Google Workspace

{
  "skill_name": "google-workspace",
  "version": "1.1.0",
  "evals": [
    {
      "id": 1,
      "prompt": "I need an internal approvals workflow where a Google Form writes to Sheets, reviewers get reminder emails, and approved rows create calendar events. What Workspace surface should own this and what auth model should I start with?",
      "expected_behavior": "Treats the request as a multi-service workflow, identifies Forms + Sheets + Gmail + Calendar, chooses Apps Script or a lightweight backend based on runtime ownership, and explains the auth choice before any API-specific code.",
      "assertions": [
        "Classifies the job as a cross-service workflow rather than a single API call",
        "Names the relevant Workspace products",
        "Chooses an execution surface with rationale",
        "States an auth model and why it fits"
      ]
    },
    {
      "id": 2,
      "prompt": "Create a Google Doc titled 'Q1 2026 Report', replace {{owner}} with 'Alice', and store the document in a shared Drive folder for the team.",
      "expected_behavior": "Routes to Docs plus Drive, identifies required object IDs or lookup steps, and produces an execution packet covering document creation, placeholder replacement, destination folder, and sharing/ownership considerations.",
      "assertions": [
        "Routes to Docs as the primary content surface and Drive as the storage/sharing surface",
        "Mentions document creation plus placeholder replacement or batch update",
        "Calls out the destination folder / shared Drive requirement",
        "Notes ownership or permission considerations"
      ]
    },
    {
      "id": 3,
      "prompt": "We run a backend service that sends weekly Gmail summaries and updates a Sheet with delivery status. Should this live in Apps Script or direct REST APIs?",
      "expected_behavior": "Prefers direct REST APIs for a backend-owned scheduled integration, explains why Apps Script is less ideal here, and names Gmail plus Sheets as the service bundle.",
      "assertions": [
        "Chooses direct REST APIs or an equivalent backend-owned route",
        "Explains why Apps Script is not the best default for this case",
        "Names Gmail and Sheets",
        "Mentions scheduling / backend ownership as decision factors"
      ]
    },
    {
      "id": 4,
      "prompt": "Suspend a departing employee, move them to a different org unit, and review their group memberships across the Workspace domain.",
      "expected_behavior": "Routes immediately to Admin SDK / admin APIs, separates admin identity from ordinary content operations, and calls out delegated admin or domain-wide delegation needs.",
      "assertions": [
        "Routes to Admin SDK rather than Docs/Drive/Gmail content APIs",
        "Separates admin operations from ordinary content tasks",
        "Calls out delegated admin or domain-wide delegation",
        "Mentions users, groups, or org units explicitly"
      ]
    },
    {
      "id": 5,
      "prompt": "구글 스프레드시트 승인 큐를 만들고 상태가 바뀌면 지메일 알림을 보내고 싶어. Apps Script로 끝내도 될까?",
      "expected_behavior": "Understands the Korean prompt, treats it as a Sheets + Gmail approvals workflow, evaluates whether Apps Script is sufficient, and mentions quota/runtime considerations for trigger-heavy flows.",
      "assertions": [
        "Correctly identifies Sheets and Gmail from the Korean prompt",
        "Evaluates Apps Script as a possible route rather than blindly assuming it",
        "Mentions trigger or quota/runtime considerations",
        "Produces a workflow-oriented answer instead of isolated API snippets"
      ]
    }
  ]
}

#!/usr/bin/env bash
# auth-setup.sh — Google Workspace authentication setup helper
# Usage:
#   bash auth-setup.sh --oauth2 credentials.json
#   bash auth-setup.sh --service-account service-account-key.json [--subject admin@yourdomain.com]
#   bash auth-setup.sh --check

set -euo pipefail

MODE=""
CREDS_FILE=""
SUBJECT=""
TOKEN_DIR="${HOME}/.config/gws-agent"

usage() {
  cat <<EOF
Usage: $0 [OPTIONS]

Options:
  --oauth2 <credentials.json>       OAuth2 user auth (interactive browser flow)
  --service-account <key.json>      Service account auth
  --subject <email>                 Impersonate user (for domain-wide delegation)
  --check                           Check current auth status
  --token-dir <dir>                 Custom token storage dir (default: ~/.config/gws-agent)
  -h, --help                        Show this help

Examples:
  $0 --oauth2 ~/credentials.json
  $0 --service-account ~/sa-key.json --subject admin@company.com
  $0 --check
EOF
}

# Parse args
while [[ $# -gt 0 ]]; do
  case "$1" in
    --oauth2)         MODE="oauth2";   CREDS_FILE="${2:-}"; shift 2 ;;
    --service-account) MODE="sa";      CREDS_FILE="${2:-}"; shift 2 ;;
    --subject)        SUBJECT="${2:-}"; shift 2 ;;
    --token-dir)      TOKEN_DIR="${2:-}"; shift 2 ;;
    --check)          MODE="check";    shift ;;
    -h|--help)        usage; exit 0 ;;
    *) echo "Unknown option: $1"; usage; exit 1 ;;
  esac
done

# Verify Python and libraries
check_deps() {
  if ! command -v python3 &>/dev/null; then
    echo "❌ python3 not found. Install Python 3.8+"
    exit 1
  fi
  python3 -c "import googleapiclient, google_auth_oauthlib" 2>/dev/null || {
    echo "📦 Installing Google API client libraries..."
    pip install --quiet google-api-python-client google-auth-httplib2 google-auth-oauthlib
  }
}

# Check auth status
check_auth() {
  TOKEN_FILE="${TOKEN_DIR}/token.json"
  SA_FILE="${TOKEN_DIR}/service-account.json"
  echo "=== Google Workspace Auth Status ==="
  echo "Token dir: ${TOKEN_DIR}"
  if [[ -f "$TOKEN_FILE" ]]; then
    echo "✅ OAuth2 token found: $TOKEN_FILE"
    python3 - <<'PYEOF'
import json, sys
from pathlib import Path
token_file = Path.home() / '.config/gws-agent/token.json'
try:
    t = json.loads(token_file.read_text())
    print(f"   Account: {t.get('client_id','unknown')[:20]}...")
    print(f"   Scopes:  {', '.join(t.get('scopes',[]))}")
    print(f"   Expired: {t.get('expiry','unknown')}")
except Exception as e:
    print(f"   (Could not parse token: {e})")
PYEOF
  else
    echo "⚠️  No OAuth2 token at: $TOKEN_FILE"
    echo "   Run: $0 --oauth2 credentials.json"
  fi
  if [[ -f "$SA_FILE" ]]; then
    echo "✅ Service account key found: $SA_FILE"
    python3 -c "
import json
from pathlib import Path
sa = json.loads(Path.home().joinpath('.config/gws-agent/service-account.json').read_text())
print(f'   Email: {sa.get(\"client_email\",\"unknown\")}')
print(f'   Project: {sa.get(\"project_id\",\"unknown\")}')
"
  else
    echo "⚠️  No service account key at: $SA_FILE"
  fi
  echo "====================================="
}

# OAuth2 setup
setup_oauth2() {
  if [[ -z "$CREDS_FILE" || ! -f "$CREDS_FILE" ]]; then
    echo "❌ credentials.json not found: '${CREDS_FILE}'"
    echo ""
    echo "To get credentials.json:"
    echo "  1. Go to https://console.cloud.google.com/apis/credentials"
    echo "  2. Create credentials > OAuth 2.0 Client ID > Desktop app"
    echo "  3. Download JSON and provide its path"
    exit 1
  fi

  mkdir -p "$TOKEN_DIR"
  cp "$CREDS_FILE" "${TOKEN_DIR}/credentials.json"

  echo "🔐 Starting OAuth2 browser flow..."
  python3 - <<PYEOF
import os, json
from pathlib import Path
from google_auth_oauthlib.flow import InstalledAppFlow
from googleapiclient.discovery import build

SCOPES = [
    'https://www.googleapis.com/auth/documents',
    'https://www.googleapis.com/auth/spreadsheets',
    'https://www.googleapis.com/auth/presentations',
    'https://www.googleapis.com/auth/drive',
    'https://www.googleapis.com/auth/gmail.modify',
    'https://www.googleapis.com/auth/calendar',
    'https://www.googleapis.com/auth/chat.messages',
    'https://www.googleapis.com/auth/forms.body',
]

token_dir = Path(os.environ.get('TOKEN_DIR', Path.home() / '.config/gws-agent'))
creds_file = token_dir / 'credentials.json'
token_file = token_dir / 'token.json'

flow = InstalledAppFlow.from_client_secrets_file(str(creds_file), SCOPES)
creds = flow.run_local_server(port=0)

import json
token_file.write_text(json.dumps({
    'token':    creds.token,
    'refresh_token': creds.refresh_token,
    'token_uri':     creds.token_uri,
    'client_id':     creds.client_id,
    'client_secret': creds.client_secret,
    'scopes':        list(creds.scopes or []),
}))
print(f"✅ Token saved to: {token_file}")
print(f"   Authorized scopes: {len(creds.scopes or [])} scopes")
PYEOF
}

# Service account setup
setup_service_account() {
  if [[ -z "$CREDS_FILE" || ! -f "$CREDS_FILE" ]]; then
    echo "❌ Service account key file not found: '${CREDS_FILE}'"
    echo ""
    echo "To get a service account key:"
    echo "  1. Go to https://console.cloud.google.com/iam-admin/serviceaccounts"
    echo "  2. Create service account > Add key > JSON"
    echo "  3. For Admin SDK: grant domain-wide delegation in Google Admin console"
    exit 1
  fi

  mkdir -p "$TOKEN_DIR"
  cp "$CREDS_FILE" "${TOKEN_DIR}/service-account.json"

  python3 - <<PYEOF
import json, os
from pathlib import Path
sa_file = Path(os.environ.get('TOKEN_DIR', Path.home() / '.config/gws-agent')) / 'service-account.json'
sa = json.loads(sa_file.read_text())
print(f"✅ Service account key saved")
print(f"   Email:   {sa.get('client_email','?')}")
print(f"   Project: {sa.get('project_id','?')}")
subject = os.environ.get('SUBJECT','')
if subject:
    print(f"   Subject: {subject} (domain-wide delegation)")
PYEOF

  if [[ -n "$SUBJECT" ]]; then
    echo "$SUBJECT" > "${TOKEN_DIR}/.subject"
    echo "✅ Delegation subject saved: $SUBJECT"
  fi
}

# Main
check_deps
export TOKEN_DIR SUBJECT

case "$MODE" in
  oauth2)  setup_oauth2 ;;
  sa)      setup_service_account ;;
  check)   check_auth ;;
  "")      usage; exit 0 ;;
esac

#!/usr/bin/env python3
"""
gws-helper.py — Google Workspace AI agent helper
Builds authenticated service clients for all Workspace APIs.

Usage (as a library):
    from gws_helper import GWSClient
    gws = GWSClient()
    doc = gws.docs.documents().create(body={'title': 'Test'}).execute()

Usage (CLI):
    python3 gws-helper.py --check
    python3 gws-helper.py --create-doc "My Document"
    python3 gws-helper.py --list-drive
    python3 gws-helper.py --send-email --to alice@example.com --subject "Hello" --body "World"
"""

import argparse
import base64
import json
import os
import sys
import time
from email.mime.text import MIMEText
from pathlib import Path
from typing import Optional

# ---------------------------------------------------------------------------
# Auth helpers
# ---------------------------------------------------------------------------

TOKEN_DIR = Path(os.environ.get('GWS_TOKEN_DIR', Path.home() / '.config/gws-agent'))

SCOPES = [
    'https://www.googleapis.com/auth/documents',
    'https://www.googleapis.com/auth/spreadsheets',
    'https://www.googleapis.com/auth/presentations',
    'https://www.googleapis.com/auth/drive',
    'https://www.googleapis.com/auth/gmail.modify',
    'https://www.googleapis.com/auth/calendar',
    'https://www.googleapis.com/auth/chat.messages',
    'https://www.googleapis.com/auth/forms.body',
]


def _load_oauth2_creds():
    try:
        from google.oauth2.credentials import Credentials
        from google.auth.transport.requests import Request
        from google_auth_oauthlib.flow import InstalledAppFlow
    except ImportError:
        raise RuntimeError("Run: pip install google-api-python-client google-auth-oauthlib")

    token_file = TOKEN_DIR / 'token.json'
    creds = None

    if token_file.exists():
        creds = Credentials.from_authorized_user_file(str(token_file), SCOPES)

    if not creds or not creds.valid:
        if creds and creds.expired and creds.refresh_token:
            creds.refresh(Request())
        else:
            creds_file = TOKEN_DIR / 'credentials.json'
            if not creds_file.exists():
                raise FileNotFoundError(
                    f"credentials.json not found at {creds_file}\n"
                    "Run: bash scripts/auth-setup.sh --oauth2 credentials.json"
                )
            flow = InstalledAppFlow.from_client_secrets_file(str(creds_file), SCOPES)
            creds = flow.run_local_server(port=0)

        token_file.write_text(creds.to_json())

    return creds


def _load_sa_creds(subject: Optional[str] = None):
    try:
        from google.oauth2 import service_account
    except ImportError:
        raise RuntimeError("Run: pip install google-auth")

    sa_file = TOKEN_DIR / 'service-account.json'
    if not sa_file.exists():
        raise FileNotFoundError(
            f"Service account key not found at {sa_file}\n"
            "Run: bash scripts/auth-setup.sh --service-account <key.json>"
        )

    sa_scopes = [
        'https://www.googleapis.com/auth/admin.directory.user',
        'https://www.googleapis.com/auth/admin.directory.group',
        'https://www.googleapis.com/auth/drive',
        'https://www.googleapis.com/auth/documents',
        'https://www.googleapis.com/auth/spreadsheets',
    ]

    creds = service_account.Credentials.from_service_account_file(
        str(sa_file), scopes=sa_scopes
    )

    # Use saved subject if available
    if not subject:
        subj_file = TOKEN_DIR / '.subject'
        if subj_file.exists():
            subject = subj_file.read_text().strip()

    if subject:
        creds = creds.with_subject(subject)

    return creds


def get_credentials(mode: str = 'auto', subject: Optional[str] = None):
    """Return Google credentials. mode: 'oauth2' | 'sa' | 'auto'"""
    if mode == 'sa':
        return _load_sa_creds(subject)
    if mode == 'oauth2':
        return _load_oauth2_creds()
    # auto: try SA first, fall back to OAuth2
    sa_file = TOKEN_DIR / 'service-account.json'
    if sa_file.exists():
        return _load_sa_creds(subject)
    return _load_oauth2_creds()


# ---------------------------------------------------------------------------
# Client builder
# ---------------------------------------------------------------------------

class GWSClient:
    """Authenticated Google Workspace service clients."""

    def __init__(self, auth_mode: str = 'auto', subject: Optional[str] = None):
        try:
            from googleapiclient.discovery import build
        except ImportError:
            raise RuntimeError("Run: pip install google-api-python-client")

        creds = get_credentials(mode=auth_mode, subject=subject)
        self._build = lambda svc, ver: build(svc, ver, credentials=creds)
        self._creds = creds

    @property
    def docs(self):
        return self._build('docs', 'v1')

    @property
    def sheets(self):
        return self._build('sheets', 'v4')

    @property
    def slides(self):
        return self._build('slides', 'v1')

    @property
    def drive(self):
        return self._build('drive', 'v3')

    @property
    def gmail(self):
        return self._build('gmail', 'v1')

    @property
    def calendar(self):
        return self._build('calendar', 'v3')

    @property
    def chat(self):
        return self._build('chat', 'v1')

    @property
    def forms(self):
        return self._build('forms', 'v1')

    @property
    def admin(self):
        return self._build('admin', 'directory_v1')

    @property
    def script(self):
        return self._build('script', 'v1')


# ---------------------------------------------------------------------------
# Utility functions
# ---------------------------------------------------------------------------

def api_call_with_retry(func, *args, max_retries: int = 5, **kwargs):
    """Execute a Google API call with exponential backoff on 429/503."""
    from googleapiclient.errors import HttpError
    for attempt in range(max_retries):
        try:
            return func(*args, **kwargs).execute()
        except HttpError as e:
            if e.resp.status in (429, 503) and attempt < max_retries - 1:
                wait = (2 ** attempt) + 0.1
                print(f"  Rate limit (attempt {attempt+1}/{max_retries}), waiting {wait:.1f}s...")
                time.sleep(wait)
            else:
                raise


def create_doc_from_template(drive, docs, template_id: str, replacements: dict,
                               dest_folder_id: Optional[str] = None) -> str:
    """Clone a template Google Doc and fill placeholders. Returns new doc ID."""
    body = {'name': replacements.get('{{title}}', 'New Document')}
    if dest_folder_id:
        body['parents'] = [dest_folder_id]
    copy = api_call_with_retry(drive.files().copy, fileId=template_id, body=body)
    new_id = copy['id']
    requests = [
        {'replaceAllText': {
            'containsText': {'text': k, 'matchCase': False},
            'replaceText': v
        }}
        for k, v in replacements.items()
    ]
    if requests:
        api_call_with_retry(
            docs.documents().batchUpdate,
            documentId=new_id, body={'requests': requests}
        )
    return new_id


def send_email(gmail, to: str, subject: str, body: str,
               attachments: Optional[list] = None) -> dict:
    """Send a plain text email, optionally with file attachments."""
    from email.mime.multipart import MIMEMultipart
    from email.mime.application import MIMEApplication

    if attachments:
        msg = MIMEMultipart()
        msg['to'] = to
        msg['subject'] = subject
        msg.attach(MIMEText(body))
        for path in attachments:
            path = Path(path)
            with open(path, 'rb') as f:
                part = MIMEApplication(f.read(), Name=path.name)
            part['Content-Disposition'] = f'attachment; filename="{path.name}"'
            msg.attach(part)
    else:
        msg = MIMEText(body)
        msg['to'] = to
        msg['subject'] = subject

    raw = base64.urlsafe_b64encode(msg.as_bytes()).decode()
    return api_call_with_retry(
        gmail.users().messages().send, userId='me', body={'raw': raw}
    )


def append_rows_to_sheet(sheets, spreadsheet_id: str, sheet_name: str, rows: list) -> dict:
    """Append rows to a Google Sheet."""
    return api_call_with_retry(
        sheets.spreadsheets().values().append,
        spreadsheetId=spreadsheet_id,
        range=f'{sheet_name}!A1',
        valueInputOption='USER_ENTERED',
        insertDataOption='INSERT_ROWS',
        body={'values': rows}
    )


def export_doc_to_pdf(drive, doc_id: str, output_path: str) -> str:
    """Export a Google Doc to PDF and save locally."""
    import io
    from googleapiclient.http import MediaIoBaseDownload
    request = drive.files().export_media(fileId=doc_id, mimeType='application/pdf')
    fh = io.BytesIO()
    downloader = MediaIoBaseDownload(fh, request)
    done = False
    while not done:
        _, done = downloader.next_chunk()
    with open(output_path, 'wb') as f:
        f.write(fh.getvalue())
    return output_path


# ---------------------------------------------------------------------------
# CLI
# ---------------------------------------------------------------------------

def main():
    parser = argparse.ArgumentParser(description='Google Workspace AI agent helper')
    parser.add_argument('--auth-mode', choices=['auto', 'oauth2', 'sa'], default='auto')
    parser.add_argument('--subject', help='Delegation subject email')
    parser.add_argument('--check', action='store_true', help='Check auth and list APIs')

    # Docs
    parser.add_argument('--create-doc', metavar='TITLE', help='Create a new Google Doc')

    # Sheets
    parser.add_argument('--create-sheet', metavar='TITLE', help='Create a new Google Sheet')

    # Drive
    parser.add_argument('--list-drive', action='store_true', help='List recent Drive files')
    parser.add_argument('--create-folder', metavar='NAME', help='Create a Drive folder')
    parser.add_argument('--share', metavar='FILE_ID', help='Share a file (use with --email)')
    parser.add_argument('--email', help='Email address for sharing')

    # Gmail
    parser.add_argument('--send-email', action='store_true', help='Send an email')
    parser.add_argument('--to', help='Recipient email address')
    parser.add_argument('--subject', dest='email_subject', help='Email subject')
    parser.add_argument('--body', help='Email body text')
    parser.add_argument('--attach', nargs='+', help='File paths to attach')

    # Calendar
    parser.add_argument('--list-events', action='store_true', help='List today\'s events')

    args = parser.parse_args()

    if args.check:
        from pathlib import Path
        token_dir = TOKEN_DIR
        print(f"Token dir: {token_dir}")
        print(f"OAuth2 token: {'✅ found' if (token_dir/'token.json').exists() else '❌ missing'}")
        print(f"Service account: {'✅ found' if (token_dir/'service-account.json').exists() else '❌ missing'}")
        return

    gws = GWSClient(auth_mode=args.auth_mode, subject=args.subject)

    if args.create_doc:
        doc = gws.docs.documents().create(body={'title': args.create_doc}).execute()
        print(json.dumps({
            'documentId': doc['documentId'],
            'title': doc.get('title'),
            'url': f"https://docs.google.com/document/d/{doc['documentId']}/edit"
        }, indent=2))

    elif args.create_sheet:
        ss = gws.sheets.spreadsheets().create(body={
            'properties': {'title': args.create_sheet}
        }).execute()
        print(json.dumps({
            'spreadsheetId': ss['spreadsheetId'],
            'title': ss['properties']['title'],
            'url': ss['spreadsheetUrl']
        }, indent=2))

    elif args.list_drive:
        results = gws.drive.files().list(
            pageSize=20,
            fields='files(id, name, mimeType, modifiedTime, webViewLink)',
            orderBy='modifiedTime desc'
        ).execute()
        files = results.get('files', [])
        print(json.dumps(files, indent=2))

    elif args.create_folder:
        folder = gws.drive.files().create(body={
            'name': args.create_folder,
            'mimeType': 'application/vnd.google-apps.folder'
        }, fields='id,name,webViewLink').execute()
        print(json.dumps(folder, indent=2))

    elif args.share and args.email:
        perm = gws.drive.permissions().create(
            fileId=args.share,
            body={'type': 'user', 'role': 'writer', 'emailAddress': args.email},
            sendNotificationEmail=True
        ).execute()
        print(f"✅ Shared {args.share} with {args.email} (permissionId={perm['id']})")

    elif args.send_email:
        if not (args.to and args.email_subject and args.body):
            print("❌ --send-email requires --to, --subject, and --body")
            sys.exit(1)
        send_email(gws.gmail, args.to, args.email_subject, args.body,
                   attachments=args.attach)
        print(f"✅ Email sent to {args.to}")

    elif args.list_events:
        from datetime import datetime, timedelta
        now = datetime.utcnow().isoformat() + 'Z'
        end = (datetime.utcnow() + timedelta(hours=24)).isoformat() + 'Z'
        result = gws.calendar.events().list(
            calendarId='primary',
            timeMin=now, timeMax=end,
            singleEvents=True, orderBy='startTime'
        ).execute()
        events = result.get('items', [])
        for ev in events:
            start = ev.get('start', {})
            dt = start.get('dateTime', start.get('date', '?'))
            print(f"  {dt} — {ev.get('summary', '(no title)')}")

    else:
        parser.print_help()


if __name__ == '__main__':
    main()

N:google-workspace
D:Plan and execute Google Workspace operations across Docs, Sheets, Slides, Drive, Gmail, Calendar, Forms, Chat, and Admin SDK by choosing the right surface first: Apps Script, direct REST API, or admin-only APIs. Use when the user needs Workspace automation, spreadsheet/document/file workflows, Gmail sending, calendar scheduling, Forms pipelines, Drive sharing, or domain user/admin changes.
G:google-workspace google-docs google-sheets google-slides google-drive gmail google-calendar google-chat google-forms admin-sdk apps-script spreadsheet document shared-drive send-email approval-flow domain-user
F:Claude|Gemini|Codex|OpenCode
T:Bash|Read|Write|Edit|Glob|Grep

U[5]:
  Route work across Docs, Sheets, Slides, Drive, Gmail, Calendar, Forms, Chat, and Admin SDK
  Choose Apps Script vs direct REST API vs admin-only APIs before coding
  Pick the auth model: OAuth, service account, domain-wide delegation, or Apps Script auth
  Design cross-service workflows like Form→Sheet→Gmail/Calendar or approval queues
  Review quota/runtime risk and route-outs before implementation

S[4]{n,action,details}:
  1,Classify Request,Identify products operation actor execution home and trigger cadence
  2,Choose Surface,Pick Apps Script direct REST API or Admin SDK based on workflow ownership and limits
  3,Choose Auth,Match OAuth service account or delegated admin access to the task
  4,Execute Packet,Return the service bundle scopes IDs sequence verification and risks

R[4]:
  Start with surface choice and auth model instead of jumping to snippets
  Separate admin operations from ordinary content editing workflows
  Prefer batch operations and watch Apps Script quota/runtime limits on heavy jobs
  Route no-code cross-app orchestration requests out instead of turning this into a Zapier or n8n tutorial