@oneuptime/common 12.0.14 → 12.0.16

package/build/dist/Utils/NetworkDiscovery/UnclaimedScanDiagnosis.js

@@ -0,0 +1,87 @@
+import OneUptimeDate from "../../Types/Date";
+import ColumnLength from "../../Types/Database/ColumnLength";
+/*
+ * Why a network discovery scan is still sitting in "Pending".
+ *
+ * A scan leaves "Pending" in exactly one place: the probe asks
+ * /probe/discovery-scan/list and the server claims a row for it
+ * (App/FeatureSet/Telemetry/API/ProbeIngest/DiscoveryScan.ts). Nothing on the
+ * server can make that happen — if the probe never asks, the row simply never
+ * moves.
+ *
+ * Until this existed, that outcome was completely silent. The scans list
+ * showed "Pending" and an em-dash in Responded Hosts, forever, with no
+ * timestamp, no probe state and no message anywhere in the product; the only
+ * evidence lived in the probe container's log, if the operator had it. That is
+ * what OneUptime issue #3287 reported: four scans submitted over an hour, all
+ * "Pending", nothing to act on.
+ *
+ * So this module writes the sentence the operator was missing. It is pure and
+ * lives in Common so the wording can be unit-tested without a database, the
+ * same way ScanTargetUtil's messages are.
+ *
+ * It deliberately does NOT fail the scan. A scan nobody has claimed is still
+ * perfectly runnable the moment the probe comes back, and a recurring one
+ * would tangle with the re-queue pass; what was missing was information, not a
+ * state change.
+ */
+/*
+ * How long a scan may sit unclaimed before the job says anything.
+ *
+ * The probe polls every minute, so this is fifteen consecutive failed polls —
+ * long enough that a restarting probe, a redeploy or a brief network blip
+ * never produces a message, short enough to be useful while the operator is
+ * still looking at the page they just submitted from.
+ *
+ * It is NOT the whole guard against false positives: a scan queued behind
+ * another scan on the same probe is legitimately Pending for as long as that
+ * sweep takes (the claim endpoint hands out one at a time), so the caller
+ * excludes probes that currently have a scan In Progress. This threshold only
+ * decides how long an IDLE probe gets before its silence is worth reporting.
+ */
+export const UNCLAIMED_PENDING_MINUTES = 15;
+/*
+ * The two cases below are genuinely different problems with different fixes,
+ * and telling them apart is the entire point of this message: a probe that is
+ * not connected is an infrastructure problem the operator can see and fix,
+ * whereas a probe that IS connected and still is not claiming scans means the
+ * probe is running but its discovery job is not — an old image, a wedged
+ * sweep, or a probe that cannot reach the probe-ingest route specifically.
+ */
+export function buildUnclaimedScanDiagnosis(probeState) {
+    const probeLabel = probeState.probeName
+        ? `Probe "${truncateProbeName(probeState.probeName)}"`
+        : "The assigned probe";
+    if (!probeState.isProbeConnected) {
+        const lastSeen = probeState.lastAliveAt
+            ? `It was last seen ${OneUptimeDate.fromNow(probeState.lastAliveAt)}.`
+            : "It has never connected.";
+        return (`Not started yet: ${probeLabel} is not connected to OneUptime, so it has not picked this scan up. ` +
+            `${lastSeen} The scan will run on its own as soon as the probe reconnects.`);
+    }
+    return (`Not started yet: ${probeLabel} is connected but has not picked this scan up for over ` +
+        `${UNCLAIMED_PENDING_MINUTES} minutes. Check that the probe is running a version that supports ` +
+        `network discovery, and that it can reach the probe-ingest endpoint. The scan will run on its own ` +
+        `once the probe starts claiming scans again.`);
+}
+/*
+ * statusMessage is a varchar(500) and this job writes through the full
+ * update pipeline, which does NOT clamp — an over-long value would throw and
+ * the diagnosis would be lost rather than truncated. The only unbounded part
+ * of the sentence is the probe's name (itself a ShortText column, so at most
+ * 100 characters), and it is cut here so the arithmetic holds for every
+ * possible name. See the test that asserts the worst case still fits.
+ */
+const MAX_PROBE_NAME_LENGTH = 60;
+function truncateProbeName(name) {
+    if (name.length <= MAX_PROBE_NAME_LENGTH) {
+        return name;
+    }
+    return name.substring(0, MAX_PROBE_NAME_LENGTH) + "…";
+}
+/*
+ * Exported so the job and its tests agree on the ceiling they are checking
+ * against, rather than both hard-coding 500.
+ */
+export const MAX_SCAN_STATUS_MESSAGE_LENGTH = ColumnLength.LongText;
+//# sourceMappingURL=UnclaimedScanDiagnosis.js.map

package/build/dist/Utils/NetworkDiscovery/UnclaimedScanDiagnosis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnclaimedScanDiagnosis.js","sourceRoot":"","sources":["../../../../Utils/NetworkDiscovery/UnclaimedScanDiagnosis.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAC7C,OAAO,YAAY,MAAM,mCAAmC,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,EAAE,CAAC;AAepD;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAmC;IAEnC,MAAM,UAAU,GAAW,UAAU,CAAC,SAAS;QAC7C,CAAC,CAAC,UAAU,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG;QACtD,CAAC,CAAC,oBAAoB,CAAC;IAEzB,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAW,UAAU,CAAC,WAAW;YAC7C,CAAC,CAAC,oBAAoB,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG;YACtE,CAAC,CAAC,yBAAyB,CAAC;QAE9B,OAAO,CACL,oBAAoB,UAAU,qEAAqE;YACnG,GAAG,QAAQ,gEAAgE,CAC5E,CAAC;IACJ,CAAC;IAED,OAAO,CACL,oBAAoB,UAAU,yDAAyD;QACvF,GAAG,yBAAyB,oEAAoE;QAChG,mGAAmG;QACnG,6CAA6C,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAW,EAAE,CAAC;AAEzC,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,IAAI,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,qBAAqB,CAAC,GAAG,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,YAAY,CAAC,QAAQ,CAAC"}

package/build/dist/Utils/SecurityEvent/GenericNormalizer.js

@@ -0,0 +1,176 @@
+import OcsfSeverity, { OcsfSeverityId, normalizeOcsfSeverity, } from "../../Types/SecurityEvent/OcsfSeverity";
+import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime, readString, readValue, } from "./NormalizerHelpers";
+import { prettifyUdmEventType } from "./UdmNormalizer";
+/*
+ * Best-effort normalizer for security events that are neither OCSF nor
+ * UDM — arbitrary vendor JSON forwarded from a SIEM, a webhook, or a
+ * custom script. Field lookup walks common aliases; anything not
+ * recognized still lands in `attributes`, so nothing is lost.
+ */
+const MESSAGE_FIELDS = [
+    "message",
+    "msg",
+    "summary",
+    "description",
+    "title",
+    "alert_name",
+    "alertName",
+    "name",
+];
+const SEVERITY_FIELDS = [
+    "severity",
+    "severity_name",
+    "level",
+    "priority",
+    "risk_level",
+    "riskLevel",
+];
+const TIME_FIELDS = [
+    "timestamp",
+    "time",
+    "@timestamp",
+    "event_time",
+    "eventTime",
+    "created_at",
+    "createdAt",
+    "date",
+    "detected_at",
+    "detectedAt",
+];
+const USER_FIELDS = [
+    "user",
+    "username",
+    "user_name",
+    "userName",
+    "account",
+    "principal",
+    "actor",
+];
+const HOST_FIELDS = [
+    "host",
+    "hostname",
+    "host_name",
+    "computer",
+    "computer_name",
+    "device",
+    "device_name",
+    "machine",
+];
+const SOURCE_IP_FIELDS = [
+    "source_ip",
+    "src_ip",
+    "sourceIp",
+    "srcIp",
+    "client_ip",
+    "clientIp",
+    "ip",
+    "ip_address",
+    "ipAddress",
+];
+const TARGET_IP_FIELDS = [
+    "destination_ip",
+    "dest_ip",
+    "dst_ip",
+    "destinationIp",
+    "target_ip",
+    "targetIp",
+    "server_ip",
+];
+const TYPE_FIELDS = [
+    "event_type",
+    "eventType",
+    "category",
+    "type",
+    "action",
+];
+const VENDOR_FIELDS = ["vendor", "vendor_name", "vendorName"];
+const PRODUCT_FIELDS = [
+    "product",
+    "product_name",
+    "productName",
+    "source",
+    "log_source",
+    "logSource",
+];
+const RULE_NAME_FIELDS = [
+    "rule",
+    "rule_name",
+    "ruleName",
+    "signature",
+    "detection",
+];
+const ID_FIELDS = [
+    "id",
+    "uid",
+    "uuid",
+    "event_id",
+    "eventId",
+    "alert_id",
+    "alertId",
+];
+function readFirst(payload, fields) {
+    for (const field of fields) {
+        const value = readString(payload, field);
+        if (value) {
+            return value;
+        }
+    }
+    return "";
+}
+export default class GenericNormalizer {
+    static normalize(payload) {
+        const severityName = normalizeOcsfSeverity(readFirst(payload, SEVERITY_FIELDS)) ||
+            OcsfSeverity.Unknown;
+        let time = null;
+        for (const field of TIME_FIELDS) {
+            time = parseEventTime(readValue(payload, field));
+            if (time) {
+                break;
+            }
+        }
+        const typeText = readFirst(payload, TYPE_FIELDS);
+        const className = typeText
+            ? prettifyUdmEventType(typeText.replace(/[\s.-]+/g, "_"))
+            : "Base Event";
+        const principalUser = readFirst(payload, USER_FIELDS);
+        const principalHost = readFirst(payload, HOST_FIELDS);
+        const principalIp = readFirst(payload, SOURCE_IP_FIELDS);
+        const targetIp = readFirst(payload, TARGET_IP_FIELDS);
+        return {
+            time: time || new Date(),
+            eventUid: readFirst(payload, ID_FIELDS) || contentHashEventUid(payload),
+            categoryUid: 0,
+            categoryName: "Uncategorized",
+            classUid: 0,
+            className,
+            activityName: "",
+            severityId: OcsfSeverityId[severityName],
+            severityName,
+            statusName: readString(payload, "status"),
+            message: readFirst(payload, MESSAGE_FIELDS) || "Security event",
+            vendorName: readFirst(payload, VENDOR_FIELDS),
+            productName: readFirst(payload, PRODUCT_FIELDS),
+            ruleId: readString(payload, "rule_id") || readString(payload, "ruleId"),
+            ruleName: readFirst(payload, RULE_NAME_FIELDS),
+            mitreTactics: [],
+            mitreTechniques: [],
+            principalUser,
+            principalHost,
+            principalIp,
+            principalProcess: readString(payload, "process"),
+            targetUser: readString(payload, "target_user"),
+            targetHost: readString(payload, "target_host"),
+            targetIp,
+            targetPort: 0,
+            targetResource: readString(payload, "target"),
+            observables: buildObservables([
+                principalUser,
+                principalHost,
+                principalIp,
+                targetIp,
+            ]),
+            attributes: flattenPayload(payload),
+        };
+    }
+}
+//# sourceMappingURL=GenericNormalizer.js.map

package/build/dist/Utils/SecurityEvent/GenericNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GenericNormalizer.js","sourceRoot":"","sources":["../../../../Utils/SecurityEvent/GenericNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;;;;GAKG;AAEH,MAAM,cAAc,GAAkB;IACpC,SAAS;IACT,KAAK;IACL,SAAS;IACT,aAAa;IACb,OAAO;IACP,YAAY;IACZ,WAAW;IACX,MAAM;CACP,CAAC;AAEF,MAAM,eAAe,GAAkB;IACrC,UAAU;IACV,eAAe;IACf,OAAO;IACP,UAAU;IACV,YAAY;IACZ,WAAW;CACZ,CAAC;AAEF,MAAM,WAAW,GAAkB;IACjC,WAAW;IACX,MAAM;IACN,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,MAAM;IACN,aAAa;IACb,YAAY;CACb,CAAC;AAEF,MAAM,WAAW,GAAkB;IACjC,MAAM;IACN,UAAU;IACV,WAAW;IACX,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;CACR,CAAC;AAEF,MAAM,WAAW,GAAkB;IACjC,MAAM;IACN,UAAU;IACV,WAAW;IACX,UAAU;IACV,eAAe;IACf,QAAQ;IACR,aAAa;IACb,SAAS;CACV,CAAC;AAEF,MAAM,gBAAgB,GAAkB;IACtC,WAAW;IACX,QAAQ;IACR,UAAU;IACV,OAAO;IACP,WAAW;IACX,UAAU;IACV,IAAI;IACJ,YAAY;IACZ,WAAW;CACZ,CAAC;AAEF,MAAM,gBAAgB,GAAkB;IACtC,gBAAgB;IAChB,SAAS;IACT,QAAQ;IACR,eAAe;IACf,WAAW;IACX,UAAU;IACV,WAAW;CACZ,CAAC;AAEF,MAAM,WAAW,GAAkB;IACjC,YAAY;IACZ,WAAW;IACX,UAAU;IACV,MAAM;IACN,QAAQ;CACT,CAAC;AAEF,MAAM,aAAa,GAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AAE7E,MAAM,cAAc,GAAkB;IACpC,SAAS;IACT,cAAc;IACd,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,WAAW;CACZ,CAAC;AAEF,MAAM,gBAAgB,GAAkB;IACtC,MAAM;IACN,WAAW;IACX,UAAU;IACV,WAAW;IACX,WAAW;CACZ,CAAC;AAEF,MAAM,SAAS,GAAkB;IAC/B,IAAI;IACJ,KAAK;IACL,MAAM;IACN,UAAU;IACV,SAAS;IACT,UAAU;IACV,SAAS;CACV,CAAC;AAEF,SAAS,SAAS,CAAC,OAAmB,EAAE,MAAqB;IAC3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAW,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,iBAAiB;IAC7B,MAAM,CAAC,SAAS,CAAC,OAAmB;QACzC,MAAM,YAAY,GAChB,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC1D,YAAY,CAAC,OAAO,CAAC;QAEvB,IAAI,IAAI,GAAgB,IAAI,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YACjD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAW,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,GAAW,QAAQ;YAChC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC,CAAC,YAAY,CAAC;QAEjB,MAAM,aAAa,GAAW,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,aAAa,GAAW,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAW,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAW,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAE9D,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;YACvE,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,eAAe;YAC7B,QAAQ,EAAE,CAAC;YACX,SAAS;YACT,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC;YACzC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,gBAAgB;YAC/D,UAAU,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;YAC7C,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;YAC/C,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC;YACvE,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;YAC9C,YAAY,EAAE,EAAE;YAChB,eAAe,EAAE,EAAE;YACnB,aAAa;YACb,aAAa;YACb,WAAW;YACX,gBAAgB,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC;YAChD,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9C,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9C,QAAQ;YACR,UAAU,EAAE,CAAC;YACb,cAAc,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC7C,WAAW,EAAE,gBAAgB,CAAC;gBAC5B,aAAa;gBACb,aAAa;gBACb,WAAW;gBACX,QAAQ;aACT,CAAC;YACF,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;SACpC,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.js

@@ -0,0 +1,146 @@
+import OcsfSeverity, { OcsfSeverityId, normalizeOcsfSeverity, } from "../../Types/SecurityEvent/OcsfSeverity";
+import { ocsfCategoryForClassUid } from "../../Types/SecurityEvent/OcsfEventClass";
+import UdmNormalizer from "./UdmNormalizer";
+import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime, readString, readValue, } from "./NormalizerHelpers";
+/*
+ * Google SecOps (Chronicle) detection/alert payload -> a Detection Finding
+ * (OCSF class 2004).
+ *
+ * This is the shape a SecOps SOAR playbook webhook or the detections
+ * stream (legacyStreamDetectionAlerts) delivers: rule metadata in a
+ * `detection` array plus the matched UDM events in `collectionElements`.
+ * The matched sample events are run through the UDM entity extraction so
+ * the finding row inherits their observables — that is what makes a
+ * detection joinable to the hosts/users it fired on.
+ */
+const DETECTION_FINDING_CLASS_UID = 2004;
+/*
+ * How many sample events to mine for observables. Detections can carry
+ * hundreds of matched events; a handful is enough to identify the
+ * entities involved without turning one finding row into a megabyte.
+ */
+const MAX_SAMPLE_EVENTS = 25;
+function collectSampleEvents(payload) {
+    var _a;
+    const events = [];
+    const collectionElements = (_a = readValue(payload, "collectionElements")) !== null && _a !== void 0 ? _a : readValue(payload, "collection_elements");
+    if (!Array.isArray(collectionElements)) {
+        return events;
+    }
+    for (const element of collectionElements) {
+        if (typeof element !== "object" || element === null) {
+            continue;
+        }
+        const references = readValue(element, "references");
+        if (!Array.isArray(references)) {
+            continue;
+        }
+        for (const reference of references) {
+            if (events.length >= MAX_SAMPLE_EVENTS) {
+                return events;
+            }
+            if (typeof reference !== "object" || reference === null) {
+                continue;
+            }
+            const event = readValue(reference, "event");
+            if (event && typeof event === "object" && !Array.isArray(event)) {
+                events.push(event);
+            }
+        }
+    }
+    return events;
+}
+function readDetectionEntry(payload) {
+    const detection = readValue(payload, "detection");
+    if (Array.isArray(detection)) {
+        const first = detection[0];
+        if (first && typeof first === "object" && !Array.isArray(first)) {
+            return first;
+        }
+        return null;
+    }
+    if (detection && typeof detection === "object") {
+        return detection;
+    }
+    return null;
+}
+export default class GoogleSecOpsAlertNormalizer {
+    static isGoogleSecOpsAlert(payload) {
+        const type = readString(payload, "type").toUpperCase();
+        return Boolean(readDetectionEntry(payload) ||
+            type.includes("RULE_DETECTION") ||
+            readValue(payload, "collectionElements") ||
+            readValue(payload, "collection_elements"));
+    }
+    static normalize(payload) {
+        var _a, _b, _c;
+        const detection = readDetectionEntry(payload);
+        const ruleName = detection
+            ? readString(detection, "ruleName") || readString(detection, "rule_name")
+            : "";
+        const ruleId = detection
+            ? readString(detection, "ruleId") ||
+                readString(detection, "rule_id") ||
+                readString(detection, "ruleVersionId") ||
+                readString(detection, "rule_version_id")
+            : "";
+        const severityName = (detection && normalizeOcsfSeverity(readString(detection, "severity"))) ||
+            normalizeOcsfSeverity(readString(payload, "severity")) ||
+            OcsfSeverity.Unknown;
+        const time = parseEventTime((_c = (_b = (_a = readValue(payload, "detectionTime")) !== null && _a !== void 0 ? _a : readValue(payload, "detection_time")) !== null && _b !== void 0 ? _b : readValue(payload, "createdTime")) !== null && _c !== void 0 ? _c : readValue(payload, "created_time"));
+        /*
+         * Mine the matched UDM sample events for entities. The detection row's
+         * observables become the union across samples, and the first sample
+         * supplies the principal/target columns so the finding points at a
+         * concrete actor instead of nothing.
+         */
+        const sampleEvents = collectSampleEvents(payload);
+        const sampleObservables = [];
+        let firstSample = null;
+        for (const sampleEvent of sampleEvents) {
+            const normalized = UdmNormalizer.normalize(sampleEvent);
+            if (!firstSample) {
+                firstSample = normalized;
+            }
+            sampleObservables.push(...normalized.observables);
+        }
+        const { categoryUid, categoryName } = ocsfCategoryForClassUid(DETECTION_FINDING_CLASS_UID);
+        const description = detection
+            ? readString(detection, "description")
+            : "";
+        const message = ruleName || description || "Google SecOps detection";
+        return {
+            time: time || new Date(),
+            eventUid: readString(payload, "id") || contentHashEventUid(payload),
+            categoryUid,
+            categoryName,
+            classUid: DETECTION_FINDING_CLASS_UID,
+            className: "Detection Finding",
+            activityName: "Create",
+            severityId: OcsfSeverityId[severityName],
+            severityName,
+            statusName: readString(payload, "detection.alertState") ||
+                readString(payload, "detection.alert_state") ||
+                "",
+            message,
+            vendorName: "Google",
+            productName: "Google SecOps",
+            ruleId,
+            ruleName,
+            mitreTactics: firstSample ? firstSample.mitreTactics : [],
+            mitreTechniques: firstSample ? firstSample.mitreTechniques : [],
+            principalUser: firstSample ? firstSample.principalUser : "",
+            principalHost: firstSample ? firstSample.principalHost : "",
+            principalIp: firstSample ? firstSample.principalIp : "",
+            principalProcess: firstSample ? firstSample.principalProcess : "",
+            targetUser: firstSample ? firstSample.targetUser : "",
+            targetHost: firstSample ? firstSample.targetHost : "",
+            targetIp: firstSample ? firstSample.targetIp : "",
+            targetPort: firstSample ? firstSample.targetPort : 0,
+            targetResource: firstSample ? firstSample.targetResource : "",
+            observables: buildObservables(sampleObservables),
+            attributes: flattenPayload(payload),
+        };
+    }
+}
+//# sourceMappingURL=GoogleSecOpsAlertNormalizer.js.map

package/build/dist/Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleSecOpsAlertNormalizer.js","sourceRoot":"","sources":["../../../../Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;GAUG;AAEH,MAAM,2BAA2B,GAAW,IAAI,CAAC;AAEjD;;;;GAIG;AACH,MAAM,iBAAiB,GAAW,EAAE,CAAC;AAErC,SAAS,mBAAmB,CAAC,OAAmB;;IAC9C,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,MAAM,kBAAkB,GACtB,MAAA,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,mCACxC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAc,SAAS,CACrC,OAAqB,EACrB,YAAY,CACb,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAc,SAAS,CAAC,SAAuB,EAAE,OAAO,CAAC,CAAC;YAErE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAmB;IAC7C,MAAM,SAAS,GAAc,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAc,SAAS,CAAC,CAAC,CAAc,CAAC;QACnD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,KAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,SAAuB,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,2BAA2B;IACvC,MAAM,CAAC,mBAAmB,CAAC,OAAmB;QACnD,MAAM,IAAI,GAAW,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAE/D,OAAO,OAAO,CACZ,kBAAkB,CAAC,OAAO,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/B,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;YACxC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAC5C,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,OAAmB;;QACzC,MAAM,SAAS,GAAsB,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAW,SAAS;YAChC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,MAAM,GAAW,SAAS;YAC9B,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAC/B,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC;gBAChC,UAAU,CAAC,SAAS,EAAE,eAAe,CAAC;gBACtC,UAAU,CAAC,SAAS,EAAE,iBAAiB,CAAC;YAC1C,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,YAAY,GAChB,CAAC,SAAS,IAAI,qBAAqB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;YACvE,qBAAqB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACtD,YAAY,CAAC,OAAO,CAAC;QAEvB,MAAM,IAAI,GAAgB,cAAc,CACtC,MAAA,MAAA,MAAA,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,mCACjC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,mCACpC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,mCACjC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CACrC,CAAC;QAEF;;;;;WAKG;QACH,MAAM,YAAY,GAAsB,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,iBAAiB,GAAkB,EAAE,CAAC;QAC5C,IAAI,WAAW,GAAmC,IAAI,CAAC;QAEvD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,UAAU,GACd,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAEvC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,WAAW,GAAG,UAAU,CAAC;YAC3B,CAAC;YAED,iBAAiB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,MAAM,WAAW,GAAW,SAAS;YACnC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,OAAO,GACX,QAAQ,IAAI,WAAW,IAAI,yBAAyB,CAAC;QAEvD,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;YACnE,WAAW;YACX,YAAY;YACZ,QAAQ,EAAE,2BAA2B;YACrC,SAAS,EAAE,mBAAmB;YAC9B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EACR,UAAU,CAAC,OAAO,EAAE,sBAAsB,CAAC;gBAC3C,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC;gBAC5C,EAAE;YACJ,OAAO;YACP,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,eAAe;YAC5B,MAAM;YACN,QAAQ;YACR,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;YACzD,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;YAC/D,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC3D,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC3D,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YACvD,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;YACjE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACrD,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACrD,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACjD,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;YAC7D,WAAW,EAAE,gBAAgB,CAAC,iBAAiB,CAAC;YAChD,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;SACpC,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Utils/SecurityEvent/NormalizerHelpers.js

@@ -0,0 +1,196 @@
+import Crypto from "../Crypto";
+/*
+ * Shared helpers for the security-event normalizers (OCSF, UDM, SecOps
+ * alert, generic). Pure and isomorphic — no server imports — so the same
+ * code is unit-testable and usable from the UI if ever needed.
+ */
+/*
+ * Flatten a nested payload into dot-notation keys with scalar values, the
+ * shape the SecurityEvent `attributes` Map(String,String) column stores.
+ *
+ * Arrays of scalars collapse to a comma-joined string (queryable with a
+ * "contains" filter); arrays of objects recurse with the index in the key.
+ * Depth is capped so a hostile payload cannot recurse unboundedly.
+ */
+export function flattenPayload(payload, maxDepth = 10) {
+    const result = {};
+    const visit = (value, prefix, depth) => {
+        if (value === null || value === undefined) {
+            return;
+        }
+        if (Array.isArray(value)) {
+            const scalars = value.filter((item) => {
+                return typeof item !== "object" || item === null;
+            });
+            if (scalars.length === value.length) {
+                if (value.length > 0) {
+                    result[prefix] = value
+                        .map((item) => {
+                        return String(item);
+                    })
+                        .join(",");
+                }
+                return;
+            }
+            value.forEach((item, index) => {
+                visit(item, `${prefix}.${index}`, depth + 1);
+            });
+            return;
+        }
+        if (typeof value === "object") {
+            if (depth >= maxDepth) {
+                result[prefix] = JSON.stringify(value);
+                return;
+            }
+            for (const key of Object.keys(value)) {
+                const child = value[key];
+                visit(child, prefix ? `${prefix}.${key}` : key, depth + 1);
+            }
+            return;
+        }
+        result[prefix] = String(value);
+    };
+    visit(payload, "", 0);
+    return result;
+}
+/*
+ * Read a string off a nested payload by dot path, tolerating arrays along
+ * the way (first element wins). Returns '' when the path is absent or not
+ * scalar — normalizers treat empty string as "source did not say".
+ */
+export function readString(payload, path) {
+    const value = readValue(payload, path);
+    if (value === null || value === undefined) {
+        return "";
+    }
+    if (Array.isArray(value)) {
+        const first = value.find((item) => {
+            return item !== null && item !== undefined && typeof item !== "object";
+        });
+        return first === undefined ? "" : String(first);
+    }
+    if (typeof value === "object") {
+        return "";
+    }
+    return String(value);
+}
+export function readNumber(payload, path) {
+    const value = readValue(payload, path);
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return value;
+    }
+    if (typeof value === "string" && value.trim() !== "") {
+        const parsed = Number(value);
+        if (Number.isFinite(parsed)) {
+            return parsed;
+        }
+    }
+    return null;
+}
+export function readStringArray(payload, path) {
+    const value = readValue(payload, path);
+    if (value === null || value === undefined) {
+        return [];
+    }
+    if (Array.isArray(value)) {
+        return value
+            .filter((item) => {
+            return item !== null && item !== undefined && typeof item !== "object";
+        })
+            .map((item) => {
+            return String(item);
+        });
+    }
+    if (typeof value === "object") {
+        return [];
+    }
+    return [String(value)];
+}
+export function readValue(payload, path) {
+    const parts = path.split(".");
+    let current = payload;
+    for (const part of parts) {
+        if (current === null || current === undefined) {
+            return null;
+        }
+        if (Array.isArray(current)) {
+            current = current[0];
+        }
+        if (current === null ||
+            current === undefined ||
+            typeof current !== "object" ||
+            Array.isArray(current)) {
+            return null;
+        }
+        current = current[part];
+    }
+    return current === undefined ? null : current;
+}
+/*
+ * Parse the timestamps security payloads actually carry: RFC3339 strings,
+ * epoch seconds, epoch millis, and epoch micros/nanos (which UDM and OCSF
+ * both use in places). Returns null rather than guessing when the value is
+ * unparseable — the caller decides the fallback.
+ */
+export function parseEventTime(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    if (typeof value === "string" && value.trim() !== "") {
+        const numeric = Number(value);
+        if (!Number.isFinite(numeric)) {
+            const parsed = new Date(value);
+            return Number.isNaN(parsed.getTime()) ? null : parsed;
+        }
+        return parseEventTime(numeric);
+    }
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+        // Epoch scale by magnitude: seconds < 1e11 < millis < 1e14 < micros < 1e17 < nanos.
+        let millis = value;
+        if (value >= 1e17) {
+            millis = value / 1e6;
+        }
+        else if (value >= 1e14) {
+            millis = value / 1e3;
+        }
+        else if (value < 1e11) {
+            millis = value * 1000;
+        }
+        const parsed = new Date(Math.trunc(millis));
+        return Number.isNaN(parsed.getTime()) ? null : parsed;
+    }
+    return null;
+}
+/*
+ * Build the deduplicated observables array from the entity fields a
+ * normalizer extracted. Order is stable (users, hosts, ips, then extras)
+ * so tests and content hashing are deterministic.
+ */
+export function buildObservables(values) {
+    const seen = new Set();
+    const observables = [];
+    for (const value of values) {
+        const trimmed = (value || "").trim();
+        if (!trimmed) {
+            continue;
+        }
+        const canonical = trimmed.toLowerCase();
+        if (seen.has(canonical)) {
+            continue;
+        }
+        seen.add(canonical);
+        observables.push(trimmed);
+    }
+    return observables;
+}
+/*
+ * Stable content hash used as eventUid when the source payload carries no
+ * id of its own. Repeated deliveries of the same payload produce the same
+ * uid, so downstream consumers can dedupe.
+ */
+export function contentHashEventUid(payload) {
+    const flattened = flattenPayload(payload);
+    const canonical = JSON.stringify(flattened, Object.keys(flattened).sort());
+    return `sha256:${Crypto.getSha256Hash(canonical)}`;
+}
+//# sourceMappingURL=NormalizerHelpers.js.map

package/build/dist/Utils/SecurityEvent/NormalizerHelpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NormalizerHelpers.js","sourceRoot":"","sources":["../../../../Utils/SecurityEvent/NormalizerHelpers.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,WAAW,CAAC;AAE/B;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAmB,EACnB,WAAmB,EAAE;IAErB,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B,MAAM,KAAK,GAA8D,CACvE,KAAgB,EAChB,MAAc,EACd,KAAa,EACP,EAAE;QACR,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAqB,KAAK,CAAC,MAAM,CAC5C,CAAC,IAAe,EAAW,EAAE;gBAC3B,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC;YACnD,CAAC,CACF,CAAC;YAEF,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBACpC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK;yBACnB,GAAG,CAAC,CAAC,IAAe,EAAU,EAAE;wBAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;oBACtB,CAAC,CAAC;yBACD,IAAI,CAAC,GAAG,CAAC,CAAC;gBACf,CAAC;gBACD,OAAO;YACT,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,CAAC,IAAe,EAAE,KAAa,EAAQ,EAAE;gBACrD,KAAK,CAAC,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YAEH,OAAO;QACT,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;gBACtB,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,EAAE,CAAC;gBACnD,MAAM,KAAK,GAAe,KAAoB,CAAC,GAAG,CAAC,CAAC;gBACpD,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;YAED,OAAO;QACT,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAEtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAmB,EAAE,IAAY;IAC1D,MAAM,KAAK,GAAc,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAElD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAc,KAAK,CAAC,IAAI,CAAC,CAAC,IAAe,EAAW,EAAE;YAC/D,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAmB,EAAE,IAAY;IAC1D,MAAM,KAAK,GAAc,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAElD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAmB,EACnB,IAAY;IAEZ,MAAM,KAAK,GAAc,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAElD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,IAAe,EAAW,EAAE;YACnC,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QACzE,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,IAAe,EAAU,EAAE;YAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAmB,EAAE,IAAY;IACzD,MAAM,KAAK,GAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,OAAO,GAAc,OAAO,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,GAAG,OAAO,CAAC,CAAC,CAAc,CAAC;QACpC,CAAC;QAED,IACE,OAAO,KAAK,IAAI;YAChB,OAAO,KAAK,SAAS;YACrB,OAAO,OAAO,KAAK,QAAQ;YAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAI,OAAsB,CAAC,IAAI,CAAc,CAAC;IACvD,CAAC;IAED,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,OAAO,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;QAEtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACxD,CAAC;QAED,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACrE,oFAAoF;QACpF,IAAI,MAAM,GAAW,KAAK,CAAC;QAE3B,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,GAAG,KAAK,GAAG,GAAG,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,GAAG,KAAK,GAAG,GAAG,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;YACxB,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiC;IAEjC,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;IAC5C,MAAM,WAAW,GAAkB,EAAE,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAW,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAW,OAAO,CAAC,WAAW,EAAE,CAAC;QAEhD,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmB;IACrD,MAAM,SAAS,GAAe,cAAc,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAW,IAAI,CAAC,SAAS,CACtC,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAC9B,CAAC;IAEF,OAAO,UAAU,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AACrD,CAAC"}