@oneuptime/common 13.0.4 → 13.0.5

package/build/dist/Utils/SecurityEvent/Connectors/ElasticSecurityNormalizer.js

@@ -0,0 +1,328 @@
+import OcsfSeverity, { OcsfSeverityId, normalizeOcsfSeverity, } from "../../../Types/SecurityEvent/OcsfSeverity";
+import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
+import { DETECTION_FINDING_CLASS_NAME, DETECTION_FINDING_CLASS_UID, } from "../../../Types/SecurityEvent/DetectionFindingConstants";
+import { getSecurityEventConnectorDefinition, } from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import SecurityEventConnectorProvider from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime, } from "../NormalizerHelpers";
+/*
+ * Elastic Security detection alert -> OCSF Detection Finding (2004).
+ *
+ * The input is one hit of the Elasticsearch search response that
+ * POST /api/detection_engine/signals/search returns: `{ _id, _index,
+ * _source }`. A bare alert document (the `_source` alone, as a Kibana
+ * connector action or a forwarder would deliver it) is accepted too; it
+ * just has no `_id` to use as the event uid.
+ *
+ * Alert documents carry two field spellings at once and both must be
+ * read. Kibana's rule registry writes its own fields with DOTTED KEYS at
+ * the top level of `_source` (`"kibana.alert.rule.name": "..."`), while
+ * the ECS fields copied from the matched source event arrive as NESTED
+ * objects (`host: { name: "..." }`) or, depending on the shipper, dotted as
+ * well — and a dotted prefix can hold a nested object
+ * (`"kibana.alert.rule.parameters": { threat: [...] }`). Every read below
+ * therefore resolves a path against any mix of the two spellings. Field
+ * names follow the published alert schema:
+ * https://www.elastic.co/guide/en/security/current/alert-schema.html
+ *
+ * Pure and isomorphic: imports only from Common/Types and Common/Utils.
+ */
+const ELASTIC_DEFINITION = getSecurityEventConnectorDefinition(SecurityEventConnectorProvider.ElasticSecurity);
+/*
+ * The vendor/product pair is the dedupe scope in the event store and the
+ * label the dashboard groups by, so it is read from the catalog rather
+ * than retyped here: a rename in one place must not orphan stored rows.
+ */
+export const ELASTIC_SECURITY_VENDOR_NAME = (ELASTIC_DEFINITION === null || ELASTIC_DEFINITION === void 0 ? void 0 : ELASTIC_DEFINITION.vendorName) || "Elastic";
+export const ELASTIC_SECURITY_PRODUCT_NAME = (ELASTIC_DEFINITION === null || ELASTIC_DEFINITION === void 0 ? void 0 : ELASTIC_DEFINITION.productName) || "Elastic Security";
+/*
+ * Rule risk_score bands, matching the severity defaults the rule editor
+ * assigns (low 21, medium 47, high 73, critical 99). Used only when
+ * `kibana.alert.severity` is missing, which happens on alerts written by
+ * older rule types.
+ */
+function severityFromRiskScore(riskScore) {
+    if (riskScore === null) {
+        return null;
+    }
+    if (riskScore >= 74) {
+        return OcsfSeverity.Critical;
+    }
+    if (riskScore >= 48) {
+        return OcsfSeverity.High;
+    }
+    if (riskScore >= 22) {
+        return OcsfSeverity.Medium;
+    }
+    return OcsfSeverity.Low;
+}
+function isJsonObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function firstObject(value) {
+    if (isJsonObject(value)) {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        const found = value.find((item) => {
+            return isJsonObject(item);
+        });
+        return found ? found : null;
+    }
+    return null;
+}
+/*
+ * Resolve a dot path against a document whose keys may be dotted, nested
+ * or any mix of the two. At every level the longest dotted key present
+ * wins, so "kibana.alert.rule.parameters.threat" finds both
+ * `{"kibana.alert.rule.parameters": {threat}}` and `{kibana: {alert: ...}}`.
+ * Arrays along the way contribute their first object (readValue's rule).
+ */
+function resolvePath(payload, segments, start) {
+    for (let length = segments.length - start; length >= 1; length--) {
+        const key = segments.slice(start, start + length).join(".");
+        if (!Object.prototype.hasOwnProperty.call(payload, key)) {
+            continue;
+        }
+        const value = payload[key];
+        if (value === null || value === undefined) {
+            continue;
+        }
+        if (start + length === segments.length) {
+            return value;
+        }
+        const child = firstObject(value);
+        if (child) {
+            const nested = resolvePath(child, segments, start + length);
+            if (nested !== null) {
+                return nested;
+            }
+        }
+    }
+    return null;
+}
+function readField(payload, path) {
+    return resolvePath(payload, path.split("."), 0);
+}
+function readFieldString(payload, path) {
+    const value = readField(payload, path);
+    if (value === null || value === undefined) {
+        return "";
+    }
+    if (Array.isArray(value)) {
+        const first = value.find((item) => {
+            return item !== null && item !== undefined && typeof item !== "object";
+        });
+        return first === undefined ? "" : String(first);
+    }
+    if (typeof value === "object") {
+        return "";
+    }
+    return String(value);
+}
+function readFieldStrings(payload, path) {
+    const value = readField(payload, path);
+    if (value === null || value === undefined) {
+        return [];
+    }
+    if (Array.isArray(value)) {
+        return value
+            .filter((item) => {
+            return item !== null && item !== undefined && typeof item !== "object";
+        })
+            .map((item) => {
+            return String(item);
+        });
+    }
+    if (typeof value === "object") {
+        return [];
+    }
+    return [String(value)];
+}
+function readFieldNumber(payload, path) {
+    const text = readFieldString(payload, path);
+    if (text.trim() === "") {
+        return null;
+    }
+    const parsed = Number(text);
+    return Number.isFinite(parsed) ? parsed : null;
+}
+function readFieldObjects(payload, path) {
+    const value = readField(payload, path);
+    if (Array.isArray(value)) {
+        return value.filter((item) => {
+            return isJsonObject(item);
+        });
+    }
+    if (isJsonObject(value)) {
+        return [value];
+    }
+    return [];
+}
+/*
+ * `kibana.alert.rule.threat[]` follows the rule schema's Threat object:
+ * { framework, tactic: { id, name, reference }, technique: [{ id, name,
+ * reference, subtechnique: [{ id, name, reference }] }] }. Only ids are
+ * kept — they are the stable join key across products. Sub-technique ids
+ * (T1078.004) are listed alongside their parent technique.
+ */
+function collectMitre(threats) {
+    const tactics = [];
+    const techniques = [];
+    for (const threat of threats) {
+        const tacticId = readFieldString(threat, "tactic.id");
+        if (tacticId) {
+            tactics.push(tacticId);
+        }
+        for (const technique of readFieldObjects(threat, "technique")) {
+            const techniqueId = readFieldString(technique, "id");
+            if (techniqueId) {
+                techniques.push(techniqueId);
+            }
+            for (const subtechnique of readFieldObjects(technique, "subtechnique")) {
+                const subtechniqueId = readFieldString(subtechnique, "id");
+                if (subtechniqueId) {
+                    techniques.push(subtechniqueId);
+                }
+            }
+        }
+    }
+    return {
+        tactics: buildObservables(tactics),
+        techniques: buildObservables(techniques),
+    };
+}
+/*
+ * Accept either a search hit ({ _id, _index, _source }) or a bare alert
+ * document.
+ */
+function splitHit(raw) {
+    const source = raw["_source"];
+    if (isJsonObject(source)) {
+        return {
+            id: readFieldString(raw, "_id"),
+            index: readFieldString(raw, "_index"),
+            source: source,
+        };
+    }
+    return {
+        id: "",
+        index: readFieldString(raw, "_index"),
+        source: raw,
+    };
+}
+export default class ElasticSecurityNormalizer {
+    /*
+     * A document is an Elastic Security alert when it carries the rule
+     * registry's alert fields or is marked event.kind "signal" (which the
+     * alert schema guarantees for every alert document).
+     */
+    static isRecognized(raw) {
+        if (!isJsonObject(raw)) {
+            return false;
+        }
+        const { source } = splitHit(raw);
+        return Boolean(readFieldString(source, "kibana.alert.rule.uuid") ||
+            readFieldString(source, "kibana.alert.uuid") ||
+            readFieldString(source, "kibana.alert.rule.name") ||
+            readFieldString(source, "event.kind").toLowerCase() === "signal");
+    }
+    static normalize(raw) {
+        const { id, index, source } = splitHit(raw);
+        const ruleName = readFieldString(source, "kibana.alert.rule.name");
+        const ruleId = readFieldString(source, "kibana.alert.rule.uuid") ||
+            readFieldString(source, "kibana.alert.rule.rule_id");
+        const description = readFieldString(source, "kibana.alert.rule.description");
+        const reason = readFieldString(source, "kibana.alert.reason");
+        const severityName = normalizeOcsfSeverity(readFieldString(source, "kibana.alert.severity")) ||
+            severityFromRiskScore(readFieldNumber(source, "kibana.alert.risk_score")) ||
+            OcsfSeverity.Unknown;
+        /*
+         * Event time is the time of the ACTIVITY the alert describes:
+         * original_time is the matched source event's @timestamp; start is the
+         * alerting framework's first-detected time; the alert's own @timestamp
+         * (rule execution time) is the last resort. The connector pages on
+         * @timestamp separately, so this choice never affects polling.
+         */
+        const time = parseEventTime(readField(source, "kibana.alert.original_time")) ||
+            parseEventTime(readField(source, "kibana.alert.start")) ||
+            parseEventTime(readField(source, "@timestamp"));
+        const threats = readFieldObjects(source, "kibana.alert.rule.threat");
+        const mitre = collectMitre(threats.length > 0
+            ? threats
+            : readFieldObjects(source, "kibana.alert.rule.parameters.threat"));
+        const hostName = readFieldString(source, "host.name");
+        const hostIps = readFieldStrings(source, "host.ip");
+        const userName = readFieldString(source, "user.name");
+        const targetUserName = readFieldString(source, "user.target.name");
+        const sourceIp = readFieldString(source, "source.ip");
+        const destinationIp = readFieldString(source, "destination.ip");
+        const destinationDomain = readFieldString(source, "destination.domain");
+        const processName = readFieldString(source, "process.name") ||
+            readFieldString(source, "process.executable");
+        const filePath = readFieldString(source, "file.path");
+        const { categoryUid, categoryName } = ocsfCategoryForClassUid(DETECTION_FINDING_CLASS_UID);
+        const attributes = flattenPayload(source);
+        if (index) {
+            attributes["_index"] = index;
+        }
+        if (id) {
+            attributes["_id"] = id;
+        }
+        return {
+            time: time || new Date(),
+            /*
+             * The search hit's _id is the alert's stable identifier (it equals
+             * kibana.alert.uuid for detection alerts); a bare document falls
+             * back to that field, then to a content hash.
+             */
+            eventUid: id ||
+                readFieldString(source, "kibana.alert.uuid") ||
+                contentHashEventUid(raw),
+            categoryUid,
+            categoryName,
+            classUid: DETECTION_FINDING_CLASS_UID,
+            className: DETECTION_FINDING_CLASS_NAME,
+            activityName: "Create",
+            severityId: OcsfSeverityId[severityName],
+            severityName,
+            statusName: readFieldString(source, "kibana.alert.workflow_status"),
+            message: reason || ruleName || description || "Elastic Security alert",
+            vendorName: ELASTIC_SECURITY_VENDOR_NAME,
+            productName: ELASTIC_SECURITY_PRODUCT_NAME,
+            ruleId,
+            ruleName,
+            mitreTactics: mitre.tactics,
+            mitreTechniques: mitre.techniques,
+            principalUser: userName,
+            principalHost: hostName,
+            principalIp: sourceIp || hostIps[0] || "",
+            principalProcess: processName,
+            targetUser: targetUserName,
+            targetHost: destinationDomain,
+            targetIp: destinationIp,
+            targetPort: readFieldNumber(source, "destination.port") || 0,
+            targetResource: filePath,
+            observables: buildObservables([
+                userName,
+                targetUserName,
+                ...readFieldStrings(source, "related.user"),
+                hostName,
+                ...readFieldStrings(source, "related.hosts"),
+                ...hostIps,
+                sourceIp,
+                destinationIp,
+                ...readFieldStrings(source, "related.ip"),
+                destinationDomain,
+                readFieldString(source, "dns.question.name"),
+                readFieldString(source, "url.domain"),
+                processName,
+                readFieldString(source, "file.hash.sha256"),
+                readFieldString(source, "file.hash.sha1"),
+                readFieldString(source, "file.hash.md5"),
+                ...readFieldStrings(source, "related.hash"),
+            ]),
+            attributes,
+        };
+    }
+}
+//# sourceMappingURL=ElasticSecurityNormalizer.js.map

package/build/dist/Utils/SecurityEvent/Connectors/ElasticSecurityNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ElasticSecurityNormalizer.js","sourceRoot":"","sources":["../../../../../Utils/SecurityEvent/Connectors/ElasticSecurityNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,wDAAwD,CAAC;AAChE,OAAO,EAEL,mCAAmC,GACpC,MAAM,uEAAuE,CAAC;AAC/E,OAAO,8BAA8B,MAAM,wEAAwE,CAAC;AACpH,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,GACf,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,kBAAkB,GACtB,mCAAmC,CACjC,8BAA8B,CAAC,eAAe,CAC/C,CAAC;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,UAAU,KAAI,SAAS,CAAC;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GACxC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,WAAW,KAAI,kBAAkB,CAAC;AAExD;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,SAAwB;IACrD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAED,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,OAAO,YAAY,CAAC,GAAG,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CACnB,KAAmC;IAEnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,KAAmC;IACtD,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAa,KAAwB,CAAC,IAAI,CACnD,CAAC,IAAa,EAAW,EAAE;YACzB,OAAO,YAAY,CAAC,IAAiB,CAAC,CAAC;QACzC,CAAC,CACF,CAAC;QAEF,OAAO,KAAK,CAAC,CAAC,CAAE,KAAoB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAClB,OAAmB,EACnB,QAAuB,EACvB,KAAa;IAEb,KAAK,IAAI,MAAM,GAAW,QAAQ,CAAC,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;QACzE,MAAM,GAAG,GAAW,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEpE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YACxD,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAc,OAAO,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,IAAI,KAAK,GAAG,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAsB,WAAW,CAAC,KAAK,CAAC,CAAC;QAEpD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAqB,WAAW,CAC1C,KAAK,EACL,QAAQ,EACR,KAAK,GAAG,MAAM,CACf,CAAC;YAEF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,OAAmB,EAAE,IAAY;IAClD,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,OAAmB,EAAE,IAAY;IACxD,MAAM,KAAK,GAAqB,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEzD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAa,KAAwB,CAAC,IAAI,CACnD,CAAC,IAAa,EAAW,EAAE;YACzB,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QACzE,CAAC,CACF,CAAC;QACF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAmB,EAAE,IAAY;IACzD,MAAM,KAAK,GAAqB,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEzD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAQ,KAAwB;aAC7B,MAAM,CAAC,CAAC,IAAa,EAAW,EAAE;YACjC,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QACzE,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,IAAa,EAAU,EAAE;YAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,OAAmB,EAAE,IAAY;IACxD,MAAM,IAAI,GAAW,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEpD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,CAAC,IAAI,CAAC,CAAC;IAEpC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAmB,EACnB,IAAY;IAEZ,MAAM,KAAK,GAAqB,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAQ,KAAwB,CAAC,MAAM,CAAC,CAAC,IAAa,EAAW,EAAE;YACjE,OAAO,YAAY,CAAC,IAAiB,CAAC,CAAC;QACzC,CAAC,CAAsB,CAAC;IAC1B,CAAC;IAED,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAOD;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,OAA0B;IAC9C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAkB,EAAE,CAAC;IAErC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAW,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAE9D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YAC9D,MAAM,WAAW,GAAW,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAE7D,IAAI,WAAW,EAAE,CAAC;gBAChB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/B,CAAC;YAED,KAAK,MAAM,YAAY,IAAI,gBAAgB,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;gBACvE,MAAM,cAAc,GAAW,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAEnE,IAAI,cAAc,EAAE,CAAC;oBACnB,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAClC,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC;KACzC,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,SAAS,QAAQ,CAAC,GAAe;IAC/B,MAAM,MAAM,GAA0B,GAAG,CAAC,SAAS,CAAC,CAAC;IAErD,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC;YAC/B,KAAK,EAAE,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;YACrC,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,EAAE;QACN,KAAK,EAAE,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrC,MAAM,EAAE,GAAG;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,yBAAyB;IAC5C;;;;OAIG;IACI,MAAM,CAAC,YAAY,CAAC,GAAe;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAEjC,OAAO,OAAO,CACZ,eAAe,CAAC,MAAM,EAAE,wBAAwB,CAAC;YAC/C,eAAe,CAAC,MAAM,EAAE,mBAAmB,CAAC;YAC5C,eAAe,CAAC,MAAM,EAAE,wBAAwB,CAAC;YACjD,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CACnE,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,GAAe;QACrC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAW,eAAe,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QAC3E,MAAM,MAAM,GACV,eAAe,CAAC,MAAM,EAAE,wBAAwB,CAAC;YACjD,eAAe,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACvD,MAAM,WAAW,GAAW,eAAe,CACzC,MAAM,EACN,+BAA+B,CAChC,CAAC;QACF,MAAM,MAAM,GAAW,eAAe,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAEtE,MAAM,YAAY,GAChB,qBAAqB,CAAC,eAAe,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;YACvE,qBAAqB,CACnB,eAAe,CAAC,MAAM,EAAE,yBAAyB,CAAC,CACnD;YACD,YAAY,CAAC,OAAO,CAAC;QAEvB;;;;;;WAMG;QACH,MAAM,IAAI,GACR,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;YAC/D,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;YACvD,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QAElD,MAAM,OAAO,GAAsB,gBAAgB,CACjD,MAAM,EACN,0BAA0B,CAC3B,CAAC;QACF,MAAM,KAAK,GAAoB,YAAY,CACzC,OAAO,CAAC,MAAM,GAAG,CAAC;YAChB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,qCAAqC,CAAC,CACpE,CAAC;QAEF,MAAM,QAAQ,GAAW,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAkB,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAW,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,cAAc,GAAW,eAAe,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAW,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,aAAa,GAAW,eAAe,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACxE,MAAM,iBAAiB,GAAW,eAAe,CAC/C,MAAM,EACN,oBAAoB,CACrB,CAAC;QACF,MAAM,WAAW,GACf,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC;YACvC,eAAe,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAW,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAE9D,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,MAAM,UAAU,GAAe,cAAc,CAAC,MAAM,CAAC,CAAC;QAEtD,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC/B,CAAC;QAED,IAAI,EAAE,EAAE,CAAC;YACP,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACzB,CAAC;QAED,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB;;;;eAIG;YACH,QAAQ,EACN,EAAE;gBACF,eAAe,CAAC,MAAM,EAAE,mBAAmB,CAAC;gBAC5C,mBAAmB,CAAC,GAAG,CAAC;YAC1B,WAAW;YACX,YAAY;YACZ,QAAQ,EAAE,2BAA2B;YACrC,SAAS,EAAE,4BAA4B;YACvC,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EAAE,eAAe,CAAC,MAAM,EAAE,8BAA8B,CAAC;YACnE,OAAO,EAAE,MAAM,IAAI,QAAQ,IAAI,WAAW,IAAI,wBAAwB;YACtE,UAAU,EAAE,4BAA4B;YACxC,WAAW,EAAE,6BAA6B;YAC1C,MAAM;YACN,QAAQ;YACR,YAAY,EAAE,KAAK,CAAC,OAAO;YAC3B,eAAe,EAAE,KAAK,CAAC,UAAU;YACjC,aAAa,EAAE,QAAQ;YACvB,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;YACzC,gBAAgB,EAAE,WAAW;YAC7B,UAAU,EAAE,cAAc;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,eAAe,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAC5D,cAAc,EAAE,QAAQ;YACxB,WAAW,EAAE,gBAAgB,CAAC;gBAC5B,QAAQ;gBACR,cAAc;gBACd,GAAG,gBAAgB,CAAC,MAAM,EAAE,cAAc,CAAC;gBAC3C,QAAQ;gBACR,GAAG,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC;gBAC5C,GAAG,OAAO;gBACV,QAAQ;gBACR,aAAa;gBACb,GAAG,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC;gBACzC,iBAAiB;gBACjB,eAAe,CAAC,MAAM,EAAE,mBAAmB,CAAC;gBAC5C,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC;gBACrC,WAAW;gBACX,eAAe,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBAC3C,eAAe,CAAC,MAAM,EAAE,gBAAgB,CAAC;gBACzC,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC;gBACxC,GAAG,gBAAgB,CAAC,MAAM,EAAE,cAAc,CAAC;aAC5C,CAAC;YACF,UAAU;SACX,CAAC;IACJ,CAAC;CACF"}