@oneuptime/common 12.0.28 → 12.0.30

package/build/dist/Server/Utils/APIKey/AccessPermission.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessPermission.js","sourceRoot":"","sources":["../../../../../Server/Utils/APIKey/AccessPermission.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,QAAQ,MAAM,yBAAyB,CAAC;AAC/C,OAAO,UAIN,MAAM,2BAA2B,CAAC;AACnC,OAAO,uBAEN,MAAM,wCAAwC,CAAC;AAChD,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,kBAAkB,MAAM,kCAAkC,CAAC;AAElE,MAAM,CAAC,OAAO,OAAO,sBAAsB;IAErB,AAAb,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAC/C,SAAmB;QAEnB,OAAO;YACL,UAAU,EAAE,CAAC,SAAS,CAAC;YACvB,iBAAiB,EAAE;gBACjB,UAAU,CAAC,MAAM;gBACjB,UAAU,CAAC,IAAI;gBACf,UAAU,CAAC,WAAW;aACvB;YACD,KAAK,EAAE,4BAA4B;SACpC,CAAC;IACJ,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,+BAA+B,CACjD,SAAmB;QAEnB,OAAO;YACL,UAAU,EAAE,CAAC,SAAS,CAAC;YACvB,iBAAiB,EAAE;gBACjB,UAAU,CAAC,MAAM;gBACjB,UAAU,CAAC,IAAI;gBACf,UAAU,CAAC,WAAW;gBACtB,UAAU,CAAC,YAAY;aACxB;YACD,KAAK,EAAE,4BAA4B;SACpC,CAAC;IACJ,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,kCAAkC,CACpD,SAAmB;QAEnB,MAAM,eAAe,GAA0B,EAAE,CAAC;QAElD,eAAe,CAAC,IAAI,CAAC;YACnB,UAAU,EAAE,UAAU,CAAC,YAAY;YACnC,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,gBAAgB;SACxB,CAAC,CAAC;QAEH,MAAM,UAAU,GACd,kBAAkB,CAAC,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAErE,UAAU,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAExE,OAAO,UAAU,CAAC;IACpB,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAC9C,SAAmB,EACnB,QAAkB;QAElB,+DAA+D;QAC/D,MAAM,oBAAoB,GACxB,MAAM,uBAAuB,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAEpE,MAAM,eAAe,GAA0B,oBAAoB,CAAC,GAAG,CACrE,CAAC,GAAwB,EAAkB,EAAE;YAC3C,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,KAAK,EAAE,gBAAgB;aACxB,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,UAAU,GACd,kBAAkB,CAAC,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAErE,UAAU,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAExE,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AA7EqB;IADnB,WAAW,EAAE;;qCAED,QAAQ;;iEAWpB;AAGmB;IADnB,WAAW,EAAE;;qCAED,QAAQ;;mEAYpB;AAGmB;IADnB,WAAW,EAAE;;qCAED,QAAQ;;sEAgBpB;AAGmB;IADnB,WAAW,EAAE;;qCAED,QAAQ;QACT,QAAQ;;gEAuBnB"}
+{"version":3,"file":"AccessPermission.js","sourceRoot":"","sources":["../../../../../Server/Utils/APIKey/AccessPermission.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,QAAQ,MAAM,yBAAyB,CAAC;AAC/C,OAAO,UAIN,MAAM,2BAA2B,CAAC;AACnC,OAAO,uBAEN,MAAM,wCAAwC,CAAC;AAChD,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,kBAAkB,MAAM,kCAAkC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,OAAO,OAAO,sBAAsB;IAErB,AAAb,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAC/C,SAAmB;QAEnB,OAAO;YACL,UAAU,EAAE,CAAC,SAAS,CAAC;YACvB,iBAAiB,EAAE;gBACjB,UAAU,CAAC,MAAM;gBACjB,UAAU,CAAC,IAAI;gBACf,UAAU,CAAC,WAAW;gBACtB,UAAU,CAAC,oBAAoB;aAChC;YACD,KAAK,EAAE,4BAA4B;SACpC,CAAC;IACJ,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,+BAA+B,CACjD,SAAmB;QAEnB,OAAO;YACL,UAAU,EAAE,CAAC,SAAS,CAAC;YACvB,iBAAiB,EAAE;gBACjB,UAAU,CAAC,MAAM;gBACjB,UAAU,CAAC,IAAI;gBACf,UAAU,CAAC,WAAW;gBACtB,UAAU,CAAC,oBAAoB;gBAC/B,UAAU,CAAC,YAAY;aACxB;YACD,KAAK,EAAE,4BAA4B;SACpC,CAAC;IACJ,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,kCAAkC,CACpD,SAAmB;QAEnB,MAAM,eAAe,GAA0B,EAAE,CAAC;QAElD,eAAe,CAAC,IAAI,CAAC;YACnB,UAAU,EAAE,UAAU,CAAC,YAAY;YACnC,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,gBAAgB;SACxB,CAAC,CAAC;QAEH,MAAM,UAAU,GACd,kBAAkB,CAAC,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAErE,UAAU,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAExE,OAAO,UAAU,CAAC;IACpB,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAC9C,SAAmB,EACnB,QAAkB;QAElB,+DAA+D;QAC/D,MAAM,oBAAoB,GACxB,MAAM,uBAAuB,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAEpE,MAAM,eAAe,GAA0B,oBAAoB,CAAC,GAAG,CACrE,CAAC,GAAwB,EAAkB,EAAE;YAC3C,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,KAAK,EAAE,gBAAgB;aACxB,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,UAAU,GACd,kBAAkB,CAAC,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAErE,UAAU,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAExE,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AA/EqB;IADnB,WAAW,EAAE;;qCAED,QAAQ;;iEAYpB;AAGmB;IADnB,WAAW,EAAE;;qCAED,QAAQ;;mEAapB;AAGmB;IADnB,WAAW,EAAE;;qCAED,QAAQ;;sEAgBpB;AAGmB;IADnB,WAAW,EAAE;;qCAED,QAAQ;QACT,QAAQ;;gEAuBnB"}

package/build/dist/Server/Utils/Greenlock/Greenlock.js

@@ -21,21 +21,39 @@ import ServerException from "../../../Types/Exception/ServerException";
 import Text from "../../../Types/Text";
 import AcmeCertificate from "../../../Models/DatabaseModels/AcmeCertificate";
 import AcmeChallenge from "../../../Models/DatabaseModels/AcmeChallenge";
+import ArrayUtil from "../../../Utils/Array";
 import acme from "acme-client";
 import CaptureSpan from "../Telemetry/CaptureSpan";
-export default class GreenlockUtil {
+class GreenlockUtil {
+    /*
+     * Stable per-domain lead time, somewhere in the range above. Same domain,
+     * same answer, on every run and every replica.
+     */
+    static getRenewalLeadTimeInDays(domain) {
+        const spanInDays = GreenlockUtil.RENEW_LEAD_TIME_MAX_IN_DAYS -
+            GreenlockUtil.RENEW_LEAD_TIME_MIN_IN_DAYS;
+        let hash = 0;
+        for (let i = 0; i < domain.length; i++) {
+            hash = (hash * 31 + domain.charCodeAt(i)) % 1000003;
+        }
+        return (GreenlockUtil.RENEW_LEAD_TIME_MIN_IN_DAYS + (hash % (spanInDays + 1)));
+    }
     static async renewAllCertsWhichAreExpiringSoon(data) {
         try {
             logger.debug("Renewing all certificates");
-            // get all certificates which are expiring soon
+            /*
+             * Read the widest window any domain's lead time can make it due in, then
+             * keep only the domains whose own lead time has actually been reached.
+             */
             const certificates = await AcmeCertificateService.findBy({
                 query: {
-                    expiresAt: QueryHelper.lessThanEqualTo(OneUptimeDate.addRemoveDays(OneUptimeDate.getCurrentDate(), 40)),
+                    expiresAt: QueryHelper.lessThanEqualTo(OneUptimeDate.addRemoveDays(OneUptimeDate.getCurrentDate(), GreenlockUtil.RENEW_LEAD_TIME_MAX_IN_DAYS)),
                 },
                 limit: LIMIT_MAX,
                 skip: 0,
                 select: {
                     domain: true,
+                    expiresAt: true,
                 },
                 sort: {
                     expiresAt: SortOrder.Ascending,
@@ -44,40 +62,31 @@ export default class GreenlockUtil {
                     isRoot: true,
                 },
             });
-            logger.debug(`Found ${certificates.length} certificates which are expiring soon`, { certificateCount: certificates.length });
-            // order certificate for each domain
-            for (const certificate of certificates) {
-                if (!certificate.domain) {
-                    continue;
+            const now = OneUptimeDate.getCurrentDate();
+            const dueCertificates = certificates.filter((certificate) => {
+                if (!certificate.domain || !certificate.expiresAt) {
+                    return false;
                 }
-                const certLogAttributes = {
+                const renewAt = OneUptimeDate.addRemoveDays(certificate.expiresAt, -GreenlockUtil.getRenewalLeadTimeInDays(certificate.domain));
+                return !OneUptimeDate.isAfter(renewAt, now);
+            });
+            /*
+             * Still sorted by expiry, so a run that cannot take the whole backlog
+             * spends itself on the domains closest to expiring and leaves the rest -
+             * which by construction still have weeks of lead time - to the next run.
+             */
+            const batch = dueCertificates.slice(0, GreenlockUtil.RENEW_MAX_PER_RUN);
+            logger.debug(`Found ${dueCertificates.length} certificates due for renewal, renewing ${batch.length} in this run`, {
+                dueCount: dueCertificates.length,
+                batchCount: batch.length,
+            });
+            await ArrayUtil.forEachWithConcurrency(batch, GreenlockUtil.RENEW_CONCURRENCY, async (certificate) => {
+                await GreenlockUtil.renewCertForDomain({
                     domain: certificate.domain,
-                };
-                logger.debug(`Renewing certificate for domain: ${certificate.domain}`, certLogAttributes);
-                try {
-                    //validate cname
-                    const isValidCname = await data.validateCname(certificate.domain);
-                    if (!isValidCname) {
-                        logger.debug(`CNAME is not valid for domain: ${certificate.domain}`, certLogAttributes);
-                        // if cname is not valid then remove the domain
-                        await GreenlockUtil.removeDomain(certificate.domain);
-                        await data.notifyDomainRemoved(certificate.domain);
-                        logger.error(`Cname is not valid for domain: ${certificate.domain}`, certLogAttributes);
-                    }
-                    else {
-                        logger.debug(`CNAME is valid for domain: ${certificate.domain}`, certLogAttributes);
-                        await GreenlockUtil.orderCert({
-                            domain: certificate.domain,
-                            validateCname: data.validateCname,
-                        });
-                        logger.debug(`Certificate renewed for domain: ${certificate.domain}`, certLogAttributes);
-                    }
-                }
-                catch (e) {
-                    logger.error(`Error renewing certificate for domain: ${certificate.domain}`, certLogAttributes);
-                    logger.error(e, certLogAttributes);
-                }
-            }
+                    validateCname: data.validateCname,
+                    notifyDomainRemoved: data.notifyDomainRemoved,
+                });
+            });
         }
         catch (e) {
             logger.error("Error renewing all certificates");
@@ -85,6 +94,41 @@ export default class GreenlockUtil {
             throw e;
         }
     }
+    /*
+     * Renew one domain. Never throws: one domain that cannot be renewed - a CNAME
+     * that no longer points here, a challenge the CA would not accept - must not
+     * take down the rest of the run with it.
+     */
+    static async renewCertForDomain(data) {
+        const { domain } = data;
+        const certLogAttributes = {
+            domain: domain,
+        };
+        logger.debug(`Renewing certificate for domain: ${domain}`, certLogAttributes);
+        try {
+            //validate cname
+            const isValidCname = await data.validateCname(domain);
+            if (!isValidCname) {
+                logger.debug(`CNAME is not valid for domain: ${domain}`, certLogAttributes);
+                // if cname is not valid then remove the domain
+                await GreenlockUtil.removeDomain(domain);
+                await data.notifyDomainRemoved(domain);
+                logger.error(`Cname is not valid for domain: ${domain}`, certLogAttributes);
+            }
+            else {
+                logger.debug(`CNAME is valid for domain: ${domain}`, certLogAttributes);
+                await GreenlockUtil.orderCert({
+                    domain: domain,
+                    validateCname: data.validateCname,
+                });
+                logger.debug(`Certificate renewed for domain: ${domain}`, certLogAttributes);
+            }
+        }
+        catch (e) {
+            logger.error(`Error renewing certificate for domain: ${domain}`, certLogAttributes);
+            logger.error(e, certLogAttributes);
+        }
+    }
     static async removeDomain(domain) {
         try {
             // remove certificate for this domain.
@@ -252,6 +296,37 @@ export default class GreenlockUtil {
         }
     }
 }
+/*
+ * How early a certificate is renewed, as a range rather than a single value.
+ *
+ * Let's Encrypt issues for 90 days, so every domain ordered on the same day
+ * expires on the same day. Renewing them all at one fixed lead time keeps
+ * that batch together for every cycle that follows, and a single bad day -
+ * an upstream outage, a rate limit, a run that does not finish - then expires
+ * the whole batch at once instead of one domain.
+ *
+ * Spreading the lead time across a range pulls the batch apart: domains that
+ * expire on the same day come due days apart, and having been renewed days
+ * apart they expire days apart next cycle too. The offset is derived from the
+ * domain name so it is stable - a domain must not drift in and out of
+ * eligibility between two runs, which would leave it renewed by neither.
+ */
+GreenlockUtil.RENEW_LEAD_TIME_MAX_IN_DAYS = 40;
+GreenlockUtil.RENEW_LEAD_TIME_MIN_IN_DAYS = 25;
+/*
+ * A run renews at most this many domains, at most this many at a time.
+ *
+ * Both bound how much of a backlog is dispatched at once. Let's Encrypt
+ * allows 300 new orders per account per three hours, and the reactive
+ * provisioning sweep spends from the same allowance, so a run that tried to
+ * clear a large backlog in one pass would spend the account's budget and get
+ * the renewals behind it refused. At the schedule this job runs on the cap
+ * still clears far more per day than one sequential daily pass ever did,
+ * while leaving room under the limit.
+ */
+GreenlockUtil.RENEW_MAX_PER_RUN = 10;
+GreenlockUtil.RENEW_CONCURRENCY = 5;
+export default GreenlockUtil;
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Utils/Greenlock/Greenlock.js.map

@@ -1 +1 @@
-{"version":3,"file":"Greenlock.js","sourceRoot":"","sources":["../../../../../Server/Utils/Greenlock/Greenlock.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,sBAAsB,MAAM,uCAAuC,CAAC;AAC3E,OAAO,oBAAoB,MAAM,qCAAqC,CAAC;AACvE,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAC3D,OAAO,MAAyB,MAAM,WAAW,CAAC;AAClD,OAAO,SAAS,MAAM,uCAAuC,CAAC;AAC9D,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAChD,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AACzE,OAAO,SAAS,MAAM,oCAAoC,CAAC;AAC3D,OAAO,eAAe,MAAM,0CAA0C,CAAC;AACvE,OAAO,IAAI,MAAM,qBAAqB,CAAC;AACvC,OAAO,eAAe,MAAM,gDAAgD,CAAC;AAC7E,OAAO,aAAa,MAAM,8CAA8C,CAAC;AACzE,OAAO,IAAI,MAAM,aAAa,CAAC;AAE/B,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAEnD,MAAM,CAAC,OAAO,OAAO,aAAa;IAEZ,AAAb,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,IAGrD;QACC,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAE1C,+CAA+C;YAE/C,MAAM,YAAY,GAChB,MAAM,sBAAsB,CAAC,MAAM,CAAC;gBAClC,KAAK,EAAE;oBACL,SAAS,EAAE,WAAW,CAAC,eAAe,CACpC,aAAa,CAAC,aAAa,CACzB,aAAa,CAAC,cAAc,EAAE,EAC9B,EAAE,CACH,CACF;iBACF;gBACD,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE;oBACN,MAAM,EAAE,IAAI;iBACb;gBACD,IAAI,EAAE;oBACJ,SAAS,EAAE,SAAS,CAAC,SAAS;iBAC/B;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEL,MAAM,CAAC,KAAK,CACV,SAAS,YAAY,CAAC,MAAM,uCAAuC,EACnE,EAAE,gBAAgB,EAAE,YAAY,CAAC,MAAM,EAAE,CAC1C,CAAC;YAEF,oCAAoC;YAEpC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;oBACxB,SAAS;gBACX,CAAC;gBAED,MAAM,iBAAiB,GAAkB;oBACvC,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC3B,CAAC;gBAEF,MAAM,CAAC,KAAK,CACV,oCAAoC,WAAW,CAAC,MAAM,EAAE,EACxD,iBAAiB,CAClB,CAAC;gBAEF,IAAI,CAAC;oBACH,gBAAgB;oBAChB,MAAM,YAAY,GAAY,MAAM,IAAI,CAAC,aAAa,CACpD,WAAW,CAAC,MAAM,CACnB,CAAC;oBAEF,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,MAAM,CAAC,KAAK,CACV,kCAAkC,WAAW,CAAC,MAAM,EAAE,EACtD,iBAAiB,CAClB,CAAC;wBAEF,+CAA+C;wBAC/C,MAAM,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;wBACrD,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;wBAEnD,MAAM,CAAC,KAAK,CACV,kCAAkC,WAAW,CAAC,MAAM,EAAE,EACtD,iBAAiB,CAClB,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,KAAK,CACV,8BAA8B,WAAW,CAAC,MAAM,EAAE,EAClD,iBAAiB,CAClB,CAAC;wBAEF,MAAM,aAAa,CAAC,SAAS,CAAC;4BAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,aAAa,EAAE,IAAI,CAAC,aAAa;yBAClC,CAAC,CAAC;wBAEH,MAAM,CAAC,KAAK,CACV,mCAAmC,WAAW,CAAC,MAAM,EAAE,EACvD,iBAAiB,CAClB,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,0CAA0C,WAAW,CAAC,MAAM,EAAE,EAC9D,iBAAiB,CAClB,CAAC;oBACF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAEhB,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAc;QAC7C,IAAI,CAAC;YACH,sCAAsC;YACtC,MAAM,sBAAsB,CAAC,QAAQ,CAAC;gBACpC,KAAK,EAAE;oBACL,MAAM,EAAE,MAAM;iBACf;gBACD,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAG7B;QACC,MAAM,kBAAkB,GAAkB;YACxC,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CACV,oDAAoD,IAAI,CAAC,MAAM,EAAE,EACjE,kBAAkB,CACnB,CAAC;YAEF,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YAEtB,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;YAEtC,MAAM,sBAAsB,GAAW,qBAAqB,CAAC;YAE7D,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5B,MAAM,IAAI,eAAe,CACvB,6EAA6E,CAC9E,CAAC;YACJ,CAAC;YAED,IAAI,cAAc,GAAW,MAAM,CAAC,IAAI,CACtC,sBAAsB,EACtB,QAAQ,CACT,CAAC,QAAQ,EAAE,CAAC;YAEb,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAE9D,gBAAgB;YAEhB,MAAM,CAAC,KAAK,CACV,gCAAgC,MAAM,EAAE,EACxC,kBAAkB,CACnB,CAAC;YAEF,MAAM,YAAY,GAAY,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAE/D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,CAAC,KAAK,CACV,kCAAkC,MAAM,EAAE,EAC1C,kBAAkB,CACnB,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,oBAAoB,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;gBAE/D,MAAM,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,CAAC,KAAK,CACV,kCAAkC,MAAM,EAAE,EAC1C,kBAAkB,CACnB,CAAC;gBACF,MAAM,IAAI,gBAAgB,CAAC,gCAAgC,GAAG,MAAM,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,8BAA8B,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAEzE,MAAM,MAAM,GAAgB,IAAI,IAAI,CAAC,MAAM,CAAC;gBAC1C,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU;gBACnD,UAAU,EAAE,cAAc;aAC3B,CAAC,CAAC;YAEH,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBACvE,UAAU,EAAE,MAAM;aACnB,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CACV,oCAAoC,MAAM,EAAE,EAC5C,kBAAkB,CACnB,CAAC;YAEF,MAAM,WAAW,GAAW,MAAM,MAAM,CAAC,IAAI,CAAC;gBAC5C,GAAG,EAAE,kBAAkB;gBACvB,KAAK,EAAE,4BAA4B,CAAC,QAAQ,EAAE;gBAC9C,oBAAoB,EAAE,IAAI;gBAC1B,iBAAiB,EAAE,CAAC,SAAS,CAAC,EAAE,mDAAmD;gBACnF,iBAAiB,EAAE,KAAK,EACtB,KAAyB,EACzB,SAAoB,EACpB,gBAAwB,EACxB,EAAE;oBACF,yBAAyB;oBACzB,aAAa;oBACb,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBACjC,MAAM,CAAC,KAAK,CACV,kCAAkC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAC1D,kBAAkB,CACnB,CAAC;wBAEF,MAAM,aAAa,GAAkB,IAAI,aAAa,EAAE,CAAC;wBACzD,aAAa,CAAC,SAAS,GAAG,gBAAgB,CAAC;wBAC3C,aAAa,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;wBACtC,aAAa,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;wBAE9C,MAAM,oBAAoB,CAAC,MAAM,CAAC;4BAChC,IAAI,EAAE,aAAa;4BACnB,KAAK,EAAE;gCACL,MAAM,EAAE,IAAI;6BACb;yBACF,CAAC,CAAC;wBAEH,MAAM,CAAC,KAAK,CACV,iCAAiC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EACzD,kBAAkB,CACnB,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,iBAAiB,EAAE,KAAK,EACtB,KAAyB,EACzB,SAAoB,EACpB,EAAE;oBACF,0BAA0B;oBAE1B,MAAM,CAAC,KAAK,CACV,kCAAkC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAC1D,kBAAkB,CACnB,CAAC;oBAEF,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBACjC,MAAM,oBAAoB,CAAC,QAAQ,CAAC;4BAClC,KAAK,EAAE;gCACL,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK;6BAC/B;4BACD,KAAK,EAAE,CAAC;4BACR,IAAI,EAAE,CAAC;4BACP,KAAK,EAAE;gCACL,MAAM,EAAE,IAAI;6BACb;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,CAAC,KAAK,CACV,iCAAiC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EACzD,kBAAkB,CACnB,CAAC;gBACJ,CAAC;aACF,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CACV,mCAAmC,MAAM,EAAE,EAC3C,kBAAkB,CACnB,CAAC;YAEF,uCAAuC;YACvC,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAS,IAAI,CAAC,SAAS,CAAC;YACtC,MAAM,SAAS,GAAS,IAAI,CAAC,QAAQ,CAAC;YAEtC,MAAM,CAAC,KAAK,CAAC,2BAA2B,SAAS,EAAE,EAAE,kBAAkB,CAAC,CAAC;YACzE,MAAM,CAAC,KAAK,CAAC,0BAA0B,QAAQ,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAEvE,uDAAuD;YACvD,MAAM,mBAAmB,GACvB,MAAM,sBAAsB,CAAC,SAAS,CAAC;gBACrC,KAAK,EAAE;oBACL,MAAM,EAAE,MAAM;iBACf;gBACD,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;iBACV;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEL,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,CAAC,KAAK,CACV,oCAAoC,MAAM,EAAE,EAC5C,kBAAkB,CACnB,CAAC;gBAEF,yBAAyB;gBACzB,MAAM,sBAAsB,CAAC,QAAQ,CAAC;oBACpC,KAAK,EAAE;wBACL,MAAM,EAAE,MAAM;qBACf;oBACD,KAAK,EAAE,CAAC;oBACR,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE;wBACJ,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;wBACnC,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;wBACzC,QAAQ,EAAE,QAAQ;wBAClB,SAAS,EAAE,SAAS;qBACrB;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,MAAM,CAAC,KAAK,CACV,mCAAmC,MAAM,EAAE,EAC3C,kBAAkB,CACnB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CACV,oCAAoC,MAAM,EAAE,EAC5C,kBAAkB,CACnB,CAAC;gBACF,yBAAyB;gBACzB,MAAM,eAAe,GAAoB,IAAI,eAAe,EAAE,CAAC;gBAE/D,eAAe,CAAC,MAAM,GAAG,MAAM,CAAC;gBAChC,eAAe,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;gBACrD,eAAe,CAAC,cAAc,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;gBAC3D,eAAe,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBACpC,eAAe,CAAC,SAAS,GAAG,SAAS,CAAC;gBAEtC,MAAM,sBAAsB,CAAC,MAAM,CAAC;oBAClC,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,MAAM,CAAC,KAAK,CACV,mCAAmC,MAAM,EAAE,EAC3C,kBAAkB,CACnB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,MAAM,EAAE,EACvD,kBAAkB,CACnB,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAEpC,IAAI,CAAC,YAAY,SAAS,EAAE,CAAC;gBAC3B,MAAM,CAAC,CAAC;YACV,CAAC;YAED,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,eAAe,CACvB,mCAAmC,IAAI,CAAC,MAAM,yEAAyE,CACxH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,eAAe,CACvB,mCAAmC,IAAI,CAAC,MAAM,wPAAwP,CACvS,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAnXqB;IADnB,WAAW,EAAE;;;;4DAwGb;AAGmB;IADnB,WAAW,EAAE;;;;uCAkBb;AAGmB;IADnB,WAAW,EAAE;;;;oCAqPb"}
+{"version":3,"file":"Greenlock.js","sourceRoot":"","sources":["../../../../../Server/Utils/Greenlock/Greenlock.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,sBAAsB,MAAM,uCAAuC,CAAC;AAC3E,OAAO,oBAAoB,MAAM,qCAAqC,CAAC;AACvE,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAC3D,OAAO,MAAyB,MAAM,WAAW,CAAC;AAClD,OAAO,SAAS,MAAM,uCAAuC,CAAC;AAC9D,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAChD,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AACzE,OAAO,SAAS,MAAM,oCAAoC,CAAC;AAC3D,OAAO,eAAe,MAAM,0CAA0C,CAAC;AACvE,OAAO,IAAI,MAAM,qBAAqB,CAAC;AACvC,OAAO,eAAe,MAAM,gDAAgD,CAAC;AAC7E,OAAO,aAAa,MAAM,8CAA8C,CAAC;AACzE,OAAO,SAAS,MAAM,sBAAsB,CAAC;AAC7C,OAAO,IAAI,MAAM,aAAa,CAAC;AAE/B,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAEnD,MAAqB,aAAa;IAiChC;;;OAGG;IACI,MAAM,CAAC,wBAAwB,CAAC,MAAc;QACnD,MAAM,UAAU,GACd,aAAa,CAAC,2BAA2B;YACzC,aAAa,CAAC,2BAA2B,CAAC;QAE5C,IAAI,IAAI,GAAW,CAAC,CAAC;QAErB,KAAK,IAAI,CAAC,GAAW,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QACtD,CAAC;QAED,OAAO,CACL,aAAa,CAAC,2BAA2B,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CACtE,CAAC;IACJ,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,IAGrD;QACC,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAE1C;;;eAGG;YACH,MAAM,YAAY,GAChB,MAAM,sBAAsB,CAAC,MAAM,CAAC;gBAClC,KAAK,EAAE;oBACL,SAAS,EAAE,WAAW,CAAC,eAAe,CACpC,aAAa,CAAC,aAAa,CACzB,aAAa,CAAC,cAAc,EAAE,EAC9B,aAAa,CAAC,2BAA2B,CAC1C,CACF;iBACF;gBACD,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE;oBACN,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE,IAAI;iBAChB;gBACD,IAAI,EAAE;oBACJ,SAAS,EAAE,SAAS,CAAC,SAAS;iBAC/B;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEL,MAAM,GAAG,GAAS,aAAa,CAAC,cAAc,EAAE,CAAC;YAEjD,MAAM,eAAe,GAAsB,YAAY,CAAC,MAAM,CAC5D,CAAC,WAA4B,EAAE,EAAE;gBAC/B,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;oBAClD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,MAAM,OAAO,GAAS,aAAa,CAAC,aAAa,CAC/C,WAAW,CAAC,SAAS,EACrB,CAAC,aAAa,CAAC,wBAAwB,CAAC,WAAW,CAAC,MAAM,CAAC,CAC5D,CAAC;gBAEF,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC,CACF,CAAC;YAEF;;;;eAIG;YACH,MAAM,KAAK,GAAsB,eAAe,CAAC,KAAK,CACpD,CAAC,EACD,aAAa,CAAC,iBAAiB,CAChC,CAAC;YAEF,MAAM,CAAC,KAAK,CACV,SAAS,eAAe,CAAC,MAAM,2CAA2C,KAAK,CAAC,MAAM,cAAc,EACpG;gBACE,QAAQ,EAAE,eAAe,CAAC,MAAM;gBAChC,UAAU,EAAE,KAAK,CAAC,MAAM;aACzB,CACF,CAAC;YAEF,MAAM,SAAS,CAAC,sBAAsB,CACpC,KAAK,EACL,aAAa,CAAC,iBAAiB,EAC/B,KAAK,EAAE,WAA4B,EAAiB,EAAE;gBACpD,MAAM,aAAa,CAAC,kBAAkB,CAAC;oBACrC,MAAM,EAAE,WAAW,CAAC,MAAgB;oBACpC,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;iBAC9C,CAAC,CAAC;YACL,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAEhB,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAIvC;QACC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAExB,MAAM,iBAAiB,GAAkB;YACvC,MAAM,EAAE,MAAM;SACf,CAAC;QAEF,MAAM,CAAC,KAAK,CACV,oCAAoC,MAAM,EAAE,EAC5C,iBAAiB,CAClB,CAAC;QAEF,IAAI,CAAC;YACH,gBAAgB;YAChB,MAAM,YAAY,GAAY,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAE/D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,CAAC,KAAK,CACV,kCAAkC,MAAM,EAAE,EAC1C,iBAAiB,CAClB,CAAC;gBAEF,+CAA+C;gBAC/C,MAAM,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBAEvC,MAAM,CAAC,KAAK,CACV,kCAAkC,MAAM,EAAE,EAC1C,iBAAiB,CAClB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,8BAA8B,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;gBAExE,MAAM,aAAa,CAAC,SAAS,CAAC;oBAC5B,MAAM,EAAE,MAAM;oBACd,aAAa,EAAE,IAAI,CAAC,aAAa;iBAClC,CAAC,CAAC;gBAEH,MAAM,CAAC,KAAK,CACV,mCAAmC,MAAM,EAAE,EAC3C,iBAAiB,CAClB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CACV,0CAA0C,MAAM,EAAE,EAClD,iBAAiB,CAClB,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAc;QAC7C,IAAI,CAAC;YACH,sCAAsC;YACtC,MAAM,sBAAsB,CAAC,QAAQ,CAAC;gBACpC,KAAK,EAAE;oBACL,MAAM,EAAE,MAAM;iBACf;gBACD,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAG7B;QACC,MAAM,kBAAkB,GAAkB;YACxC,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CACV,oDAAoD,IAAI,CAAC,MAAM,EAAE,EACjE,kBAAkB,CACnB,CAAC;YAEF,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YAEtB,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;YAEtC,MAAM,sBAAsB,GAAW,qBAAqB,CAAC;YAE7D,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5B,MAAM,IAAI,eAAe,CACvB,6EAA6E,CAC9E,CAAC;YACJ,CAAC;YAED,IAAI,cAAc,GAAW,MAAM,CAAC,IAAI,CACtC,sBAAsB,EACtB,QAAQ,CACT,CAAC,QAAQ,EAAE,CAAC;YAEb,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAE9D,gBAAgB;YAEhB,MAAM,CAAC,KAAK,CACV,gCAAgC,MAAM,EAAE,EACxC,kBAAkB,CACnB,CAAC;YAEF,MAAM,YAAY,GAAY,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAE/D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,CAAC,KAAK,CACV,kCAAkC,MAAM,EAAE,EAC1C,kBAAkB,CACnB,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,oBAAoB,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;gBAE/D,MAAM,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,CAAC,KAAK,CACV,kCAAkC,MAAM,EAAE,EAC1C,kBAAkB,CACnB,CAAC;gBACF,MAAM,IAAI,gBAAgB,CAAC,gCAAgC,GAAG,MAAM,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,8BAA8B,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAEzE,MAAM,MAAM,GAAgB,IAAI,IAAI,CAAC,MAAM,CAAC;gBAC1C,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU;gBACnD,UAAU,EAAE,cAAc;aAC3B,CAAC,CAAC;YAEH,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBACvE,UAAU,EAAE,MAAM;aACnB,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CACV,oCAAoC,MAAM,EAAE,EAC5C,kBAAkB,CACnB,CAAC;YAEF,MAAM,WAAW,GAAW,MAAM,MAAM,CAAC,IAAI,CAAC;gBAC5C,GAAG,EAAE,kBAAkB;gBACvB,KAAK,EAAE,4BAA4B,CAAC,QAAQ,EAAE;gBAC9C,oBAAoB,EAAE,IAAI;gBAC1B,iBAAiB,EAAE,CAAC,SAAS,CAAC,EAAE,mDAAmD;gBACnF,iBAAiB,EAAE,KAAK,EACtB,KAAyB,EACzB,SAAoB,EACpB,gBAAwB,EACxB,EAAE;oBACF,yBAAyB;oBACzB,aAAa;oBACb,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBACjC,MAAM,CAAC,KAAK,CACV,kCAAkC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAC1D,kBAAkB,CACnB,CAAC;wBAEF,MAAM,aAAa,GAAkB,IAAI,aAAa,EAAE,CAAC;wBACzD,aAAa,CAAC,SAAS,GAAG,gBAAgB,CAAC;wBAC3C,aAAa,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;wBACtC,aAAa,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;wBAE9C,MAAM,oBAAoB,CAAC,MAAM,CAAC;4BAChC,IAAI,EAAE,aAAa;4BACnB,KAAK,EAAE;gCACL,MAAM,EAAE,IAAI;6BACb;yBACF,CAAC,CAAC;wBAEH,MAAM,CAAC,KAAK,CACV,iCAAiC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EACzD,kBAAkB,CACnB,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,iBAAiB,EAAE,KAAK,EACtB,KAAyB,EACzB,SAAoB,EACpB,EAAE;oBACF,0BAA0B;oBAE1B,MAAM,CAAC,KAAK,CACV,kCAAkC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAC1D,kBAAkB,CACnB,CAAC;oBAEF,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBACjC,MAAM,oBAAoB,CAAC,QAAQ,CAAC;4BAClC,KAAK,EAAE;gCACL,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK;6BAC/B;4BACD,KAAK,EAAE,CAAC;4BACR,IAAI,EAAE,CAAC;4BACP,KAAK,EAAE;gCACL,MAAM,EAAE,IAAI;6BACb;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,CAAC,KAAK,CACV,iCAAiC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EACzD,kBAAkB,CACnB,CAAC;gBACJ,CAAC;aACF,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CACV,mCAAmC,MAAM,EAAE,EAC3C,kBAAkB,CACnB,CAAC;YAEF,uCAAuC;YACvC,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAS,IAAI,CAAC,SAAS,CAAC;YACtC,MAAM,SAAS,GAAS,IAAI,CAAC,QAAQ,CAAC;YAEtC,MAAM,CAAC,KAAK,CAAC,2BAA2B,SAAS,EAAE,EAAE,kBAAkB,CAAC,CAAC;YACzE,MAAM,CAAC,KAAK,CAAC,0BAA0B,QAAQ,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAEvE,uDAAuD;YACvD,MAAM,mBAAmB,GACvB,MAAM,sBAAsB,CAAC,SAAS,CAAC;gBACrC,KAAK,EAAE;oBACL,MAAM,EAAE,MAAM;iBACf;gBACD,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;iBACV;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEL,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,CAAC,KAAK,CACV,oCAAoC,MAAM,EAAE,EAC5C,kBAAkB,CACnB,CAAC;gBAEF,yBAAyB;gBACzB,MAAM,sBAAsB,CAAC,QAAQ,CAAC;oBACpC,KAAK,EAAE;wBACL,MAAM,EAAE,MAAM;qBACf;oBACD,KAAK,EAAE,CAAC;oBACR,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE;wBACJ,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;wBACnC,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;wBACzC,QAAQ,EAAE,QAAQ;wBAClB,SAAS,EAAE,SAAS;qBACrB;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,MAAM,CAAC,KAAK,CACV,mCAAmC,MAAM,EAAE,EAC3C,kBAAkB,CACnB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CACV,oCAAoC,MAAM,EAAE,EAC5C,kBAAkB,CACnB,CAAC;gBACF,yBAAyB;gBACzB,MAAM,eAAe,GAAoB,IAAI,eAAe,EAAE,CAAC;gBAE/D,eAAe,CAAC,MAAM,GAAG,MAAM,CAAC;gBAChC,eAAe,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;gBACrD,eAAe,CAAC,cAAc,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;gBAC3D,eAAe,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBACpC,eAAe,CAAC,SAAS,GAAG,SAAS,CAAC;gBAEtC,MAAM,sBAAsB,CAAC,MAAM,CAAC;oBAClC,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,MAAM,CAAC,KAAK,CACV,mCAAmC,MAAM,EAAE,EAC3C,kBAAkB,CACnB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,MAAM,EAAE,EACvD,kBAAkB,CACnB,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAEpC,IAAI,CAAC,YAAY,SAAS,EAAE,CAAC;gBAC3B,MAAM,CAAC,CAAC;YACV,CAAC;YAED,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,eAAe,CACvB,mCAAmC,IAAI,CAAC,MAAM,yEAAyE,CACxH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,eAAe,CACvB,mCAAmC,IAAI,CAAC,MAAM,wPAAwP,CACvS,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;;AApdD;;;;;;;;;;;;;;GAcG;AACoB,yCAA2B,GAAW,EAAE,CAAC;AACzC,yCAA2B,GAAW,EAAE,CAAC;AAEhE;;;;;;;;;;GAUG;AACoB,+BAAiB,GAAW,EAAE,CAAC;AAC/B,+BAAiB,GAAW,CAAC,CAAC;eA/BlC,aAAa;AAsDZ;IADnB,WAAW,EAAE;;;;4DAwFb;AAgEmB;IADnB,WAAW,EAAE;;;;uCAkBb;AAGmB;IADnB,WAAW,EAAE;;;;oCAqPb"}

package/build/dist/Server/Utils/LogPipelineProcessorValidation.js

@@ -0,0 +1,77 @@
+import BadDataException from "../../Types/Exception/BadDataException";
+import LogPipelineProcessorType from "../../Types/Log/LogPipelineProcessorType";
+import { compileGrokPattern } from "../../Utils/Grok/Grok";
+/*
+ * Save-time validation for log pipeline processors.
+ *
+ * A processor that cannot do anything is worse than a rejected one: it
+ * sits in the pipeline list looking configured while every log flows
+ * past it untouched, and nothing surfaces the fact. That is exactly how
+ * GrokParser behaved before it was implemented
+ * (OneUptime/oneuptime#2515).
+ *
+ * The grok pattern is the one field where a typo is both easy and
+ * invisible - `%{IPV4:client ip}` or a stray bracket compiles to
+ * nothing. Compiling it here is cheap, happens once per human edit, and
+ * puts the error in front of the only person who can fix it. The ingest
+ * path stays defensive anyway: rows saved before this validation
+ * existed still fail closed to "leave the log alone".
+ */
+/*
+ * Prefixes become the leading part of an attribute key, so hold them to
+ * what an attribute key can sensibly be.
+ */
+const TARGET_PREFIX_REGEX = /^[A-Za-z_][A-Za-z0-9_.@:-]*$/;
+/*
+ * `configuration` is a jsonb column, but the dashboard's JSON form field
+ * has historically persisted it as a JSON string literal - so both
+ * shapes reach here (see LogPipelineService.normalizeProcessorConfig).
+ */
+function readConfiguration(configuration) {
+    if (configuration && typeof configuration === "object") {
+        return configuration;
+    }
+    if (typeof configuration === "string") {
+        try {
+            const parsed = JSON.parse(configuration);
+            if (parsed && typeof parsed === "object") {
+                return parsed;
+            }
+        }
+        catch (_a) {
+            throw new BadDataException("Processor configuration is not valid JSON.");
+        }
+    }
+    return null;
+}
+export function validateLogPipelineProcessor(candidate) {
+    if (candidate.processorType !== LogPipelineProcessorType.GrokParser) {
+        return;
+    }
+    const configuration = readConfiguration(candidate.configuration);
+    if (!configuration) {
+        throw new BadDataException("A Grok Parser processor needs a configuration with a grok pattern.");
+    }
+    const config = configuration;
+    const pattern = typeof config.pattern === "string" ? config.pattern.trim() : "";
+    if (!pattern) {
+        throw new BadDataException("A Grok Parser processor needs a grok pattern, for example: %{IPV4:client_ip} %{WORD:verb}");
+    }
+    // Throws BadDataException with a message written for the person editing.
+    compileGrokPattern(pattern);
+    if (config.targetPrefix !== undefined && config.targetPrefix !== null) {
+        if (typeof config.targetPrefix !== "string") {
+            throw new BadDataException("Target prefix must be text.");
+        }
+        const targetPrefix = config.targetPrefix.trim();
+        if (targetPrefix && !TARGET_PREFIX_REGEX.test(targetPrefix)) {
+            throw new BadDataException(`"${config.targetPrefix}" is not a valid target prefix. Use letters, digits, and . _ - : @ (starting with a letter or underscore).`);
+        }
+    }
+    if (config.source !== undefined && config.source !== null) {
+        if (typeof config.source !== "string") {
+            throw new BadDataException("Source field must be text.");
+        }
+    }
+}
+//# sourceMappingURL=LogPipelineProcessorValidation.js.map

package/build/dist/Server/Utils/LogPipelineProcessorValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LogPipelineProcessorValidation.js","sourceRoot":"","sources":["../../../../Server/Utils/LogPipelineProcessorValidation.ts"],"names":[],"mappings":"AAAA,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,OAAO,wBAEN,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;;;;;;;;;;;;;GAeG;AAEH;;;GAGG;AACH,MAAM,mBAAmB,GAAW,8BAA8B,CAAC;AAOnE;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,aAAqD;IAErD,IAAI,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,aAA2B,CAAC;IACrC,CAAC;IAED,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAElD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,MAAoB,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,4CAA4C,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,SAAwC;IAExC,IAAI,SAAS,CAAC,aAAa,KAAK,wBAAwB,CAAC,UAAU,EAAE,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAsB,iBAAiB,CACxD,SAAS,CAAC,aAAa,CACxB,CAAC;IAEF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,CACxB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAqB,aAA4C,CAAC;IAC9E,MAAM,OAAO,GACX,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CACxB,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE5B,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACtE,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,YAAY,GAAW,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAExD,IAAI,YAAY,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,gBAAgB,CACxB,IAAI,MAAM,CAAC,YAAY,4GAA4G,CACpI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC"}

package/build/dist/Server/Utils/OnCall/CalendarFeedToken.js

@@ -0,0 +1,161 @@
+import crypto from "crypto";
+import OneUptimeDate from "../../../Types/Date";
+import { PREVIOUS_TOKEN_GRACE_DAYS } from "../../../Types/OnCallDutyPolicy/CalendarFeedWindow";
+/*
+ * The capability token that addresses an on-call calendar feed.
+ *
+ * A calendar client keeps the feed URL forever and re-fetches it unattended,
+ * so the token has to be both unguessable and cheap to look up: 256 bits from
+ * the CSPRNG, carried in the URL as base64url (43 characters, no padding), and
+ * stored ONLY as its unkeyed SHA-256 hex digest. The digest is what the public
+ * route queries by, which keeps the plaintext out of the indexed column; a
+ * database dump therefore yields hashes, not working feed URLs.
+ *
+ * Unkeyed on purpose: a keyed hash (HMAC over EncryptionSecret, the backup-code
+ * recipe) would tie every feed to the instance secret, and rotating that secret
+ * would silently break every subscribed calendar in the world with no way to
+ * tell the user. The token already carries 256 bits of entropy, so a rainbow
+ * table buys nothing and the key adds no strength worth that failure mode.
+ *
+ * The hint is the last four characters - enough for the settings page to say
+ * "link ending in …k3Qx" so a user can tell two links apart, far too little to
+ * recover anything.
+ */
+// crypto.randomBytes(32) -> 32 bytes -> ceil(32 * 8 / 6) = 43 base64url chars.
+const TOKEN_BYTE_LENGTH = 32;
+export const CALENDAR_FEED_TOKEN_LENGTH = 43;
+export const CALENDAR_FEED_TOKEN_HINT_LENGTH = 4;
+/*
+ * Shape guard for the public route. Anything that does not match is answered
+ * 404 before any database work, so a scanner probing the path costs one regex.
+ */
+export const CALENDAR_FEED_TOKEN_REGEX = /^[A-Za-z0-9_-]{43}$/;
+export default class CalendarFeedToken {
+    /**
+     * A fresh 43-character base64url token from 32 CSPRNG bytes.
+     */
+    static mint() {
+        return crypto.randomBytes(TOKEN_BYTE_LENGTH).toString("base64url");
+    }
+    /**
+     * Unkeyed SHA-256 of the token, lowercase hex (64 characters). This is the
+     * value stored in `tokenHash` / `previousTokenHash` and the value the public
+     * route looks up by. Deterministic: the same token always hashes the same.
+     */
+    static hash(token) {
+        return crypto.createHash("sha256").update(token, "utf8").digest("hex");
+    }
+    /**
+     * The display hint - the last four characters of the token. Never enough to
+     * reconstruct the token; enough to tell "…k3Qx" from "…Q9zA" in the UI.
+     */
+    static hint(token) {
+        return token.slice(-CALENDAR_FEED_TOKEN_HINT_LENGTH);
+    }
+    /**
+     * True when the string has exactly the shape a minted token has. Used as
+     * the shape guard on the public route so a malformed path never reaches the
+     * database.
+     */
+    static isValidShape(token) {
+        return typeof token === "string" && CALENDAR_FEED_TOKEN_REGEX.test(token);
+    }
+    /**
+     * Everything a feed row needs when a token is minted or rotated.
+     */
+    static mintSet() {
+        const token = CalendarFeedToken.mint();
+        return {
+            token: token,
+            tokenHash: CalendarFeedToken.hash(token),
+            tokenHint: CalendarFeedToken.hint(token),
+        };
+    }
+    /**
+     * The token columns a feed row should hold after minting or rotating.
+     *
+     * The hash the row held before (if any) moves to `previousTokenHash` and
+     * keeps serving an EMPTY calendar until `previousTokenExpiresAt`
+     * (PREVIOUS_TOKEN_GRACE_DAYS from now), so a still-subscribed client clears
+     * its copy instead of showing "could not fetch" until the user notices.
+     */
+    static buildRotation(data) {
+        const now = data.now || OneUptimeDate.getCurrentDate();
+        const minted = CalendarFeedToken.mintSet();
+        const previousTokenHash = data.currentTokenHash || null;
+        return Object.assign(Object.assign({}, minted), { rotatedAt: now, previousTokenHash: previousTokenHash, previousTokenExpiresAt: previousTokenHash
+                ? OneUptimeDate.addRemoveDays(now, PREVIOUS_TOKEN_GRACE_DAYS)
+                : null });
+    }
+    /**
+     * Populate the token columns of a row about to be INSERTED.
+     *
+     * With `trustSuppliedToken`, a well-formed plaintext token already on the
+     * row (the calendar API mints one up front so it can build the URL in the
+     * same response) is kept and the hash and hint are DERIVED from it. Without
+     * it - every non-root create - whatever the request carried is discarded
+     * and a fresh token is minted. Either way a malformed token or a
+     * caller-chosen hash is replaced: there is no path to a row whose hash
+     * disagrees with its token, and no path for a request body to choose the
+     * secret. A brand-new row never carries a grace-period hash.
+     */
+    static applyTokenColumnsOnCreate(data, options) {
+        let minted;
+        if (options.trustSuppliedToken &&
+            CalendarFeedToken.isValidShape(data.token)) {
+            minted = {
+                token: data.token,
+                tokenHash: CalendarFeedToken.hash(data.token),
+                tokenHint: CalendarFeedToken.hint(data.token),
+            };
+        }
+        else {
+            minted = CalendarFeedToken.mintSet();
+        }
+        data.token = minted.token;
+        data.tokenHash = minted.tokenHash;
+        data.tokenHint = minted.tokenHint;
+        data.rotatedAt = OneUptimeDate.getCurrentDate();
+        data.previousTokenHash = undefined;
+        data.previousTokenExpiresAt = undefined;
+        return minted;
+    }
+    /**
+     * The partial row a rotation writes. `previousTokenHash` /
+     * `previousTokenExpiresAt` are null on a first mint, which the update path
+     * has to be able to write; the model types them as optional strings/dates,
+     * hence the cast at this one boundary.
+     */
+    static toRotationUpdateData(rotation) {
+        return {
+            token: rotation.token,
+            tokenHash: rotation.tokenHash,
+            tokenHint: rotation.tokenHint,
+            rotatedAt: rotation.rotatedAt,
+            previousTokenHash: rotation.previousTokenHash,
+            previousTokenExpiresAt: rotation.previousTokenExpiresAt,
+        };
+    }
+    /**
+     * Constant-time comparison of two hashes, for callers that compare a
+     * freshly computed digest against a stored one in memory rather than in a
+     * WHERE clause. Length mismatch is answered false without leaking timing on
+     * the content.
+     */
+    static isHashEqual(a, b) {
+        /*
+         * Plain Uint8Arrays rather than Buffers: the two are interchangeable at
+         * runtime, but the App build's @types/node rejects Buffer where an
+         * ArrayBufferView is expected (the same mismatch PasswordHash and
+         * TwoFactorBackupCode trip over), and TextEncoder is global on every
+         * supported Node.
+         */
+        const bytesA = new TextEncoder().encode(a);
+        const bytesB = new TextEncoder().encode(b);
+        if (bytesA.length !== bytesB.length) {
+            return false;
+        }
+        return crypto.timingSafeEqual(bytesA, bytesB);
+    }
+}
+//# sourceMappingURL=CalendarFeedToken.js.map

package/build/dist/Server/Utils/OnCall/CalendarFeedToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CalendarFeedToken.js","sourceRoot":"","sources":["../../../../../Server/Utils/OnCall/CalendarFeedToken.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,+EAA+E;AAC/E,MAAM,iBAAiB,GAAW,EAAE,CAAC;AAErC,MAAM,CAAC,MAAM,0BAA0B,GAAW,EAAE,CAAC;AAErD,MAAM,CAAC,MAAM,+BAA+B,GAAW,CAAC,CAAC;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,qBAAqB,CAAC;AA8CvE,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACpC;;OAEG;IACI,MAAM,CAAC,IAAI;QAChB,OAAO,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,IAAI,CAAC,KAAa;QAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,IAAI,CAAC,KAAa;QAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,+BAA+B,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,YAAY,CAAC,KAAc;QACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,OAAO;QACnB,MAAM,KAAK,GAAW,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAE/C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;YACxC,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,aAAa,CAAC,IAG3B;QACC,MAAM,GAAG,GAAS,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,cAAc,EAAE,CAAC;QAC7D,MAAM,MAAM,GAA4B,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAEpE,MAAM,iBAAiB,GAAkB,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC;QAEvE,uCACK,MAAM,KACT,SAAS,EAAE,GAAG,EACd,iBAAiB,EAAE,iBAAiB,EACpC,sBAAsB,EAAE,iBAAiB;gBACvC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC;gBAC7D,CAAC,CAAC,IAAI,IACR;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACI,MAAM,CAAC,yBAAyB,CACrC,IAA8B,EAC9B,OAAwC;QAExC,IAAI,MAA+B,CAAC;QAEpC,IACE,OAAO,CAAC,kBAAkB;YAC1B,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1C,CAAC;YACD,MAAM,GAAG;gBACP,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC7C,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAC9C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC;QAChD,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QAExC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,oBAAoB,CAChC,QAA8B;QAE9B,OAAO;YACL,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,iBAAiB,EAAE,QAAQ,CAAC,iBAAsC;YAClE,sBAAsB,EACpB,QAAQ,CAAC,sBAAyC;SACrD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,WAAW,CAAC,CAAS,EAAE,CAAS;QAC5C;;;;;;WAMG;QACH,MAAM,MAAM,GAAe,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,MAAM,GAAe,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEvD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;CACF"}