@oneuptime/common 13.0.3 → 13.0.5

package/build/dist/Server/Utils/SecurityEvent/Connectors/CrowdStrikeFalcon/CrowdStrikeFalconClient.js

@@ -0,0 +1,405 @@
+import APIException from "../../../../../Types/Exception/ApiException";
+import { redactLogString, redactLogValue } from "../../../LogRedaction";
+/*
+ * API hostnames per Falcon cloud. A mismatched cloud answers 403, which
+ * reads like a permissions problem, so the connector names the cloud in
+ * that remediation.
+ */
+export const CROWDSTRIKE_FALCON_CLOUD_BASE_URLS = {
+    "us-1": "https://api.crowdstrike.com",
+    "us-2": "https://api.us-2.crowdstrike.com",
+    "eu-1": "https://api.eu-1.crowdstrike.com",
+    "us-gov-1": "https://api.laggar.gcw.crowdstrike.com",
+};
+export function getCrowdStrikeFalconBaseUrl(cloud) {
+    const key = (cloud || "").trim().toLowerCase();
+    if (Object.prototype.hasOwnProperty.call(CROWDSTRIKE_FALCON_CLOUD_BASE_URLS, key)) {
+        return CROWDSTRIKE_FALCON_CLOUD_BASE_URLS[key];
+    }
+    return null;
+}
+export const CROWDSTRIKE_FALCON_CLOUDS = [
+    "us-1",
+    "us-2",
+    "eu-1",
+    "us-gov-1",
+];
+/*
+ * The largest page the alerts query allows. Also used as the entity batch
+ * size so one ids page maps to one entity request.
+ */
+export const CROWDSTRIKE_ALERTS_QUERY_MAX_LIMIT = 10000;
+export const CROWDSTRIKE_ALERTS_PAGE_SIZE = 1000;
+export const CROWDSTRIKE_ALERTS_ENTITY_BATCH_SIZE = 1000;
+/*
+ * limit + offset must not exceed this on the alerts query index. A window
+ * with more alerts than this cannot be read completely by offset paging.
+ */
+export const CROWDSTRIKE_ALERTS_OFFSET_CEILING = 10000;
+export const CROWDSTRIKE_ALERTS_DEFAULT_SORT = "created_timestamp.asc";
+/*
+ * Falcon tokens last 30 minutes; refresh a minute early so a token that
+ * expires mid-page does not turn into a spurious 401.
+ */
+const TOKEN_EXPIRY_SLACK_IN_SECONDS = 60;
+const DEFAULT_TOKEN_LIFETIME_IN_SECONDS = 1799;
+/*
+ * Error bodies are echoed for diagnosis but bounded: a WAF or gateway can
+ * answer with a multi-megabyte HTML page.
+ */
+const MAX_ERROR_BODY_LENGTH = 2000;
+const TRUNCATION_MARKER = "... (truncated)";
+const RATE_LIMIT_RETRY_AFTER_HEADER = "x-ratelimit-retryafter";
+/*
+ * What DataSourceHttpFetch throws for a non-2xx status. The status and the
+ * body are recovered from it so the caller sees one shape either way.
+ */
+const TRANSPORT_STATUS_ERROR_PATTERN = /Data source responded with HTTP (\d{3})(?::\s?([\s\S]*))?$/;
+const HTTP_STATUS_IN_MESSAGE_PATTERN = /\(HTTP (\d{3})\)/;
+export default class CrowdStrikeFalconClient {
+    constructor(options) {
+        this.cachedAccessToken = null;
+        this.cachedAccessTokenExpiresAtInMs = 0;
+        this.requestCount = 0;
+        const baseUrl = getCrowdStrikeFalconBaseUrl(options.cloud);
+        if (!baseUrl) {
+            throw new APIException(`CrowdStrike Falcon cloud "${redactLogString(String(options.cloud || ""))}" is not one of ${CROWDSTRIKE_FALCON_CLOUDS.join(", ")}.`);
+        }
+        this.baseUrl = baseUrl;
+        this.clientId = options.clientId;
+        this.clientSecret = options.clientSecret;
+        this.transport = options.transport;
+        this.requestTimeoutInMs = options.requestTimeoutInMs;
+    }
+    getBaseUrl() {
+        return this.baseUrl;
+    }
+    // Outbound requests issued so far, token requests included.
+    getRequestCount() {
+        return this.requestCount;
+    }
+    /*
+     * FQL for "created in [start, end)". Quoted RFC3339 timestamps and `+`
+     * as the conjunction, per Falcon Query Language. The filter is passed
+     * through URLSearchParams, which percent-encodes the `+` so Falcon does
+     * not read it as a space.
+     */
+    static buildCreatedTimestampFilter(start, end) {
+        return `created_timestamp:>='${start.toISOString()}'+created_timestamp:<'${end.toISOString()}'`;
+    }
+    static parseHttpStatusFromMessage(message) {
+        const match = (message || "").match(HTTP_STATUS_IN_MESSAGE_PATTERN);
+        if (!match || !match[1]) {
+            return null;
+        }
+        return Number(match[1]);
+    }
+    async getAccessToken() {
+        if (this.cachedAccessToken &&
+            Date.now() < this.cachedAccessTokenExpiresAtInMs) {
+            return this.cachedAccessToken;
+        }
+        const response = await this.send("token request", {
+            method: "POST",
+            url: `${this.baseUrl}/oauth2/token`,
+            headers: { Accept: "application/json" },
+            body: { client_id: this.clientId, client_secret: this.clientSecret },
+            formUrlEncoded: true,
+        });
+        // Falcon answers the token request with 201, not 200.
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+            throw new APIException(`CrowdStrike Falcon token request failed (HTTP ${response.statusCode}): ${this.describeErrorBody(response)}`);
+        }
+        if (!this.isJsonObject(response.bodyJson)) {
+            throw new APIException("CrowdStrike Falcon token request returned a non-JSON body.");
+        }
+        const accessToken = response.bodyJson["access_token"];
+        if (typeof accessToken !== "string" || !accessToken) {
+            throw new APIException("CrowdStrike Falcon token request returned no access_token.");
+        }
+        const expiresIn = response.bodyJson["expires_in"];
+        const lifetimeInSeconds = typeof expiresIn === "number" &&
+            Number.isFinite(expiresIn) &&
+            expiresIn > 0
+            ? expiresIn
+            : DEFAULT_TOKEN_LIFETIME_IN_SECONDS;
+        this.cachedAccessToken = accessToken;
+        this.cachedAccessTokenExpiresAtInMs =
+            Date.now() +
+                Math.max(1, lifetimeInSeconds - TOKEN_EXPIRY_SLACK_IN_SECONDS) * 1000;
+        return accessToken;
+    }
+    /*
+     * GET /alerts/queries/alerts/v2 — one page of composite ids matching the
+     * filter, sorted by creation time ascending so offset paging is stable.
+     */
+    async queryAlertIds(data) {
+        var _a, _b;
+        if (data.limit < 1 || data.limit > CROWDSTRIKE_ALERTS_QUERY_MAX_LIMIT) {
+            throw new APIException(`CrowdStrike Falcon alerts query limit must be between 1 and ${CROWDSTRIKE_ALERTS_QUERY_MAX_LIMIT}.`);
+        }
+        if (data.offset < 0) {
+            throw new APIException("CrowdStrike Falcon alerts query offset must not be negative.");
+        }
+        const params = new URLSearchParams();
+        params.set("filter", data.filter);
+        params.set("sort", data.sort || CROWDSTRIKE_ALERTS_DEFAULT_SORT);
+        params.set("limit", String(data.limit));
+        params.set("offset", String(data.offset));
+        const response = await this.sendAuthenticated("alerts query", {
+            method: "GET",
+            url: `${this.baseUrl}/alerts/queries/alerts/v2?${params.toString()}`,
+        });
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+            throw new APIException(`CrowdStrike Falcon alerts query failed (HTTP ${response.statusCode}): ${this.describeErrorBody(response)}`);
+        }
+        if (!this.isJsonObject(response.bodyJson)) {
+            throw new APIException("CrowdStrike Falcon alerts query returned a non-JSON body.");
+        }
+        const resources = response.bodyJson["resources"];
+        /*
+         * `resources` may be null on an empty result in some Falcon responses;
+         * anything that is neither null nor an array is not this endpoint.
+         */
+        if (resources !== null &&
+            resources !== undefined &&
+            !Array.isArray(resources)) {
+            throw new APIException(`CrowdStrike Falcon alerts query returned an unrecognized response shape: ${this.summarizeBody(response.bodyJson)}`);
+        }
+        const compositeIds = (Array.isArray(resources) ? resources : [])
+            .filter((item) => {
+            return typeof item === "string" && item.length > 0;
+        })
+            .map((item) => {
+            return String(item);
+        });
+        const pagination = this.readPagination(response.bodyJson);
+        return {
+            compositeIds,
+            total: this.readCount(pagination, "total"),
+            offset: (_a = this.readCount(pagination, "offset")) !== null && _a !== void 0 ? _a : data.offset,
+            limit: (_b = this.readCount(pagination, "limit")) !== null && _b !== void 0 ? _b : data.limit,
+        };
+    }
+    /*
+     * How many alerts Falcon created in [start, end): one request with
+     * limit=1, reading meta.pagination.total. Bounded by construction — the
+     * count is Falcon's, not a page walk — which is what the availability
+     * check needs for a 7-day window on a busy tenant.
+     */
+    async countAlertsCreatedBetween(data) {
+        const page = await this.queryAlertIds({
+            filter: CrowdStrikeFalconClient.buildCreatedTimestampFilter(data.startTime, data.endTime),
+            limit: 1,
+            offset: 0,
+        });
+        if (page.total !== null) {
+            return { count: page.total, exact: true };
+        }
+        return { count: page.compositeIds.length, exact: false };
+    }
+    /*
+     * POST /alerts/entities/alerts/v2 — full alert entities for up to one
+     * batch of composite ids. Batching is the caller's job so it can count
+     * requests against its budget.
+     */
+    async getAlerts(compositeIds) {
+        if (!compositeIds.length) {
+            return [];
+        }
+        if (compositeIds.length > CROWDSTRIKE_ALERTS_ENTITY_BATCH_SIZE) {
+            throw new APIException(`CrowdStrike Falcon alerts fetch accepts at most ${CROWDSTRIKE_ALERTS_ENTITY_BATCH_SIZE} composite ids per request.`);
+        }
+        const response = await this.sendAuthenticated("alerts fetch", {
+            method: "POST",
+            url: `${this.baseUrl}/alerts/entities/alerts/v2`,
+            body: JSON.stringify({ composite_ids: compositeIds }),
+        });
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+            throw new APIException(`CrowdStrike Falcon alerts fetch failed (HTTP ${response.statusCode}): ${this.describeErrorBody(response)}`);
+        }
+        if (!this.isJsonObject(response.bodyJson)) {
+            throw new APIException("CrowdStrike Falcon alerts fetch returned a non-JSON body.");
+        }
+        const resources = response.bodyJson["resources"];
+        if (resources !== null &&
+            resources !== undefined &&
+            !Array.isArray(resources)) {
+            throw new APIException(`CrowdStrike Falcon alerts fetch returned an unrecognized response shape: ${this.summarizeBody(response.bodyJson)}`);
+        }
+        return (Array.isArray(resources) ? resources : []).filter((item) => {
+            return this.isJsonObject(item);
+        });
+    }
+    /*
+     * Authenticated call with one retry on 401 when the token came from the
+     * cache: a token revoked mid-run (client secret rotated in Falcon) should
+     * cost one extra request, not a failed poll.
+     */
+    async sendAuthenticated(step, request) {
+        const hadCachedToken = Boolean(this.cachedAccessToken);
+        const token = await this.getAccessToken();
+        const response = await this.send(step, {
+            method: request.method,
+            url: request.url,
+            headers: Object.assign({ Authorization: `Bearer ${token}`, Accept: "application/json" }, (request.body !== undefined
+                ? { "Content-Type": "application/json" }
+                : {})),
+            body: request.body,
+        });
+        if (response.statusCode !== 401 || !hadCachedToken) {
+            return response;
+        }
+        this.cachedAccessToken = null;
+        this.cachedAccessTokenExpiresAtInMs = 0;
+        const freshToken = await this.getAccessToken();
+        return this.send(step, {
+            method: request.method,
+            url: request.url,
+            headers: Object.assign({ Authorization: `Bearer ${freshToken}`, Accept: "application/json" }, (request.body !== undefined
+                ? { "Content-Type": "application/json" }
+                : {})),
+            body: request.body,
+        });
+    }
+    /*
+     * The one place a request leaves this class. Applies the timeout, counts
+     * the request, and folds the transport's thrown non-2xx errors back into
+     * a response so every caller sees status + body.
+     */
+    async send(step, request) {
+        this.requestCount++;
+        let response;
+        try {
+            response = await this.transport({
+                method: request.method,
+                url: request.url,
+                headers: request.headers,
+                body: request.body,
+                formUrlEncoded: request.formUrlEncoded,
+                timeoutInMs: this.requestTimeoutInMs,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const match = message.match(TRANSPORT_STATUS_ERROR_PATTERN);
+            if (match && match[1]) {
+                const bodyText = match[2] || "";
+                return {
+                    statusCode: Number(match[1]),
+                    bodyText,
+                    bodyJson: this.tryParseJson(bodyText),
+                    headers: {},
+                };
+            }
+            /*
+             * Timeouts, DNS failures, egress-guard refusals: nothing came back,
+             * so no status is claimed. The transport's own wording ("timeout of
+             * 20000ms exceeded") is kept, redacted.
+             */
+            throw new APIException(`CrowdStrike Falcon ${step} could not be completed: ${this.scrubSecrets(redactLogString(message))}`);
+        }
+        const headers = {};
+        for (const key of Object.keys(response.headers || {})) {
+            headers[key.toLowerCase()] = String(response.headers[key]);
+        }
+        return {
+            statusCode: response.statusCode,
+            bodyText: response.bodyText || "",
+            bodyJson: response.bodyJson !== undefined
+                ? response.bodyJson
+                : this.tryParseJson(response.bodyText || ""),
+            headers,
+        };
+    }
+    /*
+     * The echoed error body: JSON is redacted structurally (so a
+     * `client_secret` member is replaced whatever its value), text is
+     * redacted textually, both are bounded, and a 429 names the
+     * X-RateLimit-RetryAfter header so the operator knows what Falcon asked.
+     */
+    describeErrorBody(response) {
+        let body;
+        if (response.bodyJson !== undefined) {
+            body = JSON.stringify(redactLogValue(response.bodyJson));
+        }
+        else {
+            body = redactLogString(response.bodyText || "");
+        }
+        body = this.scrubSecrets(body || "(empty body)");
+        if (body.length > MAX_ERROR_BODY_LENGTH) {
+            body = `${body.slice(0, MAX_ERROR_BODY_LENGTH - TRUNCATION_MARKER.length)}${TRUNCATION_MARKER}`;
+        }
+        if (response.statusCode === 429) {
+            const retryAfter = response.headers[RATE_LIMIT_RETRY_AFTER_HEADER];
+            return retryAfter
+                ? `${body}; Falcon rate limited the request, X-RateLimit-RetryAfter: ${redactLogString(retryAfter)}`
+                : `${body}; Falcon rate limited the request and the X-RateLimit-RetryAfter header was not available`;
+        }
+        return body;
+    }
+    summarizeBody(bodyJson) {
+        let summary = "";
+        try {
+            summary = JSON.stringify(redactLogValue(bodyJson)) || "";
+        }
+        catch (_a) {
+            summary = "(unserializable body)";
+        }
+        summary = this.scrubSecrets(summary);
+        if (summary.length > MAX_ERROR_BODY_LENGTH) {
+            summary = `${summary.slice(0, MAX_ERROR_BODY_LENGTH - TRUNCATION_MARKER.length)}${TRUNCATION_MARKER}`;
+        }
+        return summary;
+    }
+    /*
+     * Belt and braces behind the generic redactor: the values this client
+     * KNOWS are secrets are removed by literal match wherever they appear.
+     */
+    scrubSecrets(text) {
+        let scrubbed = text;
+        for (const secret of [this.clientSecret, this.cachedAccessToken]) {
+            if (secret && secret.length >= 4) {
+                scrubbed = scrubbed.split(secret).join("[REDACTED]");
+            }
+        }
+        return scrubbed;
+    }
+    readPagination(bodyJson) {
+        const meta = bodyJson["meta"];
+        if (!this.isJsonObject(meta)) {
+            return null;
+        }
+        const pagination = meta["pagination"];
+        return this.isJsonObject(pagination) ? pagination : null;
+    }
+    readCount(pagination, key) {
+        if (!pagination) {
+            return null;
+        }
+        const value = pagination[key];
+        if (typeof value === "number" && Number.isFinite(value) && value >= 0) {
+            return value;
+        }
+        if (typeof value === "string" && value.trim() !== "") {
+            const parsed = Number(value);
+            return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+        }
+        return null;
+    }
+    tryParseJson(text) {
+        if (!text) {
+            return undefined;
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch (_a) {
+            return undefined;
+        }
+    }
+    isJsonObject(value) {
+        return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+}
+//# sourceMappingURL=CrowdStrikeFalconClient.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/CrowdStrikeFalcon/CrowdStrikeFalconClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CrowdStrikeFalconClient.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/SecurityEvent/Connectors/CrowdStrikeFalcon/CrowdStrikeFalconClient.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,6CAA6C,CAAC;AAIvE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAmDxE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAG3C;IACF,MAAM,EAAE,6BAA6B;IACrC,MAAM,EAAE,kCAAkC;IAC1C,MAAM,EAAE,kCAAkC;IAC1C,UAAU,EAAE,wCAAwC;CACrD,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,MAAM,GAAG,GAAW,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEvD,IACE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAClC,kCAAkC,EAClC,GAAG,CACJ,EACD,CAAC;QACD,OAAO,kCAAkC,CAAC,GAA6B,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAkC;IACtE,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;CACX,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAW,KAAK,CAAC;AAChE,MAAM,CAAC,MAAM,4BAA4B,GAAW,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,oCAAoC,GAAW,IAAI,CAAC;AACjE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAW,KAAK,CAAC;AAC/D,MAAM,CAAC,MAAM,+BAA+B,GAAW,uBAAuB,CAAC;AAE/E;;;GAGG;AACH,MAAM,6BAA6B,GAAW,EAAE,CAAC;AACjD,MAAM,iCAAiC,GAAW,IAAI,CAAC;AAEvD;;;GAGG;AACH,MAAM,qBAAqB,GAAW,IAAI,CAAC;AAC3C,MAAM,iBAAiB,GAAW,iBAAiB,CAAC;AAEpD,MAAM,6BAA6B,GAAW,wBAAwB,CAAC;AAEvE;;;GAGG;AACH,MAAM,8BAA8B,GAClC,4DAA4D,CAAC;AAE/D,MAAM,8BAA8B,GAAW,kBAAkB,CAAC;AAwClE,MAAM,CAAC,OAAO,OAAO,uBAAuB;IAW1C,YAAmB,OAAuC;QAJlD,sBAAiB,GAAkB,IAAI,CAAC;QACxC,mCAA8B,GAAW,CAAC,CAAC;QAC3C,iBAAY,GAAW,CAAC,CAAC;QAG/B,MAAM,OAAO,GAAkB,2BAA2B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACpB,6BAA6B,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,mBAAmB,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpI,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IACvD,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,4DAA4D;IACrD,eAAe;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,2BAA2B,CAAC,KAAW,EAAE,GAAS;QAC9D,OAAO,wBAAwB,KAAK,CAAC,WAAW,EAAE,yBAAyB,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC;IAClG,CAAC;IAEM,MAAM,CAAC,0BAA0B,CAAC,OAAe;QACtD,MAAM,KAAK,GAA4B,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAC1D,8BAA8B,CAC/B,CAAC;QAEF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAEM,KAAK,CAAC,cAAc;QACzB,IACE,IAAI,CAAC,iBAAiB;YACtB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,8BAA8B,EAChD,CAAC;YACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAChC,CAAC;QAED,MAAM,QAAQ,GAAuB,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,eAAe;YACnC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE;YACpE,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QAEH,sDAAsD;QACtD,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CACpB,iDAAiD,QAAQ,CAAC,UAAU,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAC7G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,YAAY,CACpB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAY,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAE/D,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YACpD,MAAM,IAAI,YAAY,CACpB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAY,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,iBAAiB,GACrB,OAAO,SAAS,KAAK,QAAQ;YAC7B,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC1B,SAAS,GAAG,CAAC;YACX,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,iCAAiC,CAAC;QAExC,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC;QACrC,IAAI,CAAC,8BAA8B;YACjC,IAAI,CAAC,GAAG,EAAE;gBACV,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,iBAAiB,GAAG,6BAA6B,CAAC,GAAG,IAAI,CAAC;QAExE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,aAAa,CAAC,IAK1B;;QACC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,kCAAkC,EAAE,CAAC;YACtE,MAAM,IAAI,YAAY,CACpB,+DAA+D,kCAAkC,GAAG,CACrG,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,YAAY,CACpB,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAoB,IAAI,eAAe,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,+BAA+B,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAuB,MAAM,IAAI,CAAC,iBAAiB,CAC/D,cAAc,EACd;YACE,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,6BAA6B,MAAM,CAAC,QAAQ,EAAE,EAAE;SACrE,CACF,CAAC;QAEF,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CACpB,gDAAgD,QAAQ,CAAC,UAAU,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAC5G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,YAAY,CACpB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAY,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1D;;;WAGG;QACH,IACE,SAAS,KAAK,IAAI;YAClB,SAAS,KAAK,SAAS;YACvB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACzB,CAAC;YACD,MAAM,IAAI,YAAY,CACpB,4EAA4E,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CACpH,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAkB,CAClC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAC1C;aACE,MAAM,CAAC,CAAC,IAAa,EAAW,EAAE;YACjC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACrD,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,IAAa,EAAU,EAAE;YAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEL,MAAM,UAAU,GAAsB,IAAI,CAAC,cAAc,CACvD,QAAQ,CAAC,QAAQ,CAClB,CAAC;QAEF,OAAO;YACL,YAAY;YACZ,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC;YAC1C,MAAM,EAAE,MAAA,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,mCAAI,IAAI,CAAC,MAAM;YAC3D,KAAK,EAAE,MAAA,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,mCAAI,IAAI,CAAC,KAAK;SACzD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,yBAAyB,CAAC,IAGtC;QACC,MAAM,IAAI,GAA4B,MAAM,IAAI,CAAC,aAAa,CAAC;YAC7D,MAAM,EAAE,uBAAuB,CAAC,2BAA2B,CACzD,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,CACb;YACD,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,CAAC;SACV,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,SAAS,CACpB,YAA2B;QAE3B,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,GAAG,oCAAoC,EAAE,CAAC;YAC/D,MAAM,IAAI,YAAY,CACpB,mDAAmD,oCAAoC,6BAA6B,CACrH,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAuB,MAAM,IAAI,CAAC,iBAAiB,CAC/D,cAAc,EACd;YACE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,4BAA4B;YAChD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;SACtD,CACF,CAAC;QAEF,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CACpB,gDAAgD,QAAQ,CAAC,UAAU,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAC5G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,YAAY,CACpB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAY,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1D,IACE,SAAS,KAAK,IAAI;YAClB,SAAS,KAAK,SAAS;YACvB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACzB,CAAC;YACD,MAAM,IAAI,YAAY,CACpB,4EAA4E,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CACpH,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACvD,CAAC,IAAa,EAAsB,EAAE;YACpC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAC7B,IAAkC,EAClC,OAIC;QAED,MAAM,cAAc,GAAY,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChE,MAAM,KAAK,GAAW,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAElD,MAAM,QAAQ,GAAuB,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YACzD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,kBACL,aAAa,EAAE,UAAU,KAAK,EAAE,EAChC,MAAM,EAAE,kBAAkB,IACvB,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;gBAC5B,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC,CACR;YACD,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACnD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC,8BAA8B,GAAG,CAAC,CAAC;QACxC,MAAM,UAAU,GAAW,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAEvD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,kBACL,aAAa,EAAE,UAAU,UAAU,EAAE,EACrC,MAAM,EAAE,kBAAkB,IACvB,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;gBAC5B,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC,CACR;YACD,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,IAAI,CAChB,IAAkC,EAClC,OAMC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,IAAI,QAAgC,CAAC;QAErC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,WAAW,EAAE,IAAI,CAAC,kBAAkB;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,KAAK,GAA4B,OAAO,CAAC,KAAK,CAClD,8BAA8B,CAC/B,CAAC;YAEF,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO;oBACL,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC5B,QAAQ;oBACR,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;oBACrC,OAAO,EAAE,EAAE;iBACZ,CAAC;YACJ,CAAC;YAED;;;;eAIG;YACH,MAAM,IAAI,YAAY,CACpB,sBAAsB,IAAI,4BAA4B,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CACpG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAuB,EAAE,CAAC;QAEvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAChC,QAAQ,CAAC,OAA8B,CAAC,GAAG,CAAC,CAC9C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;YACjC,QAAQ,EACN,QAAQ,CAAC,QAAQ,KAAK,SAAS;gBAC7B,CAAC,CAAC,QAAQ,CAAC,QAAQ;gBACnB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;YAChD,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,QAA4B;QACpD,IAAI,IAAY,CAAC;QAEjB,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAqB,CAAC,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,cAAc,CAAC,CAAC;QAEjD,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACxC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAClG,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAChC,MAAM,UAAU,GACd,QAAQ,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;YAElD,OAAO,UAAU;gBACf,CAAC,CAAC,GAAG,IAAI,8DAA8D,eAAe,CAAC,UAAU,CAAC,EAAE;gBACpG,CAAC,CAAC,GAAG,IAAI,2FAA2F,CAAC;QACzG,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa,CAAC,QAAiB;QACrC,IAAI,OAAO,GAAW,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,GAAG,uBAAuB,CAAC;QACpC,CAAC;QAED,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAErC,IAAI,OAAO,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YAC3C,OAAO,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QACxG,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,IAAY;QAC/B,IAAI,QAAQ,GAAW,IAAI,CAAC;QAE5B,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACjE,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACjC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,cAAc,CAAC,QAAoB;QACzC,MAAM,IAAI,GAAY,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEvC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAY,IAAI,CAAC,YAAY,CAAC,CAAC;QAE/C,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAEO,SAAS,CAAC,UAA6B,EAAE,GAAW;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAY,UAAU,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,KAAc;QACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;CACF"}