npm - @rawdash/connector-entra-id - Versions diffs - 0.1.0 - Mend

@rawdash/connector-entra-id 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../../connector-shared/src/errors.ts","../../../connector-shared/src/retry.ts","../../../connector-shared/src/version.ts","../../../connector-shared/src/request.ts","../../../connector-shared/src/rate-limit.ts","../../../connector-shared/src/map-concurrent.ts","../../../connector-shared/src/sanitize.ts","../../../connector-shared/src/epoch.ts","../../../connector-shared/src/pagination.ts","../../../connector-shared/src/logger.ts","../src/entra-id.ts","../src/index.ts"],"sourcesContent":["import type { HttpResponse } from './types';\n\nexport type HttpErrorKind =\n | 'transient'\n | 'rate_limit'\n | 'auth'\n | 'upstream_bug'\n | 'client_bug';\n\nexport abstract class HttpClientError extends Error {\n abstract readonly kind: HttpErrorKind;\n readonly response?: HttpResponse;\n\n constructor(message: string, response?: HttpResponse) {\n super(message);\n this.name = new.target.name;\n this.response = response;\n }\n}\n\nexport class TransientError extends HttpClientError {\n readonly kind = 'transient' as const;\n}\n\nexport class RateLimitError extends HttpClientError {\n readonly kind = 'rate_limit' as const;\n readonly retryAfter?: Date;\n\n constructor(message: string, response?: HttpResponse, retryAfter?: Date) {\n super(message, response);\n this.retryAfter = retryAfter;\n }\n}\n\nexport class AuthError extends HttpClientError {\n readonly kind = 'auth' as const;\n}\n\nexport class UpstreamBugError extends HttpClientError {\n readonly kind = 'upstream_bug' as const;\n}\n\nexport class ClientBugError extends HttpClientError {\n readonly kind = 'client_bug' as const;\n}\n\nexport function classifyStatus(status: number): HttpErrorKind {\n if (status === 429) {\n return 'rate_limit';\n }\n if (status === 401 || status === 403) {\n return 'auth';\n }\n if (status === 408) {\n return 'transient';\n }\n if (status >= 500) {\n return 'upstream_bug';\n }\n if (status >= 400) {\n return 'client_bug';\n }\n return 'client_bug';\n}\n\nexport function errorForStatus(\n message: string,\n response: HttpResponse,\n retryAfter?: Date,\n): HttpClientError {\n const kind = classifyStatus(response.status);\n switch (kind) {\n case 'rate_limit':\n return new RateLimitError(message, response, retryAfter);\n case 'auth':\n return new AuthError(message, response);\n case 'transient':\n return new TransientError(message, response);\n case 'upstream_bug':\n return new UpstreamBugError(message, response);\n case 'client_bug':\n return new ClientBugError(message, response);\n }\n}\n","import { HttpClientError, RateLimitError, TransientError } from './errors';\n\nexport interface RetryPolicy {\n maxAttempts?: number;\n initialDelayMs?: number;\n maxDelayMs?: number;\n retryOn?: (status: number | null, err?: Error) => boolean;\n}\n\nexport const defaultRetryOn = (status: number | null, err?: Error): boolean => {\n if (err instanceof RateLimitError) {\n return true;\n }\n if (err instanceof TransientError) {\n return true;\n }\n if (status === null) {\n return err instanceof Error && !(err instanceof HttpClientError);\n }\n if (status === 408 || status === 429) {\n return true;\n }\n if (status >= 500) {\n return true;\n }\n return false;\n};\n\nexport function backoffDelayMs(\n attempt: number,\n policy: Required<Pick<RetryPolicy, 'initialDelayMs' | 'maxDelayMs'>>,\n): number {\n const base = policy.initialDelayMs * 2 ** attempt;\n const jitter = base * 0.25 * Math.random();\n return Math.min(base + jitter, policy.maxDelayMs);\n}\n\nexport function parseRetryAfter(\n headerValue: string | null,\n now: Date = new Date(),\n): Date | undefined {\n if (!headerValue) {\n return undefined;\n }\n const trimmed = headerValue.trim();\n if (/^\\d+$/.test(trimmed)) {\n return new Date(now.getTime() + Number(trimmed) * 1000);\n }\n const parsed = Date.parse(trimmed);\n if (Number.isNaN(parsed)) {\n return undefined;\n }\n return new Date(parsed);\n}\n\nexport function sleep(ms: number, signal?: AbortSignal): Promise<void> {\n if (signal?.aborted) {\n return Promise.reject(signal.reason ?? new Error('Aborted'));\n }\n return new Promise<void>((resolve, reject) => {\n const onAbort = () => {\n clearTimeout(timer);\n reject(signal!.reason ?? new Error('Aborted'));\n };\n const timer = setTimeout(() => {\n signal?.removeEventListener('abort', onAbort);\n resolve();\n }, ms);\n signal?.addEventListener('abort', onAbort, { once: true });\n });\n}\n","export const HTTP_CLIENT_VERSION = '0.0.0';\n\nexport const DEFAULT_USER_AGENT = `rawdash-connector/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;\n\nexport function connectorUserAgent(connectorId: string): string {\n return `rawdash-connector-${connectorId}/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;\n}\n","import {\n AuthError,\n ClientBugError,\n HttpClientError,\n RateLimitError,\n TransientError,\n UpstreamBugError,\n errorForStatus,\n} from './errors';\nimport { defaultRetryOn, parseRetryAfter, sleep } from './retry';\nimport type { FetchLike, HttpMethod, HttpRequest, HttpResponse } from './types';\nimport { DEFAULT_USER_AGENT } from './version';\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst DEFAULT_MAX_ATTEMPTS = 3;\nconst DEFAULT_INITIAL_DELAY_MS = 1000;\nconst DEFAULT_MAX_DELAY_MS = 60_000;\nconst OBSERVER_TIMEOUT_MS = 250;\n\nexport interface RequestObservation {\n url: string;\n method: HttpMethod;\n status: number;\n resource: string;\n requestId: string;\n body: unknown;\n}\n\nexport type RequestObserver = (\n event: RequestObservation,\n) => void | Promise<void>;\n\nexport interface RequestOptions {\n fetch?: FetchLike;\n observer?: RequestObserver;\n resource: string;\n requestId?: string;\n}\n\nasync function notifyObserver(\n observer: RequestObserver,\n event: RequestObservation,\n): Promise<void> {\n let result: void | Promise<void>;\n try {\n result = observer(event);\n } catch (err) {\n console.warn('[connector-shared] request observer threw:', err);\n return;\n }\n if (!(result instanceof Promise)) {\n return;\n }\n const guarded = result.catch((err) => {\n console.warn('[connector-shared] request observer rejected:', err);\n });\n let timer: ReturnType<typeof setTimeout> | undefined;\n const timeout = new Promise<void>((resolve) => {\n timer = setTimeout(resolve, OBSERVER_TIMEOUT_MS);\n });\n try {\n await Promise.race([guarded, timeout]);\n } finally {\n if (timer) {\n clearTimeout(timer);\n }\n }\n}\n\nfunction newRequestId(): string {\n const c = (globalThis as { crypto?: { randomUUID?: () => string } }).crypto;\n if (c?.randomUUID) {\n return c.randomUUID();\n }\n return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;\n}\n\nfunction mergeHeaders(\n defaults: Record<string, string>,\n overrides: Record<string, string> | undefined,\n): Record<string, string> {\n const merged: Record<string, string> = {};\n for (const [k, v] of Object.entries(defaults)) {\n merged[k.toLowerCase()] = v;\n }\n if (overrides) {\n for (const [k, v] of Object.entries(overrides)) {\n merged[k.toLowerCase()] = v;\n }\n }\n return merged;\n}\n\nfunction linkTimeoutSignal(\n parent: AbortSignal | undefined,\n timeoutMs: number,\n): { signal: AbortSignal; cancel: () => void } {\n const controller = new AbortController();\n const onParentAbort = () => {\n controller.abort(parent?.reason);\n };\n if (parent) {\n if (parent.aborted) {\n controller.abort(parent.reason);\n } else {\n parent.addEventListener('abort', onParentAbort, { once: true });\n }\n }\n const timer = setTimeout(() => {\n controller.abort(new Error(`Request timed out after ${timeoutMs}ms`));\n }, timeoutMs);\n return {\n signal: controller.signal,\n cancel: () => {\n clearTimeout(timer);\n if (parent) {\n parent.removeEventListener('abort', onParentAbort);\n }\n },\n };\n}\n\nasync function readBody(res: Response, parseJson: boolean): Promise<unknown> {\n if (res.status === 204 || res.status === 205) {\n return null;\n }\n const contentType = res.headers.get('content-type') ?? '';\n if (parseJson && contentType.includes('application/json')) {\n const text = await res.text();\n if (text.length === 0) {\n return null;\n }\n return JSON.parse(text);\n }\n return res.text();\n}\n\nexport async function request<T = unknown>(\n req: HttpRequest,\n options: RequestOptions,\n): Promise<HttpResponse<T>> {\n const fetchImpl: FetchLike = options.fetch ?? (globalThis.fetch as FetchLike);\n const retry = req.retry ?? {};\n const maxAttempts = retry.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;\n const initialDelayMs = retry.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS;\n const maxDelayMs = retry.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;\n const retryOn = retry.retryOn ?? defaultRetryOn;\n const timeoutMs = req.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n const parseJson = req.parseJson ?? true;\n\n const headers = mergeHeaders(\n {\n 'User-Agent': DEFAULT_USER_AGENT,\n Accept: 'application/json',\n },\n req.headers,\n );\n\n let lastErr: Error | undefined;\n\n for (let attempt = 0; attempt < maxAttempts; attempt++) {\n req.signal?.throwIfAborted();\n\n const { signal, cancel } = linkTimeoutSignal(req.signal, timeoutMs);\n let res: Response;\n try {\n res = await fetchImpl(req.url, {\n method: req.method ?? 'GET',\n headers,\n body: req.body as RequestInit['body'],\n signal,\n });\n } catch (err) {\n cancel();\n if (req.signal?.aborted) {\n throw req.signal.reason ?? err;\n }\n const error = err instanceof Error ? err : new Error(String(err));\n lastErr = error;\n if (attempt < maxAttempts - 1 && retryOn(null, error)) {\n const delay = computeDelay(attempt, initialDelayMs, maxDelayMs);\n await sleep(delay, req.signal);\n continue;\n }\n throw new TransientError(error.message);\n }\n cancel();\n\n const body = await readBody(res, parseJson);\n const httpResponse: HttpResponse<T> = {\n status: res.status,\n headers: res.headers,\n body: body as T,\n };\n if (req.rateLimit) {\n const state = req.rateLimit.parse(res.headers);\n if (state) {\n httpResponse.rateLimitState = state;\n }\n }\n\n if (options.observer) {\n await notifyObserver(options.observer, {\n url: req.url,\n method: req.method ?? 'GET',\n status: res.status,\n resource: options.resource,\n requestId: options.requestId ?? newRequestId(),\n body,\n });\n }\n\n if (res.ok) {\n return httpResponse;\n }\n\n const retryAfter = parseRetryAfter(res.headers.get('retry-after'));\n const message = `HTTP ${res.status} ${res.statusText} for ${req.method ?? 'GET'} ${req.url}`;\n const err = errorForStatus(message, httpResponse, retryAfter);\n\n if (\n attempt < maxAttempts - 1 &&\n retryOn(res.status, err) &&\n !(err instanceof AuthError) &&\n !(err instanceof ClientBugError)\n ) {\n lastErr = err;\n let delay = computeDelay(attempt, initialDelayMs, maxDelayMs);\n if (err instanceof RateLimitError && retryAfter) {\n const wait = retryAfter.getTime() - Date.now();\n if (wait > 0) {\n delay = Math.min(wait, maxDelayMs);\n }\n }\n await sleep(delay, req.signal);\n continue;\n }\n\n throw err;\n }\n\n throw lastErr ?? new UpstreamBugError('Exhausted retry attempts');\n}\n\nfunction computeDelay(\n attempt: number,\n initialDelayMs: number,\n maxDelayMs: number,\n): number {\n const base = initialDelayMs * 2 ** attempt;\n const jitter = base * 0.25 * Math.random();\n return Math.min(base + jitter, maxDelayMs);\n}\n\nexport { HttpClientError };\n","export interface RateLimitState {\n remaining: number;\n resetAt: Date;\n}\n\nexport interface RateLimitPolicy {\n parse(headers: Headers): RateLimitState | null;\n}\n\nexport interface StandardRateLimitPolicyConfig {\n remainingHeader: string;\n resetHeader: string;\n resetUnit: 's' | 'ms';\n resetFallbackMs?: number;\n}\n\nexport function standardRateLimitPolicy(\n config: StandardRateLimitPolicyConfig,\n): RateLimitPolicy {\n const { remainingHeader, resetHeader, resetUnit, resetFallbackMs } = config;\n const multiplier = resetUnit === 's' ? 1000 : 1;\n return {\n parse(h) {\n const remainingRaw = h.get(remainingHeader);\n if (remainingRaw === null || remainingRaw.trim() === '') {\n return null;\n }\n const remaining = Number(remainingRaw);\n if (!Number.isFinite(remaining)) {\n return null;\n }\n const resetRaw = h.get(resetHeader);\n if (resetRaw === null) {\n if (resetFallbackMs === undefined) {\n return null;\n }\n return {\n remaining,\n resetAt: new Date(Date.now() + resetFallbackMs),\n };\n }\n if (resetRaw.trim() === '') {\n return null;\n }\n const reset = Number(resetRaw);\n if (!Number.isFinite(reset) || reset < 0) {\n return null;\n }\n const resetMs = reset * multiplier;\n if (!Number.isFinite(resetMs)) {\n return null;\n }\n return { remaining, resetAt: new Date(resetMs) };\n },\n };\n}\n","export async function mapWithConcurrency<T, R>(\n items: readonly T[],\n concurrency: number,\n fn: (item: T, index: number) => Promise<R>,\n): Promise<R[]> {\n const results = new Array<R>(items.length);\n if (items.length === 0) {\n return results;\n }\n const normalized = Number.isFinite(concurrency) ? Math.floor(concurrency) : 1;\n const limit = Math.max(1, Math.min(normalized, items.length));\n let next = 0;\n let failed = false;\n\n async function worker(): Promise<void> {\n while (!failed) {\n const i = next++;\n if (i >= items.length) {\n return;\n }\n try {\n results[i] = await fn(items[i]!, i);\n } catch (err) {\n failed = true;\n throw err;\n }\n }\n }\n\n const workers: Promise<void>[] = [];\n for (let w = 0; w < limit; w++) {\n workers.push(worker());\n }\n await Promise.all(workers);\n return results;\n}\n","export interface SanitizeAllowedUrlOptions {\n url: string | null;\n host: string;\n pathname: string;\n protocol?: 'https:' | 'http:';\n}\n\nexport function sanitizeAllowedUrl(\n options: SanitizeAllowedUrlOptions,\n): string | null {\n const { url, host, pathname, protocol = 'https:' } = options;\n if (url === null) {\n return null;\n }\n try {\n const u = new URL(url);\n if (u.protocol !== protocol || u.host !== host || u.pathname !== pathname) {\n return null;\n }\n return u.toString();\n } catch {\n return null;\n }\n}\n","export type EpochUnit = 'ms' | 's' | 'iso';\n\nexport function parseEpoch(\n value: number | string | null | undefined,\n unit: EpochUnit,\n): number | null {\n if (value === null || value === undefined) {\n return null;\n }\n if (unit === 'iso') {\n if (typeof value !== 'string') {\n return null;\n }\n const ms = new Date(value).getTime();\n return Number.isFinite(ms) ? ms : null;\n }\n if (typeof value === 'string' && value.trim() === '') {\n return null;\n }\n const n = typeof value === 'number' ? value : Number(value);\n if (!Number.isFinite(n)) {\n return null;\n }\n const result = unit === 's' ? n * 1000 : n;\n return Number.isFinite(result) ? result : null;\n}\n","import { request } from './request';\nimport type { HttpRequest } from './types';\n\nexport function parseLinkHeader(header: string | null): Record<string, string> {\n if (!header) {\n return {};\n }\n const result: Record<string, string> = {};\n for (const part of header.split(',')) {\n const match = part.match(/<([^>]+)>\\s*;\\s*rel=\"([^\"]+)\"/);\n if (match) {\n result[match[2]!] = match[1]!;\n }\n }\n return result;\n}\n\nexport async function* paginateLink<T>(\n initial: HttpRequest,\n parse: (body: unknown) => T[],\n options: { resource: string },\n): AsyncIterable<T> {\n let next: string | null = initial.url;\n while (next) {\n const res: Awaited<ReturnType<typeof request>> = await request(\n {\n ...initial,\n url: next,\n },\n { resource: options.resource },\n );\n for (const item of parse(res.body)) {\n yield item;\n }\n const links = parseLinkHeader(res.headers.get('link'));\n next = links['next'] ?? null;\n }\n}\n\nexport async function* paginateCursor<T>(\n initial: HttpRequest,\n parse: (body: unknown) => { items: T[]; nextCursor: string | null },\n buildNext: (req: HttpRequest, cursor: string) => HttpRequest,\n options: { resource: string },\n): AsyncIterable<T> {\n let req: HttpRequest = initial;\n while (true) {\n const res = await request(req, { resource: options.resource });\n const { items, nextCursor } = parse(res.body);\n for (const item of items) {\n yield item;\n }\n if (!nextCursor) {\n return;\n }\n req = buildNext(req, nextCursor);\n }\n}\n\nexport async function* paginatePage<T>(\n initial: HttpRequest,\n parse: (body: unknown) => { items: T[]; hasMore: boolean },\n buildPage: (req: HttpRequest, page: number) => HttpRequest,\n options: { resource: string },\n): AsyncIterable<T> {\n let page = 1;\n while (true) {\n const req = page === 1 ? initial : buildPage(initial, page);\n const res = await request(req, { resource: options.resource });\n const { items, hasMore } = parse(res.body);\n for (const item of items) {\n yield item;\n }\n if (!hasMore || items.length === 0) {\n return;\n }\n page++;\n }\n}\n","export type LogFields = Record<string, unknown>;\n\nexport interface ConnectorLogger {\n info(event: string, fields?: LogFields): void;\n warn(event: string, fields?: LogFields): void;\n}\n\nexport interface ConnectorLoggerOptions {\n scope: string;\n}\n\nconst MAX_VALUE_LEN = 120;\n\nfunction truncate(s: string, max = MAX_VALUE_LEN): string {\n if (s.length <= max) {\n return s;\n }\n return `${s.slice(0, max - 1)}…`;\n}\n\nfunction formatValue(value: unknown): string {\n if (value === null) {\n return 'null';\n }\n if (value === undefined) {\n return '';\n }\n if (typeof value === 'number' || typeof value === 'boolean') {\n return String(value);\n }\n if (typeof value === 'string') {\n const t = truncate(value);\n if (/[\\s\"=]/.test(t)) {\n return JSON.stringify(t);\n }\n return t;\n }\n if (typeof value === 'bigint') {\n return value.toString();\n }\n let json: string | undefined;\n try {\n json = JSON.stringify(value);\n } catch {\n json = undefined;\n }\n return truncate(json ?? String(value));\n}\n\nexport function formatLogFields(fields?: LogFields): string {\n if (!fields) {\n return '';\n }\n const parts: string[] = [];\n for (const [k, v] of Object.entries(fields)) {\n if (v === undefined) {\n continue;\n }\n parts.push(`${k}=${formatValue(v)}`);\n }\n return parts.length > 0 ? ` ${parts.join(' ')}` : '';\n}\n\nexport function formatLogLine(\n scope: string,\n event: string,\n fields?: LogFields,\n): string {\n return `[${scope}] ${event}${formatLogFields(fields)}`;\n}\n\nexport function createDefaultConnectorLogger(\n opts: ConnectorLoggerOptions,\n): ConnectorLogger {\n return {\n info(event, fields) {\n console.info(formatLogLine(opts.scope, event, fields));\n },\n warn(event, fields) {\n console.warn(formatLogLine(opts.scope, event, fields));\n },\n };\n}\n\nconst NOOP_LOGGER: ConnectorLogger = {\n info() {},\n warn() {},\n};\n\nexport function noopConnectorLogger(): ConnectorLogger {\n return NOOP_LOGGER;\n}\n","import {\n type HttpResponse,\n connectorUserAgent,\n parseEpoch,\n sanitizeAllowedUrl,\n standardRateLimitPolicy,\n} from '@rawdash/connector-shared';\nimport {\n BaseConnector,\n type ChunkedSyncCursor,\n type ConnectorContext,\n type ConnectorDoc,\n type CredentialsSchema,\n type StorageHandle,\n type SyncOptions,\n type SyncResult,\n defineConfigFields,\n defineConnectorDoc,\n defineResources,\n makeChunkedCursorGuard,\n paginateChunked,\n schemasFromResources,\n selectActivePhases,\n} from '@rawdash/core';\nimport { z } from 'zod';\n\nconst GRAPH_HOST = 'graph.microsoft.com';\nconst LOGIN_HOST = 'login.microsoftonline.com';\nconst API_VERSION = 'v1.0';\n\n// Entra tenant identifier: GUID, or a verified domain like contoso.onmicrosoft.com,\n// or one of the well-known values (common, organizations, consumers). Reject\n// anything containing a slash or whitespace so the token URL stays anchored.\nconst TENANT_ID_PATTERN = /^[a-zA-Z0-9.-]{1,256}$/;\n\nexport const configFields = defineConfigFields(\n z.object({\n tenantId: z\n .string()\n .trim()\n .min(1)\n .regex(\n TENANT_ID_PATTERN,\n 'Use the tenant GUID, a verified domain (e.g. \"contoso.onmicrosoft.com\"), or one of the well-known values \"common\" / \"organizations\" / \"consumers\".',\n )\n .meta({\n label: 'Tenant ID',\n description:\n 'Microsoft Entra tenant identifier. Either the directory (tenant) GUID from the Azure portal, or a verified domain such as \"contoso.onmicrosoft.com\".',\n placeholder: '00000000-0000-0000-0000-000000000000',\n }),\n clientId: z.string().min(1).meta({\n label: 'Application (client) ID',\n description:\n 'Application (client) ID of the Entra app registration used to call Microsoft Graph.',\n placeholder: '00000000-0000-0000-0000-000000000000',\n }),\n clientSecret: z.object({ $secret: z.string().min(1) }).meta({\n label: 'Client secret',\n description:\n 'Client secret value (not the secret ID) from the app registration. Stored as a secret.',\n placeholder: 'ENTRA_CLIENT_SECRET',\n secret: true,\n }),\n resources: z\n .array(z.enum(['users', 'signins', 'risky_users']))\n .nonempty()\n .optional()\n .meta({\n label: 'Resources',\n description:\n 'Which Entra ID resources to sync. Omit to sync all of them. The app registration only needs the Microsoft Graph application permissions for the resources listed here (User.Read.All, AuditLog.Read.All, IdentityRiskyUser.Read.All).',\n }),\n signinsLookbackDays: z.number().int().positive().max(30).optional().meta({\n label: 'Sign-ins lookback (days)',\n description:\n 'How many days of sign-in events to backfill on a full sync. Defaults to 7. Microsoft Graph retains sign-in logs for 30 days on the Premium tiers required to call the API.',\n placeholder: '7',\n }),\n }),\n);\n\nexport const doc: ConnectorDoc = defineConnectorDoc({\n displayName: 'Microsoft Entra ID',\n category: 'security',\n brandColor: '#0078D4',\n tagline:\n 'Sync users, sign-in events, and risky users from a Microsoft Entra ID (formerly Azure AD) tenant for sign-in volume, failed-sign-in rate, and identity-risk dashboards.',\n vendor: {\n name: 'Microsoft Entra ID',\n domain: 'microsoft.com',\n apiDocs: 'https://learn.microsoft.com/en-us/graph/api/resources/signin',\n website:\n 'https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id',\n },\n auth: {\n summary:\n 'OAuth 2.0 client-credentials flow against the Microsoft identity platform, using an Entra app registration with Microsoft Graph application permissions.',\n setup: [\n 'In the Azure portal, open Microsoft Entra ID -> App registrations and create a new registration (single tenant).',\n 'Under API permissions, add Microsoft Graph Application permissions for the resources you want to sync: User.Read.All (users), AuditLog.Read.All (signins), IdentityRiskyUser.Read.All (risky_users). Grant admin consent.',\n 'Under Certificates & secrets, add a new client secret and copy the Value (not the Secret ID) immediately - Azure only shows it once.',\n 'Copy the Directory (tenant) ID and Application (client) ID from the registration overview.',\n 'Store the client secret as a rawdash secret and reference it from the connector config as `clientSecret: secret(\"ENTRA_CLIENT_SECRET\")`.',\n ],\n },\n rateLimit:\n 'Microsoft Graph applies per-app and per-tenant throttling. The shared HTTP client backs off on 429 using Retry-After and the standard rate-limit policy.',\n limitations: [\n 'The sign-in logs and risky-users endpoints require Entra ID P1 or P2; tenants on the free tier cannot call them and the connector will surface a 4xx from Microsoft Graph.',\n 'Sign-in logs are retained by Microsoft for 30 days; backfills beyond that window return no data.',\n 'Conditional Access, application assignments, and audit logs (admin activity) are out of scope.',\n ],\n});\n\nexport type EntraIdResource = 'users' | 'signins' | 'risky_users';\n\nexport interface EntraIdSettings {\n tenantId: string;\n resources?: readonly EntraIdResource[];\n signinsLookbackDays?: number;\n}\n\nconst entraIdCredentials = {\n clientId: {\n description: 'Entra app registration application (client) ID',\n auth: 'required' as const,\n },\n clientSecret: {\n description: 'Entra app registration client secret value',\n auth: 'required' as const,\n },\n} satisfies CredentialsSchema;\n\ntype EntraIdCredentials = typeof entraIdCredentials;\n\nconst entraIdRateLimit = standardRateLimitPolicy({\n remainingHeader: 'ratelimit-remaining',\n resetHeader: 'ratelimit-reset',\n resetUnit: 's',\n});\n\nconst PHASE_ORDER = ['users', 'signins', 'risky_users'] as const;\n\ntype EntraIdPhase = (typeof PHASE_ORDER)[number];\n\ntype EntraIdSyncCursor = ChunkedSyncCursor<EntraIdPhase, string>;\n\nconst isEntraIdSyncCursor = makeChunkedCursorGuard(PHASE_ORDER);\n\nconst USER_ENTITY = 'entra_user';\nconst SIGNIN_EVENT = 'entra_signin_event';\nconst RISKY_USER_ENTITY = 'entra_risky_user';\n\nconst USERS_PAGE_SIZE = 500;\nconst SIGNINS_PAGE_SIZE = 1000;\nconst RISKY_USERS_PAGE_SIZE = 500;\nconst DEFAULT_SIGNINS_LOOKBACK_DAYS = 7;\n\nconst oauthTokenSchema = z.object({\n access_token: z.string().min(1),\n token_type: z.string().optional(),\n expires_in: z.number().optional(),\n});\n\nconst userSchema = z.object({\n id: z.string().min(1),\n displayName: z.string().nullish(),\n userPrincipalName: z.string().nullish(),\n mail: z.string().nullish(),\n accountEnabled: z.boolean().nullish(),\n userType: z.string().nullish(),\n createdDateTime: z.string().nullish(),\n});\n\nconst usersResponseSchema = z.object({\n '@odata.nextLink': z.string().nullish(),\n value: z.array(userSchema),\n});\n\nconst signinStatusSchema = z.object({\n errorCode: z.number().nullish(),\n failureReason: z.string().nullish(),\n additionalDetails: z.string().nullish(),\n});\n\nconst signinLocationSchema = z.object({\n city: z.string().nullish(),\n state: z.string().nullish(),\n countryOrRegion: z.string().nullish(),\n});\n\nconst signinSchema = z.object({\n id: z.string().min(1),\n createdDateTime: z.string(),\n userId: z.string().nullish(),\n userPrincipalName: z.string().nullish(),\n userDisplayName: z.string().nullish(),\n appId: z.string().nullish(),\n appDisplayName: z.string().nullish(),\n ipAddress: z.string().nullish(),\n clientAppUsed: z.string().nullish(),\n conditionalAccessStatus: z.string().nullish(),\n riskLevelAggregated: z.string().nullish(),\n riskLevelDuringSignIn: z.string().nullish(),\n riskState: z.string().nullish(),\n riskDetail: z.string().nullish(),\n status: signinStatusSchema.nullish(),\n location: signinLocationSchema.nullish(),\n});\n\nconst signinsResponseSchema = z.object({\n '@odata.nextLink': z.string().nullish(),\n value: z.array(signinSchema),\n});\n\nconst riskyUserSchema = z.object({\n id: z.string().min(1),\n userPrincipalName: z.string().nullish(),\n userDisplayName: z.string().nullish(),\n riskLevel: z.string().nullish(),\n riskState: z.string().nullish(),\n riskDetail: z.string().nullish(),\n riskLastUpdatedDateTime: z.string().nullish(),\n isProcessing: z.boolean().nullish(),\n isDeleted: z.boolean().nullish(),\n});\n\nconst riskyUsersResponseSchema = z.object({\n '@odata.nextLink': z.string().nullish(),\n value: z.array(riskyUserSchema),\n});\n\nexport const entraIdResources = defineResources({\n [USER_ENTITY]: {\n shape: 'entity',\n filterable: [\n { field: 'accountEnabled', ops: ['eq'], values: ['true', 'false'] },\n {\n field: 'userType',\n ops: ['eq'],\n values: ['Member', 'Guest'],\n },\n ],\n description:\n 'Entra ID users with display name, principal name, mail, account-enabled flag, and user type.',\n endpoint: 'GET /v1.0/users',\n notes:\n 'Fully enumerated on every sync; @odata.nextLink pages are followed within the chunked sync loop.',\n fields: [\n { name: 'displayName', description: 'Display name from the directory.' },\n {\n name: 'userPrincipalName',\n description: 'User principal name (e.g. alice@contoso.com).',\n },\n { name: 'mail', description: 'Primary SMTP address (may be null).' },\n {\n name: 'accountEnabled',\n description:\n 'Whether the account is enabled (sign-in allowed when true).',\n },\n {\n name: 'userType',\n description: 'Either \"Member\" (in-tenant) or \"Guest\" (B2B invitee).',\n },\n {\n name: 'createdAt',\n description: 'When the user was created (Unix ms).',\n },\n ],\n responses: {\n oauth_token: oauthTokenSchema,\n users: usersResponseSchema,\n },\n },\n [SIGNIN_EVENT]: {\n shape: 'event',\n filterable: [\n { field: 'status', ops: ['eq'], values: ['success', 'failure'] },\n {\n field: 'riskLevel',\n ops: ['eq'],\n values: [\n 'none',\n 'low',\n 'medium',\n 'high',\n 'hidden',\n 'unknownFutureValue',\n ],\n },\n { field: 'appDisplayName', ops: ['eq'] },\n ],\n description:\n 'Sign-in events from the Entra ID audit logs (`/auditLogs/signIns`). One event per interactive sign-in attempt with user, app, IP, location, and risk fields.',\n endpoint: 'GET /v1.0/auditLogs/signIns',\n notes:\n 'Backfill window defaults to 7 days and is capped at the Microsoft Graph 30-day retention. Incremental syncs filter on `createdDateTime`.',\n fields: [\n {\n name: 'status',\n description:\n 'Aggregated status: \"success\" when the sign-in completed without error, otherwise \"failure\".',\n },\n {\n name: 'errorCode',\n description: 'Microsoft Graph signInStatus.errorCode (0 on success).',\n },\n {\n name: 'failureReason',\n description: 'Human-readable failure reason (null on success).',\n },\n { name: 'userId', description: 'Directory object id of the actor.' },\n {\n name: 'userPrincipalName',\n description: 'User principal name at sign-in time.',\n },\n { name: 'appId', description: 'Application (client) id signed into.' },\n {\n name: 'appDisplayName',\n description: 'Display name of the application signed into.',\n },\n { name: 'ipAddress', description: 'Client IP recorded by Entra.' },\n {\n name: 'countryOrRegion',\n description: 'Geographic country/region from location.countryOrRegion.',\n },\n {\n name: 'city',\n description: 'City from location.city (may be null).',\n },\n {\n name: 'riskLevel',\n description:\n 'Aggregated risk level (none / low / medium / high / hidden / unknownFutureValue).',\n },\n {\n name: 'riskState',\n description:\n 'Risk state (none / confirmedSafe / remediated / dismissed / atRisk / confirmedCompromised).',\n },\n {\n name: 'clientAppUsed',\n description:\n 'Client app type (Browser, Mobile Apps and Desktop clients, etc.).',\n },\n {\n name: 'conditionalAccessStatus',\n description:\n 'Outcome of conditional-access policy evaluation (success / failure / notApplied / unknownFutureValue).',\n },\n ],\n responses: { signins: signinsResponseSchema },\n },\n [RISKY_USER_ENTITY]: {\n shape: 'entity',\n filterable: [\n {\n field: 'riskLevel',\n ops: ['eq'],\n values: ['low', 'medium', 'high', 'hidden', 'unknownFutureValue'],\n },\n {\n field: 'riskState',\n ops: ['eq'],\n values: [\n 'none',\n 'confirmedSafe',\n 'remediated',\n 'dismissed',\n 'atRisk',\n 'confirmedCompromised',\n 'unknownFutureValue',\n ],\n },\n ],\n description:\n 'Users currently flagged by Entra Identity Protection, with their risk level, risk state, and last-updated timestamp.',\n endpoint: 'GET /v1.0/identityProtection/riskyUsers',\n notes:\n 'Fully enumerated on every sync; @odata.nextLink pages are followed within the chunked sync loop.',\n fields: [\n {\n name: 'userPrincipalName',\n description: 'User principal name of the risky user.',\n },\n { name: 'displayName', description: 'Display name of the risky user.' },\n {\n name: 'riskLevel',\n description:\n 'Identity Protection risk level (low / medium / high / hidden / unknownFutureValue).',\n },\n {\n name: 'riskState',\n description:\n 'Risk state (none / confirmedSafe / remediated / dismissed / atRisk / confirmedCompromised / unknownFutureValue).',\n },\n {\n name: 'riskDetail',\n description:\n 'Latest risk detail string (the specific reason for the flag).',\n },\n {\n name: 'riskLastUpdatedAt',\n description: 'When the risk was last refreshed (Unix ms).',\n },\n ],\n responses: { risky_users: riskyUsersResponseSchema },\n },\n});\n\nexport const id = 'entra-id';\n\ntype UsersResponse = z.infer<typeof usersResponseSchema>;\ntype SigninsResponse = z.infer<typeof signinsResponseSchema>;\ntype RiskyUsersResponse = z.infer<typeof riskyUsersResponseSchema>;\ntype OauthTokenResponse = z.infer<typeof oauthTokenSchema>;\ntype EntraUser = z.infer<typeof userSchema>;\ntype EntraSignin = z.infer<typeof signinSchema>;\ntype EntraRiskyUser = z.infer<typeof riskyUserSchema>;\n\nfunction signinStatus(\n errorCode: number | null | undefined,\n): 'success' | 'failure' {\n return errorCode === 0 || errorCode === null || errorCode === undefined\n ? 'success'\n : 'failure';\n}\n\nfunction pageRequestPath(phase: EntraIdPhase): string {\n switch (phase) {\n case 'users':\n return `/${API_VERSION}/users`;\n case 'signins':\n return `/${API_VERSION}/auditLogs/signIns`;\n case 'risky_users':\n return `/${API_VERSION}/identityProtection/riskyUsers`;\n }\n}\n\nfunction sanitizeGraphUrl(\n url: string | null,\n phase: EntraIdPhase,\n): string | null {\n return sanitizeAllowedUrl({\n url,\n host: GRAPH_HOST,\n pathname: pageRequestPath(phase),\n });\n}\n\nexport class EntraIdConnector extends BaseConnector<\n EntraIdSettings,\n EntraIdCredentials\n> {\n static readonly id = id;\n\n static readonly resources = entraIdResources;\n\n static readonly schemas = schemasFromResources(entraIdResources);\n\n static create(input: unknown, ctx?: ConnectorContext): EntraIdConnector {\n const parsed = configFields.parse(input);\n return new EntraIdConnector(\n {\n tenantId: parsed.tenantId,\n resources: parsed.resources,\n signinsLookbackDays: parsed.signinsLookbackDays,\n },\n {\n clientId: parsed.clientId,\n clientSecret: parsed.clientSecret,\n },\n ctx,\n );\n }\n\n readonly id = id;\n override readonly credentials = entraIdCredentials;\n\n private accessToken: string | null = null;\n private accessTokenExpiry: number = 0;\n\n private tokenUrl(): string {\n return `https://${LOGIN_HOST}/${encodeURIComponent(this.settings.tenantId)}/oauth2/v2.0/token`;\n }\n\n private async refreshAccessToken(signal?: AbortSignal): Promise<string> {\n const body = new URLSearchParams({\n grant_type: 'client_credentials',\n client_id: this.creds.clientId,\n client_secret: this.creds.clientSecret,\n scope: `https://${GRAPH_HOST}/.default`,\n });\n const res = await this.post<OauthTokenResponse>(this.tokenUrl(), {\n resource: 'oauth_token',\n headers: {\n 'Content-Type': 'application/x-www-form-urlencoded',\n Accept: 'application/json',\n 'User-Agent': connectorUserAgent('entra-id'),\n },\n body: body.toString(),\n signal,\n });\n const token = res.body.access_token;\n const expiresIn = res.body.expires_in ?? 3600;\n this.accessToken = token;\n this.accessTokenExpiry = Date.now() + (expiresIn - 60) * 1000;\n return token;\n }\n\n private async getAccessToken(signal?: AbortSignal): Promise<string> {\n if (!this.accessToken || Date.now() >= this.accessTokenExpiry) {\n return this.refreshAccessToken(signal);\n }\n return this.accessToken;\n }\n\n private async apiGet<T>(\n url: string,\n resource: string,\n signal?: AbortSignal,\n retried = false,\n ): Promise<HttpResponse<T>> {\n const token = await this.getAccessToken(signal);\n const res = await this.get<T>(url, {\n resource,\n headers: {\n Authorization: `Bearer ${token}`,\n Accept: 'application/json',\n 'User-Agent': connectorUserAgent('entra-id'),\n },\n rateLimit: entraIdRateLimit,\n signal,\n });\n if (res.status === 401 && !retried) {\n this.accessToken = null;\n this.accessTokenExpiry = 0;\n return this.apiGet<T>(url, resource, signal, true);\n }\n return res;\n }\n\n private signinsSince(options: SyncOptions): string {\n if (options.since) {\n return options.since;\n }\n const lookback =\n this.settings.signinsLookbackDays ?? DEFAULT_SIGNINS_LOOKBACK_DAYS;\n const since = new Date(Date.now() - lookback * 24 * 60 * 60 * 1000);\n return since.toISOString();\n }\n\n private buildInitialUrl(phase: EntraIdPhase, options: SyncOptions): string {\n const u = new URL(`https://${GRAPH_HOST}${pageRequestPath(phase)}`);\n switch (phase) {\n case 'users':\n u.searchParams.set(\n '$select',\n 'id,displayName,userPrincipalName,mail,accountEnabled,userType,createdDateTime',\n );\n u.searchParams.set('$top', String(USERS_PAGE_SIZE));\n return u.toString();\n case 'signins': {\n const since = this.signinsSince(options);\n u.searchParams.set('$filter', `createdDateTime ge ${since}`);\n u.searchParams.set('$orderby', 'createdDateTime asc');\n u.searchParams.set('$top', String(SIGNINS_PAGE_SIZE));\n return u.toString();\n }\n case 'risky_users':\n u.searchParams.set('$top', String(RISKY_USERS_PAGE_SIZE));\n return u.toString();\n }\n }\n\n private async fetchPhasePage(\n phase: EntraIdPhase,\n page: string | null,\n options: SyncOptions,\n signal: AbortSignal | undefined,\n ): Promise<{ items: unknown[]; next: string | null }> {\n const url = page ?? this.buildInitialUrl(phase, options);\n switch (phase) {\n case 'users': {\n const res = await this.apiGet<UsersResponse>(url, 'users', signal);\n const next = sanitizeGraphUrl(\n res.body['@odata.nextLink'] ?? null,\n phase,\n );\n return { items: res.body.value, next };\n }\n case 'signins': {\n const res = await this.apiGet<SigninsResponse>(url, 'signins', signal);\n const next = sanitizeGraphUrl(\n res.body['@odata.nextLink'] ?? null,\n phase,\n );\n return { items: res.body.value, next };\n }\n case 'risky_users': {\n const res = await this.apiGet<RiskyUsersResponse>(\n url,\n 'risky_users',\n signal,\n );\n const next = sanitizeGraphUrl(\n res.body['@odata.nextLink'] ?? null,\n phase,\n );\n return { items: res.body.value, next };\n }\n }\n }\n\n private async writeUsers(\n storage: StorageHandle,\n items: EntraUser[],\n ): Promise<void> {\n for (const u of items) {\n const createdMs = parseEpoch(u.createdDateTime ?? null, 'iso');\n await storage.entity({\n type: USER_ENTITY,\n id: u.id,\n attributes: {\n displayName: u.displayName ?? null,\n userPrincipalName: u.userPrincipalName ?? null,\n mail: u.mail ?? null,\n accountEnabled: u.accountEnabled ?? null,\n userType: u.userType ?? null,\n createdAt: createdMs,\n },\n updated_at: createdMs ?? 0,\n });\n }\n }\n\n private async writeSignins(\n storage: StorageHandle,\n items: EntraSignin[],\n sinceMs: number | null,\n ): Promise<void> {\n for (const s of items) {\n const ts = parseEpoch(s.createdDateTime, 'iso');\n if (ts === null) {\n continue;\n }\n if (sinceMs !== null && ts <= sinceMs) {\n continue;\n }\n const errorCode = s.status?.errorCode ?? null;\n await storage.event({\n name: SIGNIN_EVENT,\n start_ts: ts,\n end_ts: null,\n attributes: {\n signinId: s.id,\n status: signinStatus(errorCode),\n errorCode,\n failureReason: s.status?.failureReason ?? null,\n userId: s.userId ?? null,\n userPrincipalName: s.userPrincipalName ?? null,\n userDisplayName: s.userDisplayName ?? null,\n appId: s.appId ?? null,\n appDisplayName: s.appDisplayName ?? null,\n ipAddress: s.ipAddress ?? null,\n clientAppUsed: s.clientAppUsed ?? null,\n city: s.location?.city ?? null,\n state: s.location?.state ?? null,\n countryOrRegion: s.location?.countryOrRegion ?? null,\n riskLevel: s.riskLevelAggregated ?? null,\n riskLevelDuringSignIn: s.riskLevelDuringSignIn ?? null,\n riskState: s.riskState ?? null,\n riskDetail: s.riskDetail ?? null,\n conditionalAccessStatus: s.conditionalAccessStatus ?? null,\n },\n });\n }\n }\n\n private async writeRiskyUsers(\n storage: StorageHandle,\n items: EntraRiskyUser[],\n ): Promise<void> {\n for (const r of items) {\n const updatedMs = parseEpoch(r.riskLastUpdatedDateTime ?? null, 'iso');\n await storage.entity({\n type: RISKY_USER_ENTITY,\n id: r.id,\n attributes: {\n userPrincipalName: r.userPrincipalName ?? null,\n displayName: r.userDisplayName ?? null,\n riskLevel: r.riskLevel ?? null,\n riskState: r.riskState ?? null,\n riskDetail: r.riskDetail ?? null,\n riskLastUpdatedAt: updatedMs,\n isProcessing: r.isProcessing ?? null,\n isDeleted: r.isDeleted ?? null,\n },\n updated_at: updatedMs ?? 0,\n });\n }\n }\n\n private async writePhase(\n storage: StorageHandle,\n phase: EntraIdPhase,\n items: unknown[],\n sinceMs: number | null,\n ): Promise<void> {\n switch (phase) {\n case 'users':\n return this.writeUsers(storage, items as EntraUser[]);\n case 'signins':\n return this.writeSignins(storage, items as EntraSignin[], sinceMs);\n case 'risky_users':\n return this.writeRiskyUsers(storage, items as EntraRiskyUser[]);\n }\n }\n\n private async clearScopeOnFirstPage(\n storage: StorageHandle,\n phase: EntraIdPhase,\n isFull: boolean,\n ): Promise<void> {\n if (!isFull) {\n return;\n }\n switch (phase) {\n case 'users':\n await storage.entities([], { types: [USER_ENTITY] });\n return;\n case 'signins':\n await storage.events([], { names: [SIGNIN_EVENT] });\n return;\n case 'risky_users':\n await storage.entities([], { types: [RISKY_USER_ENTITY] });\n return;\n }\n }\n\n private resolveCursor(cursor: unknown): EntraIdSyncCursor | undefined {\n if (!isEntraIdSyncCursor(cursor)) {\n return undefined;\n }\n return {\n phase: cursor.phase,\n page: sanitizeGraphUrl(cursor.page, cursor.phase),\n };\n }\n\n async sync(\n options: SyncOptions,\n storage: StorageHandle,\n signal?: AbortSignal,\n ): Promise<SyncResult> {\n const cursor = this.resolveCursor(options.cursor);\n const isFull = options.mode === 'full';\n const sinceMsRaw = options.since ? Date.parse(options.since) : null;\n const sinceMs =\n sinceMsRaw !== null && Number.isFinite(sinceMsRaw) ? sinceMsRaw : null;\n\n const phases = selectActivePhases<EntraIdResource, EntraIdPhase>(\n (r) => r,\n PHASE_ORDER,\n this.settings.resources,\n );\n\n return paginateChunked<EntraIdPhase, string>({\n phases,\n cursor,\n signal,\n logger: this.logger,\n fetchPage: async (phase, page, sig) =>\n this.fetchPhasePage(phase, page, options, sig),\n writeBatch: async (phase, items, page) => {\n if (page === null) {\n await this.clearScopeOnFirstPage(storage, phase, isFull);\n }\n await this.writePhase(storage, phase, items, sinceMs);\n },\n });\n }\n}\n","import { EntraIdConnector } from './entra-id';\n\nexport {\n EntraIdConnector,\n entraIdResources as resources,\n configFields,\n doc,\n id,\n} from './entra-id';\nexport type { EntraIdResource, EntraIdSettings } from './entra-id';\nexport default EntraIdConnector;\n"],"mappings":";AEAO,IAAM,sBAAsB;AAE5B,IAAM,qBAAqB,qBAAqB,mBAAmB;AAEnE,SAAS,mBAAmB,aAA6B;AAC9D,SAAO,qBAAqB,WAAW,IAAI,mBAAmB;AAChE;AEUO,SAAS,wBACd,QACiB;AACjB,QAAM,EAAE,iBAAiB,aAAa,WAAW,gBAAgB,IAAI;AACrE,QAAM,aAAa,cAAc,MAAM,MAAO;AAC9C,SAAO;IACL,MAAM,GAAG;AACP,YAAM,eAAe,EAAE,IAAI,eAAe;AAC1C,UAAI,iBAAiB,QAAQ,aAAa,KAAK,MAAM,IAAI;AACvD,eAAO;MACT;AACA,YAAM,YAAY,OAAO,YAAY;AACrC,UAAI,CAAC,OAAO,SAAS,SAAS,GAAG;AAC/B,eAAO;MACT;AACA,YAAM,WAAW,EAAE,IAAI,WAAW;AAClC,UAAI,aAAa,MAAM;AACrB,YAAI,oBAAoB,QAAW;AACjC,iBAAO;QACT;AACA,eAAO;UACL;UACA,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe;QAChD;MACF;AACA,UAAI,SAAS,KAAK,MAAM,IAAI;AAC1B,eAAO;MACT;AACA,YAAM,QAAQ,OAAO,QAAQ;AAC7B,UAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GAAG;AACxC,eAAO;MACT;AACA,YAAM,UAAU,QAAQ;AACxB,UAAI,CAAC,OAAO,SAAS,OAAO,GAAG;AAC7B,eAAO;MACT;AACA,aAAO,EAAE,WAAW,SAAS,IAAI,KAAK,OAAO,EAAE;IACjD;EACF;AACF;AEhDO,SAAS,mBACd,SACe;AACf,QAAM,EAAE,KAAK,MAAM,UAAU,WAAW,SAAS,IAAI;AACrD,MAAI,QAAQ,MAAM;AAChB,WAAO;EACT;AACA,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,GAAG;AACrB,QAAI,EAAE,aAAa,YAAY,EAAE,SAAS,QAAQ,EAAE,aAAa,UAAU;AACzE,aAAO;IACT;AACA,WAAO,EAAE,SAAS;EACpB,QAAQ;AACN,WAAO;EACT;AACF;ACrBO,SAAS,WACd,OACA,MACe;AACf,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO;EACT;AACA,MAAI,SAAS,OAAO;AAClB,QAAI,OAAO,UAAU,UAAU;AAC7B,aAAO;IACT;AACA,UAAM,KAAK,IAAI,KAAK,KAAK,EAAE,QAAQ;AACnC,WAAO,OAAO,SAAS,EAAE,IAAI,KAAK;EACpC;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAAI;AACpD,WAAO;EACT;AACA,QAAM,IAAI,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK;AAC1D,MAAI,CAAC,OAAO,SAAS,CAAC,GAAG;AACvB,WAAO;EACT;AACA,QAAM,SAAS,SAAS,MAAM,IAAI,MAAO;AACzC,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;;;AGlBA;AAAA,EACE;AAAA,EAQA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS;AAElB,IAAM,aAAa;AACnB,IAAM,aAAa;AACnB,IAAM,cAAc;AAKpB,IAAM,oBAAoB;AAEnB,IAAM,eAAe;AAAA,EAC1B,EAAE,OAAO;AAAA,IACP,UAAU,EACP,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL;AAAA,MACC;AAAA,MACA;AAAA,IACF,EACC,KAAK;AAAA,MACJ,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,IACf,CAAC;AAAA,IACH,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,KAAK;AAAA,MAC/B,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,IACf,CAAC;AAAA,IACD,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK;AAAA,MAC1D,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,MACb,QAAQ;AAAA,IACV,CAAC;AAAA,IACD,WAAW,EACR,MAAM,EAAE,KAAK,CAAC,SAAS,WAAW,aAAa,CAAC,CAAC,EACjD,SAAS,EACT,SAAS,EACT,KAAK;AAAA,MACJ,OAAO;AAAA,MACP,aACE;AAAA,IACJ,CAAC;AAAA,IACH,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK;AAAA,MACvE,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,IACf,CAAC;AAAA,EACH,CAAC;AACH;AAEO,IAAM,MAAoB,mBAAmB;AAAA,EAClD,aAAa;AAAA,EACb,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,SACE;AAAA,EACF,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SACE;AAAA,EACJ;AAAA,EACA,MAAM;AAAA,IACJ,SACE;AAAA,IACF,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,WACE;AAAA,EACF,aAAa;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,CAAC;AAUD,IAAM,qBAAqB;AAAA,EACzB,UAAU;AAAA,IACR,aAAa;AAAA,IACb,MAAM;AAAA,EACR;AAAA,EACA,cAAc;AAAA,IACZ,aAAa;AAAA,IACb,MAAM;AAAA,EACR;AACF;AAIA,IAAM,mBAAmB,wBAAwB;AAAA,EAC/C,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,WAAW;AACb,CAAC;AAED,IAAM,cAAc,CAAC,SAAS,WAAW,aAAa;AAMtD,IAAM,sBAAsB,uBAAuB,WAAW;AAE9D,IAAM,cAAc;AACpB,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAE1B,IAAM,kBAAkB;AACxB,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,gCAAgC;AAEtC,IAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAED,IAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,QAAQ;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,QAAQ;AAAA,EACzB,gBAAgB,EAAE,QAAQ,EAAE,QAAQ;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AACtC,CAAC;AAED,IAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,OAAO,EAAE,MAAM,UAAU;AAC3B,CAAC;AAED,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,QAAQ;AAAA,EAClC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AACxC,CAAC;AAED,IAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,QAAQ;AAAA,EACzB,OAAO,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC1B,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AACtC,CAAC;AAED,IAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACpC,OAAO,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,QAAQ;AAAA,EAClC,yBAAyB,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC5C,qBAAqB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACxC,uBAAuB,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC/B,QAAQ,mBAAmB,QAAQ;AAAA,EACnC,UAAU,qBAAqB,QAAQ;AACzC,CAAC;AAED,IAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,OAAO,EAAE,MAAM,YAAY;AAC7B,CAAC;AAED,IAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC/B,yBAAyB,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC5C,cAAc,EAAE,QAAQ,EAAE,QAAQ;AAAA,EAClC,WAAW,EAAE,QAAQ,EAAE,QAAQ;AACjC,CAAC;AAED,IAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,mBAAmB,EAAE,OAAO,EAAE,QAAQ;AAAA,EACtC,OAAO,EAAE,MAAM,eAAe;AAChC,CAAC;AAEM,IAAM,mBAAmB,gBAAgB;AAAA,EAC9C,CAAC,WAAW,GAAG;AAAA,IACb,OAAO;AAAA,IACP,YAAY;AAAA,MACV,EAAE,OAAO,kBAAkB,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,OAAO,EAAE;AAAA,MAClE;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ,CAAC,UAAU,OAAO;AAAA,MAC5B;AAAA,IACF;AAAA,IACA,aACE;AAAA,IACF,UAAU;AAAA,IACV,OACE;AAAA,IACF,QAAQ;AAAA,MACN,EAAE,MAAM,eAAe,aAAa,mCAAmC;AAAA,MACvE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,QAAQ,aAAa,sCAAsC;AAAA,MACnE;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,CAAC,YAAY,GAAG;AAAA,IACd,OAAO;AAAA,IACP,YAAY;AAAA,MACV,EAAE,OAAO,UAAU,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,WAAW,SAAS,EAAE;AAAA,MAC/D;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,OAAO,kBAAkB,KAAK,CAAC,IAAI,EAAE;AAAA,IACzC;AAAA,IACA,aACE;AAAA,IACF,UAAU;AAAA,IACV,OACE;AAAA,IACF,QAAQ;AAAA,MACN;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,MACnE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,SAAS,aAAa,uCAAuC;AAAA,MACrE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,aAAa,aAAa,+BAA+B;AAAA,MACjE;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,IACF;AAAA,IACA,WAAW,EAAE,SAAS,sBAAsB;AAAA,EAC9C;AAAA,EACA,CAAC,iBAAiB,GAAG;AAAA,IACnB,OAAO;AAAA,IACP,YAAY;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ,CAAC,OAAO,UAAU,QAAQ,UAAU,oBAAoB;AAAA,MAClE;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK,CAAC,IAAI;AAAA,QACV,QAAQ;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,aACE;AAAA,IACF,UAAU;AAAA,IACV,OACE;AAAA,IACF,QAAQ;AAAA,MACN;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,EAAE,MAAM,eAAe,aAAa,kCAAkC;AAAA,MACtE;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,WAAW,EAAE,aAAa,yBAAyB;AAAA,EACrD;AACF,CAAC;AAEM,IAAM,KAAK;AAUlB,SAAS,aACP,WACuB;AACvB,SAAO,cAAc,KAAK,cAAc,QAAQ,cAAc,SAC1D,YACA;AACN;AAEA,SAAS,gBAAgB,OAA6B;AACpD,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO,IAAI,WAAW;AAAA,IACxB,KAAK;AACH,aAAO,IAAI,WAAW;AAAA,IACxB,KAAK;AACH,aAAO,IAAI,WAAW;AAAA,EAC1B;AACF;AAEA,SAAS,iBACP,KACA,OACe;AACf,SAAO,mBAAmB;AAAA,IACxB;AAAA,IACA,MAAM;AAAA,IACN,UAAU,gBAAgB,KAAK;AAAA,EACjC,CAAC;AACH;AAEO,IAAM,mBAAN,MAAM,0BAAyB,cAGpC;AAAA,EACA,OAAgB,KAAK;AAAA,EAErB,OAAgB,YAAY;AAAA,EAE5B,OAAgB,UAAU,qBAAqB,gBAAgB;AAAA,EAE/D,OAAO,OAAO,OAAgB,KAA0C;AACtE,UAAM,SAAS,aAAa,MAAM,KAAK;AACvC,WAAO,IAAI;AAAA,MACT;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,qBAAqB,OAAO;AAAA,MAC9B;AAAA,MACA;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,cAAc,OAAO;AAAA,MACvB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAES,KAAK;AAAA,EACI,cAAc;AAAA,EAExB,cAA6B;AAAA,EAC7B,oBAA4B;AAAA,EAE5B,WAAmB;AACzB,WAAO,WAAW,UAAU,IAAI,mBAAmB,KAAK,SAAS,QAAQ,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAc,mBAAmB,QAAuC;AACtE,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MACZ,WAAW,KAAK,MAAM;AAAA,MACtB,eAAe,KAAK,MAAM;AAAA,MAC1B,OAAO,WAAW,UAAU;AAAA,IAC9B,CAAC;AACD,UAAM,MAAM,MAAM,KAAK,KAAyB,KAAK,SAAS,GAAG;AAAA,MAC/D,UAAU;AAAA,MACV,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,cAAc,mBAAmB,UAAU;AAAA,MAC7C;AAAA,MACA,MAAM,KAAK,SAAS;AAAA,MACpB;AAAA,IACF,CAAC;AACD,UAAM,QAAQ,IAAI,KAAK;AACvB,UAAM,YAAY,IAAI,KAAK,cAAc;AACzC,SAAK,cAAc;AACnB,SAAK,oBAAoB,KAAK,IAAI,KAAK,YAAY,MAAM;AACzD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,eAAe,QAAuC;AAClE,QAAI,CAAC,KAAK,eAAe,KAAK,IAAI,KAAK,KAAK,mBAAmB;AAC7D,aAAO,KAAK,mBAAmB,MAAM;AAAA,IACvC;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,OACZ,KACA,UACA,QACA,UAAU,OACgB;AAC1B,UAAM,QAAQ,MAAM,KAAK,eAAe,MAAM;AAC9C,UAAM,MAAM,MAAM,KAAK,IAAO,KAAK;AAAA,MACjC;AAAA,MACA,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,QAAQ;AAAA,QACR,cAAc,mBAAmB,UAAU;AAAA,MAC7C;AAAA,MACA,WAAW;AAAA,MACX;AAAA,IACF,CAAC;AACD,QAAI,IAAI,WAAW,OAAO,CAAC,SAAS;AAClC,WAAK,cAAc;AACnB,WAAK,oBAAoB;AACzB,aAAO,KAAK,OAAU,KAAK,UAAU,QAAQ,IAAI;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA8B;AACjD,QAAI,QAAQ,OAAO;AACjB,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,WACJ,KAAK,SAAS,uBAAuB;AACvC,UAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW,KAAK,KAAK,KAAK,GAAI;AAClE,WAAO,MAAM,YAAY;AAAA,EAC3B;AAAA,EAEQ,gBAAgB,OAAqB,SAA8B;AACzE,UAAM,IAAI,IAAI,IAAI,WAAW,UAAU,GAAG,gBAAgB,KAAK,CAAC,EAAE;AAClE,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,UAAE,aAAa;AAAA,UACb;AAAA,UACA;AAAA,QACF;AACA,UAAE,aAAa,IAAI,QAAQ,OAAO,eAAe,CAAC;AAClD,eAAO,EAAE,SAAS;AAAA,MACpB,KAAK,WAAW;AACd,cAAM,QAAQ,KAAK,aAAa,OAAO;AACvC,UAAE,aAAa,IAAI,WAAW,sBAAsB,KAAK,EAAE;AAC3D,UAAE,aAAa,IAAI,YAAY,qBAAqB;AACpD,UAAE,aAAa,IAAI,QAAQ,OAAO,iBAAiB,CAAC;AACpD,eAAO,EAAE,SAAS;AAAA,MACpB;AAAA,MACA,KAAK;AACH,UAAE,aAAa,IAAI,QAAQ,OAAO,qBAAqB,CAAC;AACxD,eAAO,EAAE,SAAS;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAc,eACZ,OACA,MACA,SACA,QACoD;AACpD,UAAM,MAAM,QAAQ,KAAK,gBAAgB,OAAO,OAAO;AACvD,YAAQ,OAAO;AAAA,MACb,KAAK,SAAS;AACZ,cAAM,MAAM,MAAM,KAAK,OAAsB,KAAK,SAAS,MAAM;AACjE,cAAM,OAAO;AAAA,UACX,IAAI,KAAK,iBAAiB,KAAK;AAAA,UAC/B;AAAA,QACF;AACA,eAAO,EAAE,OAAO,IAAI,KAAK,OAAO,KAAK;AAAA,MACvC;AAAA,MACA,KAAK,WAAW;AACd,cAAM,MAAM,MAAM,KAAK,OAAwB,KAAK,WAAW,MAAM;AACrE,cAAM,OAAO;AAAA,UACX,IAAI,KAAK,iBAAiB,KAAK;AAAA,UAC/B;AAAA,QACF;AACA,eAAO,EAAE,OAAO,IAAI,KAAK,OAAO,KAAK;AAAA,MACvC;AAAA,MACA,KAAK,eAAe;AAClB,cAAM,MAAM,MAAM,KAAK;AAAA,UACrB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,cAAM,OAAO;AAAA,UACX,IAAI,KAAK,iBAAiB,KAAK;AAAA,UAC/B;AAAA,QACF;AACA,eAAO,EAAE,OAAO,IAAI,KAAK,OAAO,KAAK;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,WACZ,SACA,OACe;AACf,eAAW,KAAK,OAAO;AACrB,YAAM,YAAY,WAAW,EAAE,mBAAmB,MAAM,KAAK;AAC7D,YAAM,QAAQ,OAAO;AAAA,QACnB,MAAM;AAAA,QACN,IAAI,EAAE;AAAA,QACN,YAAY;AAAA,UACV,aAAa,EAAE,eAAe;AAAA,UAC9B,mBAAmB,EAAE,qBAAqB;AAAA,UAC1C,MAAM,EAAE,QAAQ;AAAA,UAChB,gBAAgB,EAAE,kBAAkB;AAAA,UACpC,UAAU,EAAE,YAAY;AAAA,UACxB,WAAW;AAAA,QACb;AAAA,QACA,YAAY,aAAa;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,SACA,OACA,SACe;AACf,eAAW,KAAK,OAAO;AACrB,YAAM,KAAK,WAAW,EAAE,iBAAiB,KAAK;AAC9C,UAAI,OAAO,MAAM;AACf;AAAA,MACF;AACA,UAAI,YAAY,QAAQ,MAAM,SAAS;AACrC;AAAA,MACF;AACA,YAAM,YAAY,EAAE,QAAQ,aAAa;AACzC,YAAM,QAAQ,MAAM;AAAA,QAClB,MAAM;AAAA,QACN,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,YAAY;AAAA,UACV,UAAU,EAAE;AAAA,UACZ,QAAQ,aAAa,SAAS;AAAA,UAC9B;AAAA,UACA,eAAe,EAAE,QAAQ,iBAAiB;AAAA,UAC1C,QAAQ,EAAE,UAAU;AAAA,UACpB,mBAAmB,EAAE,qBAAqB;AAAA,UAC1C,iBAAiB,EAAE,mBAAmB;AAAA,UACtC,OAAO,EAAE,SAAS;AAAA,UAClB,gBAAgB,EAAE,kBAAkB;AAAA,UACpC,WAAW,EAAE,aAAa;AAAA,UAC1B,eAAe,EAAE,iBAAiB;AAAA,UAClC,MAAM,EAAE,UAAU,QAAQ;AAAA,UAC1B,OAAO,EAAE,UAAU,SAAS;AAAA,UAC5B,iBAAiB,EAAE,UAAU,mBAAmB;AAAA,UAChD,WAAW,EAAE,uBAAuB;AAAA,UACpC,uBAAuB,EAAE,yBAAyB;AAAA,UAClD,WAAW,EAAE,aAAa;AAAA,UAC1B,YAAY,EAAE,cAAc;AAAA,UAC5B,yBAAyB,EAAE,2BAA2B;AAAA,QACxD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,gBACZ,SACA,OACe;AACf,eAAW,KAAK,OAAO;AACrB,YAAM,YAAY,WAAW,EAAE,2BAA2B,MAAM,KAAK;AACrE,YAAM,QAAQ,OAAO;AAAA,QACnB,MAAM;AAAA,QACN,IAAI,EAAE;AAAA,QACN,YAAY;AAAA,UACV,mBAAmB,EAAE,qBAAqB;AAAA,UAC1C,aAAa,EAAE,mBAAmB;AAAA,UAClC,WAAW,EAAE,aAAa;AAAA,UAC1B,WAAW,EAAE,aAAa;AAAA,UAC1B,YAAY,EAAE,cAAc;AAAA,UAC5B,mBAAmB;AAAA,UACnB,cAAc,EAAE,gBAAgB;AAAA,UAChC,WAAW,EAAE,aAAa;AAAA,QAC5B;AAAA,QACA,YAAY,aAAa;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,WACZ,SACA,OACA,OACA,SACe;AACf,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,KAAK,WAAW,SAAS,KAAoB;AAAA,MACtD,KAAK;AACH,eAAO,KAAK,aAAa,SAAS,OAAwB,OAAO;AAAA,MACnE,KAAK;AACH,eAAO,KAAK,gBAAgB,SAAS,KAAyB;AAAA,IAClE;AAAA,EACF;AAAA,EAEA,MAAc,sBACZ,SACA,OACA,QACe;AACf,QAAI,CAAC,QAAQ;AACX;AAAA,IACF;AACA,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,cAAM,QAAQ,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;AACnD;AAAA,MACF,KAAK;AACH,cAAM,QAAQ,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;AAClD;AAAA,MACF,KAAK;AACH,cAAM,QAAQ,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;AACzD;AAAA,IACJ;AAAA,EACF;AAAA,EAEQ,cAAc,QAAgD;AACpE,QAAI,CAAC,oBAAoB,MAAM,GAAG;AAChC,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd,MAAM,iBAAiB,OAAO,MAAM,OAAO,KAAK;AAAA,IAClD;AAAA,EACF;AAAA,EAEA,MAAM,KACJ,SACA,SACA,QACqB;AACrB,UAAM,SAAS,KAAK,cAAc,QAAQ,MAAM;AAChD,UAAM,SAAS,QAAQ,SAAS;AAChC,UAAM,aAAa,QAAQ,QAAQ,KAAK,MAAM,QAAQ,KAAK,IAAI;AAC/D,UAAM,UACJ,eAAe,QAAQ,OAAO,SAAS,UAAU,IAAI,aAAa;AAEpE,UAAM,SAAS;AAAA,MACb,CAAC,MAAM;AAAA,MACP;AAAA,MACA,KAAK,SAAS;AAAA,IAChB;AAEA,WAAO,gBAAsC;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,WAAW,OAAO,OAAO,MAAM,QAC7B,KAAK,eAAe,OAAO,MAAM,SAAS,GAAG;AAAA,MAC/C,YAAY,OAAO,OAAO,OAAO,SAAS;AACxC,YAAI,SAAS,MAAM;AACjB,gBAAM,KAAK,sBAAsB,SAAS,OAAO,MAAM;AAAA,QACzD;AACA,cAAM,KAAK,WAAW,SAAS,OAAO,OAAO,OAAO;AAAA,MACtD;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;ACrwBA,IAAO,gBAAQ;","names":[]}

package/package.json ADDED Viewed

@@ -0,0 +1,43 @@
+{
+  "name": "@rawdash/connector-entra-id",
+  "version": "0.1.0",
+  "description": "Rawdash connector for Microsoft Entra ID (formerly Azure AD) — syncs users, sign-in events, and risky users from Microsoft Graph into the six-shape storage model",
+  "license": "Apache-2.0",
+  "type": "module",
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rawdash/rawdash.git",
+    "directory": "packages/connectors/entra-id"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "@rawdash/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@rawdash/core": "workspace:*",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@rawdash/connector-shared": "workspace:*",
+    "@rawdash/connector-test-utils": "workspace:*",
+    "fast-check": "^4.8.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.7.2",
+    "vitest": "^4.1.4"
+  }
+}