@oneuptime/common 13.0.4 → 13.0.5

package/build/dist/Server/Utils/SecurityEvent/Connectors/MicrosoftSentinel/MicrosoftSentinelConnector.js

@@ -0,0 +1,417 @@
+import BadDataException from "../../../../../Types/Exception/BadDataException";
+import SecurityEventConnectorProvider from "../../../../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import MicrosoftSentinelNormalizer from "../../../../../Utils/SecurityEvent/Connectors/MicrosoftSentinelNormalizer";
+import { parseEventTime, readValue, } from "../../../../../Utils/SecurityEvent/NormalizerHelpers";
+import DataSourceHttpFetch from "../../../DataSource/HttpFetch";
+import { redactLogString } from "../../../LogRedaction";
+import ConnectorErrorMessage from "../../ConnectorErrorMessage";
+import { makeCheck, readSettingString, } from "../Types";
+import MicrosoftSentinelClient, { MICROSOFT_SENTINEL_DEFAULT_PAGE_SIZE, } from "./MicrosoftSentinelClient";
+/*
+ * Microsoft Sentinel connector: imports incidents from one Log Analytics
+ * workspace as OCSF Incident Findings.
+ *
+ * Polling is by the incident's createdTimeUtc (see Connectors/Types.ts for
+ * why creation time is the only safe cursor basis). Sentinel creates an
+ * incident when its analytics rule fires, which for scheduled rules is
+ * long after the activity the incident describes — a cursor over activity
+ * time would miss most of them.
+ */
+const PROVIDER_TITLE = "Microsoft Sentinel";
+const DAY_IN_MS = 24 * 60 * 60 * 1000;
+export default class MicrosoftSentinelConnector {
+    constructor(transport) {
+        this.provider = SecurityEventConnectorProvider.MicrosoftSentinel;
+        this.transport =
+            transport ||
+                ((request) => {
+                    return DataSourceHttpFetch.fetch(request);
+                });
+    }
+    /*
+     * Settings are read by the catalog's field keys so the form, the service
+     * validation and this connector can never disagree on a key name.
+     */
+    static resolveSettings(settings) {
+        const config = settings.config || {};
+        const secrets = settings.secrets || {};
+        const cloudRaw = readSettingString(config, "cloud").toLowerCase() || "public";
+        if (!MicrosoftSentinelClient.isCloud(cloudRaw)) {
+            throw new BadDataException(`Cloud must be "public" or "usgov"; received "${cloudRaw}".`);
+        }
+        return {
+            tenantId: readSettingString(config, "tenantId"),
+            clientId: readSettingString(config, "clientId"),
+            clientSecret: readSettingString(secrets, "clientSecret"),
+            subscriptionId: readSettingString(config, "subscriptionId"),
+            resourceGroup: readSettingString(config, "resourceGroup"),
+            workspaceName: readSettingString(config, "workspaceName"),
+            cloud: cloudRaw,
+        };
+    }
+    validateSettings(settings) {
+        if (settings.provider !== this.provider) {
+            throw new BadDataException(`Settings are for provider "${String(settings.provider)}", not ${PROVIDER_TITLE}.`);
+        }
+        const resolved = MicrosoftSentinelConnector.resolveSettings(settings);
+        MicrosoftSentinelClient.validateTenantId(resolved.tenantId);
+        MicrosoftSentinelClient.validateGuid(resolved.clientId, "Application (client) ID");
+        MicrosoftSentinelClient.validateGuid(resolved.subscriptionId, "Subscription ID");
+        MicrosoftSentinelClient.validateResourceGroup(resolved.resourceGroup);
+        MicrosoftSentinelClient.validateWorkspaceName(resolved.workspaceName);
+        if (!resolved.clientSecret) {
+            throw new BadDataException("Client secret is required.");
+        }
+    }
+    createClient(settings, requestTimeoutInMs) {
+        const resolved = MicrosoftSentinelConnector.resolveSettings(settings);
+        return new MicrosoftSentinelClient(Object.assign(Object.assign({}, resolved), { transport: this.transport, requestTimeoutInMs }));
+    }
+    /*
+     * ---------------------------------------------------------------------
+     * Test connection
+     * ---------------------------------------------------------------------
+     */
+    async testConnection(settings, options) {
+        const checks = [];
+        const now = new Date();
+        const dayAgo = new Date(now.getTime() - DAY_IN_MS);
+        const weekAgo = new Date(now.getTime() - 7 * DAY_IN_MS);
+        let client;
+        try {
+            client = this.createClient(settings, options.requestTimeoutInMs);
+        }
+        catch (error) {
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Microsoft Entra",
+                status: "fail",
+                startedAtMs: Date.now(),
+                message: redactLogString(ConnectorErrorMessage.toMessage(error)),
+                remediation: "Correct the highlighted setting and test again. Nothing was contacted.",
+            }));
+            checks.push(MicrosoftSentinelConnector.skipped("read-permission", "Read incidents", "Skipped because the configuration is not usable."));
+            checks.push(MicrosoftSentinelConnector.skipped("detections-available", "Incidents available to import", "Skipped because the configuration is not usable."));
+            return checks;
+        }
+        // 1. Authentication: a client-credentials token for Azure Resource Manager.
+        const authStartedMs = Date.now();
+        try {
+            await client.getAccessToken();
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Microsoft Entra",
+                status: "pass",
+                startedAtMs: authStartedMs,
+                message: "Microsoft Entra issued an access token for Azure Resource Manager with the app registration's client secret.",
+            }));
+        }
+        catch (error) {
+            const message = redactLogString(ConnectorErrorMessage.toMessage(error));
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Microsoft Entra",
+                status: "fail",
+                startedAtMs: authStartedMs,
+                message,
+                remediation: MicrosoftSentinelConnector.authenticationRemediation(message),
+            }));
+            checks.push(MicrosoftSentinelConnector.skipped("read-permission", "Read incidents", "Skipped because authentication failed."));
+            checks.push(MicrosoftSentinelConnector.skipped("detections-available", "Incidents available to import", "Skipped because authentication failed."));
+            return checks;
+        }
+        // 2. Read permission: one incident created in the last day.
+        const readStartedMs = Date.now();
+        try {
+            const page = await client.listIncidents({
+                startTime: dayAgo,
+                endTime: now,
+                top: 1,
+            });
+            checks.push(makeCheck({
+                key: "read-permission",
+                name: "Read incidents",
+                status: "pass",
+                startedAtMs: readStartedMs,
+                message: page.incidents.length
+                    ? "The workspace answered an incidents query; the app registration can read incidents."
+                    : "The workspace answered an incidents query (no incident was created in the last 24 hours); the app registration can read incidents.",
+                details: {
+                    workspaceName: readSettingString(settings.config || {}, "workspaceName"),
+                    sampleIncidentCount: page.incidents.length,
+                },
+            }));
+        }
+        catch (error) {
+            const message = redactLogString(ConnectorErrorMessage.toMessage(error));
+            checks.push(makeCheck({
+                key: "read-permission",
+                name: "Read incidents",
+                status: "fail",
+                startedAtMs: readStartedMs,
+                message,
+                remediation: MicrosoftSentinelConnector.readRemediation(message),
+            }));
+            checks.push(MicrosoftSentinelConnector.skipped("detections-available", "Incidents available to import", "Skipped because incidents could not be read."));
+            return checks;
+        }
+        // 3. Availability: bounded counts over the last day and the last week.
+        const countStartedMs = Date.now();
+        try {
+            const last24h = await client.countIncidentsCreated({
+                startTime: dayAgo,
+                endTime: now,
+                top: MICROSOFT_SENTINEL_DEFAULT_PAGE_SIZE,
+            });
+            const last7d = await client.countIncidentsCreated({
+                startTime: weekAgo,
+                endTime: now,
+                top: MICROSOFT_SENTINEL_DEFAULT_PAGE_SIZE,
+            });
+            const label24h = MicrosoftSentinelConnector.countLabel(last24h);
+            const label7d = MicrosoftSentinelConnector.countLabel(last7d);
+            const nothing = last24h.count === 0 &&
+                last7d.count === 0 &&
+                !last24h.hasMore &&
+                !last7d.hasMore;
+            checks.push(makeCheck(Object.assign(Object.assign({ key: "detections-available", name: "Incidents available to import", status: nothing ? "warn" : "pass", startedAtMs: countStartedMs, message: nothing
+                    ? "No incidents were created in the last 7 days. Polling will import new incidents as Microsoft Sentinel creates them."
+                    : `${label24h} incident${last24h.count === 1 && !last24h.hasMore ? "" : "s"} created in the last 24 hours and ${label7d} in the last 7 days.` }, (nothing
+                ? {
+                    remediation: "Confirm that analytics rules are enabled on this workspace and are producing incidents (Microsoft Sentinel > Incidents). A quiet workspace is not a connector fault.",
+                }
+                : {})), { details: {
+                    createdLast24h: last24h.count,
+                    hasMoreLast24h: last24h.hasMore,
+                    createdLast7d: last7d.count,
+                    hasMoreLast7d: last7d.hasMore,
+                } })));
+        }
+        catch (error) {
+            const message = redactLogString(ConnectorErrorMessage.toMessage(error));
+            checks.push(makeCheck({
+                key: "detections-available",
+                name: "Incidents available to import",
+                status: "fail",
+                startedAtMs: countStartedMs,
+                message,
+                remediation: MicrosoftSentinelConnector.readRemediation(message),
+            }));
+        }
+        return checks;
+    }
+    static skipped(key, name, message) {
+        return makeCheck({
+            key,
+            name,
+            status: "skip",
+            startedAtMs: Date.now(),
+            message,
+        });
+    }
+    static countLabel(count) {
+        return count.hasMore ? `${count.count}+` : String(count.count);
+    }
+    /*
+     * The client puts "(HTTP <status>)" in every status-bearing message, so
+     * remediation can key off the status without re-parsing vendor bodies.
+     */
+    static statusFromMessage(message) {
+        const match = message.match(/\(HTTP (\d{3})\)/);
+        return match ? Number(match[1]) : null;
+    }
+    static authenticationRemediation(message) {
+        const status = MicrosoftSentinelConnector.statusFromMessage(message);
+        if (message.includes("timed out")) {
+            return "Microsoft Entra did not answer in time. Check outbound HTTPS access from the OneUptime app and worker processes to login.microsoftonline.com (or login.microsoftonline.us for Azure Government) and test again.";
+        }
+        if (status === 429) {
+            return "Microsoft Entra is throttling this app registration. Wait a minute and test again.";
+        }
+        if (status !== null && status >= 500) {
+            return "Microsoft Entra reported a server-side problem. Test again in a few minutes; polling retries on its own.";
+        }
+        return "Open the app registration in Microsoft Entra admin center and compare its Directory (tenant) ID and Application (client) ID with the connection, then create a new client secret under Certificates & secrets and paste the secret VALUE (not the secret ID) into the connection. Check that Cloud matches where the tenant lives.";
+    }
+    static readRemediation(message) {
+        const status = MicrosoftSentinelConnector.statusFromMessage(message);
+        if (message.includes("timed out")) {
+            return "Azure Resource Manager did not answer in time. Check outbound HTTPS access from the OneUptime app and worker processes to management.azure.com (or management.usgovcloudapi.net for Azure Government) and test again.";
+        }
+        if (status === 403) {
+            return "Grant the app registration the Microsoft Sentinel Reader role on the resource group that contains the Log Analytics workspace: Azure portal > resource group > Access control (IAM) > Add role assignment > Microsoft Sentinel Reader > Members: select the app registration. Role assignments can take a few minutes to apply.";
+        }
+        if (status === 404) {
+            return "Check Subscription ID, Resource group and Workspace name against the workspace's Overview page in the Azure portal, and confirm Microsoft Sentinel is enabled on that workspace.";
+        }
+        if (status === 401) {
+            return "The token was accepted by Microsoft Entra but refused by Azure Resource Manager. Confirm the Cloud setting matches the cloud that hosts the workspace, then test again.";
+        }
+        if (status === 429) {
+            return "Azure Resource Manager is throttling requests for this subscription. Wait a minute and test again.";
+        }
+        if (status !== null && status >= 500) {
+            return "Azure Resource Manager reported a server-side problem. Test again in a few minutes; polling retries on its own.";
+        }
+        return "Read the message: it names the step that failed and the response Azure returned. Correct the setting it points at and test again.";
+    }
+    /*
+     * ---------------------------------------------------------------------
+     * Fetch
+     * ---------------------------------------------------------------------
+     */
+    /*
+     * Read every incident created in the window, oldest first, within the
+     * request and record budgets. When a budget stops the read, the result
+     * is complete=false with resumeAfter set to the creation time of the
+     * last incident read: the list is sorted by createdTimeUtc ascending, so
+     * everything created before that point has been read, and the poller
+     * moves its cursor there instead of re-reading the same first pages
+     * forever (review finding connector-bound-hit-permanent-stall).
+     */
+    async fetchEvents(settings, window, options) {
+        const client = this.createClient(settings, options.requestTimeoutInMs);
+        const result = {
+            events: [],
+            fetchedCount: 0,
+            rejectedCount: 0,
+            failedCount: 0,
+            complete: true,
+            requestCount: 0,
+            warnings: [],
+            samples: [],
+        };
+        const maxRequests = Math.max(1, Math.floor(options.maxRequests));
+        const maxEvents = Math.max(1, Math.floor(options.maxEvents));
+        const sampleLimit = Math.max(0, Math.floor(options.sampleLimit));
+        const readIncidents = [];
+        let boundWarning = null;
+        let nextLink = null;
+        let pageIndex = 0;
+        /*
+         * The token request is not counted against maxRequests: the budget
+         * bounds how much of the window one run reads, and a token is a fixed
+         * cost that would otherwise silently shrink that budget by one page.
+         */
+        while (true) {
+            if (result.requestCount >= maxRequests) {
+                boundWarning = `Stopped after ${result.requestCount} incidents requests (the per-run request limit) before reading the whole window.`;
+                break;
+            }
+            const page = await client.listIncidents({
+                startTime: window.startTime,
+                endTime: window.endTime,
+                top: MICROSOFT_SENTINEL_DEFAULT_PAGE_SIZE,
+                nextLink: pageIndex === 0 ? null : nextLink,
+            });
+            result.requestCount++;
+            pageIndex++;
+            let incidents = page.incidents;
+            const remaining = maxEvents - result.fetchedCount;
+            let eventBoundHit = false;
+            if (incidents.length > remaining) {
+                incidents = incidents.slice(0, Math.max(0, remaining));
+                eventBoundHit = true;
+            }
+            for (const raw of incidents) {
+                result.fetchedCount++;
+                const readIncident = {
+                    createdAt: parseEventTime(readValue(raw, "properties.createdTimeUtc")),
+                    failed: false,
+                };
+                readIncidents.push(readIncident);
+                if (!MicrosoftSentinelNormalizer.isRecognized(raw)) {
+                    result.rejectedCount++;
+                    continue;
+                }
+                try {
+                    const normalized = MicrosoftSentinelNormalizer.normalize(raw);
+                    result.events.push(normalized);
+                    if (result.samples.length < sampleLimit) {
+                        result.samples.push(MicrosoftSentinelConnector.toSample(normalized));
+                    }
+                }
+                catch (_a) {
+                    result.failedCount++;
+                    readIncident.failed = true;
+                }
+            }
+            if (eventBoundHit ||
+                (page.nextLink && result.fetchedCount >= maxEvents)) {
+                boundWarning = `Stopped after ${result.fetchedCount} incidents (the per-run record limit) before reading the whole window.`;
+                break;
+            }
+            if (!page.nextLink) {
+                break;
+            }
+            nextLink = page.nextLink;
+        }
+        if (boundWarning === null) {
+            return result;
+        }
+        result.complete = false;
+        const resume = MicrosoftSentinelConnector.findResumePoint(readIncidents, window);
+        result.resumeAfter = resume.resumeAfter;
+        result.warnings.push(resume.resumeAfter
+            ? `${boundWarning} Incidents are read oldest first; every incident created before ${resume.resumeAfter.toISOString()} was read.`
+            : boundWarning);
+        if (resume.outOfOrder) {
+            result.warnings.push("Microsoft Sentinel returned incidents out of creation-time order, so this run cannot name a point to resume from.");
+        }
+        return result;
+    }
+    /*
+     * Where the next poll can resume after a bounded read: the creation time
+     * of the last incident read. Two cases name no point, so the poller
+     * narrows its window instead of skipping anything:
+     *  - an incident created earlier than one before it means the API did
+     *    not honour $orderby, and "everything before the last one was read"
+     *    no longer holds;
+     *  - an incident that failed normalization is never resumed past, since
+     *    the poller retries normalization failures; the point stops at that
+     *    incident's creation time (or is absent when it has none).
+     * Creation times outside the window are ignored: the $filter excludes
+     * them, so such a value cannot say anything about this window.
+     */
+    static findResumePoint(readIncidents, window) {
+        const inWindow = (value) => {
+            if (value &&
+                value.getTime() >= window.startTime.getTime() &&
+                value.getTime() < window.endTime.getTime()) {
+                return value;
+            }
+            return null;
+        };
+        let latest = null;
+        for (const readIncident of readIncidents) {
+            const createdAt = inWindow(readIncident.createdAt);
+            if (createdAt && latest && createdAt.getTime() < latest.getTime()) {
+                return { resumeAfter: undefined, outOfOrder: true };
+            }
+            if (createdAt) {
+                latest = createdAt;
+            }
+        }
+        for (const readIncident of readIncidents) {
+            if (readIncident.failed) {
+                return {
+                    resumeAfter: inWindow(readIncident.createdAt) || undefined,
+                    outOfOrder: false,
+                };
+            }
+        }
+        return { resumeAfter: latest || undefined, outOfOrder: false };
+    }
+    static toSample(event) {
+        const createdTime = String(event.attributes["properties.createdTimeUtc"] || "");
+        const activityTime = String(event.attributes["properties.firstActivityTimeUtc"] || "");
+        return Object.assign(Object.assign({ id: event.eventUid, title: event.message, severity: event.severityName }, (createdTime ? { createdTime } : {})), { 
+            /*
+             * The sample's eventTime is the incident's own activity time when
+             * Sentinel reported one, so the diagnostics view can show how far
+             * behind the activity an incident was created.
+             */
+            eventTime: activityTime || event.time.toISOString() });
+    }
+}
+//# sourceMappingURL=MicrosoftSentinelConnector.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/MicrosoftSentinel/MicrosoftSentinelConnector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MicrosoftSentinelConnector.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/SecurityEvent/Connectors/MicrosoftSentinel/MicrosoftSentinelConnector.ts"],"names":[],"mappings":"AAAA,OAAO,gBAAgB,MAAM,iDAAiD,CAAC;AAG/E,OAAO,8BAA8B,MAAM,8EAA8E,CAAC;AAK1H,OAAO,2BAA2B,MAAM,2EAA2E,CAAC;AACpH,OAAO,EACL,cAAc,EACd,SAAS,GACV,MAAM,sDAAsD,CAAC;AAC9D,OAAO,mBAEN,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,qBAAqB,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAQL,SAAS,EACT,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,uBAAuB,EAAE,EAC9B,oCAAoC,GAIrC,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;GASG;AAEH,MAAM,cAAc,GAAW,oBAAoB,CAAC;AACpD,MAAM,SAAS,GAAW,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA6B9C,MAAM,CAAC,OAAO,OAAO,0BAA0B;IAQ7C,YAAmB,SAA0C;QALtD,aAAQ,GACb,8BAA8B,CAAC,iBAAiB,CAAC;QAKjD,IAAI,CAAC,SAAS;YACZ,SAAS;gBACT,CAAC,CAAC,OAA8B,EAAE,EAAE;oBAClC,OAAO,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,eAAe,CAC5B,QAAmC;QAEnC,MAAM,MAAM,GAAe,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;QACjD,MAAM,OAAO,GAAe,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QAEnD,MAAM,QAAQ,GACZ,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC;QAE/D,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,gBAAgB,CACxB,gDAAgD,QAAQ,IAAI,CAC7D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC;YAC/C,QAAQ,EAAE,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC;YAC/C,YAAY,EAAE,iBAAiB,CAAC,OAAO,EAAE,cAAc,CAAC;YACxD,cAAc,EAAE,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC;YAC3D,aAAa,EAAE,iBAAiB,CAAC,MAAM,EAAE,eAAe,CAAC;YACzD,aAAa,EAAE,iBAAiB,CAAC,MAAM,EAAE,eAAe,CAAC;YACzD,KAAK,EAAE,QAAQ;SAChB,CAAC;IACJ,CAAC;IAEM,gBAAgB,CAAC,QAAmC;QACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACxB,8BAA8B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,cAAc,GAAG,CACnF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GACZ,0BAA0B,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEvD,uBAAuB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5D,uBAAuB,CAAC,YAAY,CAClC,QAAQ,CAAC,QAAQ,EACjB,yBAAyB,CAC1B,CAAC;QACF,uBAAuB,CAAC,YAAY,CAClC,QAAQ,CAAC,cAAc,EACvB,iBAAiB,CAClB,CAAC;QACF,uBAAuB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACtE,uBAAuB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAEtE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,YAAY,CAClB,QAAmC,EACnC,kBAA0B;QAE1B,MAAM,QAAQ,GACZ,0BAA0B,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEvD,OAAO,IAAI,uBAAuB,iCAC7B,QAAQ,KACX,SAAS,EAAE,IAAI,CAAC,SAAS,EACzB,kBAAkB,IAClB,CAAC;IACL,CAAC;IAED;;;;OAIG;IAEI,KAAK,CAAC,cAAc,CACzB,QAAmC,EACnC,OAA6B;QAE7B,MAAM,MAAM,GAAkC,EAAE,CAAC;QACjD,MAAM,GAAG,GAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;QAE9D,IAAI,MAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;gBACvB,OAAO,EAAE,eAAe,CAAC,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAChE,WAAW,EACT,wEAAwE;aAC3E,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CACT,0BAA0B,CAAC,OAAO,CAChC,iBAAiB,EACjB,gBAAgB,EAChB,kDAAkD,CACnD,CACF,CAAC;YACF,MAAM,CAAC,IAAI,CACT,0BAA0B,CAAC,OAAO,CAChC,sBAAsB,EACtB,+BAA+B,EAC/B,kDAAkD,CACnD,CACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,4EAA4E;QAC5E,MAAM,aAAa,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;gBAC1B,OAAO,EACL,8GAA8G;aACjH,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAW,eAAe,CACrC,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CACvC,CAAC;YACF,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;gBAC1B,OAAO;gBACP,WAAW,EACT,0BAA0B,CAAC,yBAAyB,CAAC,OAAO,CAAC;aAChE,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CACT,0BAA0B,CAAC,OAAO,CAChC,iBAAiB,EACjB,gBAAgB,EAChB,wCAAwC,CACzC,CACF,CAAC;YACF,MAAM,CAAC,IAAI,CACT,0BAA0B,CAAC,OAAO,CAChC,sBAAsB,EACtB,+BAA+B,EAC/B,wCAAwC,CACzC,CACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,4DAA4D;QAC5D,MAAM,aAAa,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAmC,MAAM,MAAM,CAAC,aAAa,CAAC;gBACtE,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,GAAG;gBACZ,GAAG,EAAE,CAAC;aACP,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,iBAAiB;gBACtB,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;gBAC1B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;oBAC5B,CAAC,CAAC,qFAAqF;oBACvF,CAAC,CAAC,oIAAoI;gBACxI,OAAO,EAAE;oBACP,aAAa,EAAE,iBAAiB,CAC9B,QAAQ,CAAC,MAAM,IAAI,EAAE,EACrB,eAAe,CAChB;oBACD,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;iBAC3C;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAW,eAAe,CACrC,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CACvC,CAAC;YACF,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,iBAAiB;gBACtB,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;gBAC1B,OAAO;gBACP,WAAW,EAAE,0BAA0B,CAAC,eAAe,CAAC,OAAO,CAAC;aACjE,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CACT,0BAA0B,CAAC,OAAO,CAChC,sBAAsB,EACtB,+BAA+B,EAC/B,8CAA8C,CAC/C,CACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,uEAAuE;QACvE,MAAM,cAAc,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAE1C,IAAI,CAAC;YACH,MAAM,OAAO,GACX,MAAM,MAAM,CAAC,qBAAqB,CAAC;gBACjC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,GAAG;gBACZ,GAAG,EAAE,oCAAoC;aAC1C,CAAC,CAAC;YACL,MAAM,MAAM,GACV,MAAM,MAAM,CAAC,qBAAqB,CAAC;gBACjC,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,GAAG;gBACZ,GAAG,EAAE,oCAAoC;aAC1C,CAAC,CAAC;YAEL,MAAM,QAAQ,GAAW,0BAA0B,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACxE,MAAM,OAAO,GAAW,0BAA0B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACtE,MAAM,OAAO,GACX,OAAO,CAAC,KAAK,KAAK,CAAC;gBACnB,MAAM,CAAC,KAAK,KAAK,CAAC;gBAClB,CAAC,OAAO,CAAC,OAAO;gBAChB,CAAC,MAAM,CAAC,OAAO,CAAC;YAElB,MAAM,CAAC,IAAI,CACT,SAAS,+BACP,GAAG,EAAE,sBAAsB,EAC3B,IAAI,EAAE,+BAA+B,EACrC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EACjC,WAAW,EAAE,cAAc,EAC3B,OAAO,EAAE,OAAO;oBACd,CAAC,CAAC,qHAAqH;oBACvH,CAAC,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qCAAqC,OAAO,sBAAsB,IAC5I,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,WAAW,EACT,sKAAsK;iBACzK;gBACH,CAAC,CAAC,EAAE,CAAC,KACP,OAAO,EAAE;oBACP,cAAc,EAAE,OAAO,CAAC,KAAK;oBAC7B,cAAc,EAAE,OAAO,CAAC,OAAO;oBAC/B,aAAa,EAAE,MAAM,CAAC,KAAK;oBAC3B,aAAa,EAAE,MAAM,CAAC,OAAO;iBAC9B,IACD,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAW,eAAe,CACrC,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CACvC,CAAC;YACF,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,sBAAsB;gBAC3B,IAAI,EAAE,+BAA+B;gBACrC,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,cAAc;gBAC3B,OAAO;gBACP,WAAW,EAAE,0BAA0B,CAAC,eAAe,CAAC,OAAO,CAAC;aACjE,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,OAAO,CACpB,GAAW,EACX,IAAY,EACZ,OAAe;QAEf,OAAO,SAAS,CAAC;YACf,GAAG;YACH,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACvB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,KAAqC;QAC7D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,iBAAiB,CAAC,OAAe;QAC9C,MAAM,KAAK,GAA4B,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAEzE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAEO,MAAM,CAAC,yBAAyB,CAAC,OAAe;QACtD,MAAM,MAAM,GACV,0BAA0B,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAExD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO,iNAAiN,CAAC;QAC3N,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,oFAAoF,CAAC;QAC9F,CAAC;QAED,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACrC,OAAO,0GAA0G,CAAC;QACpH,CAAC;QAED,OAAO,oUAAoU,CAAC;IAC9U,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,OAAe;QAC5C,MAAM,MAAM,GACV,0BAA0B,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAExD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO,uNAAuN,CAAC;QACjO,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,iUAAiU,CAAC;QAC3U,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,kLAAkL,CAAC;QAC5L,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,yKAAyK,CAAC;QACnL,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,oGAAoG,CAAC;QAC9G,CAAC;QAED,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACrC,OAAO,iHAAiH,CAAC;QAC3H,CAAC;QAED,OAAO,mIAAmI,CAAC;IAC7I,CAAC;IAED;;;;OAIG;IAEH;;;;;;;;OAQG;IACI,KAAK,CAAC,WAAW,CACtB,QAAmC,EACnC,MAA4B,EAC5B,OAA8B;QAE9B,MAAM,MAAM,GAA4B,IAAI,CAAC,YAAY,CACvD,QAAQ,EACR,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QAEF,MAAM,MAAM,GAAyB;YACnC,MAAM,EAAE,EAAE;YACV,YAAY,EAAE,CAAC;YACf,aAAa,EAAE,CAAC;YAChB,WAAW,EAAE,CAAC;YACd,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;SACZ,CAAC;QAEF,MAAM,WAAW,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACrE,MAAM,WAAW,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QAEzE,MAAM,aAAa,GAAwB,EAAE,CAAC;QAC9C,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,SAAS,GAAW,CAAC,CAAC;QAE1B;;;;WAIG;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,MAAM,CAAC,YAAY,IAAI,WAAW,EAAE,CAAC;gBACvC,YAAY,GAAG,iBAAiB,MAAM,CAAC,YAAY,kFAAkF,CAAC;gBACtI,MAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAmC,MAAM,MAAM,CAAC,aAAa,CAAC;gBACtE,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,EAAE,oCAAoC;gBACzC,QAAQ,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;aAC5C,CAAC,CAAC;YACH,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,SAAS,EAAE,CAAC;YAEZ,IAAI,SAAS,GAAsB,IAAI,CAAC,SAAS,CAAC;YAClD,MAAM,SAAS,GAAW,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;YAC1D,IAAI,aAAa,GAAY,KAAK,CAAC;YAEnC,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBACjC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;gBACvD,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YAED,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,CAAC,YAAY,EAAE,CAAC;gBAEtB,MAAM,YAAY,GAAiB;oBACjC,SAAS,EAAE,cAAc,CACvB,SAAS,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAC5C;oBACD,MAAM,EAAE,KAAK;iBACd,CAAC;gBACF,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAEjC,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnD,MAAM,CAAC,aAAa,EAAE,CAAC;oBACvB,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,UAAU,GACd,2BAA2B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAE/B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;wBACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CACjB,0BAA0B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAChD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,CAAC,WAAW,EAAE,CAAC;oBACrB,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,IACE,aAAa;gBACb,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,EACnD,CAAC;gBACD,YAAY,GAAG,iBAAiB,MAAM,CAAC,YAAY,wEAAwE,CAAC;gBAC5H,MAAM;YACR,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM;YACR,CAAC;YAED,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC;QAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;QAExB,MAAM,MAAM,GAAgB,0BAA0B,CAAC,eAAe,CACpE,aAAa,EACb,MAAM,CACP,CAAC;QACF,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAExC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,MAAM,CAAC,WAAW;YAChB,CAAC,CAAC,GAAG,YAAY,mEAAmE,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,YAAY;YAChI,CAAC,CAAC,YAAY,CACjB,CAAC;QAEF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,mHAAmH,CACpH,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,MAAM,CAAC,eAAe,CAC5B,aAAkC,EAClC,MAA4B;QAE5B,MAAM,QAAQ,GAAwC,CACpD,KAAkB,EACL,EAAE;YACf,IACE,KAAK;gBACL,KAAK,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;gBAC7C,KAAK,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAC1C,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,IAAI,MAAM,GAAgB,IAAI,CAAC;QAE/B,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,MAAM,SAAS,GAAgB,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAEhE,IAAI,SAAS,IAAI,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YACtD,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;QACH,CAAC;QAED,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;gBACxB,OAAO;oBACL,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,SAAS;oBAC1D,UAAU,EAAE,KAAK;iBAClB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IAEO,MAAM,CAAC,QAAQ,CACrB,KAA8B;QAE9B,MAAM,WAAW,GAAW,MAAM,CAChC,KAAK,CAAC,UAAU,CAAC,2BAA2B,CAAC,IAAI,EAAE,CACpD,CAAC;QACF,MAAM,YAAY,GAAW,MAAM,CACjC,KAAK,CAAC,UAAU,CAAC,iCAAiC,CAAC,IAAI,EAAE,CAC1D,CAAC;QAEF,qCACE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,KAAK,EAAE,KAAK,CAAC,OAAO,EACpB,QAAQ,EAAE,KAAK,CAAC,YAAY,IACzB,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC;;;;eAIG;YACH,SAAS,EAAE,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IACnD;IACJ,CAAC;CACF"}