@oneuptime/common 13.0.4 → 13.0.5

package/build/dist/Utils/SecurityEvent/Connectors/OktaNormalizer.js

@@ -0,0 +1,351 @@
+import OcsfSeverity, { OcsfSeverityId, normalizeOcsfSeverity, } from "../../../Types/SecurityEvent/OcsfSeverity";
+import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
+import SecurityEventConnectorProvider from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { getSecurityEventConnectorDefinition, } from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime, readString, readValue, } from "../NormalizerHelpers";
+import { prettifyUdmEventType } from "../UdmNormalizer";
+/*
+ * Okta System Log event (the `LogEvent` object of
+ * GET /api/v1/logs) -> OCSF identity events.
+ *
+ * The payload shape is the LogEvent schema of the Okta management
+ * OpenAPI specification
+ * (https://developer.okta.com/docs/api/openapi/okta-management/management/tag/SystemLog/):
+ * `uuid`, `published`, `eventType`, `displayMessage`, `severity`
+ * (DEBUG/INFO/WARN/ERROR), `outcome.result` (SUCCESS/FAILURE/SKIPPED/
+ * ALLOW/DENY/CHALLENGE/UNKNOWN/...), `actor`, `client`, `target[]`,
+ * `authenticationContext`, `securityContext`, `debugContext`.
+ *
+ * The System Log is one stream of very different things — sign-ins, MFA
+ * challenges, account edits, group membership, policy evaluations, API
+ * token lifecycle — so the OCSF class is chosen from the `eventType`
+ * prefix (the attribute Okta itself uses to categorize events). Anything
+ * without an OCSF equivalent keeps class 0 with a class name derived from
+ * the event type, so nothing is dropped for not mapping.
+ *
+ * Pure and isomorphic on purpose — this file imports only from
+ * Common/Types and Common/Utils so it runs unchanged in the server, in
+ * tests and in the browser.
+ */
+export const OKTA_AUTHENTICATION_CLASS_UID = 3002;
+export const OKTA_AUTHENTICATION_CLASS_NAME = "Authentication";
+export const OKTA_ACCOUNT_CHANGE_CLASS_UID = 3001;
+export const OKTA_ACCOUNT_CHANGE_CLASS_NAME = "Account Change";
+export const OKTA_GROUP_MANAGEMENT_CLASS_UID = 3006;
+export const OKTA_GROUP_MANAGEMENT_CLASS_NAME = "Group Management";
+export const OKTA_DETECTION_FINDING_CLASS_UID = 2004;
+export const OKTA_DETECTION_FINDING_CLASS_NAME = "Detection Finding";
+/*
+ * Okta's four severities onto OCSF. WARN and ERROR are graded higher than
+ * the generic syslog aliases in normalizeOcsfSeverity would put them:
+ * Okta reserves WARN for things like rate-limit warnings, suspicious
+ * activity reports and failed policy evaluations, and ERROR for failures
+ * of Okta's own processing — both worth a look, not a log line.
+ */
+export const OKTA_SEVERITY_MAP = {
+    DEBUG: OcsfSeverity.Informational,
+    INFO: OcsfSeverity.Informational,
+    WARN: OcsfSeverity.Medium,
+    ERROR: OcsfSeverity.High,
+};
+/*
+ * `outcome.result` values (the LogOutcome enum) as the status words the
+ * rest of the product uses. Values Okta adds later fall through to a
+ * prettified copy of the raw word rather than being lost.
+ */
+export const OKTA_OUTCOME_STATUS_MAP = {
+    SUCCESS: "Success",
+    FAILURE: "Failure",
+    SKIPPED: "Skipped",
+    ALLOW: "Allowed",
+    DENY: "Denied",
+    CHALLENGE: "Challenge",
+    UNKNOWN: "Unknown",
+    RATE_LIMIT: "Rate Limited",
+    DEFERRED: "Deferred",
+    SCHEDULED: "Scheduled",
+    ABANDONED: "Abandoned",
+    UNANSWERED: "Unanswered",
+};
+/*
+ * Outcomes that mean the actor did NOT get what it asked for. On an
+ * Authentication event these raise an INFO severity to Low: a failed
+ * sign-in is routine in isolation but is the unit every brute-force and
+ * password-spray detection counts, so it must not be indistinguishable
+ * from a successful one at the severity column.
+ */
+const FAILED_OUTCOMES = new Set(["FAILURE", "DENY"]);
+/*
+ * Okta stamps `alternateId: "unknown"` on targets that have no natural
+ * identifier (authenticator enrollments, for example). It is not an
+ * observable — every event mentioning "unknown" is not a useful query.
+ */
+const PLACEHOLDER_IDENTIFIER = "unknown";
+function definition() {
+    const found = getSecurityEventConnectorDefinition(SecurityEventConnectorProvider.OktaSystemLog);
+    if (!found) {
+        /*
+         * The catalog is a static list that always carries this provider; the
+         * throw only exists so a future catalog edit cannot silently attribute
+         * events to an empty vendor and break the dedupe scope.
+         */
+        throw new Error("Okta System Log is missing from SecurityEventConnectorCatalog.");
+    }
+    return found;
+}
+/*
+ * "user.account.update_password" -> "Update Password": the last
+ * dot-separated segment, words split on underscores and capitalized.
+ */
+function prettifyLastSegment(eventType) {
+    const segments = eventType
+        .split(".")
+        .filter((segment) => {
+        return segment.length > 0;
+    });
+    const last = segments[segments.length - 1] || "";
+    return prettifyUdmEventType(last.replace(/[\s.-]+/g, "_"));
+}
+/*
+ * "system.api_token.create" -> "System Api Token Create", the same
+ * treatment GenericNormalizer gives free-form type strings, so an
+ * unmapped Okta event reads like an unmapped event from any other source.
+ */
+function prettifyEventType(eventType) {
+    return prettifyUdmEventType(eventType.replace(/[\s.-]+/g, "_"));
+}
+function readTargets(raw) {
+    const value = readValue(raw, "target");
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    const targets = [];
+    for (const item of value) {
+        if (!item || typeof item !== "object" || Array.isArray(item)) {
+            continue;
+        }
+        const target = item;
+        targets.push({
+            id: readString(target, "id"),
+            type: readString(target, "type"),
+            alternateId: readString(target, "alternateId"),
+            displayName: readString(target, "displayName"),
+        });
+    }
+    return targets;
+}
+function identifierOf(target) {
+    if (!target) {
+        return "";
+    }
+    if (target.alternateId &&
+        target.alternateId.toLowerCase() !== PLACEHOLDER_IDENTIFIER) {
+        return target.alternateId;
+    }
+    return target.displayName;
+}
+export default class OktaNormalizer {
+    /*
+     * A record is a System Log event when it carries an `eventType` (the
+     * attribute every LogEvent has and the one this normalizer keys on)
+     * together with either its `uuid` or its `published` time. Okta's error
+     * envelope ({ errorCode, errorSummary, ... }) has none of these and is
+     * rejected rather than stored as a meaningless row.
+     */
+    static isRecognized(raw) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+            return false;
+        }
+        const eventType = readString(raw, "eventType");
+        if (!eventType) {
+            return false;
+        }
+        return Boolean(readString(raw, "uuid") || readString(raw, "published"));
+    }
+    /*
+     * Which OCSF class an event type lands in, by prefix. Documented event
+     * families: https://developer.okta.com/docs/reference/api/event-types/
+     */
+    static classify(eventType, outcomeResult) {
+        const type = eventType.trim();
+        const lower = type.toLowerCase();
+        if (lower === "user.session.start") {
+            return {
+                classUid: OKTA_AUTHENTICATION_CLASS_UID,
+                className: OKTA_AUTHENTICATION_CLASS_NAME,
+                activityName: "Logon",
+                ruleName: "",
+            };
+        }
+        if (lower === "user.session.end") {
+            return {
+                classUid: OKTA_AUTHENTICATION_CLASS_UID,
+                className: OKTA_AUTHENTICATION_CLASS_NAME,
+                activityName: "Logoff",
+                ruleName: "",
+            };
+        }
+        if (lower.startsWith("user.mfa.")) {
+            return {
+                classUid: OKTA_AUTHENTICATION_CLASS_UID,
+                className: OKTA_AUTHENTICATION_CLASS_NAME,
+                activityName: "Authentication Ticket",
+                ruleName: "",
+            };
+        }
+        if (lower.startsWith("user.authentication.")) {
+            return {
+                classUid: OKTA_AUTHENTICATION_CLASS_UID,
+                className: OKTA_AUTHENTICATION_CLASS_NAME,
+                activityName: "Logon",
+                ruleName: "",
+            };
+        }
+        /*
+         * Remaining session events (access_admin_app, impersonation.*, context
+         * changes) are still about an authenticated session but are neither a
+         * logon nor a logoff.
+         */
+        if (lower.startsWith("user.session.")) {
+            return {
+                classUid: OKTA_AUTHENTICATION_CLASS_UID,
+                className: OKTA_AUTHENTICATION_CLASS_NAME,
+                activityName: "Other",
+                ruleName: "",
+            };
+        }
+        if (lower.startsWith("user.account.") ||
+            lower.startsWith("user.lifecycle.")) {
+            return {
+                classUid: OKTA_ACCOUNT_CHANGE_CLASS_UID,
+                className: OKTA_ACCOUNT_CHANGE_CLASS_NAME,
+                activityName: prettifyLastSegment(type),
+                ruleName: "",
+            };
+        }
+        if (lower.startsWith("group.")) {
+            return {
+                classUid: OKTA_GROUP_MANAGEMENT_CLASS_UID,
+                className: OKTA_GROUP_MANAGEMENT_CLASS_NAME,
+                activityName: prettifyLastSegment(type),
+                ruleName: "",
+            };
+        }
+        /*
+         * security.* events are Okta's own detections (threat insight,
+         * suspicious activity reports, session hijacking) and a sign-on policy
+         * that DENIED access is a rule firing on the actor — both are findings
+         * about the event, with the event type as the rule that produced them.
+         */
+        if (lower.startsWith("security.") ||
+            (lower === "policy.evaluate_sign_on" &&
+                outcomeResult.toUpperCase() === "DENY")) {
+            return {
+                classUid: OKTA_DETECTION_FINDING_CLASS_UID,
+                className: OKTA_DETECTION_FINDING_CLASS_NAME,
+                activityName: "Create",
+                ruleName: type,
+            };
+        }
+        return {
+            classUid: 0,
+            className: prettifyEventType(type) || "Okta event",
+            activityName: prettifyLastSegment(type),
+            ruleName: "",
+        };
+    }
+    static severityFor(severityText, classUid, outcomeResult) {
+        const key = severityText.trim().toUpperCase();
+        let severity = OKTA_SEVERITY_MAP[key] ||
+            normalizeOcsfSeverity(severityText) ||
+            OcsfSeverity.Unknown;
+        if (classUid === OKTA_AUTHENTICATION_CLASS_UID &&
+            severity === OcsfSeverity.Informational &&
+            FAILED_OUTCOMES.has(outcomeResult.toUpperCase())) {
+            severity = OcsfSeverity.Low;
+        }
+        return severity;
+    }
+    static statusFor(outcomeResult) {
+        const key = outcomeResult.trim().toUpperCase();
+        if (!key) {
+            return "";
+        }
+        return OKTA_OUTCOME_STATUS_MAP[key] || prettifyUdmEventType(key);
+    }
+    static normalize(raw) {
+        const catalog = definition();
+        const eventType = readString(raw, "eventType");
+        const outcomeResult = readString(raw, "outcome.result");
+        const outcomeReason = readString(raw, "outcome.reason");
+        const displayMessage = readString(raw, "displayMessage");
+        const classification = OktaNormalizer.classify(eventType, outcomeResult);
+        const { categoryUid, categoryName } = ocsfCategoryForClassUid(classification.classUid);
+        const severityName = OktaNormalizer.severityFor(readString(raw, "severity"), classification.classUid, outcomeResult);
+        /*
+         * `published` is both the poll basis and the row's time: Okta stamps
+         * it when the event is written, which for the System Log is the event
+         * itself. A payload without it gets "now" rather than a guess.
+         */
+        const time = parseEventTime(readValue(raw, "published"));
+        /*
+         * `uuid` is the event's own stable identifier and the dedupe key
+         * across the overlap re-read; a payload without one gets a content
+         * hash so identical deliveries still collapse.
+         */
+        const eventUid = readString(raw, "uuid") || contentHashEventUid(raw);
+        const actorAlternateId = readString(raw, "actor.alternateId");
+        const actorDisplayName = readString(raw, "actor.displayName");
+        const clientIp = readString(raw, "client.ipAddress");
+        const targets = readTargets(raw);
+        const userTarget = targets.find((target) => {
+            return target.type.toLowerCase() === "user";
+        });
+        const applicationTarget = targets.find((target) => {
+            const type = target.type.toLowerCase();
+            return type === "appinstance" || type === "application";
+        });
+        const message = displayMessage ||
+            (outcomeReason ? `${eventType}: ${outcomeReason}` : eventType) ||
+            "Okta System Log event";
+        return {
+            time: time || new Date(),
+            eventUid,
+            categoryUid,
+            categoryName,
+            classUid: classification.classUid,
+            className: classification.className,
+            activityName: classification.activityName,
+            severityId: OcsfSeverityId[severityName],
+            severityName,
+            statusName: OktaNormalizer.statusFor(outcomeResult),
+            message,
+            vendorName: catalog.vendorName,
+            productName: catalog.productName,
+            ruleId: "",
+            ruleName: classification.ruleName,
+            mitreTactics: [],
+            mitreTechniques: [],
+            principalUser: actorAlternateId || actorDisplayName,
+            principalHost: "",
+            principalIp: clientIp,
+            principalProcess: "",
+            targetUser: identifierOf(userTarget),
+            targetHost: "",
+            targetIp: "",
+            targetPort: 0,
+            targetResource: identifierOf(applicationTarget),
+            observables: buildObservables([
+                actorAlternateId,
+                ...targets.map((target) => {
+                    return target.alternateId.toLowerCase() === PLACEHOLDER_IDENTIFIER
+                        ? ""
+                        : target.alternateId;
+                }),
+                clientIp,
+            ]),
+            attributes: flattenPayload(raw),
+        };
+    }
+}
+//# sourceMappingURL=OktaNormalizer.js.map

package/build/dist/Utils/SecurityEvent/Connectors/OktaNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OktaNormalizer.js","sourceRoot":"","sources":["../../../../../Utils/SecurityEvent/Connectors/OktaNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,8BAA8B,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAEL,mCAAmC,GACpC,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAW,IAAI,CAAC;AAC1D,MAAM,CAAC,MAAM,8BAA8B,GAAW,gBAAgB,CAAC;AACvE,MAAM,CAAC,MAAM,6BAA6B,GAAW,IAAI,CAAC;AAC1D,MAAM,CAAC,MAAM,8BAA8B,GAAW,gBAAgB,CAAC;AACvE,MAAM,CAAC,MAAM,+BAA+B,GAAW,IAAI,CAAC;AAC5D,MAAM,CAAC,MAAM,gCAAgC,GAAW,kBAAkB,CAAC;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAW,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAW,mBAAmB,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAiC;IAC7D,KAAK,EAAE,YAAY,CAAC,aAAa;IACjC,IAAI,EAAE,YAAY,CAAC,aAAa;IAChC,IAAI,EAAE,YAAY,CAAC,MAAM;IACzB,KAAK,EAAE,YAAY,CAAC,IAAI;CACzB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA2B;IAC7D,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,cAAc;IAC1B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;CACzB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,eAAe,GAAgB,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,sBAAsB,GAAW,SAAS,CAAC;AAgBjD,SAAS,UAAU;IACjB,MAAM,KAAK,GACT,mCAAmC,CACjC,8BAA8B,CAAC,aAAa,CAC7C,CAAC;IAEJ,IAAI,CAAC,KAAK,EAAE,CAAC;QACX;;;;WAIG;QACH,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,MAAM,QAAQ,GAAkB,SAAS;SACtC,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,OAAe,EAAW,EAAE;QACnC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACL,MAAM,IAAI,GAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAEzD,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,OAAO,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,GAAe;IAClC,MAAM,KAAK,GAAc,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAElD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAyB,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAe,IAAkB,CAAC;QAE9C,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC;YAC5B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;YAChC,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC;YAC9C,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAA8B;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IACE,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,sBAAsB,EAC3D,CAAC;QACD,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC;;;;;;OAMG;IACI,MAAM,CAAC,YAAY,CAAC,GAAe;QACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAW,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,QAAQ,CACpB,SAAiB,EACjB,aAAqB;QAErB,MAAM,IAAI,GAAW,SAAS,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QAEzC,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;YACnC,OAAO;gBACL,QAAQ,EAAE,6BAA6B;gBACvC,SAAS,EAAE,8BAA8B;gBACzC,YAAY,EAAE,OAAO;gBACrB,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,KAAK,kBAAkB,EAAE,CAAC;YACjC,OAAO;gBACL,QAAQ,EAAE,6BAA6B;gBACvC,SAAS,EAAE,8BAA8B;gBACzC,YAAY,EAAE,QAAQ;gBACtB,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,QAAQ,EAAE,6BAA6B;gBACvC,SAAS,EAAE,8BAA8B;gBACzC,YAAY,EAAE,uBAAuB;gBACrC,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,QAAQ,EAAE,6BAA6B;gBACvC,SAAS,EAAE,8BAA8B;gBACzC,YAAY,EAAE,OAAO;gBACrB,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED;;;;WAIG;QACH,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,QAAQ,EAAE,6BAA6B;gBACvC,SAAS,EAAE,8BAA8B;gBACzC,YAAY,EAAE,OAAO;gBACrB,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,IACE,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC;YACjC,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,EACnC,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,6BAA6B;gBACvC,SAAS,EAAE,8BAA8B;gBACzC,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC;gBACvC,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,QAAQ,EAAE,+BAA+B;gBACzC,SAAS,EAAE,gCAAgC;gBAC3C,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC;gBACvC,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED;;;;;WAKG;QACH,IACE,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAC7B,CAAC,KAAK,KAAK,yBAAyB;gBAClC,aAAa,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EACzC,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,gCAAgC;gBAC1C,SAAS,EAAE,iCAAiC;gBAC5C,YAAY,EAAE,QAAQ;gBACtB,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,YAAY;YAClD,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC;YACvC,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,WAAW,CACvB,YAAoB,EACpB,QAAgB,EAChB,aAAqB;QAErB,MAAM,GAAG,GAAW,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,QAAQ,GACV,iBAAiB,CAAC,GAAG,CAAC;YACtB,qBAAqB,CAAC,YAAY,CAAC;YACnC,YAAY,CAAC,OAAO,CAAC;QAEvB,IACE,QAAQ,KAAK,6BAA6B;YAC1C,QAAQ,KAAK,YAAY,CAAC,aAAa;YACvC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,EAChD,CAAC;YACD,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC;QAC9B,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,aAAqB;QAC3C,MAAM,GAAG,GAAW,aAAa,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEvD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,GAAe;QACrC,MAAM,OAAO,GAAqC,UAAU,EAAE,CAAC;QAE/D,MAAM,SAAS,GAAW,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,aAAa,GAAW,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAChE,MAAM,aAAa,GAAW,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAChE,MAAM,cAAc,GAAW,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAEjE,MAAM,cAAc,GAA4B,cAAc,CAAC,QAAQ,CACrE,SAAS,EACT,aAAa,CACd,CAAC;QACF,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,cAAc,CAAC,QAAQ,CACxB,CAAC;QAEF,MAAM,YAAY,GAAiB,cAAc,CAAC,WAAW,CAC3D,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,EAC3B,cAAc,CAAC,QAAQ,EACvB,aAAa,CACd,CAAC;QAEF;;;;WAIG;QACH,MAAM,IAAI,GAAgB,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QAEtE;;;;WAIG;QACH,MAAM,QAAQ,GACZ,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAEtD,MAAM,gBAAgB,GAAW,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACtE,MAAM,gBAAgB,GAAW,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAW,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAsB,WAAW,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,UAAU,GAA2B,OAAO,CAAC,IAAI,CACrD,CAAC,MAAkB,EAAW,EAAE;YAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QAC9C,CAAC,CACF,CAAC;QACF,MAAM,iBAAiB,GAA2B,OAAO,CAAC,IAAI,CAC5D,CAAC,MAAkB,EAAW,EAAE;YAC9B,MAAM,IAAI,GAAW,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/C,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,aAAa,CAAC;QAC1D,CAAC,CACF,CAAC;QAEF,MAAM,OAAO,GACX,cAAc;YACd,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,uBAAuB,CAAC;QAE1B,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ;YACR,WAAW;YACX,YAAY;YACZ,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,cAAc,CAAC,SAAS;YACnC,YAAY,EAAE,cAAc,CAAC,YAAY;YACzC,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC,aAAa,CAAC;YACnD,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,YAAY,EAAE,EAAE;YAChB,eAAe,EAAE,EAAE;YACnB,aAAa,EAAE,gBAAgB,IAAI,gBAAgB;YACnD,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,QAAQ;YACrB,gBAAgB,EAAE,EAAE;YACpB,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC;YACpC,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,CAAC;YACb,cAAc,EAAE,YAAY,CAAC,iBAAiB,CAAC;YAC/C,WAAW,EAAE,gBAAgB,CAAC;gBAC5B,gBAAgB;gBAChB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAkB,EAAU,EAAE;oBAC5C,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,sBAAsB;wBAChE,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;gBACzB,CAAC,CAAC;gBACF,QAAQ;aACT,CAAC;YACF,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC;SAChC,CAAC;IACJ,CAAC;CACF"}