@oneuptime/common 13.0.4 → 13.0.5

package/build/dist/Server/Utils/SecurityEvent/Connectors/MicrosoftDefenderXdr/MicrosoftDefenderXdrConnector.js

@@ -0,0 +1,336 @@
+import BadDataException from "../../../../../Types/Exception/BadDataException";
+import SecurityEventConnectorProvider from "../../../../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { getSecurityEventConnectorDefinition, } from "../../../../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import MicrosoftDefenderXdrNormalizer from "../../../../../Utils/SecurityEvent/Connectors/MicrosoftDefenderXdrNormalizer";
+import { readString } from "../../../../../Utils/SecurityEvent/NormalizerHelpers";
+import DataSourceHttpFetch from "../../../DataSource/HttpFetch";
+import { redactLogString } from "../../../LogRedaction";
+import ConnectorErrorMessage from "../../ConnectorErrorMessage";
+import { makeCheck, readSettingString, } from "../Types";
+import MicrosoftDefenderXdrClient, { MICROSOFT_DEFENDER_XDR_CLOUDS, MICROSOFT_DEFENDER_XDR_DEFAULT_PAGE_SIZE, } from "./MicrosoftDefenderXdrClient";
+const GUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+/*
+ * Entra accepts the tenant as its GUID or as a verified domain name
+ * (contoso.onmicrosoft.com). Anything else is a typo that would otherwise
+ * surface as a 404 from the token endpoint an hour later.
+ */
+const TENANT_REGEX = /^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/;
+const DAY_IN_MS = 24 * 60 * 60 * 1000;
+/*
+ * Why a bounded Defender read names no resume point, appended to the
+ * bound warning so a Partial run explains itself.
+ */
+const UNORDERED_READ_NOTE = "Microsoft Graph lists alerts newest first and documents no way to sort them oldest first, so this run cannot name a point to resume from.";
+export default class MicrosoftDefenderXdrConnector {
+    constructor(transport) {
+        this.provider = SecurityEventConnectorProvider.MicrosoftDefenderXdr;
+        this.transport =
+            transport ||
+                ((request) => {
+                    return DataSourceHttpFetch.fetch(request);
+                });
+    }
+    static getDefinition() {
+        const definition = getSecurityEventConnectorDefinition(SecurityEventConnectorProvider.MicrosoftDefenderXdr);
+        if (!definition) {
+            throw new BadDataException("Microsoft Defender XDR is missing from the connector catalog.");
+        }
+        return definition;
+    }
+    static fieldTitle(key) {
+        const definition = this.getDefinition();
+        const field = [
+            ...definition.configFields,
+            ...definition.secretFields,
+        ].find((candidate) => {
+            return candidate.key === key;
+        });
+        return (field === null || field === void 0 ? void 0 : field.title) || key;
+    }
+    static parseSettings(settings) {
+        const tenantId = readSettingString(settings.config, "tenantId");
+        const clientId = readSettingString(settings.config, "clientId");
+        const cloud = readSettingString(settings.config, "cloud") || "public";
+        const clientSecret = readSettingString(settings.secrets, "clientSecret");
+        if (!tenantId || !TENANT_REGEX.test(tenantId)) {
+            throw new BadDataException(`${this.fieldTitle("tenantId")} must be the tenant GUID or its verified domain name (for example contoso.onmicrosoft.com).`);
+        }
+        if (!clientId || !GUID_REGEX.test(clientId)) {
+            throw new BadDataException(`${this.fieldTitle("clientId")} must be the app registration's GUID.`);
+        }
+        if (!MicrosoftDefenderXdrClient.isCloud(cloud)) {
+            throw new BadDataException(`${this.fieldTitle("cloud")} must be one of: ${MICROSOFT_DEFENDER_XDR_CLOUDS.join(", ")}.`);
+        }
+        if (!clientSecret) {
+            throw new BadDataException(`${this.fieldTitle("clientSecret")} is required.`);
+        }
+        return { tenantId, clientId, clientSecret, cloud };
+    }
+    validateSettings(settings) {
+        if (settings.provider !== this.provider) {
+            throw new BadDataException(`Settings are for provider "${String(settings.provider)}", not ${MicrosoftDefenderXdrConnector.getDefinition().title}.`);
+        }
+        MicrosoftDefenderXdrConnector.parseSettings(settings);
+    }
+    buildClient(parsed, requestTimeoutInMs) {
+        return new MicrosoftDefenderXdrClient({
+            tenantId: parsed.tenantId,
+            clientId: parsed.clientId,
+            clientSecret: parsed.clientSecret,
+            cloud: parsed.cloud,
+            transport: this.transport,
+            requestTimeoutInMs,
+        });
+    }
+    /*
+     * Three provider checks, in dependency order. Each later check is
+     * skipped rather than failed when an earlier one fails, so the report
+     * names one root cause instead of three symptoms of it.
+     */
+    async testConnection(settings, options) {
+        const checks = [];
+        let parsed;
+        let startedAtMs = Date.now();
+        try {
+            parsed = MicrosoftDefenderXdrConnector.parseSettings(settings);
+        }
+        catch (error) {
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Microsoft Entra",
+                status: "fail",
+                startedAtMs,
+                message: redactLogString(ConnectorErrorMessage.toMessage(error)),
+                remediation: "Correct the highlighted setting and test again. Nothing was contacted.",
+            }));
+            checks.push(MicrosoftDefenderXdrConnector.skipped("read-permission", "Read alerts from Microsoft Graph", "Skipped because the configuration is not usable."));
+            checks.push(MicrosoftDefenderXdrConnector.skipped("detections-available", "Alerts available to import", "Skipped because the configuration is not usable."));
+            return checks;
+        }
+        const client = this.buildClient(parsed, options.requestTimeoutInMs);
+        try {
+            await client.getAccessToken();
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Microsoft Entra",
+                status: "pass",
+                startedAtMs,
+                message: `Microsoft Entra issued an access token for Microsoft Graph in the ${parsed.cloud === "usgov" ? "Azure Government" : "Azure public"} cloud.`,
+            }));
+        }
+        catch (error) {
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Microsoft Entra",
+                status: "fail",
+                startedAtMs,
+                message: redactLogString(ConnectorErrorMessage.toMessage(error, { truncate: false })),
+                remediation: "Check the Directory (tenant) ID, Application (client) ID and Cloud against the app registration's Overview page, and that the Client secret has not expired (Certificates & secrets). Rotate the secret with Update credentials if needed.",
+            }));
+            checks.push(MicrosoftDefenderXdrConnector.skipped("read-permission", "Read alerts from Microsoft Graph", "Skipped because authentication failed."));
+            checks.push(MicrosoftDefenderXdrConnector.skipped("detections-available", "Alerts available to import", "Skipped because authentication failed."));
+            return checks;
+        }
+        const now = new Date();
+        const dayAgo = new Date(now.getTime() - DAY_IN_MS);
+        const weekAgo = new Date(now.getTime() - 7 * DAY_IN_MS);
+        startedAtMs = Date.now();
+        try {
+            const page = await client.listAlerts({
+                startTime: dayAgo,
+                endTime: now,
+                pageSize: 1,
+            });
+            checks.push(makeCheck({
+                key: "read-permission",
+                name: "Read alerts from Microsoft Graph",
+                status: "pass",
+                startedAtMs,
+                message: `Microsoft Graph accepted a read of security alerts (${page.alerts.length} record${page.alerts.length === 1 ? "" : "s"} returned for a one-record probe over the last 24 hours).`,
+            }));
+        }
+        catch (error) {
+            const message = redactLogString(ConnectorErrorMessage.toMessage(error, { truncate: false }));
+            checks.push(makeCheck({
+                key: "read-permission",
+                name: "Read alerts from Microsoft Graph",
+                status: "fail",
+                startedAtMs,
+                message,
+                remediation: MicrosoftDefenderXdrConnector.readRemediation(message),
+            }));
+            checks.push(MicrosoftDefenderXdrConnector.skipped("detections-available", "Alerts available to import", "Skipped because the read check failed."));
+            return checks;
+        }
+        startedAtMs = Date.now();
+        try {
+            const last24h = await client.countAlerts({
+                startTime: dayAgo,
+                endTime: now,
+            });
+            const last7d = await client.countAlerts({
+                startTime: weekAgo,
+                endTime: now,
+            });
+            const label24h = MicrosoftDefenderXdrConnector.countLabel(last24h);
+            const label7d = MicrosoftDefenderXdrConnector.countLabel(last7d);
+            const nothing = last24h.count === 0 &&
+                !last24h.hasMore &&
+                last7d.count === 0 &&
+                !last7d.hasMore;
+            checks.push(makeCheck(Object.assign(Object.assign({ key: "detections-available", name: "Alerts available to import", status: nothing ? "warn" : "pass", startedAtMs, message: nothing
+                    ? "No alerts were created in the last 7 days. Polling will import new alerts as Microsoft Defender XDR creates them."
+                    : `${label24h} alert${label24h === "1" ? "" : "s"} created in the last 24 hours and ${label7d} in the last 7 days.` }, (nothing
+                ? {
+                    remediation: "Confirm that alerts exist for this tenant in the Microsoft Defender portal (Incidents & alerts). A tenant with no onboarded Defender workloads produces none.",
+                }
+                : {})), { details: {
+                    createdLast24h: label24h,
+                    createdLast7d: label7d,
+                    hasMoreLast24h: last24h.hasMore,
+                    hasMoreLast7d: last7d.hasMore,
+                } })));
+        }
+        catch (error) {
+            const message = redactLogString(ConnectorErrorMessage.toMessage(error, { truncate: false }));
+            checks.push(makeCheck({
+                key: "detections-available",
+                name: "Alerts available to import",
+                status: "fail",
+                startedAtMs,
+                message,
+                remediation: MicrosoftDefenderXdrConnector.readRemediation(message),
+            }));
+        }
+        return checks;
+    }
+    static skipped(key, name, message) {
+        return makeCheck({
+            key,
+            name,
+            status: "skip",
+            startedAtMs: Date.now(),
+            message,
+        });
+    }
+    static countLabel(count) {
+        return count.hasMore
+            ? `${MICROSOFT_DEFENDER_XDR_DEFAULT_PAGE_SIZE}+`
+            : String(count.count);
+    }
+    /*
+     * Remediation keyed off the HTTP status the client put in the message,
+     * so the check tells the reader what to change instead of quoting Graph.
+     */
+    static readRemediation(message) {
+        if (message.includes("(HTTP 403)")) {
+            return "In the app registration, add the Microsoft Graph application permission SecurityAlert.Read.All and select Grant admin consent. The tenant also needs Microsoft Defender XDR licensing. Consent changes take a few minutes to apply.";
+        }
+        if (message.includes("(HTTP 401)")) {
+            return "The token was minted but Microsoft Graph refused it. Check that the Cloud setting matches the tenant's cloud and that the app registration is enabled.";
+        }
+        /*
+         * The production transport drops response headers on error statuses,
+         * so a Retry-After value is only in the message when the transport
+         * kept it; the advice must not depend on it being there.
+         */
+        if (message.includes("(HTTP 429)")) {
+            return "Microsoft Graph is throttling this app. Wait a few minutes (at least the Retry-After period when the message names one) and test again; scheduled polls retry automatically.";
+        }
+        if (message.includes("did not complete")) {
+            return "Microsoft Graph did not answer in time. Check outbound connectivity from the OneUptime API and worker processes to graph.microsoft.com (or graph.microsoft.us).";
+        }
+        return "Read the message prefix to see which step failed, then follow the troubleshooting section of the Microsoft Defender XDR integration docs.";
+    }
+    /*
+     * Read every alert created in the window, page by page, within the
+     * request and event budgets. A budget hit returns complete=false with a
+     * warning and deliberately no resumeAfter: Graph lists alerts_v2 newest
+     * first and documents no $orderby, so the alerts read are not "every
+     * alert created before some point". The poller answers a bound hit
+     * without a resume point by narrowing the next window from the same
+     * start, which is what lets a busy tenant make progress (review finding
+     * connector-bound-hit-permanent-stall).
+     */
+    async fetchEvents(settings, window, options) {
+        const parsed = MicrosoftDefenderXdrConnector.parseSettings(settings);
+        const client = this.buildClient(parsed, options.requestTimeoutInMs);
+        const warnings = [];
+        const rawAlerts = [];
+        let complete = true;
+        const maxRequests = Math.max(1, Math.floor(options.maxRequests));
+        const maxEvents = Math.max(1, Math.floor(options.maxEvents));
+        /*
+         * The request budget counts alert pages, as the Sentinel connector
+         * does: a token request is a fixed cost (one, or two after a 401
+         * retry) that would otherwise silently shrink the page budget. The
+         * reported requestCount still counts everything that left the process.
+         */
+        let pageRequests = 0;
+        let nextLink = null;
+        for (;;) {
+            if (pageRequests >= maxRequests) {
+                complete = false;
+                warnings.push(`Stopped after ${pageRequests} alerts requests (the per-run request limit) before reading the whole window. ${UNORDERED_READ_NOTE}`);
+                break;
+            }
+            const page = nextLink
+                ? await client.listAlertsByNextLink(nextLink)
+                : await client.listAlerts({
+                    startTime: window.startTime,
+                    endTime: window.endTime,
+                    pageSize: MICROSOFT_DEFENDER_XDR_DEFAULT_PAGE_SIZE,
+                });
+            pageRequests++;
+            const remaining = maxEvents - rawAlerts.length;
+            const eventBoundHit = page.alerts.length > remaining;
+            rawAlerts.push(...page.alerts.slice(0, Math.max(0, remaining)));
+            if (eventBoundHit || (page.nextLink && rawAlerts.length >= maxEvents)) {
+                complete = false;
+                warnings.push(`Stopped after ${rawAlerts.length} alerts (the per-run record limit) before reading the whole window. ${UNORDERED_READ_NOTE}`);
+                break;
+            }
+            if (!page.nextLink) {
+                break;
+            }
+            nextLink = page.nextLink;
+        }
+        const events = [];
+        const samples = [];
+        let rejectedCount = 0;
+        let failedCount = 0;
+        for (const raw of rawAlerts) {
+            if (!MicrosoftDefenderXdrNormalizer.isRecognized(raw)) {
+                rejectedCount++;
+                continue;
+            }
+            try {
+                const normalized = MicrosoftDefenderXdrNormalizer.normalize(raw);
+                events.push(normalized);
+                if (samples.length < options.sampleLimit) {
+                    samples.push({
+                        id: normalized.eventUid,
+                        title: normalized.message,
+                        severity: normalized.severityName,
+                        createdTime: readString(raw, "createdDateTime") || undefined,
+                        eventTime: normalized.time.toISOString(),
+                    });
+                }
+            }
+            catch (_a) {
+                failedCount++;
+            }
+        }
+        return {
+            events,
+            fetchedCount: rawAlerts.length,
+            rejectedCount,
+            failedCount,
+            complete,
+            requestCount: client.getRequestCount(),
+            warnings,
+            samples,
+        };
+    }
+}
+//# sourceMappingURL=MicrosoftDefenderXdrConnector.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/MicrosoftDefenderXdr/MicrosoftDefenderXdrConnector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MicrosoftDefenderXdrConnector.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/SecurityEvent/Connectors/MicrosoftDefenderXdr/MicrosoftDefenderXdrConnector.ts"],"names":[],"mappings":"AAAA,OAAO,gBAAgB,MAAM,iDAAiD,CAAC;AAO/E,OAAO,8BAA8B,MAAM,8EAA8E,CAAC;AAC1H,OAAO,EAEL,mCAAmC,GACpC,MAAM,6EAA6E,CAAC;AACrF,OAAO,8BAA8B,MAAM,8EAA8E,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,sDAAsD,CAAC;AAClF,OAAO,mBAGN,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,qBAAqB,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAQL,SAAS,EACT,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,0BAA0B,EAAE,EACjC,6BAA6B,EAC7B,wCAAwC,GAIzC,MAAM,8BAA8B,CAAC;AAqBtC,MAAM,UAAU,GACd,+EAA+E,CAAC;AAElF;;;;GAIG;AACH,MAAM,YAAY,GAAW,mCAAmC,CAAC;AAEjE,MAAM,SAAS,GAAW,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;GAGG;AACH,MAAM,mBAAmB,GACvB,2IAA2I,CAAC;AAE9I,MAAM,CAAC,OAAO,OAAO,6BAA6B;IAQhD,YAAmB,SAA0C;QALtD,aAAQ,GACb,8BAA8B,CAAC,oBAAoB,CAAC;QAKpD,IAAI,CAAC,SAAS;YACZ,SAAS;gBACT,CAAC,CAAC,OAA8B,EAAmC,EAAE;oBACnE,OAAO,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,MAAM,CAAC,aAAa;QAC1B,MAAM,UAAU,GACd,mCAAmC,CACjC,8BAA8B,CAAC,oBAAoB,CACpD,CAAC;QAEJ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CACxB,+DAA+D,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,GAAW;QACnC,MAAM,UAAU,GAAqC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAkC;YAC3C,GAAG,UAAU,CAAC,YAAY;YAC1B,GAAG,UAAU,CAAC,YAAY;SAC3B,CAAC,IAAI,CAAC,CAAC,SAA0B,EAAW,EAAE;YAC7C,OAAO,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,KAAI,GAAG,CAAC;IAC7B,CAAC;IAEO,MAAM,CAAC,aAAa,CAC1B,QAAmC;QAEnC,MAAM,QAAQ,GAAW,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAW,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxE,MAAM,KAAK,GACT,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC;QAC1D,MAAM,YAAY,GAAW,iBAAiB,CAC5C,QAAQ,CAAC,OAAO,EAChB,cAAc,CACf,CAAC;QAEF,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,6FAA6F,CAC5H,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,uCAAuC,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,oBAAoB,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3F,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,eAAe,CAClD,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;IAEM,gBAAgB,CAAC,QAAmC;QACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACxB,8BAA8B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,6BAA6B,CAAC,aAAa,EAAE,CAAC,KAAK,GAAG,CACxH,CAAC;QACJ,CAAC;QAED,6BAA6B,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IAEO,WAAW,CACjB,MAAsB,EACtB,kBAA0B;QAE1B,OAAO,IAAI,0BAA0B,CAAC;YACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,cAAc,CACzB,QAAmC,EACnC,OAA6B;QAE7B,MAAM,MAAM,GAAkC,EAAE,CAAC;QACjD,IAAI,MAAsB,CAAC;QAC3B,IAAI,WAAW,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,GAAG,6BAA6B,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,eAAe,CAAC,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAChE,WAAW,EACT,wEAAwE;aAC3E,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CACT,6BAA6B,CAAC,OAAO,CACnC,iBAAiB,EACjB,kCAAkC,EAClC,kDAAkD,CACnD,CACF,CAAC;YACF,MAAM,CAAC,IAAI,CACT,6BAA6B,CAAC,OAAO,CACnC,sBAAsB,EACtB,4BAA4B,EAC5B,kDAAkD,CACnD,CACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAA+B,IAAI,CAAC,WAAW,CACzD,MAAM,EACN,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,qEAAqE,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,SAAS;aACtJ,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,eAAe,CACtB,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC5D;gBACD,WAAW,EACT,4OAA4O;aAC/O,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CACT,6BAA6B,CAAC,OAAO,CACnC,iBAAiB,EACjB,kCAAkC,EAClC,wCAAwC,CACzC,CACF,CAAC;YACF,MAAM,CAAC,IAAI,CACT,6BAA6B,CAAC,OAAO,CACnC,sBAAsB,EACtB,4BAA4B,EAC5B,wCAAwC,CACzC,CACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,GAAG,GAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;QAE9D,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAmC,MAAM,MAAM,CAAC,UAAU,CAAC;gBACnE,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,GAAG;gBACZ,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,iBAAiB;gBACtB,IAAI,EAAE,kCAAkC;gBACxC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,uDAAuD,IAAI,CAAC,MAAM,CAAC,MAAM,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,2DAA2D;aAC3L,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAW,eAAe,CACrC,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC5D,CAAC;YACF,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,iBAAiB;gBACtB,IAAI,EAAE,kCAAkC;gBACxC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO;gBACP,WAAW,EAAE,6BAA6B,CAAC,eAAe,CAAC,OAAO,CAAC;aACpE,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CACT,6BAA6B,CAAC,OAAO,CACnC,sBAAsB,EACtB,4BAA4B,EAC5B,wCAAwC,CACzC,CACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAmC,MAAM,MAAM,CAAC,WAAW,CAAC;gBACvE,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,GAAG;aACb,CAAC,CAAC;YACH,MAAM,MAAM,GAAmC,MAAM,MAAM,CAAC,WAAW,CAAC;gBACtE,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,GAAG;aACb,CAAC,CAAC;YAEH,MAAM,QAAQ,GACZ,6BAA6B,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,OAAO,GAAW,6BAA6B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACzE,MAAM,OAAO,GACX,OAAO,CAAC,KAAK,KAAK,CAAC;gBACnB,CAAC,OAAO,CAAC,OAAO;gBAChB,MAAM,CAAC,KAAK,KAAK,CAAC;gBAClB,CAAC,MAAM,CAAC,OAAO,CAAC;YAElB,MAAM,CAAC,IAAI,CACT,SAAS,+BACP,GAAG,EAAE,sBAAsB,EAC3B,IAAI,EAAE,4BAA4B,EAClC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EACjC,WAAW,EACX,OAAO,EAAE,OAAO;oBACd,CAAC,CAAC,mHAAmH;oBACrH,CAAC,CAAC,GAAG,QAAQ,SAAS,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qCAAqC,OAAO,sBAAsB,IAClH,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,WAAW,EACT,+JAA+J;iBAClK;gBACH,CAAC,CAAC,EAAE,CAAC,KACP,OAAO,EAAE;oBACP,cAAc,EAAE,QAAQ;oBACxB,aAAa,EAAE,OAAO;oBACtB,cAAc,EAAE,OAAO,CAAC,OAAO;oBAC/B,aAAa,EAAE,MAAM,CAAC,OAAO;iBAC9B,IACD,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAW,eAAe,CACrC,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC5D,CAAC;YACF,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,sBAAsB;gBAC3B,IAAI,EAAE,4BAA4B;gBAClC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO;gBACP,WAAW,EAAE,6BAA6B,CAAC,eAAe,CAAC,OAAO,CAAC;aACpE,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,OAAO,CACpB,GAAW,EACX,IAAY,EACZ,OAAe;QAEf,OAAO,SAAS,CAAC;YACf,GAAG;YACH,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACvB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,KAAqC;QAC7D,OAAO,KAAK,CAAC,OAAO;YAClB,CAAC,CAAC,GAAG,wCAAwC,GAAG;YAChD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,eAAe,CAAC,OAAe;QAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,qOAAqO,CAAC;QAC/O,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,wJAAwJ,CAAC;QAClK,CAAC;QAED;;;;WAIG;QACH,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,8KAA8K,CAAC;QACxL,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzC,OAAO,iKAAiK,CAAC;QAC3K,CAAC;QAED,OAAO,2IAA2I,CAAC;IACrJ,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,WAAW,CACtB,QAAmC,EACnC,MAA4B,EAC5B,OAA8B;QAE9B,MAAM,MAAM,GACV,6BAA6B,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,MAAM,GAA+B,IAAI,CAAC,WAAW,CACzD,MAAM,EACN,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QAEF,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,SAAS,GAAsB,EAAE,CAAC;QACxC,IAAI,QAAQ,GAAY,IAAI,CAAC;QAE7B,MAAM,WAAW,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAErE;;;;;WAKG;QACH,IAAI,YAAY,GAAW,CAAC,CAAC;QAC7B,IAAI,QAAQ,GAAkB,IAAI,CAAC;QAEnC,SAAS,CAAC;YACR,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;gBAChC,QAAQ,GAAG,KAAK,CAAC;gBACjB,QAAQ,CAAC,IAAI,CACX,iBAAiB,YAAY,iFAAiF,mBAAmB,EAAE,CACpI,CAAC;gBACF,MAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAmC,QAAQ;gBACnD,CAAC,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC;gBAC7C,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC;oBACtB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ,EAAE,wCAAwC;iBACnD,CAAC,CAAC;YACP,YAAY,EAAE,CAAC;YAEf,MAAM,SAAS,GAAW,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC;YACvD,MAAM,aAAa,GAAY,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;YAE9D,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;YAEhE,IAAI,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC;gBACtE,QAAQ,GAAG,KAAK,CAAC;gBACjB,QAAQ,CAAC,IAAI,CACX,iBAAiB,SAAS,CAAC,MAAM,uEAAuE,mBAAmB,EAAE,CAC9H,CAAC;gBACF,MAAM;YACR,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM;YACR,CAAC;YAED,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAmC,EAAE,CAAC;QACnD,IAAI,aAAa,GAAW,CAAC,CAAC;QAC9B,IAAI,WAAW,GAAW,CAAC,CAAC;QAE5B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,8BAA8B,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtD,aAAa,EAAE,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,UAAU,GACd,8BAA8B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAExB,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC;wBACX,EAAE,EAAE,UAAU,CAAC,QAAQ;wBACvB,KAAK,EAAE,UAAU,CAAC,OAAO;wBACzB,QAAQ,EAAE,UAAU,CAAC,YAAY;wBACjC,WAAW,EAAE,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,SAAS;wBAC5D,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE;qBACzC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,WAAM,CAAC;gBACP,WAAW,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM;YACN,YAAY,EAAE,SAAS,CAAC,MAAM;YAC9B,aAAa;YACb,WAAW;YACX,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE;YACtC,QAAQ;YACR,OAAO;SACR,CAAC;IACJ,CAAC;CACF"}