n8n 2.44.3 → 2.45.0

package/dist/modules/agents/integrations/platforms/teams/teams-entra-provisioning.service.d.ts

@@ -0,0 +1,36 @@
+import type { TeamsProvisionedAppSummary } from '@n8n/api-types';
+import type { User } from '@n8n/db';
+import { CredentialsFinderService, UrlService } from '@n8n/backend-services';
+import { CredentialsService } from '../../../../../credentials/credentials.service';
+import { TeamsGraphService } from './teams-graph.service';
+import { TeamsManagerTokenService } from './teams-manager-token.service';
+export declare const BOT_CREDENTIAL_TYPE = "microsoftEntraServicePrincipalApi";
+export interface ProvisionEntraAppOptions {
+    user: User;
+    projectId: string;
+    agentId: string;
+    agentName: string;
+    managerCredentialId: string;
+}
+export declare class TeamsEntraProvisioningService {
+    private readonly graph;
+    private readonly tokens;
+    private readonly credentialsService;
+    private readonly credentialsFinderService;
+    private readonly urlService;
+    constructor(graph: TeamsGraphService, tokens: TeamsManagerTokenService, credentialsService: CredentialsService, credentialsFinderService: CredentialsFinderService, urlService: UrlService);
+    provision(options: ProvisionEntraAppOptions): Promise<TeamsProvisionedAppSummary>;
+    private managerCredential;
+    private readTenant;
+    private rememberTenant;
+    private createApp;
+    private findAppByUniqueName;
+    private declareFileAccess;
+    private mergeFileAccess;
+    private dropExpiredSecrets;
+    private addSecret;
+    private createServicePrincipal;
+    private registrationError;
+    private findProvisionedCredential;
+    private writeBotCredential;
+}

package/dist/modules/agents/integrations/platforms/teams/teams-entra-provisioning.service.js

@@ -0,0 +1,318 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TeamsEntraProvisioningService = exports.BOT_CREDENTIAL_TYPE = void 0;
+const di_1 = require("@n8n/di");
+const is_record_1 = require("@n8n/utils/is-record");
+const n8n_workflow_1 = require("n8n-workflow");
+const teams_setup_telemetry_service_1 = require("./teams-setup-telemetry.service");
+const backend_services_1 = require("@n8n/backend-services");
+const credentials_service_1 = require("../../../../../credentials/credentials.service");
+const errors_1 = require("@n8n/errors");
+const teams_admin_consent_1 = require("./teams-admin-consent");
+const teams_graph_permissions_1 = require("./teams-graph-permissions");
+const teams_graph_service_1 = require("./teams-graph.service");
+const teams_managed_setup_service_1 = require("./teams-managed-setup.service");
+const teams_manager_token_service_1 = require("./teams-manager-token.service");
+const integration_helpers_1 = require("../../integration-helpers");
+exports.BOT_CREDENTIAL_TYPE = 'microsoftEntraServicePrincipalApi';
+const SECRET_RENEW_BEFORE_MS = 7 * 24 * 60 * 60 * 1000;
+function usableSecret(data) {
+    const value = (0, integration_helpers_1.stringProperty)(data, 'clientSecret');
+    const expiresAt = (0, integration_helpers_1.stringProperty)(data, 'secretExpiresAt');
+    if (!value || !expiresAt)
+        return undefined;
+    const expiry = Date.parse(expiresAt);
+    if (Number.isNaN(expiry) || expiry - Date.now() < SECRET_RENEW_BEFORE_MS)
+        return undefined;
+    return { value, expiresAt };
+}
+const GRAPH_APP_ID = '00000003-0000-0000-c000-000000000000';
+function withGraphPermissions(requiredResourceAccess) {
+    const entries = Array.isArray(requiredResourceAccess) ? requiredResourceAccess : [];
+    const graph = entries.find((entry) => (0, is_record_1.isRecord)(entry) && entry.resourceAppId === GRAPH_APP_ID);
+    const roles = (0, is_record_1.isRecord)(graph) && Array.isArray(graph.resourceAccess) ? graph.resourceAccess : [];
+    const missing = teams_graph_permissions_1.GRAPH_APP_ROLES.filter(({ id }) => !roles.some((role) => (0, is_record_1.isRecord)(role) && role.id === id)).map(({ id }) => ({ id, type: 'Role' }));
+    if (missing.length === 0)
+        return entries;
+    return [
+        ...entries.filter((entry) => entry !== graph),
+        { resourceAppId: GRAPH_APP_ID, resourceAccess: [...roles, ...missing] },
+    ];
+}
+const ENTRA_APP_URL = 'https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/Overview/appId';
+const SECRET_LIFETIMES_MONTHS = [24, 12, 6, 3];
+const UNIQUE_NAME_PREFIX = 'n8n-agent-';
+const APP_NAME_MAX = 120;
+let TeamsEntraProvisioningService = class TeamsEntraProvisioningService {
+    constructor(graph, tokens, credentialsService, credentialsFinderService, urlService) {
+        this.graph = graph;
+        this.tokens = tokens;
+        this.credentialsService = credentialsService;
+        this.credentialsFinderService = credentialsFinderService;
+        this.urlService = urlService;
+    }
+    async provision(options) {
+        const manager = await this.managerCredential(options);
+        const token = await this.tokens.acquire(manager, teams_manager_token_service_1.GRAPH_RESOURCE);
+        const tenant = await this.readTenant(token);
+        await this.rememberTenant(options.user, manager, tenant);
+        const existing = await this.findProvisionedCredential(options);
+        const app = await this.createApp(token, options.agentId, options.agentName);
+        const secret = (existing?.objectId === app.objectId ? existing.secret : undefined) ??
+            (await this.addSecret(token, app.objectId));
+        await this.createServicePrincipal(token, app.appId);
+        const redirectUri = (0, teams_admin_consent_1.adminConsentRedirectUri)(this.urlService.getInstanceBaseUrl(), options);
+        const fileAccessDeclared = await this.declareFileAccess(token, app.objectId, redirectUri);
+        const credentialId = await this.writeBotCredential({
+            options,
+            app,
+            secret,
+            tenantId: tenant.tenantId,
+            existingCredential: existing?.credential,
+        });
+        return {
+            credentialId,
+            appId: app.appId,
+            appName: app.displayName,
+            organizationName: tenant.organizationName,
+            entraAppUrl: `${ENTRA_APP_URL}/${app.appId}`,
+            fileAccessConsentUrl: fileAccessDeclared && redirectUri
+                ? (0, teams_admin_consent_1.adminConsentUrl)(tenant.tenantId, app.appId, redirectUri)
+                : null,
+            secretExpiresAt: secret.expiresAt,
+        };
+    }
+    async managerCredential(options) {
+        const credential = await this.credentialsFinderService.findCredentialForUser(options.managerCredentialId, options.user, ['credential:use']);
+        if (!credential || credential.type !== teams_managed_setup_service_1.TEAMS_MANAGER_CREDENTIAL_TYPE) {
+            throw (0, teams_setup_telemetry_service_1.withTeamsFailure)(new errors_1.BadRequestError('Sign in with Microsoft before creating the Teams app.'), 'not_signed_in');
+        }
+        return credential;
+    }
+    async readTenant(token) {
+        const organization = await this.graph.request(token, 'GET', '/organization?$select=id,displayName');
+        if (!organization.ok) {
+            throw new n8n_workflow_1.OperationalError('Could not read the organization this account belongs to.');
+        }
+        const first = (0, is_record_1.isRecord)(organization.body)
+            ? organization.body.value?.[0]
+            : undefined;
+        const tenantId = (0, integration_helpers_1.stringProperty)(first, 'id');
+        if (!tenantId) {
+            throw (0, teams_setup_telemetry_service_1.withTeamsFailure)(new n8n_workflow_1.UserError('Teams apps need a work or school account. Sign in again with your organization’s account.'), 'personal_account');
+        }
+        return { tenantId, organizationName: (0, integration_helpers_1.stringProperty)(first, 'displayName') ?? null };
+    }
+    async rememberTenant(user, manager, tenant) {
+        const rawData = await this.credentialsService.decrypt(manager, true);
+        const current = rawData;
+        if (current.tenantId === tenant.tenantId &&
+            current.organizationName === (tenant.organizationName ?? '')) {
+            return;
+        }
+        const updated = {
+            ...rawData,
+            tenantId: tenant.tenantId,
+            organizationName: tenant.organizationName ?? '',
+        };
+        const encrypted = await this.credentialsService.createEncryptedData({
+            id: manager.id,
+            name: manager.name,
+            type: manager.type,
+            data: updated,
+        });
+        await this.credentialsService.update(manager.id, encrypted, { kind: 'user', user }, updated);
+    }
+    async createApp(token, agentId, agentName) {
+        const displayName = (0, integration_helpers_1.sanitiseAppName)(`${agentName || 'n8n Agent'} (n8n)`, APP_NAME_MAX, 'n8n Agent (n8n)');
+        const uniqueName = `${UNIQUE_NAME_PREFIX}${agentId}`;
+        const response = await this.graph.request(token, 'PATCH', `/applications(uniqueName='${encodeURIComponent((0, teams_graph_service_1.odataLiteral)(uniqueName))}')`, {
+            displayName,
+            signInAudience: 'AzureADMyOrg',
+            tags: [uniqueName],
+        }, { Prefer: 'create-if-missing' });
+        if (!response.ok) {
+            throw this.registrationError(response.statusCode, (0, teams_graph_service_1.graphErrorCode)(response.body));
+        }
+        const objectId = (0, integration_helpers_1.stringProperty)(response.body, 'id');
+        const appId = (0, integration_helpers_1.stringProperty)(response.body, 'appId');
+        if (objectId && appId)
+            return { objectId, appId, displayName };
+        return await this.findAppByUniqueName(token, uniqueName, displayName);
+    }
+    async findAppByUniqueName(token, uniqueName, displayName) {
+        const query = new URLSearchParams({
+            $filter: `uniqueName eq '${(0, teams_graph_service_1.odataLiteral)(uniqueName)}'`,
+            $select: 'id,appId,displayName',
+        });
+        const response = await this.graph.request(token, 'GET', `/applications?${query.toString()}`);
+        if (!response.ok) {
+            throw this.registrationError(response.statusCode, (0, teams_graph_service_1.graphErrorCode)(response.body));
+        }
+        const value = (0, is_record_1.isRecord)(response.body) ? response.body.value : undefined;
+        const first = Array.isArray(value) ? value[0] : undefined;
+        const objectId = (0, integration_helpers_1.stringProperty)(first, 'id');
+        const appId = (0, integration_helpers_1.stringProperty)(first, 'appId');
+        if (!objectId || !appId) {
+            throw new n8n_workflow_1.OperationalError('Microsoft updated the app but would not say which one.');
+        }
+        return { objectId, appId, displayName: (0, integration_helpers_1.stringProperty)(first, 'displayName') ?? displayName };
+    }
+    async declareFileAccess(token, objectId, redirectUri) {
+        try {
+            return await this.mergeFileAccess(token, objectId, redirectUri);
+        }
+        catch {
+            return false;
+        }
+    }
+    async mergeFileAccess(token, objectId, redirectUri) {
+        const current = await this.graph.request(token, 'GET', `/applications/${objectId}?$select=requiredResourceAccess,web`);
+        if (!current.ok)
+            return false;
+        const app = (0, is_record_1.isRecord)(current.body) ? current.body : {};
+        const web = (0, is_record_1.isRecord)(app.web) ? app.web : {};
+        const redirectUris = Array.isArray(web.redirectUris) ? web.redirectUris : [];
+        const response = await this.graph.request(token, 'PATCH', `/applications/${objectId}`, {
+            requiredResourceAccess: withGraphPermissions(app.requiredResourceAccess),
+            ...(redirectUri && !redirectUris.includes(redirectUri)
+                ? { web: { redirectUris: [...redirectUris, redirectUri] } }
+                : {}),
+        });
+        return response.ok;
+    }
+    async dropExpiredSecrets(token, objectId) {
+        const response = await this.graph.request(token, 'GET', `/applications/${objectId}`);
+        if (!response.ok)
+            return;
+        const credentials = (0, is_record_1.isRecord)(response.body) ? response.body.passwordCredentials : undefined;
+        if (!Array.isArray(credentials))
+            return;
+        const now = Date.now();
+        for (const credential of credentials) {
+            const keyId = (0, integration_helpers_1.stringProperty)(credential, 'keyId');
+            const endDateTime = (0, integration_helpers_1.stringProperty)(credential, 'endDateTime');
+            if (!keyId || !endDateTime)
+                continue;
+            const expiry = Date.parse(endDateTime);
+            if (Number.isNaN(expiry) || expiry > now)
+                continue;
+            await this.graph.request(token, 'POST', `/applications/${objectId}/removePassword`, {
+                keyId,
+            });
+        }
+    }
+    async addSecret(token, objectId) {
+        await this.dropExpiredSecrets(token, objectId);
+        let lastCode;
+        for (const months of SECRET_LIFETIMES_MONTHS) {
+            const endDateTime = new Date();
+            endDateTime.setMonth(endDateTime.getMonth() + months);
+            const response = await this.graph.request(token, 'POST', `/applications/${objectId}/addPassword`, {
+                passwordCredential: {
+                    displayName: 'n8n agent channel',
+                    endDateTime: endDateTime.toISOString(),
+                },
+            });
+            if (response.ok) {
+                const value = (0, integration_helpers_1.stringProperty)(response.body, 'secretText');
+                if (!value) {
+                    throw new n8n_workflow_1.OperationalError('Microsoft created a secret but did not return it.');
+                }
+                return {
+                    value,
+                    expiresAt: (0, integration_helpers_1.stringProperty)(response.body, 'endDateTime') ?? endDateTime.toISOString(),
+                };
+            }
+            lastCode = (0, teams_graph_service_1.graphErrorCode)(response.body);
+        }
+        throw (0, teams_setup_telemetry_service_1.withTeamsFailure)(new n8n_workflow_1.UserError(lastCode === 'Authorization_RequestDenied'
+            ? 'This organization does not allow n8n to add a client secret. Use the manual setup.'
+            : 'This organization refused every client secret lifetime n8n offered. Use the manual setup.'), 'secrets_refused');
+    }
+    async createServicePrincipal(token, appId) {
+        const response = await this.graph.request(token, 'POST', '/servicePrincipals', { appId });
+        if (!response.ok &&
+            (0, teams_graph_service_1.graphErrorCode)(response.body) !== 'Request_MultipleObjectsWithSameKeyValue') {
+            throw new n8n_workflow_1.OperationalError('Could not finish registering the app in this organization.');
+        }
+    }
+    registrationError(statusCode, code) {
+        if (statusCode === 403 || code === 'Authorization_RequestDenied') {
+            return (0, teams_setup_telemetry_service_1.withTeamsFailure)(new n8n_workflow_1.UserError('This organization doesn’t let you register apps. Ask an admin to register the app.'), 'cannot_register_apps');
+        }
+        return new n8n_workflow_1.OperationalError('Microsoft refused to register the app. Try again.');
+    }
+    async findProvisionedCredential(options) {
+        const usable = await this.credentialsService.getCredentialsAUserCanUseInAWorkflow(options.user, { projectId: options.projectId });
+        for (const candidate of usable) {
+            if (candidate.type !== exports.BOT_CREDENTIAL_TYPE)
+                continue;
+            const credential = await this.credentialsFinderService.findCredentialForUser(candidate.id, options.user, ['credential:read']);
+            if (!credential)
+                continue;
+            const data = await this.credentialsService.decrypt(credential, true);
+            const objectId = (0, integration_helpers_1.stringProperty)(data, 'entraAppObjectId');
+            if (objectId && (0, integration_helpers_1.stringProperty)(data, 'provisionedForAgentId') === options.agentId) {
+                return { credential, objectId, secret: usableSecret(data) };
+            }
+        }
+        return undefined;
+    }
+    async writeBotCredential(input) {
+        const existingData = input.existingCredential
+            ? (await this.credentialsService.decrypt(input.existingCredential, true))
+            : {};
+        const movedIdentity = (existingData.tenantId !== undefined && existingData.tenantId !== input.tenantId) ||
+            (existingData.clientId !== undefined && existingData.clientId !== input.app.appId);
+        if (movedIdentity) {
+            delete existingData.publishedTeamsAppId;
+            delete existingData.publishedTeamsAppState;
+            delete existingData.publishedTeamsAppAt;
+            delete existingData.azureBotName;
+            delete existingData.azureSubscriptionId;
+        }
+        const data = {
+            ...existingData,
+            tenantId: input.tenantId,
+            clientId: input.app.appId,
+            clientSecret: input.secret.value,
+            entraAppObjectId: input.app.objectId,
+            provisionedForAgentId: input.options.agentId,
+            managerCredentialId: input.options.managerCredentialId,
+            secretExpiresAt: input.secret.expiresAt,
+        };
+        if (input.existingCredential) {
+            const encrypted = await this.credentialsService.createEncryptedData({
+                id: input.existingCredential.id,
+                name: input.existingCredential.name,
+                type: exports.BOT_CREDENTIAL_TYPE,
+                data,
+            });
+            await this.credentialsService.update(input.existingCredential.id, encrypted, { kind: 'user', user: input.options.user }, data);
+            return input.existingCredential.id;
+        }
+        const created = await this.credentialsService.createUnmanagedCredential({
+            name: input.app.displayName,
+            type: exports.BOT_CREDENTIAL_TYPE,
+            data,
+            projectId: input.options.projectId,
+        }, input.options.user);
+        return created.id;
+    }
+};
+exports.TeamsEntraProvisioningService = TeamsEntraProvisioningService;
+exports.TeamsEntraProvisioningService = TeamsEntraProvisioningService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [teams_graph_service_1.TeamsGraphService, teams_manager_token_service_1.TeamsManagerTokenService, credentials_service_1.CredentialsService, backend_services_1.CredentialsFinderService, backend_services_1.UrlService])
+], TeamsEntraProvisioningService);
+//# sourceMappingURL=teams-entra-provisioning.service.js.map

package/dist/modules/agents/integrations/platforms/teams/teams-entra-provisioning.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-entra-provisioning.service.js","sourceRoot":"","sources":["../../../../../../src/modules/agents/integrations/platforms/teams/teams-entra-provisioning.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gCAAkC;AAClC,oDAAgD;AAChD,+CAA2D;AAC3D,mFAAmE;AAEnE,4DAA6E;AAC7E,2EAAuE;AACvE,wCAA8C;AAE9C,+DAAiF;AACjF,uEAA4D;AAC5D,+DAAwF;AACxF,+EAA8E;AAC9E,+EAAyF;AACzF,mEAA4E;AAE/D,QAAA,mBAAmB,GAAG,mCAAmC,CAAC;AAGvE,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAGvD,SAAS,YAAY,CACpB,IAA6B;IAE7B,MAAM,KAAK,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB;QAAE,OAAO,SAAS,CAAC;IAC3F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AACD,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAC5D,SAAS,oBAAoB,CAAC,sBAA+B;IAC5D,MAAM,OAAO,GAAc,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,oBAAQ,EAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,CAAC;IAC/F,MAAM,KAAK,GACV,IAAA,oBAAQ,EAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,OAAO,GAAG,yCAAe,CAAC,MAAM,CACrC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,oBAAQ,EAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CACnE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO;QACN,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC;QAC7C,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,EAAE;KACvE,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAClB,sGAAsG,CAAC;AAOxG,MAAM,uBAAuB,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAU,CAAC;AAMxD,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAGxC,MAAM,YAAY,GAAG,GAAG,CAAC;AAiBlB,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACzC,YACkB,KAAwB,EACxB,MAAgC,EAChC,kBAAsC,EACtC,wBAAkD,EAClD,UAAsB;qBAJtB,KAAK;sBACL,MAAM;kCACN,kBAAkB;wCAClB,wBAAwB;0BACxB,UAAU;IACzB,CAAC;IASJ,KAAK,CAAC,SAAS,CAAC,OAAiC;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,4CAAc,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAM/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAM5E,MAAM,MAAM,GACX,CAAC,QAAQ,EAAE,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACnE,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAG7C,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAEpD,MAAM,WAAW,GAAG,IAAA,6CAAuB,EAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3F,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAE1F,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC;YAClD,OAAO;YACP,GAAG;YACH,MAAM;YACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,kBAAkB,EAAE,QAAQ,EAAE,UAAU;SACxC,CAAC,CAAC;QAEH,OAAO;YACN,YAAY;YACZ,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,WAAW;YACxB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,WAAW,EAAE,GAAG,aAAa,IAAI,GAAG,CAAC,KAAK,EAAE;YAC5C,oBAAoB,EACnB,kBAAkB,IAAI,WAAW;gBAChC,CAAC,CAAC,IAAA,qCAAe,EAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC;gBAC1D,CAAC,CAAC,IAAI;YACR,eAAe,EAAE,MAAM,CAAC,SAAS;SACjC,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,iBAAiB,CAAC,OAAiC;QAChE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAC3E,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,IAAI,EACZ,CAAC,gBAAgB,CAAC,CAClB,CAAC;QACF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,2DAA6B,EAAE,CAAC;YACtE,MAAM,IAAA,gDAAgB,EACrB,IAAI,wBAAe,CAAC,uDAAuD,CAAC,EAC5E,eAAe,CACf,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC;IACnB,CAAC;IAMO,KAAK,CAAC,UAAU,CACvB,KAAa;QAEb,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAC5C,KAAK,EACL,KAAK,EACL,sCAAsC,CACtC,CAAC;QAGF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,+BAAgB,CAAC,0DAA0D,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,oBAAQ,EAAC,YAAY,CAAC,IAAI,CAAC;YACxC,CAAC,CAAE,YAAY,CAAC,IAAI,CAAC,KAA+B,EAAE,CAAC,CAAC,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC;QACb,MAAM,QAAQ,GAAG,IAAA,oCAAc,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YAEf,MAAM,IAAA,gDAAgB,EACrB,IAAI,wBAAS,CACZ,2FAA2F,CAC3F,EACD,kBAAkB,CAClB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAA,oCAAc,EAAC,KAAK,EAAE,aAAa,CAAC,IAAI,IAAI,EAAE,CAAC;IACrF,CAAC;IAGO,KAAK,CAAC,cAAc,CAC3B,IAAU,EACV,OAA0B,EAC1B,MAA6D;QAE7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,OAAkC,CAAC;QACnD,IACC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YACpC,OAAO,CAAC,gBAAgB,KAAK,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAC3D,CAAC;YACF,OAAO;QACR,CAAC;QAED,MAAM,OAAO,GAAG;YACf,GAAG,OAAO;YACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,EAAE;SAC/C,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;YACnE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IAWO,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,SAAiB;QACxE,MAAM,WAAW,GAAG,IAAA,qCAAe,EAClC,GAAG,SAAS,IAAI,WAAW,QAAQ,EACnC,YAAY,EACZ,iBAAiB,CACjB,CAAC;QACF,MAAM,UAAU,GAAG,GAAG,kBAAkB,GAAG,OAAO,EAAE,CAAC;QAErD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CACxC,KAAK,EACL,OAAO,EACP,6BAA6B,kBAAkB,CAAC,IAAA,kCAAY,EAAC,UAAU,CAAC,CAAC,IAAI,EAC7E;YACC,WAAW;YAGX,cAAc,EAAE,cAAc;YAG9B,IAAI,EAAE,CAAC,UAAU,CAAC;SAClB,EACD,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAC/B,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAA,oCAAc,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,CAAC;QAID,MAAM,QAAQ,GAAG,IAAA,oCAAc,EAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAA,oCAAc,EAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,QAAQ,IAAI,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAE/D,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAChC,KAAa,EACb,UAAkB,EAClB,WAAmB;QAEnB,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;YACjC,OAAO,EAAE,kBAAkB,IAAA,kCAAY,EAAC,UAAU,CAAC,GAAG;YACtD,OAAO,EAAE,sBAAsB;SAC/B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,iBAAiB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAGlB,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAA,oCAAc,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,oBAAQ,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAA,oCAAc,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAA,oCAAc,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,+BAAgB,CAAC,wDAAwD,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAA,oCAAc,EAAC,KAAK,EAAE,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC;IAC9F,CAAC;IAQO,KAAK,CAAC,iBAAiB,CAC9B,KAAa,EACb,QAAgB,EAChB,WAA+B;QAE/B,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,eAAe,CAC5B,KAAa,EACb,QAAgB,EAChB,WAA+B;QAE/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CACvC,KAAK,EACL,KAAK,EACL,iBAAiB,QAAQ,qCAAqC,CAC9D,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAA,oBAAQ,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,IAAA,oBAAQ,EAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAc,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAExF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,QAAQ,EAAE,EAAE;YACtF,sBAAsB,EAAE,oBAAoB,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACxE,GAAG,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACrD,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,EAAE,WAAW,CAAC,EAAE,EAAE;gBAC3D,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC;IACpB,CAAC;IAQO,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,QAAgB;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,iBAAiB,QAAQ,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO;QAEzB,MAAM,WAAW,GAAG,IAAA,oBAAQ,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,OAAO;QAExC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAA,oCAAc,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,IAAA,oCAAc,EAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW;gBAAE,SAAS;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG;gBAAE,SAAS;YAEnD,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,QAAQ,iBAAiB,EAAE;gBACnF,KAAK;aACL,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAOO,KAAK,CAAC,SAAS,CACtB,KAAa,EACb,QAAgB;QAEhB,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,QAA4B,CAAC;QAEjC,KAAK,MAAM,MAAM,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;YAC/B,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;YAEtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CACxC,KAAK,EACL,MAAM,EACN,iBAAiB,QAAQ,cAAc,EACvC;gBACC,kBAAkB,EAAE;oBACnB,WAAW,EAAE,mBAAmB;oBAChC,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;iBACtC;aACD,CACD,CAAC;YAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,IAAA,oCAAc,EAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACZ,MAAM,IAAI,+BAAgB,CAAC,mDAAmD,CAAC,CAAC;gBACjF,CAAC;gBACD,OAAO;oBACN,KAAK;oBACL,SAAS,EAAE,IAAA,oCAAc,EAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE;iBACpF,CAAC;YACH,CAAC;YACD,QAAQ,GAAG,IAAA,oCAAc,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAA,gDAAgB,EACrB,IAAI,wBAAS,CACZ,QAAQ,KAAK,6BAA6B;YACzC,CAAC,CAAC,oFAAoF;YACtF,CAAC,CAAC,2FAA2F,CAC9F,EACD,iBAAiB,CACjB,CAAC;IACH,CAAC;IAGO,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,KAAa;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAE1F,IACC,CAAC,QAAQ,CAAC,EAAE;YACZ,IAAA,oCAAc,EAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,yCAAyC,EAC1E,CAAC;YACF,MAAM,IAAI,+BAAgB,CAAC,4DAA4D,CAAC,CAAC;QAC1F,CAAC;IACF,CAAC;IAEO,iBAAiB,CAAC,UAAkB,EAAE,IAAwB;QACrE,IAAI,UAAU,KAAK,GAAG,IAAI,IAAI,KAAK,6BAA6B,EAAE,CAAC;YAClE,OAAO,IAAA,gDAAgB,EACtB,IAAI,wBAAS,CACZ,oFAAoF,CACpF,EACD,sBAAsB,CACtB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,+BAAgB,CAAC,mDAAmD,CAAC,CAAC;IAClF,CAAC;IAMO,KAAK,CAAC,yBAAyB,CAAC,OAAiC;QAQxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,oCAAoC,CAChF,OAAO,CAAC,IAAI,EACZ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAChC,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;YAChC,IAAI,SAAS,CAAC,IAAI,KAAK,QAAA,mBAAmB;gBAAE,SAAS;YACrD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAC3E,SAAS,CAAC,EAAE,EACZ,OAAO,CAAC,IAAI,EACZ,CAAC,iBAAiB,CAAC,CACnB,CAAC;YACF,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,QAAQ,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;YAC1D,IAAI,QAAQ,IAAI,IAAA,oCAAc,EAAC,IAAI,EAAE,uBAAuB,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAMhC;QAQA,MAAM,YAAY,GAAG,KAAK,CAAC,kBAAkB;YAC5C,CAAC,CAAE,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAGtE;YACH,CAAC,CAAC,EAAE,CAAC;QAMN,MAAM,aAAa,GAClB,CAAC,YAAY,CAAC,QAAQ,KAAK,SAAS,IAAI,YAAY,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;YACjF,CAAC,YAAY,CAAC,QAAQ,KAAK,SAAS,IAAI,YAAY,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpF,IAAI,aAAa,EAAE,CAAC;YACnB,OAAO,YAAY,CAAC,mBAAmB,CAAC;YACxC,OAAO,YAAY,CAAC,sBAAsB,CAAC;YAC3C,OAAO,YAAY,CAAC,mBAAmB,CAAC;YAExC,OAAO,YAAY,CAAC,YAAY,CAAC;YACjC,OAAO,YAAY,CAAC,mBAAmB,CAAC;QAGzC,CAAC;QAED,MAAM,IAAI,GAAG;YACZ,GAAG,YAAY;YACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK;YACzB,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YAGhC,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;YACpC,qBAAqB,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC5C,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACtD,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;SACvC,CAAC;QAEF,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;gBACnE,EAAE,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE;gBAC/B,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,IAAI;gBACnC,IAAI,EAAE,QAAA,mBAAmB;gBACzB,IAAI;aACJ,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CACnC,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAC3B,SAAS,EACT,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAC1C,IAAI,CACJ,CAAC;YACF,OAAO,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,yBAAyB,CACtE;YACC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW;YAC3B,IAAI,EAAE,QAAA,mBAAmB;YACzB,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;SAClC,EACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAClB,CAAC;QACF,OAAO,OAAO,CAAC,EAAE,CAAC;IACnB,CAAC;CACD,CAAA;;wCAjeY,6BAA6B;IADzC,IAAA,YAAO,GAAE;qCAGgB,uCAAiB,EAChB,sDAAwB,EACZ,wCAAkB,EACZ,2CAAwB,EACtC,6BAAU;GAN5B,6BAA6B,CAiezC"}

package/dist/modules/agents/integrations/platforms/teams/teams-graph-permissions.d.ts

@@ -0,0 +1,4 @@
+export declare const GRAPH_APP_ROLES: ReadonlyArray<{
+    permission: string;
+    id: string;
+}>;

package/dist/modules/agents/integrations/platforms/teams/teams-graph-permissions.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GRAPH_APP_ROLES = void 0;
+exports.GRAPH_APP_ROLES = [
+    { permission: 'Files.Read.All', id: '01d4889c-1287-42c6-ac1f-5d1e02578ef6' },
+    { permission: 'User.ReadBasic.All', id: '97235f07-e226-4f63-ace3-39588e11d3a1' },
+    { permission: 'Team.ReadBasic.All', id: '2280dda6-0bfd-44ee-a2f4-cb867cfc4c1e' },
+    { permission: 'Channel.ReadBasic.All', id: '59a6b24b-4225-4393-8165-ebaec5f55d7a' },
+];
+//# sourceMappingURL=teams-graph-permissions.js.map

package/dist/modules/agents/integrations/platforms/teams/teams-graph-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-graph-permissions.js","sourceRoot":"","sources":["../../../../../../src/modules/agents/integrations/platforms/teams/teams-graph-permissions.ts"],"names":[],"mappings":";;;AACa,QAAA,eAAe,GAAsD;IACjF,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,EAAE,sCAAsC,EAAE;IAC5E,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE,EAAE,sCAAsC,EAAE;IAChF,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE,EAAE,sCAAsC,EAAE;IAChF,EAAE,UAAU,EAAE,uBAAuB,EAAE,EAAE,EAAE,sCAAsC,EAAE;CACnF,CAAC"}

package/dist/modules/agents/integrations/platforms/teams/teams-graph.service.d.ts

@@ -0,0 +1,19 @@
+import { Logger } from '@n8n/backend-common';
+import { OutboundHttp } from '@n8n/backend-network';
+export interface GraphResponse {
+    statusCode: number;
+    body: unknown;
+    ok: boolean;
+}
+export declare class TeamsGraphService {
+    private readonly outboundHttp;
+    private readonly logger;
+    constructor(outboundHttp: OutboundHttp, logger: Logger);
+    request(accessToken: string, method: 'GET' | 'POST' | 'PATCH' | 'DELETE', path: string, body?: unknown, headers?: Record<string, string>): Promise<GraphResponse>;
+    postZip(accessToken: string, path: string, archive: Buffer): Promise<GraphResponse>;
+}
+export declare const odataLiteral: (value: string) => string;
+export declare function graphErrorCode(body: unknown): string | undefined;
+export declare function graphErrorMessage(body: unknown): string | undefined;
+export declare function graphInnerErrorCode(body: unknown): string | undefined;
+export declare function describeGraphError(body: unknown): string | undefined;

package/dist/modules/agents/integrations/platforms/teams/teams-graph.service.js

@@ -0,0 +1,128 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.odataLiteral = exports.TeamsGraphService = void 0;
+exports.graphErrorCode = graphErrorCode;
+exports.graphErrorMessage = graphErrorMessage;
+exports.graphInnerErrorCode = graphInnerErrorCode;
+exports.describeGraphError = describeGraphError;
+const backend_common_1 = require("@n8n/backend-common");
+const backend_network_1 = require("@n8n/backend-network");
+const di_1 = require("@n8n/di");
+const is_record_1 = require("@n8n/utils/is-record");
+const n8n_workflow_1 = require("n8n-workflow");
+const integration_helpers_1 = require("../../integration-helpers");
+const GRAPH_BASE_URL = 'https://graph.microsoft.com/v1.0';
+const GRAPH_TIMEOUT_MS = 30_000;
+function graphUrl(path) {
+    let parsed;
+    try {
+        parsed = new URL(`${GRAPH_BASE_URL}${path}`);
+    }
+    catch {
+        throw new n8n_workflow_1.UnexpectedError('Refusing to send a Microsoft Graph token to a path that is not a URL.');
+    }
+    if (!parsed.href.startsWith(`${GRAPH_BASE_URL}/`)) {
+        throw new n8n_workflow_1.UnexpectedError('Refusing to send a Microsoft Graph token elsewhere.');
+    }
+    return parsed.href;
+}
+let TeamsGraphService = class TeamsGraphService {
+    constructor(outboundHttp, logger) {
+        this.outboundHttp = outboundHttp;
+        this.logger = logger;
+    }
+    async request(accessToken, method, path, body, headers = {}) {
+        const response = await this.outboundHttp
+            .requests({ useDefaultSsrfPolicy: 'unsafe' })
+            .request({
+            method,
+            url: graphUrl(path),
+            headers: {
+                authorization: `Bearer ${accessToken}`,
+                'content-type': 'application/json',
+                ...headers,
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+            returnFullResponse: true,
+            ignoreHttpStatusErrors: true,
+            timeout: GRAPH_TIMEOUT_MS,
+        });
+        const ok = response.statusCode >= 200 && response.statusCode < 300;
+        if (!ok) {
+            this.logger.debug('[TeamsGraph] Graph refused a call', {
+                method,
+                path,
+                statusCode: response.statusCode,
+                error: describeGraphError(response.body) ?? graphErrorCode(response.body),
+            });
+        }
+        return { statusCode: response.statusCode, body: response.body, ok };
+    }
+    async postZip(accessToken, path, archive) {
+        const response = await this.outboundHttp
+            .requests({ useDefaultSsrfPolicy: 'unsafe' })
+            .request({
+            method: 'POST',
+            url: graphUrl(path),
+            headers: {
+                authorization: `Bearer ${accessToken}`,
+                'content-type': 'application/zip',
+            },
+            body: archive,
+            returnFullResponse: true,
+            ignoreHttpStatusErrors: true,
+            timeout: GRAPH_TIMEOUT_MS,
+        });
+        const ok = response.statusCode >= 200 && response.statusCode < 300;
+        if (!ok) {
+            this.logger.warn('[TeamsGraph] Graph refused the app package', {
+                path,
+                statusCode: response.statusCode,
+                error: describeGraphError(response.body) ?? graphErrorCode(response.body),
+            });
+        }
+        return { statusCode: response.statusCode, body: response.body, ok };
+    }
+};
+exports.TeamsGraphService = TeamsGraphService;
+exports.TeamsGraphService = TeamsGraphService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_network_1.OutboundHttp, backend_common_1.Logger])
+], TeamsGraphService);
+const odataLiteral = (value) => value.replace(/'/g, "''");
+exports.odataLiteral = odataLiteral;
+function graphErrorCode(body) {
+    if (!(0, is_record_1.isRecord)(body))
+        return undefined;
+    const error = body.error;
+    return (0, is_record_1.isRecord)(error) ? (0, integration_helpers_1.stringProperty)(error, 'code') : undefined;
+}
+function graphErrorMessage(body) {
+    if (!(0, is_record_1.isRecord)(body))
+        return undefined;
+    const error = body.error;
+    return (0, is_record_1.isRecord)(error) ? (0, integration_helpers_1.stringProperty)(error, 'message') : undefined;
+}
+function graphInnerErrorCode(body) {
+    if (!(0, is_record_1.isRecord)(body))
+        return undefined;
+    const error = body.error;
+    if (!(0, is_record_1.isRecord)(error))
+        return undefined;
+    const inner = error.innerError;
+    return (0, is_record_1.isRecord)(inner) ? (0, integration_helpers_1.stringProperty)(inner, 'code') : undefined;
+}
+function describeGraphError(body) {
+    const parts = [graphInnerErrorCode(body) ?? graphErrorCode(body), graphErrorMessage(body)].filter((part) => typeof part === 'string' && part.length > 0);
+    return parts.length > 0 ? parts.join(': ') : undefined;
+}
+//# sourceMappingURL=teams-graph.service.js.map

package/dist/modules/agents/integrations/platforms/teams/teams-graph.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-graph.service.js","sourceRoot":"","sources":["../../../../../../src/modules/agents/integrations/platforms/teams/teams-graph.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAA6C;AAC7C,0DAAoD;AACpD,gCAAkC;AAClC,oDAAgD;AAChD,+CAA+C;AAE/C,mEAA2D;AAE3D,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAQhC,SAAS,QAAQ,CAAC,IAAY;IAC7B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,8BAAe,CACxB,uEAAuE,CACvE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,8BAAe,CAAC,qDAAqD,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAgBM,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC7B,YACkB,YAA0B,EAC1B,MAAc;4BADd,YAAY;sBACZ,MAAM;IACrB,CAAC;IAEJ,KAAK,CAAC,OAAO,CACZ,WAAmB,EACnB,MAA2C,EAC3C,IAAY,EACZ,IAAc,EAEd,OAAO,GAA2B,EAAE;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY;aAEtC,QAAQ,CAAC,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;aAC5C,OAAO,CAAC;YACR,MAAM;YACN,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,cAAc,EAAE,kBAAkB;gBAClC,GAAG,OAAO;aACV;YACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3D,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,OAAO,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEJ,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QACnE,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;gBACtD,MAAM;gBACN,IAAI;gBACJ,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;aACzE,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACrE,CAAC;IAMD,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,IAAY,EAAE,OAAe;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY;aAEtC,QAAQ,CAAC,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;aAC5C,OAAO,CAAC;YACR,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,cAAc,EAAE,iBAAiB;aACjC;YACD,IAAI,EAAE,OAAO;YACb,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,OAAO,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEJ,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QACnE,IAAI,CAAC,EAAE,EAAE,CAAC;YAGT,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;gBAC9D,IAAI;gBACJ,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;aACzE,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACrE,CAAC;CACD,CAAA;;4BA5EY,iBAAiB;IAD7B,IAAA,YAAO,GAAE;qCAGuB,8BAAY,EAClB,uBAAM;GAHpB,iBAAiB,CA4E7B;AAGM,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAA5D,QAAA,YAAY,GAAZ,YAAY,CAAgD;AAGzE,wBAA+B,IAAa;IAC3C,IAAI,CAAC,IAAA,oBAAQ,EAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,OAAO,IAAA,oBAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,oCAAc,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,2BAAkC,IAAa;IAC9C,IAAI,CAAC,IAAA,oBAAQ,EAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,OAAO,IAAA,oBAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,oCAAc,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAOD,6BAAoC,IAAa;IAChD,IAAI,CAAC,IAAA,oBAAQ,EAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,CAAC,IAAA,oBAAQ,EAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC;IAC/B,OAAO,IAAA,oBAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,oCAAc,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAMD,4BAAmC,IAAa;IAC/C,MAAM,KAAK,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAChG,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CACrE,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC"}

package/dist/modules/agents/integrations/platforms/teams/teams-integration.d.ts

@@ -1,13 +1,15 @@
-import type { AgentIntegrationConfig, RichCardComponentType } from '@n8n/api-types';
+import type { AgentIntegrationConfig, AgentIntegrationDisconnectWarning, RichCardComponentType } from '@n8n/api-types';
 import { Logger } from '@n8n/backend-common';
+import type { Attachment, Message, Thread } from 'chat';
 import { AgentRepository } from '../../../repositories/agent.repository';
-import { AgentChatIntegration, type AgentChannelPreconditionContext, type AgentChatIntegrationContext, type BridgeExecutionContext, type BridgeMessageContextParams, type BridgeResumeExecutionContext } from '../../agent-chat-integration';
+import { AgentChatIntegration, type AgentChannelPreconditionContext, type AgentChatIntegrationContext, type AgentIntegrationRemovalContext, type BridgeExecutionContext, type BridgeMessageContextParams, type BridgeResumeExecutionContext, type PlatformContextQueryParams } from '../../agent-chat-integration';
 import { type SuspendComponent } from '../../component-mapper';
-import type { ReplyExpectation } from '../../integration-tool-types';
+import type { IntegrationAction, ReplyExpectation } from '../../integration-tool-types';
 export declare class TeamsIntegration extends AgentChatIntegration {
     private readonly logger;
     private readonly agentRepository;
     readonly type = "teams";
+    onRemove(ctx: AgentIntegrationRemovalContext): Promise<AgentIntegrationDisconnectWarning | undefined>;
     readonly credentialTypes: string[];
     readonly displayLabel = "Microsoft Teams";
     readonly displayIcon = "teams";
@@ -18,6 +20,8 @@ export declare class TeamsIntegration extends AgentChatIntegration {
         useNodeToolWhen: string[];
     };
     readonly supportedComponents: readonly RichCardComponentType[];
+    readonly contextToolDefinitions: import("../../integration-tool-types").IntegrationContextQueryDefinition[];
+    readonly contextToolGuidance: string[];
     readonly actionToolDefinitions: import("../../integration-tool-types").IntegrationActionDefinition[];
     readonly actionToolGuidance: string[];
     readonly targetSuspensionCardAtActingUser = true;
@@ -36,6 +40,16 @@ export declare class TeamsIntegration extends AgentChatIntegration {
         };
         isNewMention: boolean;
     }): ReplyExpectation;
+    normalizeChannelId(channelId: string, adapter: unknown): string;
+    describeActionError(action: IntegrationAction, error: unknown): {
+        code: "PERMISSION_NOT_GRANTED";
+        message: string;
+    } | undefined;
+    executeContextQuery(params: PlatformContextQueryParams): Promise<unknown>;
+    fetchInboundAttachments({ thread, message, }: {
+        thread: Thread<unknown, unknown>;
+        message: Message<unknown>;
+    }): Promise<Attachment[]>;
     constructor(logger: Logger, agentRepository: AgentRepository);
     createAdapter(ctx: AgentChatIntegrationContext): Promise<unknown>;
     assertStartupPreconditions(ctx: AgentChannelPreconditionContext): Promise<void>;