@oneuptime/common 13.0.3 → 13.0.5

package/build/dist/Server/Utils/SecurityEvent/Connectors/ElasticSecurity/ElasticSecurityClient.js

@@ -0,0 +1,344 @@
+import APIException from "../../../../../Types/Exception/ApiException";
+import { REDACTED, redactLogString, redactLogValue, } from "../../../LogRedaction";
+/*
+ * One request never asks for more than this many alerts. Elasticsearch
+ * caps a plain search at index.max_result_window (10,000 by default) and a
+ * page of a thousand full alert documents is already several megabytes,
+ * which is where the transport's response-size cap starts to matter.
+ */
+export const ELASTIC_SECURITY_MAX_PAGE_SIZE = 1000;
+/*
+ * Upper bound on the JSON size of the excluded `_id` list in one request.
+ * Kibana refuses a request body above server.maxPayload, 1,048,576 bytes
+ * by default
+ * (https://www.elastic.co/docs/reference/kibana/configuration-reference/general-settings);
+ * half of that leaves room for the rest of the body and for a proxy with
+ * a lower limit. Detection alert ids are 64-character hashes, so this is
+ * about 7,800 alerts sharing one @timestamp.
+ */
+export const ELASTIC_SECURITY_MAX_EXCLUDED_ID_BYTES = 512 * 1024;
+export const ELASTIC_STATUS_STEP = "Elastic Security status request";
+export const ELASTIC_SEARCH_STEP = "Elastic Security alerts search";
+/*
+ * Thrown for every failure that carries an HTTP status, so the connector
+ * can pick remediation text per status without parsing the message.
+ */
+export class ElasticSecurityHttpError extends APIException {
+    constructor(message, statusCode) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+const TRANSPORT_HTTP_FAILURE_REGEX = /Data source responded with HTTP (\d{3}):\s*([\s\S]*)$/;
+export default class ElasticSecurityClient {
+    constructor(options) {
+        this.requestCount = 0;
+        this.options = options;
+        this.baseUrl = ElasticSecurityClient.buildBaseUrl(options.kibanaUrl, options.space);
+    }
+    /*
+     * {kibanaUrl}[/s/{space}] with trailing slashes removed, so a URL pasted
+     * as "https://kibana.example.com/" does not produce "//api/status".
+     * Kibana scopes every API to a space through this path prefix; the
+     * default space has no prefix.
+     */
+    static buildBaseUrl(kibanaUrl, space) {
+        const trimmed = kibanaUrl.trim().replace(/\/+$/, "");
+        const spaceId = space.trim();
+        if (!spaceId || spaceId === "default") {
+            return trimmed;
+        }
+        return `${trimmed}/s/${encodeURIComponent(spaceId)}`;
+    }
+    getBaseUrl() {
+        return this.baseUrl;
+    }
+    getRequestCount() {
+        return this.requestCount;
+    }
+    async getStatus() {
+        const response = await this.send(ELASTIC_STATUS_STEP, {
+            method: "GET",
+            url: `${this.baseUrl}/api/status`,
+            headers: this.headers(),
+            timeoutInMs: this.options.requestTimeoutInMs,
+        });
+        const body = response.bodyJson;
+        if (!ElasticSecurityClient.isJsonObject(body)) {
+            throw new APIException(`${ELASTIC_STATUS_STEP} returned a non-JSON body.`);
+        }
+        const status = body["status"];
+        const version = body["version"];
+        /*
+         * Both the authenticated and the redacted status document carry a
+         * `status` object. A JSON body without one is something else entirely
+         * (a proxy's error envelope, a different product on that URL) and is
+         * reported as such rather than read as "not authenticated".
+         */
+        if (!ElasticSecurityClient.isJsonObject(status)) {
+            throw new APIException(`${ELASTIC_STATUS_STEP} returned an unrecognized response shape: ${this.summarize(body)}`);
+        }
+        const overall = status["overall"];
+        const name = ElasticSecurityClient.readText(body["name"]);
+        const versionNumber = ElasticSecurityClient.isJsonObject(version)
+            ? ElasticSecurityClient.readText(version["number"])
+            : "";
+        return {
+            name,
+            version: versionNumber,
+            level: ElasticSecurityClient.isJsonObject(overall)
+                ? ElasticSecurityClient.readText(overall["level"])
+                : "",
+            summary: ElasticSecurityClient.isJsonObject(overall)
+                ? ElasticSecurityClient.readText(overall["summary"])
+                : "",
+            authenticated: Boolean(name || versionNumber),
+        };
+    }
+    /*
+     * One page of alerts created in [startTime, endTime), oldest first. The
+     * query is a single range filter on @timestamp, the field Kibana stamps
+     * with the rule execution time — the CREATION basis the poller needs.
+     */
+    async searchAlerts(request) {
+        const size = Math.max(0, Math.min(ELASTIC_SECURITY_MAX_PAGE_SIZE, Math.trunc(request.size)));
+        const range = {
+            range: {
+                "@timestamp": {
+                    gte: ElasticSecurityClient.toIso(request.startTime),
+                    lt: ElasticSecurityClient.toIso(request.endTime),
+                },
+            },
+        };
+        const excludeIds = (request.excludeIds || []).filter((id) => {
+            return id.length > 0;
+        });
+        /*
+         * The plain range stays the query whenever nothing is excluded, so
+         * the common request is exactly the documented shape.
+         */
+        const body = {
+            query: excludeIds.length > 0
+                ? {
+                    bool: {
+                        filter: [range],
+                        must_not: [{ ids: { values: excludeIds } }],
+                    },
+                }
+                : range,
+            size: size,
+        };
+        /*
+         * Sorting on _id is not allowed in Elasticsearch 8 (fielddata on _id
+         * is disabled), so @timestamp alone orders the page; the connector
+         * breaks ties by excluding the ids it has already read at the lower
+         * bound and by remembering ids across pages.
+         */
+        if (size > 0) {
+            body["sort"] = [{ "@timestamp": "asc" }];
+        }
+        if (request.trackTotalHits) {
+            body["track_total_hits"] = true;
+        }
+        const response = await this.send(ELASTIC_SEARCH_STEP, {
+            method: "POST",
+            url: `${this.baseUrl}/api/detection_engine/signals/search`,
+            headers: Object.assign(Object.assign({}, this.headers()), { "Content-Type": "application/json" }),
+            body: JSON.stringify(body),
+            timeoutInMs: this.options.requestTimeoutInMs,
+        });
+        return this.parseSearchBody(response);
+    }
+    /*
+     * Number of alerts created in the window, in one request: size 0 with
+     * track_total_hits so Elasticsearch counts past its default 10,000 cap
+     * instead of answering "gte 10000".
+     */
+    async countAlerts(data) {
+        const result = await this.searchAlerts({
+            startTime: data.startTime,
+            endTime: data.endTime,
+            size: 0,
+            trackTotalHits: true,
+        });
+        if (result.total === null) {
+            throw new APIException(`${ELASTIC_SEARCH_STEP} returned an unrecognized response shape: hits.total is missing.`);
+        }
+        return { count: result.total, exact: result.totalRelation !== "gte" };
+    }
+    headers() {
+        return {
+            Authorization: `ApiKey ${this.options.apiKey}`,
+            "kbn-xsrf": "true",
+            Accept: "application/json",
+        };
+    }
+    /*
+     * Send through the transport and normalize the two ways a failure
+     * arrives (a thrown transport error, or a fixture's non-2xx status) into
+     * one ElasticSecurityHttpError / APIException taxonomy.
+     */
+    async send(step, request) {
+        let response;
+        this.requestCount += 1;
+        try {
+            response = await this.options.transport(request);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const match = message.match(TRANSPORT_HTTP_FAILURE_REGEX);
+            if (match && match[1]) {
+                const status = Number(match[1]);
+                throw new ElasticSecurityHttpError(`${step} failed (HTTP ${status}): ${this.redactBody(match[2] || "")}${ElasticSecurityClient.describeHttpFailure(status)}`, status);
+            }
+            /*
+             * No status at all: a timeout, a refused connection, a DNS failure
+             * or the egress guard. Nothing came back, so the message assigns no
+             * side; the connector's remediation text talks about reachability.
+             */
+            throw new APIException(`${step} did not complete: ${this.scrub(redactLogString(message))}`);
+        }
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+            throw new ElasticSecurityHttpError(`${step} failed (HTTP ${response.statusCode}): ${this.redactBody(response.bodyText || "")}${ElasticSecurityClient.describeHttpFailure(response.statusCode)}`, response.statusCode);
+        }
+        return response;
+    }
+    parseSearchBody(response) {
+        const body = response.bodyJson;
+        if (!ElasticSecurityClient.isJsonObject(body)) {
+            throw new APIException(`${ELASTIC_SEARCH_STEP} returned a non-JSON body.`);
+        }
+        const hitsEnvelope = body["hits"];
+        /*
+         * A body without `hits` is never "no alerts": Kibana's own error
+         * envelope ({ statusCode, error, message } or { message, status_code })
+         * arrives as JSON too, and counting it as an empty window would let
+         * the poller advance its cursor past whatever it did not read.
+         */
+        if (!ElasticSecurityClient.isJsonObject(hitsEnvelope)) {
+            throw new APIException(`${ELASTIC_SEARCH_STEP} returned an unrecognized response shape: ${this.summarize(body)}`);
+        }
+        const rawHits = hitsEnvelope["hits"];
+        if (!Array.isArray(rawHits)) {
+            throw new APIException(`${ELASTIC_SEARCH_STEP} returned an unrecognized response shape: hits.hits is not an array.`);
+        }
+        const hits = [];
+        for (const rawHit of rawHits) {
+            if (!ElasticSecurityClient.isJsonObject(rawHit)) {
+                continue;
+            }
+            const hit = rawHit;
+            const source = hit["_source"];
+            hits.push({
+                id: ElasticSecurityClient.readText(hit["_id"]),
+                index: ElasticSecurityClient.readText(hit["_index"]),
+                source: ElasticSecurityClient.isJsonObject(source) ? source : {},
+                timestamp: ElasticSecurityClient.isJsonObject(source)
+                    ? ElasticSecurityClient.readText(source["@timestamp"])
+                    : "",
+            });
+        }
+        /*
+         * hits.total is { value, relation } by default and a bare number when
+         * the cluster runs with rest_total_hits_as_int.
+         */
+        const total = hitsEnvelope["total"];
+        let totalValue = null;
+        let totalRelation = null;
+        if (typeof total === "number" && Number.isFinite(total)) {
+            totalValue = total;
+            totalRelation = "eq";
+        }
+        else if (ElasticSecurityClient.isJsonObject(total)) {
+            const value = total["value"];
+            if (typeof value === "number" && Number.isFinite(value)) {
+                totalValue = value;
+                totalRelation =
+                    ElasticSecurityClient.readText(total["relation"]) === "gte"
+                        ? "gte"
+                        : "eq";
+            }
+        }
+        return { hits, total: totalValue, totalRelation };
+    }
+    /*
+     * Operator guidance appended behind the echoed body, keyed by status.
+     * The prefix, status and body ahead of it are the contract the docs are
+     * written against; this only adds to the tail. Privilege names follow
+     * https://www.elastic.co/guide/en/security/current/detections-permissions-section.html
+     */
+    static describeHttpFailure(status) {
+        let hint = "";
+        if (status === 401) {
+            hint =
+                "Kibana did not accept the API key. Paste the key's base64 encoded value (shown once as 'encoded' or 'Base64' when the key is created), and check that the key has not expired or been invalidated.";
+        }
+        else if (status === 403) {
+            hint =
+                "The API key authenticated but lacks privileges. It needs the Kibana Security feature privilege that allows viewing alerts in this space, and read plus view_index_metadata on the .alerts-security.alerts-<space-id> index.";
+        }
+        else if (status === 404) {
+            hint =
+                "Kibana answered 404. Check the Kibana URL (the origin Kibana is served from, without a trailing path) and the space id; the detection engine API lives at /api/detection_engine under that base.";
+        }
+        else if (status === 429) {
+            hint =
+                "Kibana or Elasticsearch is rate limiting requests. The poll will be retried on the next interval.";
+        }
+        else if (status === 503) {
+            hint =
+                "Kibana reports itself unavailable, usually because Elasticsearch is unreachable or still starting.";
+        }
+        else if (status >= 500) {
+            hint =
+                "Kibana or Elasticsearch failed internally. Check the Kibana server logs; the poll will be retried.";
+        }
+        else if (status >= 300 && status < 400) {
+            hint =
+                "Kibana redirected the request. Redirects are refused; use the URL Kibana is served from directly.";
+        }
+        return hint ? ` — ${hint}` : "";
+    }
+    /*
+     * The body of a failed response is quoted into check messages and the
+     * connection's lastError, so it is decoded and structurally redacted
+     * first (a JSON message can itself contain credential JSON), then the
+     * configured key is scrubbed as a literal in case Kibana echoed it.
+     */
+    redactBody(body) {
+        const excerpt = body.substring(0, 500);
+        try {
+            return this.scrub(JSON.stringify(redactLogValue(JSON.parse(excerpt))));
+        }
+        catch (_a) {
+            return this.scrub(redactLogString(excerpt));
+        }
+    }
+    summarize(body) {
+        return this.scrub(JSON.stringify(redactLogValue(body)).substring(0, 300));
+    }
+    /*
+     * The textual redaction rules know Bearer/Basic/Token schemes but not
+     * "ApiKey", so the configured key is removed as a literal as well.
+     */
+    scrub(text) {
+        const apiKey = this.options.apiKey;
+        if (!apiKey || !text) {
+            return text;
+        }
+        return text.split(apiKey).join(REDACTED);
+    }
+    static toIso(value) {
+        return value instanceof Date ? value.toISOString() : value;
+    }
+    static readText(value) {
+        if (value === null || value === undefined || typeof value === "object") {
+            return "";
+        }
+        return String(value);
+    }
+    static isJsonObject(value) {
+        return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+}
+//# sourceMappingURL=ElasticSecurityClient.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/ElasticSecurity/ElasticSecurityClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ElasticSecurityClient.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/SecurityEvent/Connectors/ElasticSecurity/ElasticSecurityClient.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,6CAA6C,CAAC;AAOvE,OAAO,EACL,QAAQ,EACR,eAAe,EACf,cAAc,GACf,MAAM,uBAAuB,CAAC;AAsG/B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,IAAI,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAW,GAAG,GAAG,IAAI,CAAC;AAEzE,MAAM,CAAC,MAAM,mBAAmB,GAAW,iCAAiC,CAAC;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAW,gCAAgC,CAAC;AAE5E;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,YAAY;IAGxD,YAAmB,OAAe,EAAE,UAAkB;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,4BAA4B,GAChC,uDAAuD,CAAC;AAE1D,MAAM,CAAC,OAAO,OAAO,qBAAqB;IAKxC,YAAmB,OAAqC;QAFhD,iBAAY,GAAW,CAAC,CAAC;QAG/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAC/C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,KAAK,CACd,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,YAAY,CAAC,SAAiB,EAAE,KAAa;QACzD,MAAM,OAAO,GAAW,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC;QAErC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,GAAG,OAAO,MAAM,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEM,eAAe;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEM,KAAK,CAAC,SAAS;QACpB,MAAM,QAAQ,GAA2B,MAAM,IAAI,CAAC,IAAI,CACtD,mBAAmB,EACnB;YACE,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,aAAa;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;SAC7C,CACF,CAAC;QAEF,MAAM,IAAI,GAA0B,QAAQ,CAAC,QAEhC,CAAC;QAEd,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,YAAY,CACpB,GAAG,mBAAmB,4BAA4B,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAA0B,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,OAAO,GAA0B,IAAI,CAAC,SAAS,CAAC,CAAC;QAEvD;;;;;WAKG;QACH,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,YAAY,CACpB,GAAG,mBAAmB,6CAA6C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAA0B,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,IAAI,GAAW,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,aAAa,GAAW,qBAAqB,CAAC,YAAY,CAAC,OAAO,CAAC;YACvE,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnD,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,aAAa;YACtB,KAAK,EAAE,qBAAqB,CAAC,YAAY,CAAC,OAAO,CAAC;gBAChD,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAClD,CAAC,CAAC,EAAE;YACN,OAAO,EAAE,qBAAqB,CAAC,YAAY,CAAC,OAAO,CAAC;gBAClD,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACpD,CAAC,CAAC,EAAE;YACN,aAAa,EAAE,OAAO,CAAC,IAAI,IAAI,aAAa,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,YAAY,CACvB,OAA4B;QAE5B,MAAM,IAAI,GAAW,IAAI,CAAC,GAAG,CAC3B,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACnE,CAAC;QAEF,MAAM,KAAK,GAAe;YACxB,KAAK,EAAE;gBACL,YAAY,EAAE;oBACZ,GAAG,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;oBACnD,EAAE,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;iBACjD;aACF;SACF,CAAC;QACF,MAAM,UAAU,GAAkB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CACjE,CAAC,EAAU,EAAW,EAAE;YACtB,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACvB,CAAC,CACF,CAAC;QAEF;;;WAGG;QACH,MAAM,IAAI,GAAe;YACvB,KAAK,EACH,UAAU,CAAC,MAAM,GAAG,CAAC;gBACnB,CAAC,CAAC;oBACE,IAAI,EAAE;wBACJ,MAAM,EAAE,CAAC,KAAK,CAAC;wBACf,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;qBAC5C;iBACF;gBACH,CAAC,CAAC,KAAK;YACX,IAAI,EAAE,IAAI;SACX,CAAC;QAEF;;;;;WAKG;QACH,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,IAAI,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,GAA2B,MAAM,IAAI,CAAC,IAAI,CACtD,mBAAmB,EACnB;YACE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,sCAAsC;YAC1D,OAAO,kCACF,IAAI,CAAC,OAAO,EAAE,KACjB,cAAc,EAAE,kBAAkB,GACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;SAC7C,CACF,CAAC;QAEF,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CAAC,IAGxB;QACC,MAAM,MAAM,GAA8B,MAAM,IAAI,CAAC,YAAY,CAAC;YAChE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,CAAC;YACP,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,CACpB,GAAG,mBAAmB,kEAAkE,CACzF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;IACxE,CAAC;IAEO,OAAO;QACb,OAAO;YACL,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAC9C,UAAU,EAAE,MAAM;YAClB,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,OAA8B;QAE9B,IAAI,QAAgC,CAAC;QACrC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;QAEvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,KAAK,GAA4B,OAAO,CAAC,KAAK,CAClD,4BAA4B,CAC7B,CAAC;YAEF,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxC,MAAM,IAAI,wBAAwB,CAChC,GAAG,IAAI,iBAAiB,MAAM,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,EACzH,MAAM,CACP,CAAC;YACJ,CAAC;YAED;;;;eAIG;YACH,MAAM,IAAI,YAAY,CACpB,GAAG,IAAI,sBAAsB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5D,MAAM,IAAI,wBAAwB,CAChC,GAAG,IAAI,iBAAiB,QAAQ,CAAC,UAAU,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAC5J,QAAQ,CAAC,UAAU,CACpB,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,eAAe,CACrB,QAAgC;QAEhC,MAAM,IAAI,GAA0B,QAAQ,CAAC,QAEhC,CAAC;QAEd,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,YAAY,CACpB,GAAG,mBAAmB,4BAA4B,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAA0B,IAAI,CAAC,MAAM,CAAC,CAAC;QAEzD;;;;;WAKG;QACH,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,YAAY,CACpB,GAAG,mBAAmB,6CAA6C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAA0B,YAAY,CAAC,MAAM,CAAC,CAAC;QAE5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,YAAY,CACpB,GAAG,mBAAmB,sEAAsE,CAC7F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAA2B,EAAE,CAAC;QAExC,KAAK,MAAM,MAAM,IAAI,OAAyB,EAAE,CAAC;YAC/C,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,MAAmB,CAAC,EAAE,CAAC;gBAC7D,SAAS;YACX,CAAC;YAED,MAAM,GAAG,GAAe,MAAoB,CAAC;YAC7C,MAAM,MAAM,GAA0B,GAAG,CAAC,SAAS,CAAC,CAAC;YAErD,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC9C,KAAK,EAAE,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACpD,MAAM,EAAE,qBAAqB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBAChE,SAAS,EAAE,qBAAqB,CAAC,YAAY,CAAC,MAAM,CAAC;oBACnD,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;oBACtD,CAAC,CAAC,EAAE;aACP,CAAC,CAAC;QACL,CAAC;QAED;;;WAGG;QACH,MAAM,KAAK,GAA0B,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,aAAa,GAAwB,IAAI,CAAC;QAE9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,UAAU,GAAG,KAAK,CAAC;YACnB,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,qBAAqB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,KAAK,GAA0B,KAAK,CAAC,OAAO,CAAC,CAAC;YAEpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxD,UAAU,GAAG,KAAK,CAAC;gBACnB,aAAa;oBACX,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,KAAK;wBACzD,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,mBAAmB,CAAC,MAAc;QAC9C,IAAI,IAAI,GAAW,EAAE,CAAC;QAEtB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI;gBACF,oMAAoM,CAAC;QACzM,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,6NAA6N,CAAC;QAClO,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,kMAAkM,CAAC;QACvM,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,mGAAmG,CAAC;QACxG,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,oGAAoG,CAAC;QACzG,CAAC;aAAM,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,IAAI;gBACF,oGAAoG,CAAC;QACzG,CAAC;aAAM,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACzC,IAAI;gBACF,mGAAmG,CAAC;QACxG,CAAC;QAED,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,IAAY;QAC7B,MAAM,OAAO,GAAW,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC,CAAC,CACjE,CAAC;QACJ,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,IAAgB;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,IAAY;QACxB,MAAM,MAAM,GAAW,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAE3C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,KAAoB;QACvC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7D,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,KAA4B;QAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAEO,MAAM,CAAC,YAAY,CACzB,KAAmC;QAEnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;CACF"}