@vibesdotdev/integrations-microsoft 0.0.0-stage → 1.0.0-rc.0

package/dist/microsoft/system.integration.microsoft.delegated.descriptor.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Delegated-OAuth Microsoft 365 descriptor.
+ *
+ * Sibling of `integration.microsoft` (app-only). The runtime-client
+ * surface (`getVibesMicrosoftClient(runtime)`) defaults to this variant so
+ * Graph calls run on behalf of the signed-in user, reading their
+ * OneDrive / SharePoint with their own tenant permissions instead of
+ * the Sites.Selected app-only grant.
+ *
+ * Tokens remain with the identity owner. The registered provider hands
+ * Secrets an OAuth-account reference, and Secrets applies the current access
+ * token to each Graph request without returning it to this package.
+ *
+ * Refresh and disconnect remain owned by Better Auth's `offline_access`
+ * lifecycle; this descriptor does not store or return tokens.
+ */
+declare const _default: {
+    id: string;
+    kind: "integration/provider";
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    capabilityId?: string | undefined;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    provider?: string | undefined;
+    category?: "push" | "webhook" | "accounting" | "vcs" | "issue-tracker" | "productivity" | "ocr" | "email" | "messaging" | "sms" | "storage" | "analytics" | "observability" | "crm" | "calendar" | "other" | undefined;
+    priority?: number | undefined;
+    baseUrl?: string | undefined;
+    config?: Record<string, import("@vibesdotdev/kernel/bootstrap").JsonValue> | undefined;
+    protectedConfigKeys?: string[] | undefined;
+    configurationSource?: "account" | "host" | undefined;
+    configSettingKey?: string | undefined;
+    credentials?: {
+        key: string;
+        source: "secret" | "setting";
+        reference?: {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        } | undefined;
+        providerType?: string | undefined;
+        scope?: "user" | "platform" | "project" | "org" | undefined;
+        scopeId?: string | undefined;
+        settingKey?: string | undefined;
+        required?: boolean | undefined;
+    }[] | undefined;
+    oauth?: {
+        authorizationEndpoint: string;
+        tokenEndpoint: string;
+        scopes?: string[] | undefined;
+        authorizationParams?: Record<string, string> | undefined;
+        configFromCallback?: string[] | undefined;
+        clientAuthentication?: "form" | "basic" | undefined;
+        bodyEncoding?: "form" | "json" | undefined;
+        headers?: Record<string, string> | undefined;
+        scopeIdCallbackParam?: string | undefined;
+    } | undefined;
+    operations?: {
+        id: string;
+        name: string;
+        description?: string | undefined;
+        requiresOrg?: boolean | undefined;
+    }[] | undefined;
+    connection?: {
+        authMode?: "delegated" | "oauth" | "webhook" | "system-config" | undefined;
+        connectable?: boolean | undefined;
+        checkable?: boolean | undefined;
+        requiresProviderAdmin?: boolean | undefined;
+    } | undefined;
+};
+export default _default;
+//# sourceMappingURL=system.integration.microsoft.delegated.descriptor.d.ts.map

package/dist/microsoft/system.integration.microsoft.delegated.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.integration.microsoft.delegated.descriptor.d.ts","sourceRoot":"","sources":["../../src/microsoft/system.integration.microsoft.delegated.descriptor.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACH,wBAkGG"}

package/dist/microsoft/system.integration.microsoft.delegated.descriptor.js

@@ -0,0 +1,109 @@
+import { oauthDefaultAccountCredentialReference } from '@vibesdotdev/auth';
+import { createRuntimeAsset } from '@vibesdotdev/kernel/factory';
+/**
+ * Delegated-OAuth Microsoft 365 descriptor.
+ *
+ * Sibling of `integration.microsoft` (app-only). The runtime-client
+ * surface (`getVibesMicrosoftClient(runtime)`) defaults to this variant so
+ * Graph calls run on behalf of the signed-in user, reading their
+ * OneDrive / SharePoint with their own tenant permissions instead of
+ * the Sites.Selected app-only grant.
+ *
+ * Tokens remain with the identity owner. The registered provider hands
+ * Secrets an OAuth-account reference, and Secrets applies the current access
+ * token to each Graph request without returning it to this package.
+ *
+ * Refresh and disconnect remain owned by Better Auth's `offline_access`
+ * lifecycle; this descriptor does not store or return tokens.
+ */
+export default createRuntimeAsset({
+    kind: 'integration/provider',
+    id: 'integration.microsoft.delegated',
+    name: 'Microsoft 365 (Delegated)',
+    description: 'Microsoft 365 integration that acts on behalf of the signed-in user, sourcing access + refresh tokens from the auth-web identity provider account record.',
+    provider: 'microsoft',
+    category: 'productivity',
+    enabled: true,
+    priority: 95,
+    requiredContext: ['userId', 'authInternalClient'],
+    optionalContext: ['orgId'],
+    baseUrl: 'https://graph.microsoft.com/v1.0',
+    config: {
+        scopes: ['Files.Read.All', 'Sites.Read.All', 'offline_access']
+    },
+    credentials: [
+        {
+            key: 'accessToken',
+            source: 'secret',
+            reference: oauthDefaultAccountCredentialReference({ providerId: 'microsoft' }),
+            required: true
+        },
+        {
+            key: 'refreshToken',
+            source: 'secret',
+            // Auth refreshes this credential; the feature supplies no refresh-token reference.
+            required: false
+        }
+    ],
+    operations: [
+        {
+            id: 'listSites',
+            name: 'List SharePoint sites',
+            description: "List SharePoint sites the signed-in user has access to (their own tenant permissions).",
+            requiresOrg: true
+        },
+        {
+            id: 'browseDrive',
+            name: 'Browse drive folder',
+            description: "List children of a folder (or root) in a SharePoint site's default drive, scoped to the signed-in user. " +
+                'Args: `{ siteId: string; folderPath?: string }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'browseDriveItem',
+            name: 'Browse drive item folder',
+            description: 'List children of a SharePoint/OneDrive folder by stable drive item id, scoped to the signed-in user. ' +
+                'Use this with item ids returned by storage.search or storage.browse. Args: `{ siteId: string; itemId: string }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'searchDrive',
+            name: 'Search drive (recursive)',
+            description: 'Recursively search a SharePoint site (or all visible sites + OneDrive when ' +
+                'siteId is omitted) for files/folders matching a query, at ANY depth, scoped ' +
+                "to the signed-in user. Finds deeply-nested files browse can't reach. " +
+                'Args: `{ query: string; siteId?: string; scopePath?: string; limit?: number }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'getDownloadUrl',
+            name: 'Get drive item download URL',
+            description: 'Return a temporary pre-authenticated download URL for a drive item, scoped to the signed-in user. ' +
+                'Args: `{ siteId: string; itemId: string }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'uploadFile',
+            name: 'Upload file',
+            description: 'Upload bytes to a path in a SharePoint site drive (simple or resumable), scoped to the signed-in user. ' +
+                'Args: `{ siteId: string; path: string; contentBase64: string; contentType?: string }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'createFolder',
+            name: 'Create folder',
+            description: 'Create a folder in a SharePoint site drive, scoped to the signed-in user. ' +
+                'Args: `{ siteId: string; name: string; parentPath?: string }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'deleteItem',
+            name: 'Delete drive item',
+            description: 'Delete a file or folder in a SharePoint site drive by item id, scoped to the signed-in user. ' +
+                'Args: `{ siteId: string; itemId: string }`.',
+            requiresOrg: true
+        }
+    ],
+    tags: ['system', 'integration', 'microsoft', 'graph', 'sharepoint', 'onedrive', 'delegated']
+});
+//# sourceMappingURL=system.integration.microsoft.delegated.descriptor.js.map

package/dist/microsoft/system.integration.microsoft.delegated.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.integration.microsoft.delegated.descriptor.js","sourceRoot":"","sources":["../../src/microsoft/system.integration.microsoft.delegated.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sCAAsC,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE;;;;;;;;;;;;;;;GAeG;AACH,eAAe,kBAAkB,CAAqC;IACrE,IAAI,EAAE,sBAAsB;IAC5B,EAAE,EAAE,iCAAiC;IACrC,IAAI,EAAE,2BAA2B;IACjC,WAAW,EACV,2JAA2J;IAC5J,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,EAAE;IACZ,eAAe,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACjD,eAAe,EAAE,CAAC,OAAO,CAAC;IAC1B,OAAO,EAAE,kCAAkC;IAC3C,MAAM,EAAE;QACP,MAAM,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;KAC9D;IACD,WAAW,EAAE;QACZ;YACC,GAAG,EAAE,aAAa;YAClB,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,sCAAsC,CAAC,EAAC,UAAU,EAAC,WAAW,EAAC,CAAC;YAC3E,QAAQ,EAAE,IAAI;SACd;QACD;YACC,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,QAAQ;YAChB,mFAAmF;YACnF,QAAQ,EAAE,KAAK;SACf;KACD;IACD,UAAU,EAAE;QACX;YACC,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EACV,wFAAwF;YACzF,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EACV,0GAA0G;gBAC1G,kDAAkD;YACnD,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,0BAA0B;YAChC,WAAW,EACV,uGAAuG;gBACvG,kHAAkH;YACnH,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,0BAA0B;YAChC,WAAW,EACV,6EAA6E;gBAC7E,8EAA8E;gBAC9E,uEAAuE;gBACvE,iFAAiF;YAClF,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,6BAA6B;YACnC,WAAW,EACV,oGAAoG;gBACpG,6CAA6C;YAC9C,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,aAAa;YACnB,WAAW,EACV,yGAAyG;gBACzG,wFAAwF;YACzF,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,eAAe;YACrB,WAAW,EACV,4EAA4E;gBAC5E,gEAAgE;YACjE,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EACV,+FAA+F;gBAC/F,6CAA6C;YAC9C,WAAW,EAAE,IAAI;SACjB;KACD;IACD,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,CAAC;CAC5F,CAAC,CAAC"}

package/dist/microsoft/system.integration.microsoft.descriptor.d.ts

@@ -0,0 +1,69 @@
+declare const _default: {
+    id: string;
+    kind: "integration/provider";
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    capabilityId?: string | undefined;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    provider?: string | undefined;
+    category?: "push" | "webhook" | "accounting" | "vcs" | "issue-tracker" | "productivity" | "ocr" | "email" | "messaging" | "sms" | "storage" | "analytics" | "observability" | "crm" | "calendar" | "other" | undefined;
+    priority?: number | undefined;
+    baseUrl?: string | undefined;
+    config?: Record<string, import("@vibesdotdev/kernel/bootstrap").JsonValue> | undefined;
+    protectedConfigKeys?: string[] | undefined;
+    configurationSource?: "account" | "host" | undefined;
+    configSettingKey?: string | undefined;
+    credentials?: {
+        key: string;
+        source: "secret" | "setting";
+        reference?: {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        } | undefined;
+        providerType?: string | undefined;
+        scope?: "user" | "platform" | "project" | "org" | undefined;
+        scopeId?: string | undefined;
+        settingKey?: string | undefined;
+        required?: boolean | undefined;
+    }[] | undefined;
+    oauth?: {
+        authorizationEndpoint: string;
+        tokenEndpoint: string;
+        scopes?: string[] | undefined;
+        authorizationParams?: Record<string, string> | undefined;
+        configFromCallback?: string[] | undefined;
+        clientAuthentication?: "form" | "basic" | undefined;
+        bodyEncoding?: "form" | "json" | undefined;
+        headers?: Record<string, string> | undefined;
+        scopeIdCallbackParam?: string | undefined;
+    } | undefined;
+    operations?: {
+        id: string;
+        name: string;
+        description?: string | undefined;
+        requiresOrg?: boolean | undefined;
+    }[] | undefined;
+    connection?: {
+        authMode?: "delegated" | "oauth" | "webhook" | "system-config" | undefined;
+        connectable?: boolean | undefined;
+        checkable?: boolean | undefined;
+        requiresProviderAdmin?: boolean | undefined;
+    } | undefined;
+};
+export default _default;
+//# sourceMappingURL=system.integration.microsoft.descriptor.d.ts.map

package/dist/microsoft/system.integration.microsoft.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.integration.microsoft.descriptor.d.ts","sourceRoot":"","sources":["../../src/microsoft/system.integration.microsoft.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,wBAwHG"}

package/dist/microsoft/system.integration.microsoft.descriptor.js

@@ -0,0 +1,114 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel/factory';
+export default createRuntimeAsset({
+    kind: 'integration/provider',
+    id: 'integration.microsoft',
+    name: 'Microsoft 365',
+    description: 'Microsoft 365 integration using Secrets-owned client credentials for app-only access to Graph API, SharePoint, and OneDrive.',
+    provider: 'microsoft',
+    category: 'productivity',
+    enabled: true,
+    priority: 90,
+    // App-only credentials resolve PER-ORG (the consented tenant). The runtime
+    // must inject the calling org/user so `MicrosoftIntegration` can resolve the
+    // right tenant per request — without this the context orgId is undefined and
+    // the env (home) tenant leaks to every org (cross-org bleed, cf. ac19f2688).
+    optionalContext: ['orgId', 'userId'],
+    baseUrl: 'https://graph.microsoft.com/v1.0',
+    configSettingKey: 'integrations.microsoft.config',
+    config: {
+        tenantId: '',
+        scopes: ['https://graph.microsoft.com/.default']
+    },
+    credentials: [
+        // The managed organization credential wins when present; the shared
+        // application references are fallback candidates. The tenant fallback is
+        // restricted to the configured home organization by the provider.
+        {
+            key: 'clientId',
+            source: 'secret',
+            providerType: 'microsoft',
+            scope: 'org',
+            reference: { source: 'secret', key: 'VIBES_AUTH_MICROSOFT_CLIENT_ID' },
+            required: true
+        },
+        {
+            key: 'clientSecret',
+            source: 'secret',
+            providerType: 'microsoft',
+            scope: 'org',
+            reference: { source: 'secret', key: 'VIBES_AUTH_MICROSOFT_CLIENT_SECRET' },
+            required: true
+        },
+        {
+            key: 'tenantId',
+            source: 'secret',
+            providerType: 'microsoft',
+            scope: 'org',
+            reference: { source: 'secret', key: 'VIBES_AUTH_MICROSOFT_TENANT_ID' },
+            required: true
+        }
+    ],
+    operations: [
+        {
+            id: 'listSites',
+            name: 'List SharePoint sites',
+            description: 'List SharePoint sites visible to the integration. App-only requires the ' +
+                'Sites.Read.All APPLICATION permission (Sites.Selected is insufficient for ' +
+                'the `GET /sites?search=*` enumeration the explorer relies on).',
+            requiresOrg: true
+        },
+        {
+            id: 'browseDrive',
+            name: 'Browse drive folder',
+            description: "List children of a folder (or root) in a SharePoint site's default drive. " +
+                'Args: `{ siteId: string; folderPath?: string }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'browseDriveItem',
+            name: 'Browse drive item folder',
+            description: 'List children of a SharePoint/OneDrive folder by stable drive item id. ' +
+                'Use this with item ids returned by storage.search or storage.browse. Args: `{ siteId: string; itemId: string }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'searchDrive',
+            name: 'Search drive (recursive)',
+            description: 'Recursively search a SharePoint site (or all visible sites when siteId ' +
+                'is omitted) for files/folders matching a query, at ANY depth, via Graph ' +
+                "`drive/root/search(q=...)`. Finds deeply-nested files browse can't reach. " +
+                'Args: `{ query: string; siteId?: string; scopePath?: string; limit?: number }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'getDownloadUrl',
+            name: 'Get drive item download URL',
+            description: 'Return a temporary pre-authenticated download URL for a drive item. ' +
+                'Args: `{ siteId: string; itemId: string }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'uploadFile',
+            name: 'Upload file',
+            description: 'Upload bytes to a path in a SharePoint site drive (simple or resumable). ' +
+                'Args: `{ siteId: string; path: string; contentBase64: string; contentType?: string }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'createFolder',
+            name: 'Create folder',
+            description: 'Create a folder in a SharePoint site drive. ' +
+                'Args: `{ siteId: string; name: string; parentPath?: string }`.',
+            requiresOrg: true
+        },
+        {
+            id: 'deleteItem',
+            name: 'Delete drive item',
+            description: 'Delete a file or folder in a SharePoint site drive by item id. ' +
+                'Args: `{ siteId: string; itemId: string }`.',
+            requiresOrg: true
+        }
+    ],
+    tags: ['system', 'integration', 'microsoft', 'graph', 'sharepoint', 'onedrive']
+});
+//# sourceMappingURL=system.integration.microsoft.descriptor.js.map

package/dist/microsoft/system.integration.microsoft.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.integration.microsoft.descriptor.js","sourceRoot":"","sources":["../../src/microsoft/system.integration.microsoft.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE,eAAe,kBAAkB,CAAqC;IACrE,IAAI,EAAE,sBAAsB;IAC5B,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,eAAe;IACrB,WAAW,EACV,8HAA8H;IAC/H,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,EAAE;IACZ,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,eAAe,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;IACpC,OAAO,EAAE,kCAAkC;IAC3C,gBAAgB,EAAE,+BAA+B;IACjD,MAAM,EAAE;QACP,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,CAAC,sCAAsC,CAAC;KAChD;IACD,WAAW,EAAE;QACZ,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE;YACC,GAAG,EAAE,UAAU;YACf,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,gCAAgC,EAAE;YACtE,QAAQ,EAAE,IAAI;SACd;QACD;YACC,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,oCAAoC,EAAE;YAC1E,QAAQ,EAAE,IAAI;SACd;QACD;YACC,GAAG,EAAE,UAAU;YACf,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,gCAAgC,EAAE;YACtE,QAAQ,EAAE,IAAI;SACd;KACD;IACD,UAAU,EAAE;QACX;YACC,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EACV,0EAA0E;gBAC1E,4EAA4E;gBAC5E,gEAAgE;YACjE,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EACV,4EAA4E;gBAC5E,kDAAkD;YACnD,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,0BAA0B;YAChC,WAAW,EACV,yEAAyE;gBACzE,kHAAkH;YACnH,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,0BAA0B;YAChC,WAAW,EACV,yEAAyE;gBACzE,0EAA0E;gBAC1E,4EAA4E;gBAC5E,iFAAiF;YAClF,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,6BAA6B;YACnC,WAAW,EACV,sEAAsE;gBACtE,6CAA6C;YAC9C,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,aAAa;YACnB,WAAW,EACV,2EAA2E;gBAC3E,wFAAwF;YACzF,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,eAAe;YACrB,WAAW,EACV,8CAA8C;gBAC9C,gEAAgE;YACjE,WAAW,EAAE,IAAI;SACjB;QACD;YACC,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EACV,iEAAiE;gBACjE,6CAA6C;YAC9C,WAAW,EAAE,IAAI;SACjB;KACD;IACD,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC;CAC/E,CAAC,CAAC"}

package/dist/microsoft.consumer.plugin.d.ts

@@ -0,0 +1,4 @@
+/** App-only provider slice; compose where org-scoped Microsoft operations are enabled. */
+export declare const microsoftConsumerPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default microsoftConsumerPlugin;
+//# sourceMappingURL=microsoft.consumer.plugin.d.ts.map

package/dist/microsoft.consumer.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.consumer.plugin.d.ts","sourceRoot":"","sources":["../src/microsoft.consumer.plugin.ts"],"names":[],"mappings":"AAEA,0FAA0F;AAC1F,eAAO,MAAM,uBAAuB,6CAOlC,CAAC;AACH,eAAe,uBAAuB,CAAC"}

package/dist/microsoft.consumer.plugin.js

@@ -0,0 +1,13 @@
+import { createRuntimePlugin, loader } from '@vibesdotdev/kernel/factory';
+import microsoftDescriptor from "./microsoft/system.integration.microsoft.descriptor.js";
+/** App-only provider slice; compose where org-scoped Microsoft operations are enabled. */
+export const microsoftConsumerPlugin = createRuntimePlugin({
+    id: 'integrations-microsoft/consumer', name: 'Microsoft app-only provider',
+    descriptors: [microsoftDescriptor],
+    loaders: [loader(microsoftDescriptor.id, { kind: 'integration/provider' }, async () => {
+            const { MicrosoftIntegration } = await import("./microsoft/microsoft-implementation.js");
+            return { default: MicrosoftIntegration };
+        })]
+});
+export default microsoftConsumerPlugin;
+//# sourceMappingURL=microsoft.consumer.plugin.js.map

package/dist/microsoft.consumer.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.consumer.plugin.js","sourceRoot":"","sources":["../src/microsoft.consumer.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAC,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,mBAAmB,MAAM,wDAAwD,CAAC;AACzF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAC,mBAAmB,CAAC;IACxD,EAAE,EAAE,iCAAiC,EAAC,IAAI,EAAE,6BAA6B;IACzE,WAAW,EAAE,CAAC,mBAAmB,CAAC;IAClC,OAAO,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAC,KAAK,IAAI,EAAE;YACnF,MAAM,EAAE,oBAAoB,EAAE,GAAC,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;YACvF,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;QAC1C,CAAC,CAAC,CAAC;CACH,CAAC,CAAC;AACH,eAAe,uBAAuB,CAAC"}

package/dist/schemas/boundary.d.ts

@@ -0,0 +1,69 @@
+import * as z from 'zod/v4';
+import { CapabilityError, valueFreeFailure, type RuntimeRef } from '@vibesdotdev/kernel';
+export declare const IdentitySchema: z.ZodString;
+export declare const OptionalIdentitySchema: z.ZodOptional<z.ZodString>;
+export declare const MicrosoftConfigSchema: z.ZodObject<{
+    tenantId: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const DelegatedAuthOAuthAccountSchema: z.ZodObject<{
+    providerId: z.ZodString;
+    accountId: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodNullable<z.ZodString>;
+    refreshToken: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    refreshTokenExpiresAt: z.ZodNullable<z.ZodString>;
+    scope: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type DelegatedAuthOAuthAccount = z.infer<typeof DelegatedAuthOAuthAccountSchema>;
+export declare const DelegatedAuthClientSchema: z.ZodObject<{
+    getOAuthAccount: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodString, z.ZodOptional<z.ZodObject<{
+        accountId: z.ZodString;
+    }, z.core.$strict>>], null>, z.ZodPromise<z.ZodNullable<z.ZodObject<{
+        providerId: z.ZodString;
+        accountId: z.ZodOptional<z.ZodString>;
+        accessToken: z.ZodNullable<z.ZodString>;
+        refreshToken: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        refreshTokenExpiresAt: z.ZodNullable<z.ZodString>;
+        scope: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>>>;
+    listOAuthAccounts: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodPromise<z.ZodArray<z.ZodObject<{
+        providerId: z.ZodString;
+        accountId: z.ZodOptional<z.ZodString>;
+        accessToken: z.ZodNullable<z.ZodString>;
+        accessTokenExpiresAt: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>>>;
+}, z.core.$strip>;
+export type DelegatedAuthClient = z.infer<typeof DelegatedAuthClientSchema>;
+/** Parse once without placing rejected values in diagnostic messages. */
+export declare function admitMicrosoft<T>(schema: z.ZodType<T>, input: unknown, boundary?: 'input' | 'response'): T;
+export declare function optionalMicrosoftContext(runtime: Pick<RuntimeRef, 'context'> | undefined, id: string): Promise<unknown>;
+export declare const GraphErrorBodySchema: z.ZodObject<{
+    error: z.ZodObject<{
+        code: z.ZodOptional<z.ZodEnum<{
+            itemNotFound: "itemNotFound";
+            ResourceNotFound: "ResourceNotFound";
+            generalException: "generalException";
+            accessDenied: "accessDenied";
+            InvalidAuthenticationToken: "InvalidAuthenticationToken";
+        }>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare class MicrosoftGraphError extends CapabilityError {
+    readonly status: number;
+    readonly graphCode?: z.infer<typeof GraphErrorBodySchema>['error']['code'];
+    constructor(status: number, graphCode?: z.infer<typeof GraphErrorBodySchema>['error']['code'], failure?: ReturnType<typeof valueFreeFailure>);
+}
+export declare function graphFailure(response: Response): Promise<MicrosoftGraphError>;
+/** Close an unused body before returning; cleanup failure remains a failure. */
+export declare function closeMicrosoftResponse(response: Response): Promise<void>;
+export declare function microsoftFailure(error: unknown): CapabilityError;
+export declare const MicrosoftTokenAcquirerSchema: z.ZodObject<{
+    acquireToken: z.ZodFunction<z.ZodTuple<readonly [z.ZodOptional<z.ZodArray<z.ZodString>>], null>, z.ZodPromise<z.ZodObject<{
+        accessToken: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export declare function readMicrosoftJson<T>(response: Response, schema: z.ZodType<T>): Promise<T>;
+//# sourceMappingURL=boundary.d.ts.map

package/dist/schemas/boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary.d.ts","sourceRoot":"","sources":["../../src/schemas/boundary.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAqB,gBAAgB,EAAQ,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAElH,eAAO,MAAM,cAAc,aAAkB,CAAC;AAC9C,eAAO,MAAM,sBAAsB,4BAA0B,CAAC;AAC9D,eAAO,MAAM,qBAAqB;;;iBAAoF,CAAC;AACvH,eAAO,MAAM,+BAA+B;;;;;;;;iBAA6B,CAAC;AAC1E,MAAM,MAAM,yBAAyB,GAAC,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACtF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAC,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE1E,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,OAAO,EAAC,QAAQ,GAAE,OAAO,GAAC,UAAkB,GAAG,CAAC,CAO7G;AAED,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAC,SAAS,CAAC,GAAC,SAAS,EAAC,EAAE,EAAE,MAAM,oBAQtG;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;iBAI/B,CAAC;AACH,qBAAa,mBAAoB,SAAQ,eAAe;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBAAzF,MAAM,EAAE,MAAM,EAAU,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC;CAK5J;AACD,wBAAsB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAUnF;AACD,gFAAgF;AAChF,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAMhE;AAED,eAAO,MAAM,4BAA4B;;;;iBAEvC,CAAC;AAEH,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAO9F"}

package/dist/schemas/boundary.js

@@ -0,0 +1,94 @@
+import { userOAuthAccountDetailSchema, userOAuthAccountSchema, userOAuthAccountSelectionSchema } from '@vibesdotdev/auth/system/internal-api';
+import * as z from 'zod/v4';
+import { CapabilityError, CaughtFailureSchema, valueFreeFailure, settle } from '@vibesdotdev/kernel';
+export const IdentitySchema = z.string().min(1);
+export const OptionalIdentitySchema = IdentitySchema.optional();
+export const MicrosoftConfigSchema = z.object({ tenantId: z.string().optional(), scopes: z.string().array().optional() });
+export const DelegatedAuthOAuthAccountSchema = userOAuthAccountDetailSchema;
+export const DelegatedAuthClientSchema = z.object({
+    getOAuthAccount: z.function({ input: [z.string(), z.string(), userOAuthAccountSelectionSchema.optional()], output: z.promise(DelegatedAuthOAuthAccountSchema.nullable()) }),
+    listOAuthAccounts: z.function({ input: [z.string()], output: z.promise(userOAuthAccountSchema.array()) }).optional()
+});
+/** Parse once without placing rejected values in diagnostic messages. */
+export function admitMicrosoft(schema, input, boundary = 'input') {
+    const parsed = schema.safeParse(input);
+    if (parsed.success)
+        return parsed.data;
+    throw new CapabilityError('Microsoft input or response does not match its contract.', boundary === 'input' ? 'INVALID_INPUT' : 'UNAVAILABLE', {
+        reason: boundary === 'input' ? 'microsoft-input-invalid' : 'microsoft-response-invalid', cause: valueFreeFailure(parsed.error),
+        details: { issues: parsed.error.issues.map(issue => ({ code: issue.code, path: issue.path.map(String) })) }
+    });
+}
+export async function optionalMicrosoftContext(runtime, id) {
+    if (!runtime)
+        return undefined;
+    try {
+        return await runtime.context(id);
+    }
+    catch (error) {
+        const failure = CaughtFailureSchema.parse(error);
+        if (CapabilityError.isAbsenceOf(failure, 'context', id))
+            return undefined;
+        throw failure;
+    }
+}
+export const GraphErrorBodySchema = z.object({
+    error: z.object({
+        code: z.enum(['itemNotFound', 'ResourceNotFound', 'generalException', 'accessDenied', 'InvalidAuthenticationToken']).optional()
+    })
+});
+export class MicrosoftGraphError extends CapabilityError {
+    status;
+    graphCode;
+    constructor(status, graphCode, failure) {
+        super('Microsoft Graph refused the request.', status === 401 ? 'AUTH_REQUIRED' : status === 403 ? 'PERMISSION_DENIED' : status === 404 ? 'NOT_FOUND' : status === 429 ? 'RATE_LIMITED' : 'UNAVAILABLE', {
+            reason: 'microsoft-graph-request-refused', details: { status, graphCode, failure }
+        });
+        this.status = status;
+        this.graphCode = graphCode;
+    }
+}
+export async function graphFailure(response) {
+    const decoded = await settle(() => response.json());
+    if (!decoded.ok) {
+        if (decoded.cause instanceof CapabilityError)
+            throw decoded.cause;
+        if (!(decoded.cause instanceof SyntaxError))
+            throw microsoftFailure(decoded.cause);
+        return new MicrosoftGraphError(response.status, undefined, valueFreeFailure(decoded.cause));
+    }
+    const body = decoded.value;
+    const parsed = GraphErrorBodySchema.safeParse(body);
+    return new MicrosoftGraphError(response.status, parsed.success ? parsed.data.error.code : undefined);
+}
+/** Close an unused body before returning; cleanup failure remains a failure. */
+export async function closeMicrosoftResponse(response) {
+    const body = response.body;
+    if (!body)
+        return;
+    const closed = await settle(() => body.cancel());
+    if (!closed.ok)
+        throw microsoftFailure(closed.cause);
+}
+export function microsoftFailure(error) {
+    const failure = CaughtFailureSchema.parse(error);
+    if (failure instanceof CapabilityError)
+        return failure;
+    return new CapabilityError('Microsoft request failed.', 'UNAVAILABLE', {
+        reason: 'microsoft-request-failed', cause: failure, details: { failure: valueFreeFailure(failure) }
+    });
+}
+export const MicrosoftTokenAcquirerSchema = z.object({
+    acquireToken: z.function({ input: [z.string().array().optional()], output: z.promise(z.object({ accessToken: z.string().min(1) })) })
+});
+export async function readMicrosoftJson(response, schema) {
+    const decoded = await settle(() => response.json());
+    if (!decoded.ok && decoded.cause instanceof CapabilityError)
+        throw decoded.cause;
+    if (!decoded.ok)
+        throw new CapabilityError('Microsoft returned invalid JSON.', 'UNAVAILABLE', {
+            reason: 'microsoft-response-invalid', cause: valueFreeFailure(decoded.cause), details: { failure: valueFreeFailure(decoded.cause) }
+        });
+    return admitMicrosoft(schema, decoded.value, 'response');
+}
+//# sourceMappingURL=boundary.js.map

package/dist/schemas/boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary.js","sourceRoot":"","sources":["../../src/schemas/boundary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AAC9I,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAC,mBAAmB,EAAC,gBAAgB,EAAC,MAAM,EAAkB,MAAM,qBAAqB,CAAC;AAElH,MAAM,CAAC,MAAM,cAAc,GAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9C,MAAM,CAAC,MAAM,sBAAsB,GAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACvH,MAAM,CAAC,MAAM,+BAA+B,GAAC,4BAA4B,CAAC;AAE1E,MAAM,CAAC,MAAM,yBAAyB,GAAC,CAAC,CAAC,MAAM,CAAC;IAC/C,eAAe,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,+BAA+B,CAAC,QAAQ,EAAE,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,QAAQ,EAAE,CAAC,EAAC,CAAC;IACnK,iBAAiB,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC,EAAC,CAAC,CAAC,QAAQ,EAAE;CAC9G,CAAC,CAAC;AAGH,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAI,MAAoB,EAAC,KAAc,EAAC,WAA6B,OAAO;IACzG,MAAM,MAAM,GAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,IAAG,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACtC,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAC,QAAQ,KAAG,OAAO,CAAA,CAAC,CAAC,eAAe,CAAA,CAAC,CAAA,aAAa,EAAC;QACtI,MAAM,EAAE,QAAQ,KAAG,OAAO,CAAA,CAAC,CAAC,yBAAyB,CAAA,CAAC,CAAA,4BAA4B,EAAC,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;QACxH,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE;KAC1G,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAA6C,EAAC,EAAU;IACtG,IAAG,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QAAC,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IACzC,OAAM,KAAK,EAAE,CAAC;QACb,MAAM,OAAO,GAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAG,eAAe,CAAC,WAAW,CAAC,OAAO,EAAC,SAAS,EAAC,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;QACvE,MAAM,OAAO,CAAC;IACf,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAC,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAC,kBAAkB,EAAC,kBAAkB,EAAC,cAAc,EAAC,4BAA4B,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC3H,CAAC;CACF,CAAC,CAAC;AACH,MAAM,OAAO,mBAAoB,SAAQ,eAAe;IAClC;IAAwB;IAA7C,YAAqB,MAAc,EAAU,SAAiE,EAAC,OAA6C;QAC3J,KAAK,CAAC,sCAAsC,EAAC,MAAM,KAAG,GAAG,CAAA,CAAC,CAAC,eAAe,CAAA,CAAC,CAAA,MAAM,KAAG,GAAG,CAAA,CAAC,CAAC,mBAAmB,CAAA,CAAC,CAAA,MAAM,KAAG,GAAG,CAAA,CAAC,CAAC,WAAW,CAAA,CAAC,CAAA,MAAM,KAAG,GAAG,CAAA,CAAC,CAAC,cAAc,CAAA,CAAC,CAAA,aAAa,EAAC;YACjL,MAAM,EAAE,iCAAiC,EAAC,OAAO,EAAE,EAAE,MAAM,EAAC,SAAS,EAAC,OAAO,EAAE;SAC/E,CAAC,CAAC;QAHiB,WAAM,GAAN,MAAM,CAAQ;QAAU,cAAS,GAAT,SAAS,CAAwD;IAI9G,CAAC;CACD;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAkB;IACpD,MAAM,OAAO,GAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAG,OAAO,CAAC,KAAK,YAAY,eAAe;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QACjE,IAAG,CAAC,CAAC,OAAO,CAAC,KAAK,YAAY,WAAW,CAAC;YAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClF,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAC,SAAS,EAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAC,OAAO,CAAC,KAAK,CAAC;IACzB,MAAM,MAAM,GAAC,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAC,MAAM,CAAC,OAAO,CAAA,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAA,CAAC,CAAA,SAAS,CAAC,CAAC;AAClG,CAAC;AACD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAkB;IAC9D,MAAM,IAAI,GAAC,QAAQ,CAAC,IAAI,CAAC;IACzB,IAAG,CAAC,IAAI;QAAE,OAAO;IACjB,MAAM,MAAM,GAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,IAAG,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC9C,MAAM,OAAO,GAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAG,OAAO,YAAY,eAAe;QAAE,OAAO,OAAO,CAAC;IACtD,OAAO,IAAI,eAAe,CAAC,2BAA2B,EAAC,aAAa,EAAC;QACpE,MAAM,EAAE,0BAA0B,EAAC,KAAK,EAAE,OAAO,EAAC,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE;KACjG,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAC,CAAC,CAAC,MAAM,CAAC;IAClD,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;CACpI,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAI,QAAkB,EAAC,MAAoB;IACjF,MAAM,OAAO,GAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAG,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,YAAY,eAAe;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IAChF,IAAG,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAC,aAAa,EAAC;YAC1F,MAAM,EAAE,4BAA4B,EAAC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAC,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;SACjI,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,MAAM,EAAC,OAAO,CAAC,KAAK,EAAC,UAAU,CAAC,CAAC;AACxD,CAAC"}