuse\n// so a corrupted cursor cannot exfiltrate the bearer token to an attacker host.\nexport function isAllowedArmUrl(value: string): boolean {\n  try {\n    const u = new URL(value);\n    return u.protocol === 'https:' && u.host === 'management.azure.com';\n  } catch {\n    return false;\n  }\n}\n\nexport function mapArmError(err: unknown): unknown {\n  if (!(err instanceof Error) || !('kind' in err)) {\n    return err;\n  }\n  const httpErr = err as Error & { response?: HttpResponse };\n  const status = httpErr.response?.status ?? 0;\n  if (status === 401 || status === 403) {\n    return new AuthError(httpErr.message, httpErr.response);\n  }\n  if (status === 429) {\n    return new RateLimitError(httpErr.message, httpErr.response);\n  }\n  if (status >= 500) {\n    return new TransientError(httpErr.message, httpErr.response);\n  }\n  return err;\n}\n","import { BaseConnector, type CredentialsSchema } from '@rawdash/core';\n\nimport {\n  type TokenCacheEntry,\n  fetchEntraAccessToken,\n  isTokenFresh,\n} from './auth';\n\nconst ARM_SCOPE = 'https://management.azure.com/.default';\n\nexport interface BaseAzureSettings {\n  tenantId: string;\n  clientId: string;\n  subscriptionId: string;\n}\n\nexport const azureCredentials = {\n  clientSecret: {\n    description: 'Azure AD app-registration client secret',\n    auth: 'required' as const,\n  },\n} satisfies CredentialsSchema;\n\nexport type AzureCredentials = typeof azureCredentials;\n\nexport abstract class BaseAzureConnector<\n  TSettings extends BaseAzureSettings,\n> extends BaseConnector<TSettings, AzureCredentials> {\n  override readonly credentials = azureCredentials;\n\n  private tokenCache: TokenCacheEntry | null = null;\n\n  protected async getAccessToken(signal?: AbortSignal): Promise<string> {\n    if (isTokenFresh(this.tokenCache)) {\n      return this.tokenCache!.token;\n    }\n    this.tokenCache = await fetchEntraAccessToken(\n      {\n        tenantId: this.settings.tenantId,\n        clientId: this.settings.clientId,\n        clientSecret: this.creds.clientSecret,\n        scope: ARM_SCOPE,\n        connectorId: this.id,\n      },\n      signal,\n    );\n    return this.tokenCache.token;\n  }\n}\n","import type { HttpResponse } from './types';\n\nexport type HttpErrorKind =\n  | 'transient'\n  | 'rate_limit'\n  | 'auth'\n  | 'upstream_bug'\n  | 'client_bug';\n\nexport abstract class HttpClientError extends Error {\n  abstract readonly kind: HttpErrorKind;\n  readonly response?: HttpResponse;\n\n  constructor(message: string, response?: HttpResponse) {\n    super(message);\n    this.name = new.target.name;\n    this.response = response;\n  }\n}\n\nexport class TransientError extends HttpClientError {\n  readonly kind = 'transient' as const;\n}\n\nexport class RateLimitError extends HttpClientError {\n  readonly kind = 'rate_limit' as const;\n  readonly retryAfter?: Date;\n\n  constructor(message: string, response?: HttpResponse, retryAfter?: Date) {\n    super(message, response);\n    this.retryAfter = retryAfter;\n  }\n}\n\nexport class AuthError extends HttpClientError {\n  readonly kind = 'auth' as const;\n}\n\nexport class UpstreamBugError extends HttpClientError {\n  readonly kind = 'upstream_bug' as const;\n}\n\nexport class ClientBugError extends HttpClientError {\n  readonly kind = 'client_bug' as const;\n}\n\nexport function classifyStatus(status: number): HttpErrorKind {\n  if (status === 429) {\n    return 'rate_limit';\n  }\n  if (status === 401 || status === 403) {\n    return 'auth';\n  }\n  if (status === 408) {\n    return 'transient';\n  }\n  if (status >= 500) {\n    return 'upstream_bug';\n  }\n  if (status >= 400) {\n    return 'client_bug';\n  }\n  return 'client_bug';\n}\n\nexport function errorForStatus(\n  message: string,\n  response: HttpResponse,\n  retryAfter?: Date,\n): HttpClientError {\n  const kind = classifyStatus(response.status);\n  switch (kind) {\n    case 'rate_limit':\n      return new RateLimitError(message, response, retryAfter);\n    case 'auth':\n      return new AuthError(message, response);\n    case 'transient':\n      return new TransientError(message, response);\n    case 'upstream_bug':\n      return new UpstreamBugError(message, response);\n    case 'client_bug':\n      return new ClientBugError(message, response);\n  }\n}\n","import { HttpClientError, RateLimitError, TransientError } from './errors';\n\nexport interface RetryPolicy {\n  maxAttempts?: number;\n  initialDelayMs?: number;\n  maxDelayMs?: number;\n  retryOn?: (status: number | null, err?: Error) => boolean;\n}\n\nexport const defaultRetryOn = (status: number | null, err?: Error): boolean => {\n  if (err instanceof RateLimitError) {\n    return true;\n  }\n  if (err instanceof TransientError) {\n    return true;\n  }\n  if (status === null) {\n    return err instanceof Error && !(err instanceof HttpClientError);\n  }\n  if (status === 408 || status === 429) {\n    return true;\n  }\n  if (status >= 500) {\n    return true;\n  }\n  return false;\n};\n\nexport function backoffDelayMs(\n  attempt: number,\n  policy: Required<Pick<RetryPolicy, 'initialDelayMs' | 'maxDelayMs'>>,\n): number {\n  const base = policy.initialDelayMs * 2 ** attempt;\n  const jitter = base * 0.25 * Math.random();\n  return Math.min(base + jitter, policy.maxDelayMs);\n}\n\nexport function parseRetryAfter(\n  headerValue: string | null,\n  now: Date = new Date(),\n): Date | undefined {\n  if (!headerValue) {\n    return undefined;\n  }\n  const trimmed = headerValue.trim();\n  if (/^\\d+$/.test(trimmed)) {\n    return new Date(now.getTime() + Number(trimmed) * 1000);\n  }\n  const parsed = Date.parse(trimmed);\n  if (Number.isNaN(parsed)) {\n    return undefined;\n  }\n  return new Date(parsed);\n}\n\nexport function sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  if (signal?.aborted) {\n    return Promise.reject(signal.reason ?? new Error('Aborted'));\n  }\n  return new Promise<void>((resolve, reject) => {\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(signal!.reason ?? new Error('Aborted'));\n    };\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n","export const HTTP_CLIENT_VERSION = '0.0.0';\n\nexport const DEFAULT_USER_AGENT = `rawdash-connector/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;\n\nexport function connectorUserAgent(connectorId: string): string {\n  return `rawdash-connector-${connectorId}/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;\n}\n","import {\n  AuthError,\n  ClientBugError,\n  HttpClientError,\n  RateLimitError,\n  TransientError,\n  UpstreamBugError,\n  errorForStatus,\n} from './errors';\nimport { defaultRetryOn, parseRetryAfter, sleep } from './retry';\nimport type { FetchLike, HttpMethod, HttpRequest, HttpResponse } from './types';\nimport { DEFAULT_USER_AGENT } from './version';\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst DEFAULT_MAX_ATTEMPTS = 3;\nconst DEFAULT_INITIAL_DELAY_MS = 1000;\nconst DEFAULT_MAX_DELAY_MS = 60_000;\nconst OBSERVER_TIMEOUT_MS = 250;\n\nexport interface RequestObservation {\n  url: string;\n  method: HttpMethod;\n  status: number;\n  resource: string;\n  requestId: string;\n  body: unknown;\n}\n\nexport type RequestObserver = (\n  event: RequestObservation,\n) => void | Promise<void>;\n\nexport interface RequestOptions {\n  fetch?: FetchLike;\n  observer?: RequestObserver;\n  resource: string;\n  requestId?: string;\n}\n\nasync function notifyObserver(\n  observer: RequestObserver,\n  event: RequestObservation,\n): Promise<void> {\n  let result: void | Promise<void>;\n  try {\n    result = observer(event);\n  } catch (err) {\n    console.warn('[connector-shared] request observer threw:', err);\n    return;\n  }\n  if (!(result instanceof Promise)) {\n    return;\n  }\n  const guarded = result.catch((err) => {\n    console.warn('[connector-shared] request observer rejected:', err);\n  });\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<void>((resolve) => {\n    timer = setTimeout(resolve, OBSERVER_TIMEOUT_MS);\n  });\n  try {\n    await Promise.race([guarded, timeout]);\n  } finally {\n    if (timer) {\n      clearTimeout(timer);\n    }\n  }\n}\n\nfunction newRequestId(): string {\n  const c = (globalThis as { crypto?: { randomUUID?: () => string } }).crypto;\n  if (c?.randomUUID) {\n    return c.randomUUID();\n  }\n  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;\n}\n\nfunction mergeHeaders(\n  defaults: Record<string, string>,\n  overrides: Record<string, string> | undefined,\n): Record<string, string> {\n  const merged: Record<string, string> = {};\n  for (const [k, v] of Object.entries(defaults)) {\n    merged[k.toLowerCase()] = v;\n  }\n  if (overrides) {\n    for (const [k, v] of Object.entries(overrides)) {\n      merged[k.toLowerCase()] = v;\n    }\n  }\n  return merged;\n}\n\nfunction linkTimeoutSignal(\n  parent: AbortSignal | undefined,\n  timeoutMs: number,\n): { signal: AbortSignal; cancel: () => void } {\n  const controller = new AbortController();\n  const onParentAbort = () => {\n    controller.abort(parent?.reason);\n  };\n  if (parent) {\n    if (parent.aborted) {\n      controller.abort(parent.reason);\n    } else {\n      parent.addEventListener('abort', onParentAbort, { once: true });\n    }\n  }\n  const timer = setTimeout(() => {\n    controller.abort(new Error(`Request timed out after ${timeoutMs}ms`));\n  }, timeoutMs);\n  return {\n    signal: controller.signal,\n    cancel: () => {\n      clearTimeout(timer);\n      if (parent) {\n        parent.removeEventListener('abort', onParentAbort);\n      }\n    },\n  };\n}\n\nasync function readBody(res: Response, parseJson: boolean): Promise<unknown> {\n  if (res.status === 204 || res.status === 205) {\n    return null;\n  }\n  const contentType = res.headers.get('content-type') ?? '';\n  if (parseJson && contentType.includes('application/json')) {\n    const text = await res.text();\n    if (text.length === 0) {\n      return null;\n    }\n    return JSON.parse(text);\n  }\n  return res.text();\n}\n\nexport async function request<T = unknown>(\n  req: HttpRequest,\n  options: RequestOptions,\n): Promise<HttpResponse<T>> {\n  const fetchImpl: FetchLike = options.fetch ?? (globalThis.fetch as FetchLike);\n  const retry = req.retry ?? {};\n  const maxAttempts = retry.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;\n  const initialDelayMs = retry.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS;\n  const maxDelayMs = retry.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;\n  const retryOn = retry.retryOn ?? defaultRetryOn;\n  const timeoutMs = req.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const parseJson = req.parseJson ?? true;\n\n  const headers = mergeHeaders(\n    {\n      'User-Agent': DEFAULT_USER_AGENT,\n      Accept: 'application/json',\n    },\n    req.headers,\n  );\n\n  let lastErr: Error | undefined;\n\n  for (let attempt = 0; attempt < maxAttempts; attempt++) {\n    req.signal?.throwIfAborted();\n\n    const { signal, cancel } = linkTimeoutSignal(req.signal, timeoutMs);\n    let res: Response;\n    try {\n      res = await fetchImpl(req.url, {\n        method: req.method ?? 'GET',\n        headers,\n        body: req.body as RequestInit['body'],\n        signal,\n      });\n    } catch (err) {\n      cancel();\n      if (req.signal?.aborted) {\n        throw req.signal.reason ?? err;\n      }\n      const error = err instanceof Error ? err : new Error(String(err));\n      lastErr = error;\n      if (attempt < maxAttempts - 1 && retryOn(null, error)) {\n        const delay = computeDelay(attempt, initialDelayMs, maxDelayMs);\n        await sleep(delay, req.signal);\n        continue;\n      }\n      throw new TransientError(error.message);\n    }\n    cancel();\n\n    const body = await readBody(res, parseJson);\n    const httpResponse: HttpResponse<T> = {\n      status: res.status,\n      headers: res.headers,\n      body: body as T,\n    };\n    if (req.rateLimit) {\n      const state = req.rateLimit.parse(res.headers);\n      if (state) {\n        httpResponse.rateLimitState = state;\n      }\n    }\n\n    if (options.observer) {\n      await notifyObserver(options.observer, {\n        url: req.url,\n        method: req.method ?? 'GET',\n        status: res.status,\n        resource: options.resource,\n        requestId: options.requestId ?? newRequestId(),\n        body,\n      });\n    }\n\n    if (res.ok) {\n      return httpResponse;\n    }\n\n    const retryAfter = parseRetryAfter(res.headers.get('retry-after'));\n    const message = `HTTP ${res.status} ${res.statusText} for ${req.method ?? 'GET'} ${req.url}`;\n    const err = errorForStatus(message, httpResponse, retryAfter);\n\n    if (\n      attempt < maxAttempts - 1 &&\n      retryOn(res.status, err) &&\n      !(err instanceof AuthError) &&\n      !(err instanceof ClientBugError)\n    ) {\n      lastErr = err;\n      let delay = computeDelay(attempt, initialDelayMs, maxDelayMs);\n      if (err instanceof RateLimitError && retryAfter) {\n        const wait = retryAfter.getTime() - Date.now();\n        if (wait > 0) {\n          delay = Math.min(wait, maxDelayMs);\n        }\n      }\n      await sleep(delay, req.signal);\n      continue;\n    }\n\n    throw err;\n  }\n\n  throw lastErr ?? new UpstreamBugError('Exhausted retry attempts');\n}\n\nfunction computeDelay(\n  attempt: number,\n  initialDelayMs: number,\n  maxDelayMs: number,\n): number {\n  const base = initialDelayMs * 2 ** attempt;\n  const jitter = base * 0.25 * Math.random();\n  return Math.min(base + jitter, maxDelayMs);\n}\n\nexport { HttpClientError };\n","export interface RateLimitState {\n  remaining: number;\n  resetAt: Date;\n}\n\nexport interface RateLimitPolicy {\n  parse(headers: Headers): RateLimitState | null;\n}\n\nexport interface StandardRateLimitPolicyConfig {\n  remainingHeader: string;\n  resetHeader: string;\n  resetUnit: 's' | 'ms';\n  resetFallbackMs?: number;\n}\n\nexport function standardRateLimitPolicy(\n  config: StandardRateLimitPolicyConfig,\n): RateLimitPolicy {\n  const { remainingHeader, resetHeader, resetUnit, resetFallbackMs } = config;\n  const multiplier = resetUnit === 's' ? 1000 : 1;\n  return {\n    parse(h) {\n      const remainingRaw = h.get(remainingHeader);\n      if (remainingRaw === null || remainingRaw.trim() === '') {\n        return null;\n      }\n      const remaining = Number(remainingRaw);\n      if (!Number.isFinite(remaining)) {\n        return null;\n      }\n      const resetRaw = h.get(resetHeader);\n      if (resetRaw === null) {\n        if (resetFallbackMs === undefined) {\n          return null;\n        }\n        return {\n          remaining,\n          resetAt: new Date(Date.now() + resetFallbackMs),\n        };\n      }\n      if (resetRaw.trim() === '') {\n        return null;\n      }\n      const reset = Number(resetRaw);\n      if (!Number.isFinite(reset) || reset < 0) {\n        return null;\n      }\n      const resetMs = reset * multiplier;\n      if (!Number.isFinite(resetMs)) {\n        return null;\n      }\n      return { remaining, resetAt: new Date(resetMs) };\n    },\n  };\n}\n","export async function mapWithConcurrency<T, R>(\n  items: readonly T[],\n  concurrency: number,\n  fn: (item: T, index: number) => Promise<R>,\n): Promise<R[]> {\n  const results = new Array<R>(items.length);\n  if (items.length === 0) {\n    return results;\n  }\n  const normalized = Number.isFinite(concurrency) ? Math.floor(concurrency) : 1;\n  const limit = Math.max(1, Math.min(normalized, items.length));\n  let next = 0;\n  let failed = false;\n\n  async function worker(): Promise<void> {\n    while (!failed) {\n      const i = next++;\n      if (i >= items.length) {\n        return;\n      }\n      try {\n        results[i] = await fn(items[i]!, i);\n      } catch (err) {\n        failed = true;\n        throw err;\n      }\n    }\n  }\n\n  const workers: Promise<void>[] = [];\n  for (let w = 0; w < limit; w++) {\n    workers.push(worker());\n  }\n  await Promise.all(workers);\n  return results;\n}\n","export interface SanitizeAllowedUrlOptions {\n  url: string | null;\n  host: string;\n  pathname: string;\n  protocol?: 'https:' | 'http:';\n}\n\nexport function sanitizeAllowedUrl(\n  options: SanitizeAllowedUrlOptions,\n): string | null {\n  const { url, host, pathname, protocol = 'https:' } = options;\n  if (url === null) {\n    return null;\n  }\n  try {\n    const u = new URL(url);\n    if (u.protocol !== protocol || u.host !== host || u.pathname !== pathname) {\n      return null;\n    }\n    return u.toString();\n  } catch {\n    return null;\n  }\n}\n","export type EpochUnit = 'ms' | 's' | 'iso';\n\nexport function parseEpoch(\n  value: number | string | null | undefined,\n  unit: EpochUnit,\n): number | null {\n  if (value === null || value === undefined) {\n    return null;\n  }\n  if (unit === 'iso') {\n    if (typeof value !== 'string') {\n      return null;\n    }\n    const ms = new Date(value).getTime();\n    return Number.isFinite(ms) ? ms : null;\n  }\n  if (typeof value === 'string' && value.trim() === '') {\n    return null;\n  }\n  const n = typeof value === 'number' ? value : Number(value);\n  if (!Number.isFinite(n)) {\n    return null;\n  }\n  const result = unit === 's' ? n * 1000 : n;\n  return Number.isFinite(result) ? result : null;\n}\n","import { request } from './request';\nimport type { HttpRequest } from './types';\n\nexport function parseLinkHeader(header: string | null): Record<string, string> {\n  if (!header) {\n    return {};\n  }\n  const result: Record<string, string> = {};\n  for (const part of header.split(',')) {\n    const match = part.match(/<([^>]+)>\\s*;\\s*rel=\"([^\"]+)\"/);\n    if (match) {\n      result[match[2]!] = match[1]!;\n    }\n  }\n  return result;\n}\n\nexport async function* paginateLink<T>(\n  initial: HttpRequest,\n  parse: (body: unknown) => T[],\n  options: { resource: string },\n): AsyncIterable<T> {\n  let next: string | null = initial.url;\n  while (next) {\n    const res: Awaited<ReturnType<typeof request>> = await request(\n      {\n        ...initial,\n        url: next,\n      },\n      { resource: options.resource },\n    );\n    for (const item of parse(res.body)) {\n      yield item;\n    }\n    const links = parseLinkHeader(res.headers.get('link'));\n    next = links['next'] ?? null;\n  }\n}\n\nexport async function* paginateCursor<T>(\n  initial: HttpRequest,\n  parse: (body: unknown) => { items: T[]; nextCursor: string | null },\n  buildNext: (req: HttpRequest, cursor: string) => HttpRequest,\n  options: { resource: string },\n): AsyncIterable<T> {\n  let req: HttpRequest = initial;\n  while (true) {\n    const res = await request(req, { resource: options.resource });\n    const { items, nextCursor } = parse(res.body);\n    for (const item of items) {\n      yield item;\n    }\n    if (!nextCursor) {\n      return;\n    }\n    req = buildNext(req, nextCursor);\n  }\n}\n\nexport async function* paginatePage<T>(\n  initial: HttpRequest,\n  parse: (body: unknown) => { items: T[]; hasMore: boolean },\n  buildPage: (req: HttpRequest, page: number) => HttpRequest,\n  options: { resource: string },\n): AsyncIterable<T> {\n  let page = 1;\n  while (true) {\n    const req = page === 1 ? initial : buildPage(initial, page);\n    const res = await request(req, { resource: options.resource });\n    const { items, hasMore } = parse(res.body);\n    for (const item of items) {\n      yield item;\n    }\n    if (!hasMore || items.length === 0) {\n      return;\n    }\n    page++;\n  }\n}\n","export type LogFields = Record<string, unknown>;\n\nexport interface ConnectorLogger {\n  info(event: string, fields?: LogFields): void;\n  warn(event: string, fields?: LogFields): void;\n}\n\nexport interface ConnectorLoggerOptions {\n  scope: string;\n}\n\nconst MAX_VALUE_LEN = 120;\n\nfunction truncate(s: string, max = MAX_VALUE_LEN): string {\n  if (s.length <= max) {\n    return s;\n  }\n  return `${s.slice(0, max - 1)}…`;\n}\n\nfunction formatValue(value: unknown): string {\n  if (value === null) {\n    return 'null';\n  }\n  if (value === undefined) {\n    return '';\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') {\n    return String(value);\n  }\n  if (typeof value === 'string') {\n    const t = truncate(value);\n    if (/[\\s\"=]/.test(t)) {\n      return JSON.stringify(t);\n    }\n    return t;\n  }\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  let json: string | undefined;\n  try {\n    json = JSON.stringify(value);\n  } catch {\n    json = undefined;\n  }\n  return truncate(json ?? String(value));\n}\n\nexport function formatLogFields(fields?: LogFields): string {\n  if (!fields) {\n    return '';\n  }\n  const parts: string[] = [];\n  for (const [k, v] of Object.entries(fields)) {\n    if (v === undefined) {\n      continue;\n    }\n    parts.push(`${k}=${formatValue(v)}`);\n  }\n  return parts.length > 0 ? ` ${parts.join(' ')}` : '';\n}\n\nexport function formatLogLine(\n  scope: string,\n  event: string,\n  fields?: LogFields,\n): string {\n  return `[${scope}] ${event}${formatLogFields(fields)}`;\n}\n\nexport function createDefaultConnectorLogger(\n  opts: ConnectorLoggerOptions,\n): ConnectorLogger {\n  return {\n    info(event, fields) {\n      console.info(formatLogLine(opts.scope, event, fields));\n    },\n    warn(event, fields) {\n      console.warn(formatLogLine(opts.scope, event, fields));\n    },\n  };\n}\n\nconst NOOP_LOGGER: ConnectorLogger = {\n  info() {},\n  warn() {},\n};\n\nexport function noopConnectorLogger(): ConnectorLogger {\n  return NOOP_LOGGER;\n}\n","import {\n  type TokenCacheEntry,\n  fetchEntraAccessToken,\n  isTokenFresh,\n} from '@rawdash/connector-azure-shared';\nimport {\n  type HttpResponse,\n  connectorUserAgent,\n  parseEpoch,\n  sanitizeAllowedUrl,\n  standardRateLimitPolicy,\n} from '@rawdash/connector-shared';\nimport {\n  BaseConnector,\n  type ChunkedSyncCursor,\n  type ConnectorContext,\n  type ConnectorDoc,\n  type CredentialsSchema,\n  type StorageHandle,\n  type SyncOptions,\n  type SyncResult,\n  defineConfigFields,\n  defineConnectorDoc,\n  defineResources,\n  makeChunkedCursorGuard,\n  paginateChunked,\n  schemasFromResources,\n  selectActivePhases,\n} from '@rawdash/core';\nimport { z } from 'zod';\n\nconst GRAPH_HOST = 'graph.microsoft.com';\nconst API_VERSION = 'v1.0';\n\n// Entra tenant identifier: GUID, or a verified domain like contoso.onmicrosoft.com,\n// or one of the well-known values (common, organizations, consumers). Reject\n// anything containing a slash or whitespace so the token URL stays anchored.\nconst TENANT_ID_PATTERN = /^[a-zA-Z0-9.-]{1,256}$/;\n\nexport const configFields = defineConfigFields(\n  z.object({\n    tenantId: z\n      .string()\n      .trim()\n      .min(1)\n      .regex(\n        TENANT_ID_PATTERN,\n        'Use the tenant GUID, a verified domain (e.g. \"contoso.onmicrosoft.com\"), or one of the well-known values \"common\" / \"organizations\" / \"consumers\".',\n      )\n      .meta({\n        label: 'Tenant ID',\n        description:\n          'Microsoft Entra tenant identifier. Either the directory (tenant) GUID from the Azure portal, or a verified domain such as \"contoso.onmicrosoft.com\".',\n        placeholder: '00000000-0000-0000-0000-000000000000',\n      }),\n    clientId: z.string().min(1).meta({\n      label: 'Application (client) ID',\n      description:\n        'Application (client) ID of the Entra app registration used to call Microsoft Graph.',\n      placeholder: '00000000-0000-0000-0000-000000000000',\n    }),\n    clientSecret: z.object({ $secret: z.string().min(1) }).meta({\n      label: 'Client secret',\n      description:\n        'Client secret value (not the secret ID) from the app registration. Stored as a secret.',\n      placeholder: 'ENTRA_CLIENT_SECRET',\n      secret: true,\n    }),\n    resources: z\n      .array(z.enum(['users', 'signins', 'risky_users']))\n      .nonempty()\n      .optional()\n      .meta({\n        label: 'Resources',\n        description:\n          'Which Entra ID resources to sync. Omit to sync all of them. The app registration only needs the Microsoft Graph application permissions for the resources listed here (User.Read.All, AuditLog.Read.All, IdentityRiskyUser.Read.All).',\n      }),\n    signinsLookbackDays: z.number().int().positive().max(30).optional().meta({\n      label: 'Sign-ins lookback (days)',\n      description:\n        'How many days of sign-in events to backfill on a full sync. Defaults to 7. Microsoft Graph retains sign-in logs for 30 days on the Premium tiers required to call the API.',\n      placeholder: '7',\n    }),\n  }),\n);\n\nexport const doc: ConnectorDoc = defineConnectorDoc({\n  displayName: 'Microsoft Entra ID',\n  category: 'security',\n  brandColor: '#0078D4',\n  tagline:\n    'Sync users, sign-in events, and risky users from a Microsoft Entra ID (formerly Azure AD) tenant for sign-in volume, failed-sign-in rate, and identity-risk dashboards.',\n  vendor: {\n    name: 'Microsoft Entra ID',\n    domain: 'microsoft.com',\n    apiDocs: 'https://learn.microsoft.com/en-us/graph/api/resources/signin',\n    website:\n      'https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id',\n  },\n  auth: {\n    summary:\n      'OAuth 2.0 client-credentials flow against the Microsoft identity platform, using an Entra app registration with Microsoft Graph application permissions.',\n    setup: [\n      'In the Azure portal, open Microsoft Entra ID -> App registrations and create a new registration (single tenant).',\n      'Under API permissions, add Microsoft Graph Application permissions for the resources you want to sync: User.Read.All (users), AuditLog.Read.All (signins), IdentityRiskyUser.Read.All (risky_users). Grant admin consent.',\n      'Under Certificates & secrets, add a new client secret and copy the Value (not the Secret ID) immediately - Azure only shows it once.',\n      'Copy the Directory (tenant) ID and Application (client) ID from the registration overview.',\n      'Store the client secret as a rawdash secret and reference it from the connector config as `clientSecret: secret(\"ENTRA_CLIENT_SECRET\")`.',\n    ],\n  },\n  rateLimit:\n    'Microsoft Graph applies per-app and per-tenant throttling. The shared HTTP client backs off on 429 using Retry-After and the standard rate-limit policy.',\n  limitations: [\n    'The sign-in logs and risky-users endpoints require Entra ID P1 or P2; tenants on the free tier cannot call them and the connector will surface a 4xx from Microsoft Graph.',\n    'Sign-in logs are retained by Microsoft for 30 days; backfills beyond that window return no data.',\n    'Conditional Access, application assignments, and audit logs (admin activity) are out of scope.',\n  ],\n});\n\nexport type EntraIdResource = 'users' | 'signins' | 'risky_users';\n\nexport interface EntraIdSettings {\n  tenantId: string;\n  resources?: readonly EntraIdResource[];\n  signinsLookbackDays?: number;\n}\n\nconst entraIdCredentials = {\n  clientId: {\n    description: 'Entra app registration application (client) ID',\n    auth: 'required' as const,\n  },\n  clientSecret: {\n    description: 'Entra app registration client secret value',\n    auth: 'required' as const,\n  },\n} satisfies CredentialsSchema;\n\ntype EntraIdCredentials = typeof entraIdCredentials;\n\nconst entraIdRateLimit = standardRateLimitPolicy({\n  remainingHeader: 'ratelimit-remaining',\n  resetHeader: 'ratelimit-reset',\n  resetUnit: 's',\n});\n\nconst PHASE_ORDER = ['users', 'signins', 'risky_users'] as const;\n\ntype EntraIdPhase = (typeof PHASE_ORDER)[number];\n\ntype EntraIdSyncCursor = ChunkedSyncCursor<EntraIdPhase, string>;\n\nconst isEntraIdSyncCursor = makeChunkedCursorGuard(PHASE_ORDER);\n\nconst USER_ENTITY = 'entra_user';\nconst SIGNIN_EVENT = 'entra_signin_event';\nconst RISKY_USER_ENTITY = 'entra_risky_user';\n\nconst USERS_PAGE_SIZE = 500;\nconst SIGNINS_PAGE_SIZE = 1000;\nconst RISKY_USERS_PAGE_SIZE = 500;\nconst DEFAULT_SIGNINS_LOOKBACK_DAYS = 7;\n\nconst oauthTokenSchema = z.object({\n  access_token: z.string().min(1),\n  token_type: z.string().optional(),\n  expires_in: z.number().optional(),\n});\n\nconst userSchema = z.object({\n  id: z.string().min(1),\n  displayName: z.string().nullish(),\n  userPrincipalName: z.string().nullish(),\n  mail: z.string().nullish(),\n  accountEnabled: z.boolean().nullish(),\n  userType: z.string().nullish(),\n  createdDateTime: z.string().nullish(),\n});\n\nconst usersResponseSchema = z.object({\n  '@odata.nextLink': z.string().nullish(),\n  value: z.array(userSchema),\n});\n\nconst signinStatusSchema = z.object({\n  errorCode: z.number().nullish(),\n  failureReason: z.string().nullish(),\n  additionalDetails: z.string().nullish(),\n});\n\nconst signinLocationSchema = z.object({\n  city: z.string().nullish(),\n  state: z.string().nullish(),\n  countryOrRegion: z.string().nullish(),\n});\n\nconst signinSchema = z.object({\n  id: z.string().min(1),\n  createdDateTime: z.string(),\n  userId: z.string().nullish(),\n  userPrincipalName: z.string().nullish(),\n  userDisplayName: z.string().nullish(),\n  appId: z.string().nullish(),\n  appDisplayName: z.string().nullish(),\n  ipAddress: z.string().nullish(),\n  clientAppUsed: z.string().nullish(),\n  conditionalAccessStatus: z.string().nullish(),\n  riskLevelAggregated: z.string().nullish(),\n  riskLevelDuringSignIn: z.string().nullish(),\n  riskState: z.string().nullish(),\n  riskDetail: z.string().nullish(),\n  status: signinStatusSchema.nullish(),\n  location: signinLocationSchema.nullish(),\n});\n\nconst signinsResponseSchema = z.object({\n  '@odata.nextLink': z.string().nullish(),\n  value: z.array(signinSchema),\n});\n\nconst riskyUserSchema = z.object({\n  id: z.string().min(1),\n  userPrincipalName: z.string().nullish(),\n  userDisplayName: z.string().nullish(),\n  riskLevel: z.string().nullish(),\n  riskState: z.string().nullish(),\n  riskDetail: z.string().nullish(),\n  riskLastUpdatedDateTime: z.string().nullish(),\n  isProcessing: z.boolean().nullish(),\n  isDeleted: z.boolean().nullish(),\n});\n\nconst riskyUsersResponseSchema = z.object({\n  '@odata.nextLink': z.string().nullish(),\n  value: z.array(riskyUserSchema),\n});\n\nexport const entraIdResources = defineResources({\n  [USER_ENTITY]: {\n    shape: 'entity',\n    filterable: [\n      { field: 'accountEnabled', ops: ['eq'], values: ['true', 'false'] },\n      {\n        field: 'userType',\n        ops: ['eq'],\n        values: ['Member', 'Guest'],\n      },\n    ],\n    description:\n      'Entra ID users with display name, principal name, mail, account-enabled flag, and user type.',\n    endpoint: 'GET /v1.0/users',\n    notes:\n      'Fully enumerated on every sync; @odata.nextLink pages are followed within the chunked sync loop.',\n    fields: [\n      { name: 'displayName', description: 'Display name from the directory.' },\n      {\n        name: 'userPrincipalName',\n        description: 'User principal name (e.g. alice@contoso.com).',\n      },\n      { name: 'mail', description: 'Primary SMTP address (may be null).' },\n      {\n        name: 'accountEnabled',\n        description:\n          'Whether the account is enabled (sign-in allowed when true).',\n      },\n      {\n        name: 'userType',\n        description: 'Either \"Member\" (in-tenant) or \"Guest\" (B2B invitee).',\n      },\n      {\n        name: 'createdAt',\n        description: 'When the user was created (Unix ms).',\n      },\n    ],\n    responses: {\n      oauth_token: oauthTokenSchema,\n      users: usersResponseSchema,\n    },\n  },\n  [SIGNIN_EVENT]: {\n    shape: 'event',\n    filterable: [\n      { field: 'status', ops: ['eq'], values: ['success', 'failure'] },\n      {\n        field: 'riskLevel',\n        ops: ['eq'],\n        values: [\n          'none',\n          'low',\n          'medium',\n          'high',\n          'hidden',\n          'unknownFutureValue',\n        ],\n      },\n      { field: 'appDisplayName', ops: ['eq'] },\n    ],\n    description:\n      'Sign-in events from the Entra ID audit logs (`/auditLogs/signIns`). One event per interactive sign-in attempt with user, app, IP, location, and risk fields.',\n    endpoint: 'GET /v1.0/auditLogs/signIns',\n    notes:\n      'Backfill window defaults to 7 days and is capped at the Microsoft Graph 30-day retention. Incremental syncs filter on `createdDateTime`.',\n    fields: [\n      {\n        name: 'status',\n        description:\n          'Aggregated status: \"success\" when the sign-in completed without error, otherwise \"failure\".',\n      },\n      {\n        name: 'errorCode',\n        description: 'Microsoft Graph signInStatus.errorCode (0 on success).',\n      },\n      {\n        name: 'failureReason',\n        description: 'Human-readable failure reason (null on success).',\n      },\n      { name: 'userId', description: 'Directory object id of the actor.' },\n      {\n        name: 'userPrincipalName',\n        description: 'User principal name at sign-in time.',\n      },\n      { name: 'appId', description: 'Application (client) id signed into.' },\n      {\n        name: 'appDisplayName',\n        description: 'Display name of the application signed into.',\n      },\n      { name: 'ipAddress', description: 'Client IP recorded by Entra.' },\n      {\n        name: 'countryOrRegion',\n        description: 'Geographic country/region from location.countryOrRegion.',\n      },\n      {\n        name: 'city',\n        description: 'City from location.city (may be null).',\n      },\n      {\n        name: 'riskLevel',\n        description:\n          'Aggregated risk level (none / low / medium / high / hidden / unknownFutureValue).',\n      },\n      {\n        name: 'riskState',\n        description:\n          'Risk state (none / confirmedSafe / remediated / dismissed / atRisk / confirmedCompromised).',\n      },\n      {\n        name: 'clientAppUsed',\n        description:\n          'Client app type (Browser, Mobile Apps and Desktop clients, etc.).',\n      },\n      {\n        name: 'conditionalAccessStatus',\n        description:\n          'Outcome of conditional-access policy evaluation (success / failure / notApplied / unknownFutureValue).',\n      },\n    ],\n    responses: { signins: signinsResponseSchema },\n  },\n  [RISKY_USER_ENTITY]: {\n    shape: 'entity',\n    filterable: [\n      {\n        field: 'riskLevel',\n        ops: ['eq'],\n        values: ['low', 'medium', 'high', 'hidden', 'unknownFutureValue'],\n      },\n      {\n        field: 'riskState',\n        ops: ['eq'],\n        values: [\n          'none',\n          'confirmedSafe',\n          'remediated',\n          'dismissed',\n          'atRisk',\n          'confirmedCompromised',\n          'unknownFutureValue',\n        ],\n      },\n    ],\n    description:\n      'Users currently flagged by Entra Identity Protection, with their risk level, risk state, and last-updated timestamp.',\n    endpoint: 'GET /v1.0/identityProtection/riskyUsers',\n    notes:\n      'Fully enumerated on every sync; @odata.nextLink pages are followed within the chunked sync loop.',\n    fields: [\n      {\n        name: 'userPrincipalName',\n        description: 'User principal name of the risky user.',\n      },\n      { name: 'displayName', description: 'Display name of the risky user.' },\n      {\n        name: 'riskLevel',\n        description:\n          'Identity Protection risk level (low / medium / high / hidden / unknownFutureValue).',\n      },\n      {\n        name: 'riskState',\n        description:\n          'Risk state (none / confirmedSafe / remediated / dismissed / atRisk / confirmedCompromised / unknownFutureValue).',\n      },\n      {\n        name: 'riskDetail',\n        description:\n          'Latest risk detail string (the specific reason for the flag).',\n      },\n      {\n        name: 'riskLastUpdatedAt',\n        description: 'When the risk was last refreshed (Unix ms).',\n      },\n    ],\n    responses: { risky_users: riskyUsersResponseSchema },\n  },\n});\n\nexport const id = 'entra-id';\n\ntype UsersResponse = z.infer<typeof usersResponseSchema>;\ntype SigninsResponse = z.infer<typeof signinsResponseSchema>;\ntype RiskyUsersResponse = z.infer<typeof riskyUsersResponseSchema>;\ntype EntraUser = z.infer<typeof userSchema>;\ntype EntraSignin = z.infer<typeof signinSchema>;\ntype EntraRiskyUser = z.infer<typeof riskyUserSchema>;\n\nfunction signinStatus(\n  errorCode: number | null | undefined,\n): 'success' | 'failure' {\n  return errorCode === 0 ? 'success' : 'failure';\n}\n\nfunction pageRequestPath(phase: EntraIdPhase): string {\n  switch (phase) {\n    case 'users':\n      return `/${API_VERSION}/users`;\n    case 'signins':\n      return `/${API_VERSION}/auditLogs/signIns`;\n    case 'risky_users':\n      return `/${API_VERSION}/identityProtection/riskyUsers`;\n  }\n}\n\nfunction sanitizeGraphUrl(\n  url: string | null,\n  phase: EntraIdPhase,\n): string | null {\n  return sanitizeAllowedUrl({\n    url,\n    host: GRAPH_HOST,\n    pathname: pageRequestPath(phase),\n  });\n}\n\nexport class EntraIdConnector extends BaseConnector<\n  EntraIdSettings,\n  EntraIdCredentials\n> {\n  static readonly id = id;\n\n  static readonly resources = entraIdResources;\n\n  static readonly schemas = schemasFromResources(entraIdResources);\n\n  static create(input: unknown, ctx?: ConnectorContext): EntraIdConnector {\n    const parsed = configFields.parse(input);\n    return new EntraIdConnector(\n      {\n        tenantId: parsed.tenantId,\n        resources: parsed.resources,\n        signinsLookbackDays: parsed.signinsLookbackDays,\n      },\n      {\n        clientId: parsed.clientId,\n        clientSecret: parsed.clientSecret,\n      },\n      ctx,\n    );\n  }\n\n  readonly id = id;\n  override readonly credentials = entraIdCredentials;\n\n  private tokenCache: TokenCacheEntry | null = null;\n\n  private async getAccessToken(signal?: AbortSignal): Promise<string> {\n    if (isTokenFresh(this.tokenCache)) {\n      return this.tokenCache!.token;\n    }\n    this.tokenCache = await fetchEntraAccessToken(\n      {\n        tenantId: this.settings.tenantId,\n        clientId: this.creds.clientId,\n        clientSecret: this.creds.clientSecret,\n        scope: `https://${GRAPH_HOST}/.default`,\n        connectorId: 'entra-id',\n      },\n      signal,\n    );\n    return this.tokenCache.token;\n  }\n\n  private async apiGet<T>(\n    url: string,\n    resource: string,\n    signal?: AbortSignal,\n  ): Promise<HttpResponse<T>> {\n    const token = await this.getAccessToken(signal);\n    return this.get<T>(url, {\n      resource,\n      headers: {\n        Authorization: `Bearer ${token}`,\n        Accept: 'application/json',\n        'User-Agent': connectorUserAgent('entra-id'),\n      },\n      rateLimit: entraIdRateLimit,\n      signal,\n    });\n  }\n\n  private signinsSince(options: SyncOptions): string {\n    if (options.since) {\n      return options.since;\n    }\n    const lookback =\n      this.settings.signinsLookbackDays ?? DEFAULT_SIGNINS_LOOKBACK_DAYS;\n    const since = new Date(Date.now() - lookback * 24 * 60 * 60 * 1000);\n    return since.toISOString();\n  }\n\n  private buildInitialUrl(phase: EntraIdPhase, options: SyncOptions): string {\n    const u = new URL(`https://${GRAPH_HOST}${pageRequestPath(phase)}`);\n    switch (phase) {\n      case 'users':\n        u.searchParams.set(\n          '$select',\n          'id,displayName,userPrincipalName,mail,accountEnabled,userType,createdDateTime',\n        );\n        u.searchParams.set('$top', String(USERS_PAGE_SIZE));\n        return u.toString();\n      case 'signins': {\n        const since = this.signinsSince(options);\n        u.searchParams.set('$filter', `createdDateTime ge ${since}`);\n        u.searchParams.set('$orderby', 'createdDateTime asc');\n        u.searchParams.set('$top', String(SIGNINS_PAGE_SIZE));\n        return u.toString();\n      }\n      case 'risky_users':\n        u.searchParams.set('$top', String(RISKY_USERS_PAGE_SIZE));\n        return u.toString();\n    }\n  }\n\n  private async fetchPhasePage(\n    phase: EntraIdPhase,\n    page: string | null,\n    options: SyncOptions,\n    signal: AbortSignal | undefined,\n  ): Promise<{ items: unknown[]; next: string | null }> {\n    const url = page ?? this.buildInitialUrl(phase, options);\n    switch (phase) {\n      case 'users': {\n        const res = await this.apiGet<UsersResponse>(url, 'users', signal);\n        const next = sanitizeGraphUrl(\n          res.body['@odata.nextLink'] ?? null,\n          phase,\n        );\n        return { items: res.body.value, next };\n      }\n      case 'signins': {\n        const res = await this.apiGet<SigninsResponse>(url, 'signins', signal);\n        const next = sanitizeGraphUrl(\n          res.body['@odata.nextLink'] ?? null,\n          phase,\n        );\n        return { items: res.body.value, next };\n      }\n      case 'risky_users': {\n        const res = await this.apiGet<RiskyUsersResponse>(\n          url,\n          'risky_users',\n          signal,\n        );\n        const next = sanitizeGraphUrl(\n          res.body['@odata.nextLink'] ?? null,\n          phase,\n        );\n        return { items: res.body.value, next };\n      }\n    }\n  }\n\n  private async writeUsers(\n    storage: StorageHandle,\n    items: EntraUser[],\n  ): Promise<void> {\n    for (const u of items) {\n      const createdMs = parseEpoch(u.createdDateTime ?? null, 'iso');\n      await storage.entity({\n        type: USER_ENTITY,\n        id: u.id,\n        attributes: {\n          displayName: u.displayName ?? null,\n          userPrincipalName: u.userPrincipalName ?? null,\n          mail: u.mail ?? null,\n          accountEnabled: u.accountEnabled ?? null,\n          userType: u.userType ?? null,\n          createdAt: createdMs,\n        },\n        updated_at: createdMs ?? 0,\n      });\n    }\n  }\n\n  private async writeSignins(\n    storage: StorageHandle,\n    items: EntraSignin[],\n    sinceMs: number | null,\n  ): Promise<void> {\n    for (const s of items) {\n      const ts = parseEpoch(s.createdDateTime, 'iso');\n      if (ts === null) {\n        continue;\n      }\n      if (sinceMs !== null && ts <= sinceMs) {\n        continue;\n      }\n      const errorCode = s.status?.errorCode ?? null;\n      await storage.event({\n        name: SIGNIN_EVENT,\n        start_ts: ts,\n        end_ts: null,\n        attributes: {\n          signinId: s.id,\n          status: signinStatus(errorCode),\n          errorCode,\n          failureReason: s.status?.failureReason ?? null,\n          userId: s.userId ?? null,\n          userPrincipalName: s.userPrincipalName ?? null,\n          userDisplayName: s.userDisplayName ?? null,\n          appId: s.appId ?? null,\n          appDisplayName: s.appDisplayName ?? null,\n          ipAddress: s.ipAddress ?? null,\n          clientAppUsed: s.clientAppUsed ?? null,\n          city: s.location?.city ?? null,\n          state: s.location?.state ?? null,\n          countryOrRegion: s.location?.countryOrRegion ?? null,\n          riskLevel: s.riskLevelAggregated ?? null,\n          riskLevelDuringSignIn: s.riskLevelDuringSignIn ?? null,\n          riskState: s.riskState ?? null,\n          riskDetail: s.riskDetail ?? null,\n          conditionalAccessStatus: s.conditionalAccessStatus ?? null,\n        },\n      });\n    }\n  }\n\n  private async writeRiskyUsers(\n    storage: StorageHandle,\n    items: EntraRiskyUser[],\n  ): Promise<void> {\n    for (const r of items) {\n      const updatedMs = parseEpoch(r.riskLastUpdatedDateTime ?? null, 'iso');\n      await storage.entity({\n        type: RISKY_USER_ENTITY,\n        id: r.id,\n        attributes: {\n          userPrincipalName: r.userPrincipalName ?? null,\n          displayName: r.userDisplayName ?? null,\n          riskLevel: r.riskLevel ?? null,\n          riskState: r.riskState ?? null,\n          riskDetail: r.riskDetail ?? null,\n          riskLastUpdatedAt: updatedMs,\n          isProcessing: r.isProcessing ?? null,\n          isDeleted: r.isDeleted ?? null,\n        },\n        updated_at: updatedMs ?? 0,\n      });\n    }\n  }\n\n  private async writePhase(\n    storage: StorageHandle,\n    phase: EntraIdPhase,\n    items: unknown[],\n    sinceMs: number | null,\n  ): Promise<void> {\n    switch (phase) {\n      case 'users':\n        return this.writeUsers(storage, items as EntraUser[]);\n      case 'signins':\n        return this.writeSignins(storage, items as EntraSignin[], sinceMs);\n      case 'risky_users':\n        return this.writeRiskyUsers(storage, items as EntraRiskyUser[]);\n    }\n  }\n\n  private async clearScopeOnFirstPage(\n    storage: StorageHandle,\n    phase: EntraIdPhase,\n    isFull: boolean,\n  ): Promise<void> {\n    if (!isFull) {\n      return;\n    }\n    switch (phase) {\n      case 'users':\n        await storage.entities([], { types: [USER_ENTITY] });\n        return;\n      case 'signins':\n        await storage.events([], { names: [SIGNIN_EVENT] });\n        return;\n      case 'risky_users':\n        await storage.entities([], { types: [RISKY_USER_ENTITY] });\n        return;\n    }\n  }\n\n  private resolveCursor(cursor: unknown): EntraIdSyncCursor | undefined {\n    if (!isEntraIdSyncCursor(cursor)) {\n      return undefined;\n    }\n    return {\n      phase: cursor.phase,\n      page: sanitizeGraphUrl(cursor.page, cursor.phase),\n    };\n  }\n\n  async sync(\n    options: SyncOptions,\n    storage: StorageHandle,\n    signal?: AbortSignal,\n  ): Promise<SyncResult> {\n    const cursor = this.resolveCursor(options.cursor);\n    const isFull = options.mode === 'full';\n    const sinceMsRaw = options.since ? Date.parse(options.since) : null;\n    const sinceMs =\n      sinceMsRaw !== null && Number.isFinite(sinceMsRaw) ? sinceMsRaw : null;\n\n    const phases = selectActivePhases<EntraIdResource, EntraIdPhase>(\n      (r) => r,\n      PHASE_ORDER,\n      this.settings.resources,\n    );\n\n    return paginateChunked<EntraIdPhase, string>({\n      phases,\n      cursor,\n      signal,\n      logger: this.logger,\n      fetchPage: async (phase, page, sig) =>\n        this.fetchPhasePage(phase, page, options, sig),\n      writeBatch: async (phase, items, page) => {\n        if (page === null) {\n          await this.clearScopeOnFirstPage(storage, phase, isFull);\n        }\n        await this.writePhase(storage, phase, items, sinceMs);\n      },\n    });\n  }\n}\n","import { EntraIdConnector } from './entra-id';\n\nexport {\n  EntraIdConnector,\n  entraIdResources as resources,\n  configFields,\n  doc,\n  id,\n} from './entra-id';\nexport type { EntraIdResource, EntraIdSettings } from './entra-id';\nexport default EntraIdConnector;\n"],"mappings":";AYAA,SAAS,qBAA6C;AZS/C,IAAe,kBAAf,cAAuC,MAAM;EAEzC;EAET,YAAY,SAAiB,UAAyB;AACpD,UAAM,OAAO;AACb,SAAK,OAAO,WAAW;AACvB,SAAK,WAAW;EAClB;AACF;AAEO,IAAM,iBAAN,cAA6B,gBAAgB;EACzC,OAAO;AAClB;AAEO,IAAM,iBAAN,cAA6B,gBAAgB;EACzC,OAAO;EACP;EAET,YAAY,SAAiB,UAAyB,YAAmB;AACvE,UAAM,SAAS,QAAQ;AACvB,SAAK,aAAa;EACpB;AACF;AAEO,IAAM,YAAN,cAAwB,gBAAgB;EACpC,OAAO;AAClB;AAEO,IAAM,mBAAN,cAA+B,gBAAgB;EAC3C,OAAO;AAClB;AAEO,IAAM,iBAAN,cAA6B,gBAAgB;EACzC,OAAO;AAClB;AAEO,SAAS,eAAe,QAA+B;AAC5D,MAAI,WAAW,KAAK;AAClB,WAAO;EACT;AACA,MAAI,WAAW,OAAO,WAAW,KAAK;AACpC,WAAO;EACT;AACA,MAAI,WAAW,KAAK;AAClB,WAAO;EACT;AACA,MAAI,UAAU,KAAK;AACjB,WAAO;EACT;AACA,MAAI,UAAU,KAAK;AACjB,WAAO;EACT;AACA,SAAO;AACT;AAEO,SAAS,eACd,SACA,UACA,YACiB;AACjB,QAAM,OAAO,eAAe,SAAS,MAAM;AAC3C,UAAQ,MAAM;IACZ,KAAK;AACH,aAAO,IAAI,eAAe,SAAS,UAAU,UAAU;IACzD,KAAK;AACH,aAAO,IAAI,UAAU,SAAS,QAAQ;IACxC,KAAK;AACH,aAAO,IAAI,eAAe,SAAS,QAAQ;IAC7C,KAAK;AACH,aAAO,IAAI,iBAAiB,SAAS,QAAQ;IAC/C,KAAK;AACH,aAAO,IAAI,eAAe,SAAS,QAAQ;EAC/C;AACF;AC1EO,IAAM,iBAAiB,CAAC,QAAuB,QAAyB;AAC7E,MAAI,eAAe,gBAAgB;AACjC,WAAO;EACT;AACA,MAAI,eAAe,gBAAgB;AACjC,WAAO;EACT;AACA,MAAI,WAAW,MAAM;AACnB,WAAO,eAAe,SAAS,EAAE,eAAe;EAClD;AACA,MAAI,WAAW,OAAO,WAAW,KAAK;AACpC,WAAO;EACT;AACA,MAAI,UAAU,KAAK;AACjB,WAAO;EACT;AACA,SAAO;AACT;AAWO,SAAS,gBACd,aACA,MAAY,oBAAI,KAAK,GACH;AAClB,MAAI,CAAC,aAAa;AAChB,WAAO;EACT;AACA,QAAM,UAAU,YAAY,KAAK;AACjC,MAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,WAAO,IAAI,KAAK,IAAI,QAAQ,IAAI,OAAO,OAAO,IAAI,GAAI;EACxD;AACA,QAAM,SAAS,KAAK,MAAM,OAAO;AACjC,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,WAAO;EACT;AACA,SAAO,IAAI,KAAK,MAAM;AACxB;AAEO,SAAS,MAAM,IAAY,QAAqC;AACrE,MAAI,QAAQ,SAAS;AACnB,WAAO,QAAQ,OAAO,OAAO,UAAU,IAAI,MAAM,SAAS,CAAC;EAC7D;AACA,SAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,UAAM,UAAU,MAAM;AACpB,mBAAa,KAAK;AAClB,aAAO,OAAQ,UAAU,IAAI,MAAM,SAAS,CAAC;IAC/C;AACA,UAAM,QAAQ,WAAW,MAAM;AAC7B,cAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAQ;IACV,GAAG,EAAE;AACL,YAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EAC3D,CAAC;AACH;ACtEO,IAAM,sBAAsB;AAE5B,IAAM,qBAAqB,qBAAqB,mBAAmB;AAEnE,SAAS,mBAAmB,aAA6B;AAC9D,SAAO,qBAAqB,WAAW,IAAI,mBAAmB;AAChE;ACOA,IAAM,qBAAqB;AAC3B,IAAM,uBAAuB;AAC7B,IAAM,2BAA2B;AACjC,IAAM,uBAAuB;AAC7B,IAAM,sBAAsB;AAsB5B,eAAe,eACb,UACA,OACe;AACf,MAAI;AACJ,MAAI;AACF,aAAS,SAAS,KAAK;EACzB,SAAS,KAAK;AACZ,YAAQ,KAAK,8CAA8C,GAAG;AAC9D;EACF;AACA,MAAI,EAAE,kBAAkB,UAAU;AAChC;EACF;AACA,QAAM,UAAU,OAAO,MAAM,CAAC,QAAQ;AACpC,YAAQ,KAAK,iDAAiD,GAAG;EACnE,CAAC;AACD,MAAI;AACJ,QAAM,UAAU,IAAI,QAAc,CAAC,YAAY;AAC7C,YAAQ,WAAW,SAAS,mBAAmB;EACjD,CAAC;AACD,MAAI;AACF,UAAM,QAAQ,KAAK,CAAC,SAAS,OAAO,CAAC;EACvC,UAAA;AACE,QAAI,OAAO;AACT,mBAAa,KAAK;IACpB;EACF;AACF;AAEA,SAAS,eAAuB;AAC9B,QAAM,IAAK,WAA0D;AACrE,MAAI,GAAG,YAAY;AACjB,WAAO,EAAE,WAAW;EACtB;AACA,SAAO,GAAG,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAC9E;AAEA,SAAS,aACP,UACA,WACwB;AACxB,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC7C,WAAO,EAAE,YAAY,CAAC,IAAI;EAC5B;AACA,MAAI,WAAW;AACb,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC9C,aAAO,EAAE,YAAY,CAAC,IAAI;IAC5B;EACF;AACA,SAAO;AACT;AAEA,SAAS,kBACP,QACA,WAC6C;AAC7C,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,gBAAgB,MAAM;AAC1B,eAAW,MAAM,QAAQ,MAAM;EACjC;AACA,MAAI,QAAQ;AACV,QAAI,OAAO,SAAS;AAClB,iBAAW,MAAM,OAAO,MAAM;IAChC,OAAO;AACL,aAAO,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;IAChE;EACF;AACA,QAAM,QAAQ,WAAW,MAAM;AAC7B,eAAW,MAAM,IAAI,MAAM,2BAA2B,SAAS,IAAI,CAAC;EACtE,GAAG,SAAS;AACZ,SAAO;IACL,QAAQ,WAAW;IACnB,QAAQ,MAAM;AACZ,mBAAa,KAAK;AAClB,UAAI,QAAQ;AACV,eAAO,oBAAoB,SAAS,aAAa;MACnD;IACF;EACF;AACF;AAEA,eAAe,SAAS,KAAe,WAAsC;AAC3E,MAAI,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAC5C,WAAO;EACT;AACA,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,MAAI,aAAa,YAAY,SAAS,kBAAkB,GAAG;AACzD,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,KAAK,WAAW,GAAG;AACrB,aAAO;IACT;AACA,WAAO,KAAK,MAAM,IAAI;EACxB;AACA,SAAO,IAAI,KAAK;AAClB;AAEA,eAAsB,QACpB,KACA,SAC0B;AAC1B,QAAM,YAAuB,QAAQ,SAAU,WAAW;AAC1D,QAAM,QAAQ,IAAI,SAAS,CAAC;AAC5B,QAAM,cAAc,MAAM,eAAe;AACzC,QAAM,iBAAiB,MAAM,kBAAkB;AAC/C,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,YAAY,IAAI,aAAa;AACnC,QAAM,YAAY,IAAI,aAAa;AAEnC,QAAM,UAAU;IACd;MACE,cAAc;MACd,QAAQ;IACV;IACA,IAAI;EACN;AAEA,MAAI;AAEJ,WAAS,UAAU,GAAG,UAAU,aAAa,WAAW;AACtD,QAAI,QAAQ,eAAe;AAE3B,UAAM,EAAE,QAAQ,OAAO,IAAI,kBAAkB,IAAI,QAAQ,SAAS;AAClE,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,IAAI,KAAK;QAC7B,QAAQ,IAAI,UAAU;QACtB;QACA,MAAM,IAAI;QACV;MACF,CAAC;IACH,SAASA,MAAK;AACZ,aAAO;AACP,UAAI,IAAI,QAAQ,SAAS;AACvB,cAAM,IAAI,OAAO,UAAUA;MAC7B;AACA,YAAM,QAAQA,gBAAe,QAAQA,OAAM,IAAI,MAAM,OAAOA,IAAG,CAAC;AAChE,gBAAU;AACV,UAAI,UAAU,cAAc,KAAK,QAAQ,MAAM,KAAK,GAAG;AACrD,cAAM,QAAQ,aAAa,SAAS,gBAAgB,UAAU;AAC9D,cAAM,MAAM,OAAO,IAAI,MAAM;AAC7B;MACF;AACA,YAAM,IAAI,eAAe,MAAM,OAAO;IACxC;AACA,WAAO;AAEP,UAAM,OAAO,MAAM,SAAS,KAAK,SAAS;AAC1C,UAAM,eAAgC;MACpC,QAAQ,IAAI;MACZ,SAAS,IAAI;MACb;IACF;AACA,QAAI,IAAI,WAAW;AACjB,YAAM,QAAQ,IAAI,UAAU,MAAM,IAAI,OAAO;AAC7C,UAAI,OAAO;AACT,qBAAa,iBAAiB;MAChC;IACF;AAEA,QAAI,QAAQ,UAAU;AACpB,YAAM,eAAe,QAAQ,UAAU;QACrC,KAAK,IAAI;QACT,QAAQ,IAAI,UAAU;QACtB,QAAQ,IAAI;QACZ,UAAU,QAAQ;QAClB,WAAW,QAAQ,aAAa,aAAa;QAC7C;MACF,CAAC;IACH;AAEA,QAAI,IAAI,IAAI;AACV,aAAO;IACT;AAEA,UAAM,aAAa,gBAAgB,IAAI,QAAQ,IAAI,aAAa,CAAC;AACjE,UAAM,UAAU,QAAQ,IAAI,MAAM,IAAI,IAAI,UAAU,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,GAAG;AAC1F,UAAM,MAAM,eAAe,SAAS,cAAc,UAAU;AAE5D,QACE,UAAU,cAAc,KACxB,QAAQ,IAAI,QAAQ,GAAG,KACvB,EAAE,eAAe,cACjB,EAAE,eAAe,iBACjB;AACA,gBAAU;AACV,UAAI,QAAQ,aAAa,SAAS,gBAAgB,UAAU;AAC5D,UAAI,eAAe,kBAAkB,YAAY;AAC/C,cAAM,OAAO,WAAW,QAAQ,IAAI,KAAK,IAAI;AAC7C,YAAI,OAAO,GAAG;AACZ,kBAAQ,KAAK,IAAI,MAAM,UAAU;QACnC;MACF;AACA,YAAM,MAAM,OAAO,IAAI,MAAM;AAC7B;IACF;AAEA,UAAM;EACR;AAEA,QAAM,WAAW,IAAI,iBAAiB,0BAA0B;AAClE;AAEA,SAAS,aACP,SACA,gBACA,YACQ;AACR,QAAM,OAAO,iBAAiB,KAAK;AACnC,QAAM,SAAS,OAAO,OAAO,KAAK,OAAO;AACzC,SAAO,KAAK,IAAI,OAAO,QAAQ,UAAU;AAC3C;AOpPA,IAAM,aAAa;AACnB,IAAM,sBAAsB;AAqB5B,eAAsB,sBACpB,OACA,QAC0B;AAC1B,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,cAAc,oBAAoB;AAC7C,SAAO,IAAI,aAAa,MAAM,QAAQ;AACtC,SAAO,IAAI,iBAAiB,MAAM,YAAY;AAC9C,SAAO,IAAI,SAAS,MAAM,KAAK;AAE/B,MAAI;AACJ,MAAI;AACF,UAAM,MAAM;MACV;QACE,KAAK,WAAW,UAAU,IAAI,mBAAmB,MAAM,QAAQ,CAAC;QAChE,QAAQ;QACR,SAAS;UACP,gBAAgB;UAChB,QAAQ;UACR,cAAc,mBAAmB,MAAM,WAAW;QACpD;QACA,MAAM,OAAO,SAAS;QACtB;MACF;MACA,EAAE,UAAU,cAAc;IAC5B;EACF,SAAS,KAAK;AACZ,UAAM,mBAAmB,GAAG;EAC9B;AAEA,QAAM,SAAS,IAAI,KAAK;AACxB,QAAM,YAAY,IAAI,KAAK;AAC3B,MAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,UAAM,IAAI;MACR;IACF;EACF;AACA,QAAM,QACJ,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,IACtD,YAAY,MACZ,KAAK,KAAK;AAChB,SAAO;IACL,OAAO;IACP,WAAW,KAAK,IAAI,IAAI,QAAQ;EAClC;AACF;AAEA,SAAS,mBAAmB,KAAuB;AACjD,MAAI,EAAE,eAAe,UAAU,EAAE,UAAU,MAAM;AAC/C,WAAO;EACT;AACA,QAAM,UAAU;AAChB,QAAM,SAAS,QAAQ,UAAU,UAAU;AAG3C,MAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KAAK;AACtD,WAAO,IAAI,UAAU,QAAQ,SAAS,QAAQ,QAAQ;EACxD;AACA,MAAI,UAAU,KAAK;AACjB,WAAO,IAAI,eAAe,QAAQ,SAAS,QAAQ,QAAQ;EAC7D;AACA,SAAO;AACT;AAEO,SAAS,aACd,OACA,MAAc,KAAK,IAAI,GACd;AACT,SAAO,UAAU,QAAQ,MAAM,MAAM;AACvC;;;AKnGO,IAAMC,uBAAsB;AAE5B,IAAMC,sBAAqB,qBAAqBD,oBAAmB;AAEnE,SAASE,oBAAmB,aAA6B;AAC9D,SAAO,qBAAqB,WAAW,IAAIF,oBAAmB;AAChE;AEUO,SAAS,wBACd,QACiB;AACjB,QAAM,EAAE,iBAAiB,aAAa,WAAW,gBAAgB,IAAI;AACrE,QAAM,aAAa,cAAc,MAAM,MAAO;AAC9C,SAAO;IACL,MAAM,GAAG;AACP,YAAM,eAAe,EAAE,IAAI,eAAe;AAC1C,UAAI,iBAAiB,QAAQ,aAAa,KAAK,MAAM,IAAI;AACvD,eAAO;MACT;AACA,YAAM,YAAY,OAAO,YAAY;AACrC,UAAI,CAAC,OAAO,SAAS,SAAS,GAAG;AAC/B,eAAO;MACT;AACA,YAAM,WAAW,EAAE,IAAI,WAAW;AAClC,UAAI,aAAa,MAAM;AACrB,YAAI,oBAAoB,QAAW;AACjC,iBAAO;QACT;AACA,eAAO;UACL;UACA,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe;QAChD;MACF;AACA,UAAI,SAAS,KAAK,MAAM,IAAI;AAC1B,eAAO;MACT;AACA,YAAM,QAAQ,OAAO,QAAQ;AAC7B,UAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GAAG;AACxC,eAAO;MACT;AACA,YAAM,UAAU,QAAQ;AACxB,UAAI,CAAC,OAAO,SAAS,OAAO,GAAG;AAC7B,eAAO;MACT;AACA,aAAO,EAAE,WAAW,SAAS,IAAI,KAAK,OAAO,EAAE;IACjD;EACF;AACF;AEhDO,SAAS,mBACd,SACe;AACf,QAAM,EAAE,KAAK,MAAM,UAAU,WAAW,SAAS,IAAI;AACrD,MAAI,QAAQ,MAAM;AAChB,WAAO;EACT;AACA,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,GAAG;AACrB,QAAI,EAAE,aAAa,YAAY,EAAE,SAAS,QAAQ,EAAE,aAAa,UAAU;AACzE,aAAO;IACT;AACA,WAAO,EAAE,SAAS;EACpB,QAAQ;AACN,WAAO;EACT;AACF;ACrBO,SAAS,WACd,OACA,MACe;AACf,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO;EACT;AACA,MAAI,SAAS,OAAO;AAClB,QAAI,OAAO,UAAU,UAAU;AAC7B,aAAO;IACT;AACA,UAAM,KAAK,IAAI,KAAK,KAAK,EAAE,QAAQ;AACnC,WAAO,OAAO,SAAS,EAAE,IAAI,KAAK;EACpC;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAAI;AACpD,WAAO;EACT;AACA,QAAM,IAAI,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK;AAC1D,MAAI,CAAC,OAAO,SAAS,CAAC,GAAG;AACvB,WAAO;EACT;AACA,QAAM,SAAS,SAAS,MAAM,IAAI,MAAO;AACzC,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;;;AGbA;AAAA,EACE,iBAAAG;AAAA,EAQA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS;AAElB,IAAM,aAAa;AACnB,IAAM,cAAc;AAKpB,IAAM,oBAAoB;AAEnB,IAAM,eAAe;AAAA,EAC1B,EAAE,OAAO;AAAA,IACP,UAAU,EACP,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL;AAAA,MACC;AAAA,MACA;AAAA,IACF,EACC,KAAK;AAAA,MACJ,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,IACf,CAAC;AAAA,IACH,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,KAAK;AAAA,MAC/B,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,IACf,CAAC;AAAA,IACD,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK;AAAA,MAC1D,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,MACb,QAAQ;AAAA,IACV,CAAC;AAAA,IACD,WAAW,EACR,MAAM,EAAE,KAAK,CAAC,SAAS,WAAW,aAAa,CAAC,CAAC,EACjD,SAAS,EACT,SAAS,EACT,KAAK;AAAA,MACJ,OAAO;AAAA,MACP,aACE;AAAA,IACJ,CAAC;AAAA,IACH,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK;AAAA,MACvE,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,IACf,CAAC;AAAA,EACH,CAAC;AACH;AAEO,IAAM,MAAoB,mBAAmB;AAAA,EAClD,aAAa;AAAA,EACb,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,SACE;AAAA,EACF,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SACE;AAAA,EACJ;AAAA,EACA,MAAM;AAAA,IACJ,SACE;AAAA,IACF,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,WACE;AAAA,EACF,aAAa;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,CAAC;AAUD,IAAM,qBAAqB;AAAA,EACzB,UAAU;AAAA,IACR,aAAa;AAAA,IACb,MAAM;AAAA,EACR;AAAA,EACA,cAAc;AAAA,IACZ,aAAa;AAAA,IACb,MAAM;AAAA,EACR;AACF;AAIA,IAAM,mBAAmB,wBAAwB;AAAA,EAC/C,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,WAAW;AACb,CAAC;AAED,IAAM,cAAc,CAAC,SAAS,WAAW,aAAa;AAMtD,IAAM,sBAAsB,uBAAuB,WAAW;AAE9D,IAAM,cAAc;AACpB,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAE1B,IAAM,kBAAkB;AACxB,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,gCAAgC;AAEtC,IAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAED,IAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,QAAQ;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,QAAQ;AAAA,EACzB,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AACtC,CAAC;AAED,IAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,OAAO,EAAE,MAAM,UAAU;AAC3B,CAAC;AAED,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,QAAQ;AAAA,EAClC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AACxC,CAAC;AAED,IAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,QAAQ;AAAA,EACzB,OAAO,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC1B,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AACtC,CAAC;AAED,IAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACpC,OAAO,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,QAAQ;AAAA,EAClC,yBAAyB,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC5C,qBAAqB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACxC,uBAAuB,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC/B,QAAQ,mBAAmB,QAAQ;AAAA,EACnC,UAAU,qBAAqB,QAAQ;AACzC,CAAC;AAED,IAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,OAAO,EAAE,MAAM,YAAY;AAC7B,CAAC;AAED,IAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC/B,yBAAyB,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC5C,cAAc,EAAE,QAAQ,EAAE,QAAQ;AAAA,EAClC,WAAW,EAAE,QAAQ,EAAE,QAAQ;AACjC,CAAC;AAED,IAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,OAAO,EAAE,MAAM,eAAe;AAChC,CAAC;AAEM,IAAM,mBAAmB,gBAAgB;AAAA,EAC9C,CAAC,WAAW,GAAG;AAAA,IACb,OAAO;AAAA,IACP,YAAY;AAAA,MACV,EAAE,OAAO,kBAAkB,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,OAAO,EAAE;AAAA,MAClE;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ,CAAC,UAAU,OAAO;AAAA,MAC5B;AAAA,IACF;AAAA,IACA,aACE;AAAA,IACF,UAAU;AAAA,IACV,OACE;AAAA,IACF,QAAQ;AAAA,MACN,EAAE,MAAM,eAAe,aAAa,mCAAmC;AAAA,MACvE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,QAAQ,aAAa,sCAAsC;AAAA,MACnE;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,CAAC,YAAY,GAAG;AAAA,IACd,OAAO;AAAA,IACP,YAAY;AAAA,MACV,EAAE,OAAO,UAAU,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,WAAW,SAAS,EAAE;AAAA,MAC/D;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,OAAO,kBAAkB,KAAK,CAAC,IAAI,EAAE;AAAA,IACzC;AAAA,IACA,aACE;AAAA,IACF,UAAU;AAAA,IACV,OACE;AAAA,IACF,QAAQ;AAAA,MACN;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,MACnE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,SAAS,aAAa,uCAAuC;AAAA,MACrE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,aAAa,aAAa,+BAA+B;AAAA,MACjE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,IACF;AAAA,IACA,WAAW,EAAE,SAAS,sBAAsB;AAAA,EAC9C;AAAA,EACA,CAAC,iBAAiB,GAAG;AAAA,IACnB,OAAO;AAAA,IACP,YAAY;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ,CAAC,OAAO,UAAU,QAAQ,UAAU,oBAAoB;AAAA,MAClE;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,aACE;AAAA,IACF,UAAU;AAAA,IACV,OACE;AAAA,IACF,QAAQ;AAAA,MACN;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,eAAe,aAAa,kCAAkC;AAAA,MACtE;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,WAAW,EAAE,aAAa,yBAAyB;AAAA,EACrD;AACF,CAAC;AAEM,IAAM,KAAK;AASlB,SAAS,aACP,WACuB;AACvB,SAAO,cAAc,IAAI,YAAY;AACvC;AAEA,SAAS,gBAAgB,OAA6B;AACpD,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO,IAAI,WAAW;AAAA,IACxB,KAAK;AACH,aAAO,IAAI,WAAW;AAAA,IACxB,KAAK;AACH,aAAO,IAAI,WAAW;AAAA,EAC1B;AACF;AAEA,SAAS,iBACP,KACA,OACe;AACf,SAAO,mBAAmB;AAAA,IACxB;AAAA,IACA,MAAM;AAAA,IACN,UAAU,gBAAgB,KAAK;AAAA,EACjC,CAAC;AACH;AAEO,IAAM,mBAAN,MAAM,0BAAyBA,eAGpC;AAAA,EACA,OAAgB,KAAK;AAAA,EAErB,OAAgB,YAAY;AAAA,EAE5B,OAAgB,UAAU,qBAAqB,gBAAgB;AAAA,EAE/D,OAAO,OAAO,OAAgB,KAA0C;AACtE,UAAM,SAAS,aAAa,MAAM,KAAK;AACvC,WAAO,IAAI;AAAA,MACT;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,qBAAqB,OAAO;AAAA,MAC9B;AAAA,MACA;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,cAAc,OAAO;AAAA,MACvB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAES,KAAK;AAAA,EACI,cAAc;AAAA,EAExB,aAAqC;AAAA,EAE7C,MAAc,eAAe,QAAuC;AAClE,QAAI,aAAa,KAAK,UAAU,GAAG;AACjC,aAAO,KAAK,WAAY;AAAA,IAC1B;AACA,SAAK,aAAa,MAAM;AAAA,MACtB;AAAA,QACE,UAAU,KAAK,SAAS;AAAA,QACxB,UAAU,KAAK,MAAM;AAAA,QACrB,cAAc,KAAK,MAAM;AAAA,QACzB,OAAO,WAAW,UAAU;AAAA,QAC5B,aAAa;AAAA,MACf;AAAA,MACA;AAAA,IACF;AACA,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA,EAEA,MAAc,OACZ,KACA,UACA,QAC0B;AAC1B,UAAM,QAAQ,MAAM,KAAK,eAAe,MAAM;AAC9C,WAAO,KAAK,IAAO,KAAK;AAAA,MACtB;AAAA,MACA,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,QAAQ;AAAA,QACR,cAAcC,oBAAmB,UAAU;AAAA,MAC7C;AAAA,MACA,WAAW;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,aAAa,SAA8B;AACjD,QAAI,QAAQ,OAAO;AACjB,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,WACJ,KAAK,SAAS,uBAAuB;AACvC,UAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW,KAAK,KAAK,KAAK,GAAI;AAClE,WAAO,MAAM,YAAY;AAAA,EAC3B;AAAA,EAEQ,gBAAgB,OAAqB,SAA8B;AACzE,UAAM,IAAI,IAAI,IAAI,WAAW,UAAU,GAAG,gBAAgB,KAAK,CAAC,EAAE;AAClE,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,UAAE,aAAa;AAAA,UACb;AAAA,UACA;AAAA,QACF;AACA,UAAE,aAAa,IAAI,QAAQ,OAAO,eAAe,CAAC;AAClD,eAAO,EAAE,SAAS;AAAA,MACpB,KAAK,WAAW;AACd,cAAM,QAAQ,KAAK,aAAa,OAAO;AACvC,UAAE,aAAa,IAAI,WAAW,sBAAsB,KAAK,EAAE;AAC3D,UAAE,aAAa,IAAI,YAAY,qBAAqB;AACpD,UAAE,aAAa,IAAI,QAAQ,OAAO,iBAAiB,CAAC;AACpD,eAAO,EAAE,SAAS;AAAA,MACpB;AAAA,MACA,KAAK;AACH,UAAE,aAAa,IAAI,QAAQ,OAAO,qBAAqB,CAAC;AACxD,eAAO,EAAE,SAAS;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAc,eACZ,OACA,MACA,SACA,QACoD;AACpD,UAAM,MAAM,QAAQ,KAAK,gBAAgB,OAAO,OAAO;AACvD,YAAQ,OAAO;AAAA,MACb,KAAK,SAAS;AACZ,cAAM,MAAM,MAAM,KAAK,OAAsB,KAAK,SAAS,MAAM;AACjE,cAAM,OAAO;AAAA,UACX,IAAI,KAAK,iBAAiB,KAAK;AAAA,UAC/B;AAAA,QACF;AACA,eAAO,EAAE,OAAO,IAAI,KAAK,OAAO,KAAK;AAAA,MACvC;AAAA,MACA,KAAK,WAAW;AACd,cAAM,MAAM,MAAM,KAAK,OAAwB,KAAK,WAAW,MAAM;AACrE,cAAM,OAAO;AAAA,UACX,IAAI,KAAK,iBAAiB,KAAK;AAAA,UAC/B;AAAA,QACF;AACA,eAAO,EAAE,OAAO,IAAI,KAAK,OAAO,KAAK;AAAA,MACvC;AAAA,MACA,KAAK,eAAe;AAClB,cAAM,MAAM,MAAM,KAAK;AAAA,UACrB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,cAAM,OAAO;AAAA,UACX,IAAI,KAAK,iBAAiB,KAAK;AAAA,UAC/B;AAAA,QACF;AACA,eAAO,EAAE,OAAO,IAAI,KAAK,OAAO,KAAK;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,WACZ,SACA,OACe;AACf,eAAW,KAAK,OAAO;AACrB,YAAM,YAAY,WAAW,EAAE,mBAAmB,MAAM,KAAK;AAC7D,YAAM,QAAQ,OAAO;AAAA,QACnB,MAAM;AAAA,QACN,IAAI,EAAE;AAAA,QACN,YAAY;AAAA,UACV,aAAa,EAAE,eAAe;AAAA,UAC9B,mBAAmB,EAAE,qBAAqB;AAAA,UAC1C,MAAM,EAAE,QAAQ;AAAA,UAChB,gBAAgB,EAAE,kBAAkB;AAAA,UACpC,UAAU,EAAE,YAAY;AAAA,UACxB,WAAW;AAAA,QACb;AAAA,QACA,YAAY,aAAa;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,SACA,OACA,SACe;AACf,eAAW,KAAK,OAAO;AACrB,YAAM,KAAK,WAAW,EAAE,iBAAiB,KAAK;AAC9C,UAAI,OAAO,MAAM;AACf;AAAA,MACF;AACA,UAAI,YAAY,QAAQ,MAAM,SAAS;AACrC;AAAA,MACF;AACA,YAAM,YAAY,EAAE,QAAQ,aAAa;AACzC,YAAM,QAAQ,MAAM;AAAA,QAClB,MAAM;AAAA,QACN,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,YAAY;AAAA,UACV,UAAU,EAAE;AAAA,UACZ,QAAQ,aAAa,SAAS;AAAA,UAC9B;AAAA,UACA,eAAe,EAAE,QAAQ,iBAAiB;AAAA,UAC1C,QAAQ,EAAE,UAAU;AAAA,UACpB,mBAAmB,EAAE,qBAAqB;AAAA,UAC1C,iBAAiB,EAAE,mBAAmB;AAAA,UACtC,OAAO,EAAE,SAAS;AAAA,UAClB,gBAAgB,EAAE,kBAAkB;AAAA,UACpC,WAAW,EAAE,aAAa;AAAA,UAC1B,eAAe,EAAE,iBAAiB;AAAA,UAClC,MAAM,EAAE,UAAU,QAAQ;AAAA,UAC1B,OAAO,EAAE,UAAU,SAAS;AAAA,UAC5B,iBAAiB,EAAE,UAAU,mBAAmB;AAAA,UAChD,WAAW,EAAE,uBAAuB;AAAA,UACpC,uBAAuB,EAAE,yBAAyB;AAAA,UAClD,WAAW,EAAE,aAAa;AAAA,UAC1B,YAAY,EAAE,cAAc;AAAA,UAC5B,yBAAyB,EAAE,2BAA2B;AAAA,QACxD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,gBACZ,SACA,OACe;AACf,eAAW,KAAK,OAAO;AACrB,YAAM,YAAY,WAAW,EAAE,2BAA2B,MAAM,KAAK;AACrE,YAAM,QAAQ,OAAO;AAAA,QACnB,MAAM;AAAA,QACN,IAAI,EAAE;AAAA,QACN,YAAY;AAAA,UACV,mBAAmB,EAAE,qBAAqB;AAAA,UAC1C,aAAa,EAAE,mBAAmB;AAAA,UAClC,WAAW,EAAE,aAAa;AAAA,UAC1B,WAAW,EAAE,aAAa;AAAA,UAC1B,YAAY,EAAE,cAAc;AAAA,UAC5B,mBAAmB;AAAA,UACnB,cAAc,EAAE,gBAAgB;AAAA,UAChC,WAAW,EAAE,aAAa;AAAA,QAC5B;AAAA,QACA,YAAY,aAAa;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,WACZ,SACA,OACA,OACA,SACe;AACf,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,KAAK,WAAW,SAAS,KAAoB;AAAA,MACtD,KAAK;AACH,eAAO,KAAK,aAAa,SAAS,OAAwB,OAAO;AAAA,MACnE,KAAK;AACH,eAAO,KAAK,gBAAgB,SAAS,KAAyB;AAAA,IAClE;AAAA,EACF;AAAA,EAEA,MAAc,sBACZ,SACA,OACA,QACe;AACf,QAAI,CAAC,QAAQ;AACX;AAAA,IACF;AACA,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,cAAM,QAAQ,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;AACnD;AAAA,MACF,KAAK;AACH,cAAM,QAAQ,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;AAClD;AAAA,MACF,KAAK;AACH,cAAM,QAAQ,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;AACzD;AAAA,IACJ;AAAA,EACF;AAAA,EAEQ,cAAc,QAAgD;AACpE,QAAI,CAAC,oBAAoB,MAAM,GAAG;AAChC,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd,MAAM,iBAAiB,OAAO,MAAM,OAAO,KAAK;AAAA,IAClD;AAAA,EACF;AAAA,EAEA,MAAM,KACJ,SACA,SACA,QACqB;AACrB,UAAM,SAAS,KAAK,cAAc,QAAQ,MAAM;AAChD,UAAM,SAAS,QAAQ,SAAS;AAChC,UAAM,aAAa,QAAQ,QAAQ,KAAK,MAAM,QAAQ,KAAK,IAAI;AAC/D,UAAM,UACJ,eAAe,QAAQ,OAAO,SAAS,UAAU,IAAI,aAAa;AAEpE,UAAM,SAAS;AAAA,MACb,CAAC,MAAM;AAAA,MACP;AAAA,MACA,KAAK,SAAS;AAAA,IAChB;AAEA,WAAO,gBAAsC;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,WAAW,OAAO,OAAO,MAAM,QAC7B,KAAK,eAAe,OAAO,MAAM,SAAS,GAAG;AAAA,MAC/C,YAAY,OAAO,OAAO,OAAO,SAAS;AACxC,YAAI,SAAS,MAAM;AACjB,gBAAM,KAAK,sBAAsB,SAAS,OAAO,MAAM;AAAA,QACzD;AACA,cAAM,KAAK,WAAW,SAAS,OAAO,OAAO,OAAO;AAAA,MACtD;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;AC5uBA,IAAO,gBAAQ;","names":["err","HTTP_CLIENT_VERSION","DEFAULT_USER_AGENT","connectorUserAgent","BaseConnector","connectorUserAgent"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rawdash/connector-entra-id",
-  "version": "0.1.0",
+  "version": "0.28.0",
   "description": "Rawdash connector for Microsoft Entra ID (formerly Azure AD) — syncs users, sign-in events, and risky users from Microsoft Graph into the six-shape storage model",
   "license": "Apache-2.0",
   "type": "module",
@@ -22,22 +22,23 @@
       "import": "./dist/index.js"
     }
   },
-  "scripts": {
-    "build": "tsup",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint src",
-    "test": "vitest run"
-  },
   "dependencies": {
-    "@rawdash/core": "workspace:*",
-    "zod": "^4.4.3"
+    "zod": "^4.4.3",
+    "@rawdash/core": "0.28.0"
   },
   "devDependencies": {
-    "@rawdash/connector-shared": "workspace:*",
-    "@rawdash/connector-test-utils": "workspace:*",
     "fast-check": "^4.8.0",
     "tsup": "^8.0.0",
     "typescript": "^5.7.2",
-    "vitest": "^4.1.4"
+    "vitest": "^4.1.4",
+    "@rawdash/connector-azure-shared": "0.1.0",
+    "@rawdash/connector-shared": "0.3.1",
+    "@rawdash/connector-test-utils": "0.0.10"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
   }
-}
+}