@oneuptime/common 13.0.3 → 13.0.5

package/build/dist/Server/Utils/SecurityEvent/Connectors/MicrosoftDefenderXdr/MicrosoftDefenderXdrClient.js

@@ -0,0 +1,406 @@
+import APIException from "../../../../../Types/Exception/ApiException";
+import BadDataException from "../../../../../Types/Exception/BadDataException";
+import { redactLogString, redactLogValue } from "../../../LogRedaction";
+import ConnectorErrorMessage from "../../ConnectorErrorMessage";
+export const MICROSOFT_DEFENDER_XDR_CLOUDS = [
+    "public",
+    "usgov",
+];
+/*
+ * Host pairs per national cloud. GCC High tenants use graph.microsoft.us
+ * with login.microsoftonline.us; GCC (moderate) tenants stay on the
+ * worldwide endpoints, so they select "public".
+ */
+const CLOUD_HOSTS = {
+    public: {
+        loginHost: "https://login.microsoftonline.com",
+        graphHost: "https://graph.microsoft.com",
+    },
+    usgov: {
+        loginHost: "https://login.microsoftonline.us",
+        graphHost: "https://graph.microsoft.us",
+    },
+};
+/*
+ * Microsoft's own List alerts_v2 example pages with `$top=100`; a larger
+ * page is not documented, so requests never exceed it. The tester asks
+ * for a single record.
+ */
+export const MICROSOFT_DEFENDER_XDR_DEFAULT_PAGE_SIZE = 100;
+/*
+ * Tokens carry expires_in (seconds). A token that expires mid-page is
+ * refreshed a minute early rather than risking a 401 halfway through a
+ * window read.
+ */
+const TOKEN_EXPIRY_SAFETY_MARGIN_IN_MS = 60 * 1000;
+const ERROR_PREFIX = "Microsoft Defender XDR";
+/*
+ * Graph error codes are identifier-shaped enumeration names
+ * (Authorization_RequestDenied, InvalidAuthenticationToken, ...). Anything
+ * else under that key — digits, punctuation, length — is not one.
+ */
+const GRAPH_ERROR_CODE_REGEX = /^[A-Za-z][A-Za-z_]{1,79}$/;
+export default class MicrosoftDefenderXdrClient {
+    constructor(options) {
+        this.cachedToken = null;
+        this.cachedTokenExpiresAtMs = 0;
+        this.requestCount = 0;
+        if (!MicrosoftDefenderXdrClient.isCloud(options.cloud)) {
+            throw new BadDataException(`Cloud must be one of: ${MICROSOFT_DEFENDER_XDR_CLOUDS.join(", ")}.`);
+        }
+        this.tenantId = options.tenantId;
+        this.clientId = options.clientId;
+        this.clientSecret = options.clientSecret;
+        this.cloud = options.cloud;
+        this.transport = options.transport;
+        this.requestTimeoutInMs = options.requestTimeoutInMs;
+    }
+    static isCloud(value) {
+        return (typeof value === "string" &&
+            MICROSOFT_DEFENDER_XDR_CLOUDS.includes(value));
+    }
+    static loginHostForCloud(cloud) {
+        return CLOUD_HOSTS[cloud].loginHost;
+    }
+    static graphHostForCloud(cloud) {
+        return CLOUD_HOSTS[cloud].graphHost;
+    }
+    /*
+     * Outbound requests made so far by this instance, token requests
+     * included: the poller's request budget counts every call that leaves
+     * the process.
+     */
+    getRequestCount() {
+        return this.requestCount;
+    }
+    buildTokenUrl() {
+        return `${MicrosoftDefenderXdrClient.loginHostForCloud(this.cloud)}/${encodeURIComponent(this.tenantId)}/oauth2/v2.0/token`;
+    }
+    buildScope() {
+        return `${MicrosoftDefenderXdrClient.graphHostForCloud(this.cloud)}/.default`;
+    }
+    /*
+     * Creation-time window on createdDateTime: inclusive lower bound,
+     * exclusive upper bound, matching ConnectorFetchWindow. OData datetime
+     * literals are unquoted ISO 8601; URLSearchParams encodes the spaces as
+     * "+", which Graph's own reference examples use between filter tokens.
+     */
+    buildAlertsUrl(data) {
+        const url = new URL(`${MicrosoftDefenderXdrClient.graphHostForCloud(this.cloud)}/v1.0/security/alerts_v2`);
+        url.searchParams.set("$filter", `createdDateTime ge ${data.startTime.toISOString()} and createdDateTime lt ${data.endTime.toISOString()}`);
+        url.searchParams.set("$top", String(MicrosoftDefenderXdrClient.clampPageSize(data.pageSize)));
+        return url.toString();
+    }
+    static clampPageSize(pageSize) {
+        if (pageSize === undefined || !Number.isFinite(pageSize) || pageSize < 1) {
+            return MICROSOFT_DEFENDER_XDR_DEFAULT_PAGE_SIZE;
+        }
+        return Math.min(Math.floor(pageSize), MICROSOFT_DEFENDER_XDR_DEFAULT_PAGE_SIZE);
+    }
+    /*
+     * Client credentials grant. The token is cached on the instance for its
+     * lifetime minus a safety margin; connectors build one client per
+     * fetch or test, so the cache never outlives the settings it was
+     * minted from.
+     */
+    async getAccessToken() {
+        if (this.cachedToken && Date.now() < this.cachedTokenExpiresAtMs) {
+            return this.cachedToken;
+        }
+        const body = {
+            client_id: this.clientId,
+            scope: this.buildScope(),
+            client_secret: this.clientSecret,
+            grant_type: "client_credentials",
+        };
+        const response = await this.send("token request", {
+            method: "POST",
+            url: this.buildTokenUrl(),
+            headers: { Accept: "application/json" },
+            body,
+            formUrlEncoded: true,
+            timeoutInMs: this.requestTimeoutInMs,
+            egressOptions: { targetLabel: "Microsoft Entra ID" },
+        });
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+            throw new APIException(`${ERROR_PREFIX} token request failed (HTTP ${response.statusCode}): ${MicrosoftDefenderXdrClient.redactErrorBody(response.bodyText)}` +
+                MicrosoftDefenderXdrClient.describeTokenFailure(response.statusCode, response.bodyJson));
+        }
+        const json = MicrosoftDefenderXdrClient.parseJsonBody(response);
+        if (!MicrosoftDefenderXdrClient.isJsonObject(json)) {
+            throw new APIException(`${ERROR_PREFIX} token request returned a non-JSON body.`);
+        }
+        const accessToken = json["access_token"];
+        if (typeof accessToken !== "string" || !accessToken) {
+            throw new APIException(`${ERROR_PREFIX} token request returned no access_token.`);
+        }
+        const expiresIn = Number(json["expires_in"]);
+        const lifetimeMs = Number.isFinite(expiresIn) && expiresIn > 0
+            ? expiresIn * 1000
+            : 5 * 60 * 1000;
+        this.cachedToken = accessToken;
+        this.cachedTokenExpiresAtMs =
+            Date.now() + Math.max(0, lifetimeMs - TOKEN_EXPIRY_SAFETY_MARGIN_IN_MS);
+        return accessToken;
+    }
+    /*
+     * First page of alerts created in [startTime, endTime).
+     */
+    async listAlerts(data) {
+        return this.fetchAlertsPage(this.buildAlertsUrl(data));
+    }
+    /*
+     * Follow an @odata.nextLink. Graph hands back an absolute URL; it must
+     * stay on the Graph host of the configured cloud, otherwise a bearer
+     * token for Graph would be sent wherever the body pointed.
+     */
+    async listAlertsByNextLink(nextLink) {
+        let parsed;
+        try {
+            parsed = new URL(nextLink);
+        }
+        catch (_a) {
+            throw new APIException(`${ERROR_PREFIX} alerts request returned an unusable next page link.`);
+        }
+        const expectedHost = new URL(MicrosoftDefenderXdrClient.graphHostForCloud(this.cloud)).host;
+        if (parsed.protocol !== "https:" || parsed.host !== expectedHost) {
+            throw new APIException(`${ERROR_PREFIX} alerts request returned a next page link on an unexpected host: ${redactLogString(parsed.host)}`);
+        }
+        return this.fetchAlertsPage(parsed.toString());
+    }
+    /*
+     * How many alerts were created in the range, bounded to one page:
+     * `hasMore` says the count is a floor ("100+"), never a total.
+     */
+    async countAlerts(data) {
+        const page = await this.listAlerts({
+            startTime: data.startTime,
+            endTime: data.endTime,
+            pageSize: MICROSOFT_DEFENDER_XDR_DEFAULT_PAGE_SIZE,
+        });
+        return { count: page.alerts.length, hasMore: page.nextLink !== null };
+    }
+    async fetchAlertsPage(url) {
+        let response = await this.sendAuthorized(url);
+        /*
+         * A cached token can be revoked or expire between pages. One retry
+         * with a fresh token separates "the token went stale" from "this app
+         * is not accepted", the way GoogleSecOpsClient does.
+         */
+        if (response.statusCode === 401 && this.cachedToken) {
+            this.cachedToken = null;
+            this.cachedTokenExpiresAtMs = 0;
+            response = await this.sendAuthorized(url);
+        }
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+            throw new APIException(`${ERROR_PREFIX} alerts request failed (HTTP ${response.statusCode}): ${MicrosoftDefenderXdrClient.redactErrorBody(response.bodyText)}` +
+                MicrosoftDefenderXdrClient.describeAlertsFailure(response.statusCode, response));
+        }
+        const json = MicrosoftDefenderXdrClient.parseJsonBody(response);
+        if (!MicrosoftDefenderXdrClient.isJsonObject(json)) {
+            throw new APIException(`${ERROR_PREFIX} alerts request returned a non-JSON body.`);
+        }
+        const value = json["value"];
+        if (!Array.isArray(value)) {
+            throw new APIException(`${ERROR_PREFIX} alerts request returned an unrecognized response shape: ${MicrosoftDefenderXdrClient.redactErrorBody(response.bodyText)}`);
+        }
+        const alerts = value.filter((item) => {
+            return MicrosoftDefenderXdrClient.isJsonObject(item);
+        });
+        const nextLink = json["@odata.nextLink"];
+        return {
+            alerts,
+            nextLink: typeof nextLink === "string" && nextLink ? nextLink : null,
+        };
+    }
+    async sendAuthorized(url) {
+        const token = await this.getAccessToken();
+        return this.send("alerts request", {
+            method: "GET",
+            url,
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: "application/json",
+            },
+            timeoutInMs: this.requestTimeoutInMs,
+            egressOptions: { targetLabel: "Microsoft Graph" },
+        });
+    }
+    /*
+     * One place every request leaves through. DataSourceHttpFetch throws
+     * BadDataException("Data source responded with HTTP <status>: <body>")
+     * for any non-2xx answer, so that shape is folded back into a response
+     * here and the status-specific messages above stay the only ones an
+     * operator sees. Anything else (timeout, DNS, refused egress) is a
+     * transport failure named as such.
+     */
+    async send(step, request) {
+        this.requestCount++;
+        try {
+            return await this.transport(request);
+        }
+        catch (error) {
+            const message = ConnectorErrorMessage.toMessage(error, {
+                truncate: false,
+            });
+            const match = message.match(/^Data source responded with HTTP (\d{3}): ?([\s\S]*)$/);
+            if (match) {
+                const bodyText = match[2] || "";
+                let bodyJson = undefined;
+                try {
+                    bodyJson = JSON.parse(bodyText);
+                }
+                catch (_a) {
+                    bodyJson = undefined;
+                }
+                return {
+                    statusCode: Number(match[1]),
+                    bodyText,
+                    bodyJson,
+                    headers: {},
+                };
+            }
+            throw new APIException(`${ERROR_PREFIX} ${step} did not complete: ${redactLogString(message)}`);
+        }
+    }
+    static parseJsonBody(response) {
+        if (response.bodyJson !== undefined) {
+            return response.bodyJson;
+        }
+        try {
+            return JSON.parse(response.bodyText || "");
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    static isJsonObject(value) {
+        return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+    }
+    /*
+     * Decode the outer JSON before redacting so a credential-bearing string
+     * nested inside a message cannot slip past the textual redactor via
+     * escaped quotes.
+     */
+    static redactErrorBody(body) {
+        if (!body) {
+            return "";
+        }
+        try {
+            return JSON.stringify(redactLogValue(JSON.parse(body)));
+        }
+        catch (_a) {
+            return redactLogString(body);
+        }
+    }
+    /*
+     * Entra's error body is { error, error_description, error_codes }. The
+     * `error` code is the stable field, so hints key off it; the AADSTS
+     * text is dynamic and only echoed (redacted) above.
+     */
+    static describeTokenFailure(status, body) {
+        const error = MicrosoftDefenderXdrClient.isJsonObject(body)
+            ? String(body["error"] || "")
+            : "";
+        const codes = MicrosoftDefenderXdrClient.isJsonObject(body) &&
+            Array.isArray(body["error_codes"])
+            ? body["error_codes"].map((code) => {
+                return Number(code);
+            })
+            : [];
+        let hint = "";
+        if (error === "invalid_client" || codes.includes(7000215)) {
+            hint =
+                "Microsoft Entra rejected the client secret. It is wrong, expired, or belongs to a different app registration; create a new secret under Certificates & secrets and update the connection's credentials.";
+        }
+        else if (error === "unauthorized_client" || codes.includes(700016)) {
+            hint =
+                "Microsoft Entra did not find the Application (client) ID in this tenant. Check the Directory (tenant) ID and Application (client) ID, and that the Cloud matches where the tenant lives.";
+        }
+        else if (error === "invalid_request" && codes.includes(90002)) {
+            hint =
+                "Microsoft Entra did not find the tenant. Check the Directory (tenant) ID and the Cloud setting.";
+        }
+        else if (error === "invalid_scope") {
+            hint =
+                "Microsoft Entra rejected the token scope for Microsoft Graph in this cloud. Check the Cloud setting.";
+        }
+        else if (status === 429) {
+            hint =
+                "Microsoft Entra throttled the token request. The next poll retries automatically.";
+        }
+        else if (status >= 500) {
+            hint =
+                "Microsoft Entra reported a server-side error. The next poll retries the same window.";
+        }
+        else if (status === 404) {
+            hint =
+                "The token endpoint was not found. The Directory (tenant) ID is usually malformed.";
+        }
+        return hint ? ` — ${hint}` : "";
+    }
+    /*
+     * Graph's error body is { error: { code, message } }
+     * (https://learn.microsoft.com/en-us/graph/errors); a 403 with any code
+     * is nearly always the missing application permission or a tenant
+     * without Defender XDR, and that is the case the docs troubleshoot.
+     *
+     * The redactor blanks every JSON member named "code" (an OAuth
+     * authorization code or an OTP lives under that key elsewhere), which
+     * also blanks Graph's error code in the echoed body. That code is a
+     * documented enumeration name such as Authorization_RequestDenied or
+     * InvalidAuthenticationToken — letters and underscores, never a
+     * credential — so it is restated in the hint when, and only when, it
+     * has that shape.
+     */
+    static describeAlertsFailure(status, response) {
+        let hint = "";
+        const graphCode = MicrosoftDefenderXdrClient.readGraphErrorCode(response.bodyJson);
+        if (graphCode) {
+            hint = `Microsoft Graph error code ${graphCode}. `;
+        }
+        if (status === 401) {
+            hint +=
+                "Microsoft Graph did not accept the access token. Check that the Cloud setting matches the tenant and that the app registration has not been disabled.";
+        }
+        else if (status === 403) {
+            hint +=
+                "The app registration lacks the SecurityAlert.Read.All application permission for Microsoft Graph with admin consent, or the tenant has no Microsoft Defender XDR license.";
+        }
+        else if (status === 404) {
+            hint +=
+                "Microsoft Graph did not find the security alerts endpoint. Check the Cloud setting.";
+        }
+        else if (status === 429) {
+            const retryAfter = (response.headers || {})["retry-after"] || "";
+            hint += retryAfter
+                ? `Microsoft Graph throttled the request; it asked to retry after ${redactLogString(retryAfter)} seconds. The next poll retries the same window.`
+                : "Microsoft Graph throttled the request. The next poll retries the same window.";
+        }
+        else if (status >= 500) {
+            hint +=
+                "Microsoft Graph reported a server-side error. The next poll retries the same window.";
+        }
+        else if (status === 400) {
+            hint +=
+                "Microsoft Graph rejected the query. Copy the message for support; the request is built by OneUptime, not from your settings.";
+        }
+        hint = hint.trim();
+        return hint ? ` — ${hint}` : "";
+    }
+    static readGraphErrorCode(body) {
+        if (!MicrosoftDefenderXdrClient.isJsonObject(body)) {
+            return "";
+        }
+        const error = body["error"];
+        if (!MicrosoftDefenderXdrClient.isJsonObject(error)) {
+            return "";
+        }
+        const code = error["code"];
+        if (typeof code !== "string" || !GRAPH_ERROR_CODE_REGEX.test(code)) {
+            return "";
+        }
+        return code;
+    }
+}
+//# sourceMappingURL=MicrosoftDefenderXdrClient.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/MicrosoftDefenderXdr/MicrosoftDefenderXdrClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MicrosoftDefenderXdrClient.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/SecurityEvent/Connectors/MicrosoftDefenderXdr/MicrosoftDefenderXdrClient.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,6CAA6C,CAAC;AACvE,OAAO,gBAAgB,MAAM,iDAAiD,CAAC;AAO/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,qBAAqB,MAAM,6BAA6B,CAAC;AAoChE,MAAM,CAAC,MAAM,6BAA6B,GAAqC;IAC7E,QAAQ;IACR,OAAO;CACR,CAAC;AAOF;;;;GAIG;AACH,MAAM,WAAW,GAAkD;IACjE,MAAM,EAAE;QACN,SAAS,EAAE,mCAAmC;QAC9C,SAAS,EAAE,6BAA6B;KACzC;IACD,KAAK,EAAE;QACL,SAAS,EAAE,kCAAkC;QAC7C,SAAS,EAAE,4BAA4B;KACxC;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAW,GAAG,CAAC;AAEpE;;;;GAIG;AACH,MAAM,gCAAgC,GAAW,EAAE,GAAG,IAAI,CAAC;AAE3D,MAAM,YAAY,GAAW,wBAAwB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,sBAAsB,GAAW,2BAA2B,CAAC;AAwBnE,MAAM,CAAC,OAAO,OAAO,0BAA0B;IAY7C,YAAmB,OAA0C;QAJrD,gBAAW,GAAkB,IAAI,CAAC;QAClC,2BAAsB,GAAW,CAAC,CAAC;QACnC,iBAAY,GAAW,CAAC,CAAC;QAG/B,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,gBAAgB,CACxB,yBAAyB,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IACvD,CAAC;IAEM,MAAM,CAAC,OAAO,CAAC,KAAc;QAClC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACxB,6BAA+C,CAAC,QAAQ,CAAC,KAAK,CAAC,CACjE,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,iBAAiB,CAAC,KAAgC;QAC9D,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC;IACtC,CAAC;IAEM,MAAM,CAAC,iBAAiB,CAAC,KAAgC;QAC9D,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACI,eAAe;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEM,aAAa;QAClB,OAAO,GAAG,0BAA0B,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAC9H,CAAC;IAEM,UAAU;QACf,OAAO,GAAG,0BAA0B,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;IAChF,CAAC;IAED;;;;;OAKG;IACI,cAAc,CAAC,IAIrB;QACC,MAAM,GAAG,GAAQ,IAAI,GAAG,CACtB,GAAG,0BAA0B,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,CACtF,CAAC;QAEF,GAAG,CAAC,YAAY,CAAC,GAAG,CAClB,SAAS,EACT,sBAAsB,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,2BAA2B,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAC1G,CAAC;QACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAClB,MAAM,EACN,MAAM,CAAC,0BAA0B,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAChE,CAAC;QAEF,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEM,MAAM,CAAC,aAAa,CAAC,QAA4B;QACtD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACzE,OAAO,wCAAwC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CACb,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EACpB,wCAAwC,CACzC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,cAAc;QACzB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAuB;YAC/B,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE;YACxB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,UAAU,EAAE,oBAAoB;SACjC,CAAC;QAEF,MAAM,QAAQ,GAA2B,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,IAAI;YACJ,cAAc,EAAE,IAAI;YACpB,WAAW,EAAE,IAAI,CAAC,kBAAkB;YACpC,aAAa,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE;SACrD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,+BAA+B,QAAQ,CAAC,UAAU,MAAM,0BAA0B,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACpI,0BAA0B,CAAC,oBAAoB,CAC7C,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,QAAQ,CAClB,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAc,0BAA0B,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE3E,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,0CAA0C,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAc,IAAI,CAAC,cAAc,CAAc,CAAC;QAEjE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YACpD,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,0CAA0C,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAW,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACrD,MAAM,UAAU,GACd,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YACzC,CAAC,CAAC,SAAS,GAAG,IAAI;YAClB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAEpB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,sBAAsB;YACzB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,gCAAgC,CAAC,CAAC;QAE1E,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU,CAAC,IAIvB;QACC,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,oBAAoB,CAC/B,QAAgB;QAEhB,IAAI,MAAW,CAAC;QAEhB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,sDAAsD,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAW,IAAI,GAAG,CAClC,0BAA0B,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CACzD,CAAC,IAAI,CAAC;QAEP,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjE,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,oEAAoE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAClH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,WAAW,CAAC,IAGxB;QACC,MAAM,IAAI,GAAmC,MAAM,IAAI,CAAC,UAAU,CAAC;YACjE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,wCAAwC;SACnD,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;IACxE,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,GAAW;QAEX,IAAI,QAAQ,GAA2B,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAEtE;;;;WAIG;QACH,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACpD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,sBAAsB,GAAG,CAAC,CAAC;YAChC,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,gCAAgC,QAAQ,CAAC,UAAU,MAAM,0BAA0B,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACrI,0BAA0B,CAAC,qBAAqB,CAC9C,QAAQ,CAAC,UAAU,EACnB,QAAQ,CACT,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAc,0BAA0B,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE3E,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,2CAA2C,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAc,IAAI,CAAC,OAAO,CAAc,CAAC;QAEpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,4DAA4D,0BAA0B,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAC3I,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAuB,KAAmB,CAAC,MAAM,CAC3D,CAAC,IAAe,EAAW,EAAE;YAC3B,OAAO,0BAA0B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CACmB,CAAC;QAEvB,MAAM,QAAQ,GAAc,IAAI,CAAC,iBAAiB,CAAc,CAAC;QAEjE,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;SACrE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,GAAW;QACtC,MAAM,KAAK,GAAW,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAElD,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACjC,MAAM,EAAE,KAAK;YACb,GAAG;YACH,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,kBAAkB;aAC3B;YACD,WAAW,EAAE,IAAI,CAAC,kBAAkB;YACpC,aAAa,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,OAA8B;QAE9B,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAW,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE;gBAC7D,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,MAAM,KAAK,GAA4B,OAAO,CAAC,KAAK,CAClD,uDAAuD,CACxD,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,IAAI,QAAQ,GAAY,SAAS,CAAC;gBAElC,IAAI,CAAC;oBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClC,CAAC;gBAAC,WAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;gBAED,OAAO;oBACL,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC5B,QAAQ;oBACR,QAAQ;oBACR,OAAO,EAAE,EAAE;iBACZ,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,IAAI,IAAI,sBAAsB,eAAe,CAAC,OAAO,CAAC,EAAE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,aAAa,CAAC,QAAgC;QAC3D,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,QAAqB,CAAC;QACxC,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAc,CAAC;QAC1D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,KAAc;QACxC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,eAAe,CAAC,IAAY;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,oBAAoB,CAAC,MAAc,EAAE,IAAa;QAC/D,MAAM,KAAK,GAAW,0BAA0B,CAAC,YAAY,CAAC,IAAI,CAAC;YACjE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,KAAK,GACT,0BAA0B,CAAC,YAAY,CAAC,IAAI,CAAC;YAC7C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAChC,CAAC,CAAE,IAAI,CAAC,aAAa,CAAe,CAAC,GAAG,CAAC,CAAC,IAAe,EAAU,EAAE;gBACjE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QAET,IAAI,IAAI,GAAW,EAAE,CAAC;QAEtB,IAAI,KAAK,KAAK,gBAAgB,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,IAAI;gBACF,yMAAyM,CAAC;QAC9M,CAAC;aAAM,IAAI,KAAK,KAAK,qBAAqB,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,IAAI;gBACF,0LAA0L,CAAC;QAC/L,CAAC;aAAM,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,IAAI;gBACF,iGAAiG,CAAC;QACtG,CAAC;aAAM,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YACrC,IAAI;gBACF,sGAAsG,CAAC;QAC3G,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,mFAAmF,CAAC;QACxF,CAAC;aAAM,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,IAAI;gBACF,sFAAsF,CAAC;QAC3F,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,mFAAmF,CAAC;QACxF,CAAC;QAED,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,MAAM,CAAC,qBAAqB,CAClC,MAAc,EACd,QAAgC;QAEhC,IAAI,IAAI,GAAW,EAAE,CAAC;QACtB,MAAM,SAAS,GAAW,0BAA0B,CAAC,kBAAkB,CACrE,QAAQ,CAAC,QAAQ,CAClB,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,GAAG,8BAA8B,SAAS,IAAI,CAAC;QACrD,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI;gBACF,uJAAuJ,CAAC;QAC5J,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,2KAA2K,CAAC;QAChL,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,qFAAqF,CAAC;QAC1F,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAW,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACzE,IAAI,IAAI,UAAU;gBAChB,CAAC,CAAC,kEAAkE,eAAe,CAAC,UAAU,CAAC,kDAAkD;gBACjJ,CAAC,CAAC,+EAA+E,CAAC;QACtF,CAAC;aAAM,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,IAAI;gBACF,sFAAsF,CAAC;QAC3F,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,8HAA8H,CAAC;QACnI,CAAC;QAED,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEnB,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAAC,IAAa;QAC7C,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAY,IAAI,CAAC,OAAO,CAAC,CAAC;QAErC,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAY,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}