@oneuptime/common 13.0.4 → 13.0.6

package/build/dist/Server/Utils/SecurityEvent/Connectors/SecurityEventConnectorRegistry.js

@@ -0,0 +1,42 @@
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import MicrosoftSentinelConnector from "./MicrosoftSentinel/MicrosoftSentinelConnector";
+import MicrosoftDefenderXdrConnector from "./MicrosoftDefenderXdr/MicrosoftDefenderXdrConnector";
+import CrowdStrikeFalconConnector from "./CrowdStrikeFalcon/CrowdStrikeFalconConnector";
+import SplunkConnector from "./Splunk/SplunkConnector";
+import ElasticSecurityConnector from "./ElasticSecurity/ElasticSecurityConnector";
+import AwsSecurityHubConnector from "./AwsSecurityHub/AwsSecurityHubConnector";
+import OktaConnector from "./Okta/OktaConnector";
+import GoogleSecOpsConnector from "./GoogleSecOps/GoogleSecOpsConnector";
+/*
+ * One connector instance per provider. Connectors are stateless (every
+ * call carries its own settings and opens its own HTTP session), so the
+ * singletons are safe to share across requests and tenants.
+ */
+class SecurityEventConnectorRegistry {
+    static getConnector(provider) {
+        const connector = this.connectors.find((candidate) => {
+            return candidate.provider === provider;
+        });
+        if (!connector) {
+            throw new BadDataException(`No connector is registered for security event provider: ${String(provider || "")}`);
+        }
+        return connector;
+    }
+    static getRegisteredProviders() {
+        return this.connectors.map((connector) => {
+            return connector.provider;
+        });
+    }
+}
+SecurityEventConnectorRegistry.connectors = [
+    new MicrosoftSentinelConnector(),
+    new MicrosoftDefenderXdrConnector(),
+    new CrowdStrikeFalconConnector(),
+    new SplunkConnector(),
+    new ElasticSecurityConnector(),
+    new AwsSecurityHubConnector(),
+    new OktaConnector(),
+    new GoogleSecOpsConnector(),
+];
+export default SecurityEventConnectorRegistry;
+//# sourceMappingURL=SecurityEventConnectorRegistry.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/SecurityEventConnectorRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityEventConnectorRegistry.js","sourceRoot":"","sources":["../../../../../../Server/Utils/SecurityEvent/Connectors/SecurityEventConnectorRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAG5E,OAAO,0BAA0B,MAAM,gDAAgD,CAAC;AACxF,OAAO,6BAA6B,MAAM,sDAAsD,CAAC;AACjG,OAAO,0BAA0B,MAAM,gDAAgD,CAAC;AACxF,OAAO,eAAe,MAAM,0BAA0B,CAAC;AACvD,OAAO,wBAAwB,MAAM,4CAA4C,CAAC;AAClF,OAAO,uBAAuB,MAAM,0CAA0C,CAAC;AAC/E,OAAO,aAAa,MAAM,sBAAsB,CAAC;AACjD,OAAO,qBAAqB,MAAM,sCAAsC,CAAC;AAEzE;;;;GAIG;AACH,MAAqB,8BAA8B;IAY1C,MAAM,CAAC,YAAY,CACxB,QAA6D;QAE7D,MAAM,SAAS,GAAuC,IAAI,CAAC,UAAU,CAAC,IAAI,CACxE,CAAC,SAAiC,EAAW,EAAE;YAC7C,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACzC,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,2DAA2D,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CACpF,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,sBAAsB;QAClC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CACxB,CAAC,SAAiC,EAAkC,EAAE;YACpE,OAAO,SAAS,CAAC,QAAQ,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC;;AAnCc,yCAAU,GAAkC;IACzD,IAAI,0BAA0B,EAAE;IAChC,IAAI,6BAA6B,EAAE;IACnC,IAAI,0BAA0B,EAAE;IAChC,IAAI,eAAe,EAAE;IACrB,IAAI,wBAAwB,EAAE;IAC9B,IAAI,uBAAuB,EAAE;IAC7B,IAAI,aAAa,EAAE;IACnB,IAAI,qBAAqB,EAAE;CAC5B,CAAC;eAViB,8BAA8B"}

package/build/dist/Server/Utils/SecurityEvent/Connectors/Splunk/SplunkClient.js

@@ -0,0 +1,494 @@
+import APIException from "../../../../../Types/Exception/ApiException";
+import BadDataException from "../../../../../Types/Exception/BadDataException";
+import { redactLogString, redactLogValue } from "../../../LogRedaction";
+import ConnectorErrorMessage from "../../ConnectorErrorMessage";
+/*
+ * Splunk REST client for the Splunk Enterprise Security connector.
+ *
+ * Three calls, all verified against Splunk's reference pages:
+ *
+ *  - Who am I: GET {url}/services/authentication/current-context
+ *    (https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/access-endpoints/access-endpoint-descriptions
+ *    — "Get the authenticated session owner username", response keys
+ *    `username`, `roles`, `capabilities`). It is the cheapest request
+ *    that proves a credential is accepted without running a search.
+ *
+ *  - Export search: POST {url}/services/search/v2/jobs/export
+ *    (https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/search-endpoints/search-endpoint-descriptions).
+ *    "Stream search results as they become available. The POST operation
+ *    on this endpoint performs a search identical to a POST to
+ *    search/jobs" — parameters `search` (must start with a command,
+ *    "search ..."), `earliest_time` ("Sets the earliest (inclusive)
+ *    ... time bounds", a UTC epoch value is accepted), `latest_time`
+ *    ("Sets the latest (exclusive) ...") and `output_mode` (json). The
+ *    GET operation "is not available in the v2 iteration"; the v1
+ *    endpoint search/jobs/export "is deprecated as of Splunk Enterprise
+ *    9.0.1", so v2 is tried first and v1 only when v2 answers 404 (a
+ *    pre-9.0 search head).
+ *
+ *    With output_mode=json the export body is newline-delimited JSON,
+ *    one object per line shaped `{"preview":false,"offset":0,"result":
+ *    {...}}` (the final line also carries `"lastrow":true`); preview
+ *    lines are interim results of a non-streaming search and must be
+ *    ignored
+ *    (https://community.splunk.com/t5/Getting-Data-In/REST-API-JSON-output-only-with-quot-result-quot-field-without/td-p/482318).
+ *
+ *    An event search streams newest first, so a plain `| head N` keeps
+ *    the NEWEST rows of a window that holds more than N and the older
+ *    ones can never be reached. A window read therefore sorts first:
+ *    `sort 0 _time` ("If 0 is specified, all results are returned";
+ *    without a count sort stops at 10,000) orders the window ascending,
+ *    the default direction, so `head` keeps the OLDEST rows and the
+ *    connector can report where the next read resumes
+ *    (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.0/search-commands/sort).
+ *
+ *  - Authentication: `Authorization: Bearer <token>` for a Splunk
+ *    authentication token
+ *    (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/authenticate-into-the-splunk-platform-with-tokens/use-authentication-tokens),
+ *    else HTTP basic with username and password, which every management
+ *    port endpoint accepts.
+ *
+ * The search head URL is chosen by the tenant, so every request goes
+ * through the injected ConnectorTransport (the SSRF-guarded
+ * DataSourceHttpFetch in production). Errors are thrown as APIException
+ * with a prefix naming the step, and any echoed body is run through the
+ * log redactor first so a credential can never ride an error message
+ * into lastError or a log sink.
+ */
+const ERROR_PREFIX = "Splunk Enterprise Security";
+/*
+ * Ceiling on rows one export may return. The poller's per-run event bound
+ * is at most this, and the tester asks for one, so a runaway search
+ * string cannot stream an unbounded body into the process.
+ */
+export const SPLUNK_MAX_EXPORT_ROWS = 10000;
+// Every notable carries this when read through the notable index.
+export const SPLUNK_DEFAULT_SEARCH = "index=notable";
+/*
+ * Module-level so the regexes need no inline parentheses: eslint's
+ * wrap-regex and prettier disagree about those and never converge.
+ */
+const TIME_MODIFIER_REGEX = /\b(earliest|latest|index_earliest|index_latest)\s*=/i;
+const HTML_BODY_REGEX = /<html|<!doctype/i;
+export default class SplunkClient {
+    constructor(options) {
+        this.requestCount = 0;
+        /*
+         * Remembered after a v2 404 so a fetch that falls back to v1 does not
+         * pay the failed v2 request again for its count probes.
+         */
+        this.useLegacyExport = false;
+        this.url = SplunkClient.normalizeBaseUrl(options.url);
+        this.apiToken = (options.apiToken || "").trim();
+        this.username = (options.username || "").trim();
+        this.password = options.password || "";
+        this.searchString = SplunkClient.normalizeSearchString(options.searchString);
+        this.transport = options.transport;
+        this.requestTimeoutInMs = options.requestTimeoutInMs;
+        if (!this.apiToken && !(this.username && this.password)) {
+            throw new BadDataException("Splunk needs an authentication token, or a username and password.");
+        }
+    }
+    /*
+     * Accept the URL the way people paste it (trailing slash, mixed case
+     * host) and refuse what would silently break: a query string or
+     * fragment would be glued onto every endpoint path.
+     */
+    static normalizeBaseUrl(raw) {
+        let parsed;
+        try {
+            parsed = new URL((raw || "").trim());
+        }
+        catch (_a) {
+            throw new BadDataException("Splunk management URL must be a URL such as https://splunk.example.com:8089.");
+        }
+        if (parsed.protocol !== "https:") {
+            throw new BadDataException("Splunk management URL must use https (the management port serves TLS by default).");
+        }
+        if (parsed.search || parsed.hash || parsed.username || parsed.password) {
+            throw new BadDataException("Splunk management URL must not contain a query string, fragment or credentials.");
+        }
+        const path = parsed.pathname.replace(/\/+$/, "");
+        return `${parsed.origin}${path}`;
+    }
+    /*
+     * The connector prefixes the SPL with the `search` command itself, so a
+     * pasted "search index=notable" would otherwise become "search search
+     * index=notable" and fail. A generating command ("| tstats ...") can
+     * never follow `search`, and a time modifier inside the string would
+     * silently override the window the poller computed — both are refused
+     * rather than guessed at.
+     */
+    static normalizeSearchString(raw) {
+        let search = (raw || "").trim();
+        if (!search) {
+            search = SPLUNK_DEFAULT_SEARCH;
+        }
+        search = search.replace(/^search\s+/i, "").trim();
+        if (!search || search.startsWith("|")) {
+            throw new BadDataException("Search must be a filter such as index=notable; it cannot start with a pipe or a generating command.");
+        }
+        if (TIME_MODIFIER_REGEX.test(search)) {
+            throw new BadDataException("Search must not contain earliest or latest; the connector sets the time range itself.");
+        }
+        return search;
+    }
+    /*
+     * Outbound requests made so far by this instance: the poller's request
+     * budget counts every call that leaves the process, a v1 fallback
+     * included.
+     */
+    getRequestCount() {
+        return this.requestCount;
+    }
+    buildCurrentContextUrl() {
+        const url = new URL(`${this.url}/services/authentication/current-context`);
+        url.searchParams.set("output_mode", "json");
+        return url.toString();
+    }
+    buildExportUrl(version) {
+        return version === "v2"
+            ? `${this.url}/services/search/v2/jobs/export`
+            : `${this.url}/services/search/jobs/export`;
+    }
+    /*
+     * The SPL sent for a window read: the tenant's selector, every field
+     * (the export of a plain `search` otherwise omits fields the search
+     * did not reference), an ascending `_time` sort when the read must
+     * keep the oldest rows, and a hard row cap so the body is bounded.
+     */
+    buildExportSearch(maxRows, oldestFirst) {
+        /*
+         * The row cap may be the ceiling plus the one probe row exportSearch
+         * adds to observe "there was more"; anything beyond that is refused.
+         */
+        const rows = !Number.isFinite(maxRows) || maxRows < 1
+            ? 1
+            : Math.min(Math.floor(maxRows), SPLUNK_MAX_EXPORT_ROWS + 1);
+        /*
+         * `sort 0`, not `sort`: without a count sort returns at most 10,000
+         * rows, which would silently cap the read below the probe row.
+         */
+        const order = oldestFirst ? " | sort 0 _time" : "";
+        return `search ${this.searchString} | fields *${order} | head ${rows}`;
+    }
+    buildCountSearch() {
+        return `search ${this.searchString} | stats count`;
+    }
+    static clampRows(rows) {
+        if (!Number.isFinite(rows) || rows < 1) {
+            return 1;
+        }
+        return Math.min(Math.floor(rows), SPLUNK_MAX_EXPORT_ROWS);
+    }
+    /*
+     * Window bounds as epoch seconds. earliest_time is inclusive and
+     * latest_time exclusive on Splunk's side, matching ConnectorFetchWindow;
+     * the start is floored and the end ceiled so a sub-second boundary can
+     * only widen the window, never lose a row — duplicates are removed by
+     * the poller's dedupe, a missed row is gone.
+     */
+    static toEpochSeconds(date, roundUp) {
+        const seconds = date.getTime() / 1000;
+        return String(roundUp ? Math.ceil(seconds) : Math.floor(seconds));
+    }
+    buildAuthorizationHeader() {
+        if (this.apiToken) {
+            return `Bearer ${this.apiToken}`;
+        }
+        return `Basic ${Buffer.from(`${this.username}:${this.password}`).toString("base64")}`;
+    }
+    /*
+     * Proves the credential is accepted and reports who Splunk thinks the
+     * caller is, so the test report can name the user and roles the tenant
+     * should compare against the role they meant to grant.
+     */
+    async getCurrentContext() {
+        const response = await this.send("authentication request", {
+            method: "GET",
+            url: this.buildCurrentContextUrl(),
+            headers: this.buildHeaders(),
+            timeoutInMs: this.requestTimeoutInMs,
+            egressOptions: { targetLabel: "Splunk" },
+        });
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+            throw new APIException(`${ERROR_PREFIX} authentication request failed (HTTP ${response.statusCode}): ${SplunkClient.redactErrorBody(response.bodyText)}` +
+                SplunkClient.describeFailure(response.statusCode, response));
+        }
+        const json = SplunkClient.parseJsonBody(response);
+        if (!SplunkClient.isJsonObject(json)) {
+            throw new APIException(`${ERROR_PREFIX} authentication request returned a non-JSON body.` +
+                SplunkClient.describeNonJsonBody(response.bodyText));
+        }
+        const entries = json["entry"];
+        const first = Array.isArray(entries)
+            ? entries[0]
+            : undefined;
+        const content = SplunkClient.isJsonObject(first)
+            ? first["content"]
+            : undefined;
+        if (!SplunkClient.isJsonObject(content)) {
+            throw new APIException(`${ERROR_PREFIX} authentication request returned an unrecognized response shape: ${SplunkClient.redactErrorBody(response.bodyText)}`);
+        }
+        return {
+            username: String(content["username"] || ""),
+            roles: SplunkClient.stringArray(content["roles"]),
+            capabilities: SplunkClient.stringArray(content["capabilities"]),
+        };
+    }
+    /*
+     * Rows the search returns in [startTime, endTime), at most maxResults,
+     * oldest first unless the caller opts out. One extra row is requested
+     * so "there was more" is observed rather than inferred from a full
+     * page.
+     */
+    async exportSearch(data) {
+        const cap = SplunkClient.clampRows(data.maxResults);
+        const probe = Math.min(cap + 1, SPLUNK_MAX_EXPORT_ROWS + 1);
+        const oldestFirst = data.oldestFirst !== false;
+        const { rows, apiVersion } = await this.runExport("search export", this.buildExportSearch(probe, oldestFirst), data.startTime, data.endTime);
+        return {
+            results: rows.slice(0, cap),
+            truncated: rows.length > cap,
+            apiVersion,
+        };
+    }
+    /*
+     * How many rows the search matches in the range. `stats count` is a
+     * single-row transforming search, so the answer is bounded by
+     * construction; Splunk does the counting.
+     */
+    async countSearch(data) {
+        const { rows } = await this.runExport("count search", this.buildCountSearch(), data.startTime, data.endTime);
+        const first = rows[0];
+        const count = first ? Number(first["count"]) : 0;
+        if (!Number.isFinite(count) || count < 0) {
+            throw new APIException(`${ERROR_PREFIX} count search returned an unrecognized response shape: ${redactLogString(JSON.stringify(rows.slice(0, 3)))}`);
+        }
+        return { count };
+    }
+    async runExport(step, search, startTime, endTime) {
+        const body = {
+            search,
+            earliest_time: SplunkClient.toEpochSeconds(startTime, false),
+            latest_time: SplunkClient.toEpochSeconds(endTime, true),
+            output_mode: "json",
+        };
+        let apiVersion = this.useLegacyExport ? "v1" : "v2";
+        let response = await this.sendExport(step, apiVersion, body);
+        /*
+         * A 404 on the v2 path is a search head older than 9.0, where only
+         * the original endpoint exists. Anything else on v2 is a real answer
+         * and is reported as such.
+         */
+        if (response.statusCode === 404 && apiVersion === "v2") {
+            this.useLegacyExport = true;
+            apiVersion = "v1";
+            response = await this.sendExport(step, apiVersion, body);
+        }
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+            throw new APIException(`${ERROR_PREFIX} ${step} failed (HTTP ${response.statusCode}): ${SplunkClient.redactErrorBody(response.bodyText)}` +
+                SplunkClient.describeFailure(response.statusCode, response));
+        }
+        return { rows: this.parseExportBody(step, response.bodyText), apiVersion };
+    }
+    async sendExport(step, apiVersion, body) {
+        return this.send(step, {
+            method: "POST",
+            url: this.buildExportUrl(apiVersion),
+            headers: this.buildHeaders(),
+            body,
+            formUrlEncoded: true,
+            timeoutInMs: this.requestTimeoutInMs,
+            egressOptions: { targetLabel: "Splunk" },
+        });
+    }
+    /*
+     * Newline-delimited JSON, one object per line. An empty body is a
+     * legitimate "no rows" answer for an export. A line that is not JSON
+     * means the URL points at something other than the management port
+     * (Splunk Web on 8000 answers HTML) and is reported, not skipped —
+     * treating an unreadable body as an empty window would move the
+     * cursor past whatever it held.
+     */
+    parseExportBody(step, bodyText) {
+        const rows = [];
+        const lines = (bodyText || "").split(/\r?\n/);
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed) {
+                continue;
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(trimmed);
+            }
+            catch (_a) {
+                throw new APIException(`${ERROR_PREFIX} ${step} returned a body that is not newline-delimited JSON.` +
+                    SplunkClient.describeNonJsonBody(bodyText));
+            }
+            if (!SplunkClient.isJsonObject(parsed)) {
+                continue;
+            }
+            /*
+             * Splunk can answer 200 and put the search failure inside the
+             * stream as a message line; that is a rejection, not an empty
+             * window.
+             */
+            const fatal = SplunkClient.findFatalMessage(parsed);
+            if (fatal) {
+                throw new APIException(`${ERROR_PREFIX} ${step} was rejected by Splunk on an HTTP 200: ${redactLogString(fatal)}`);
+            }
+            if (parsed["preview"] === true) {
+                continue;
+            }
+            const result = parsed["result"];
+            if (SplunkClient.isJsonObject(result)) {
+                rows.push(result);
+            }
+        }
+        return rows;
+    }
+    static findFatalMessage(row) {
+        const messages = row["messages"];
+        if (!Array.isArray(messages)) {
+            return "";
+        }
+        for (const message of messages) {
+            if (!SplunkClient.isJsonObject(message)) {
+                continue;
+            }
+            const type = String(message["type"] || "").toUpperCase();
+            if (type === "FATAL" || type === "ERROR") {
+                return String(message["text"] || type);
+            }
+        }
+        return "";
+    }
+    buildHeaders() {
+        return {
+            Authorization: this.buildAuthorizationHeader(),
+            Accept: "application/json",
+        };
+    }
+    /*
+     * One place every request leaves through. DataSourceHttpFetch throws
+     * BadDataException("Data source responded with HTTP <status>: <body>")
+     * for any non-2xx answer, so that shape is folded back into a response
+     * here and the status-specific messages above stay the only ones an
+     * operator sees. Anything else (timeout, DNS, refused egress) is a
+     * transport failure named as such.
+     */
+    async send(step, request) {
+        this.requestCount++;
+        try {
+            return await this.transport(request);
+        }
+        catch (error) {
+            const message = ConnectorErrorMessage.toMessage(error, {
+                truncate: false,
+            });
+            const match = message.match(/^Data source responded with HTTP (\d{3}): ?([\s\S]*)$/);
+            if (match) {
+                const bodyText = match[2] || "";
+                let bodyJson = undefined;
+                try {
+                    bodyJson = JSON.parse(bodyText);
+                }
+                catch (_a) {
+                    bodyJson = undefined;
+                }
+                return {
+                    statusCode: Number(match[1]),
+                    bodyText,
+                    bodyJson,
+                    headers: {},
+                };
+            }
+            throw new APIException(`${ERROR_PREFIX} ${step} did not complete: ${redactLogString(message)}`);
+        }
+    }
+    static parseJsonBody(response) {
+        if (response.bodyJson !== undefined) {
+            return response.bodyJson;
+        }
+        try {
+            return JSON.parse(response.bodyText || "");
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    static isJsonObject(value) {
+        return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+    }
+    static stringArray(value) {
+        if (!Array.isArray(value)) {
+            return [];
+        }
+        return value
+            .filter((item) => {
+            return typeof item === "string" || typeof item === "number";
+        })
+            .map((item) => {
+            return String(item);
+        });
+    }
+    /*
+     * Decode the outer JSON before redacting so a credential-bearing string
+     * nested inside a message cannot slip past the textual redactor via
+     * escaped quotes.
+     */
+    static redactErrorBody(body) {
+        if (!body) {
+            return "";
+        }
+        try {
+            return JSON.stringify(redactLogValue(JSON.parse(body)));
+        }
+        catch (_a) {
+            return redactLogString(body);
+        }
+    }
+    static describeNonJsonBody(body) {
+        if (HTML_BODY_REGEX.test(body || "")) {
+            return " Splunk answered with HTML, which is what Splunk Web (port 8000) returns; the Splunk management URL must point at the management port, usually 8089.";
+        }
+        return "";
+    }
+    /*
+     * Splunk's error body is { messages: [{ type, text }] }; the text is
+     * echoed (redacted) above, the status decides the hint.
+     */
+    static describeFailure(status, response) {
+        let hint = "";
+        if (status === 401) {
+            hint =
+                "Splunk did not accept the credentials. The authentication token is wrong, expired or revoked, or the username and password are wrong. Token authentication must also be enabled on the search head (Settings > Tokens).";
+        }
+        else if (status === 403) {
+            hint =
+                "Splunk accepted the credentials but the user's role lacks what this needs: the search capability and access to the searched index (index=notable for Splunk Enterprise Security).";
+        }
+        else if (status === 404) {
+            hint =
+                "Splunk did not find the endpoint. The Splunk management URL must be the search head's management port (usually 8089) with no extra path; Splunk Web on port 8000 does not serve the REST API.";
+        }
+        else if (status === 429) {
+            const retryAfter = (response.headers || {})["retry-after"] || "";
+            hint = retryAfter
+                ? `Splunk throttled the request; it asked to retry after ${redactLogString(retryAfter)} seconds. The next poll retries the same window.`
+                : "Splunk throttled the request. The next poll retries the same window.";
+        }
+        else if (status >= 500) {
+            hint =
+                "Splunk reported a server-side error (a search head under load, or a search that hit a limit). The next poll retries the same window.";
+        }
+        else if (status === 400) {
+            hint =
+                "Splunk rejected the search. Check the Search setting for a syntax error; the connector only adds the time range, `| fields *`, `| sort 0 _time` and `| head`.";
+        }
+        return hint ? ` — ${hint}` : "";
+    }
+}
+//# sourceMappingURL=SplunkClient.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/Splunk/SplunkClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SplunkClient.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/SecurityEvent/Connectors/Splunk/SplunkClient.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,6CAA6C,CAAC;AACvE,OAAO,gBAAgB,MAAM,iDAAiD,CAAC;AAO/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,qBAAqB,MAAM,6BAA6B,CAAC;AAGhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,MAAM,YAAY,GAAW,4BAA4B,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAW,KAAK,CAAC;AAEpD,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAW,eAAe,CAAC;AAE7D;;;GAGG;AACH,MAAM,mBAAmB,GACvB,sDAAsD,CAAC;AACzD,MAAM,eAAe,GAAW,kBAAkB,CAAC;AAiDnD,MAAM,CAAC,OAAO,OAAO,YAAY;IAiB/B,YAAmB,OAA4B;QARvC,iBAAY,GAAW,CAAC,CAAC;QAEjC;;;WAGG;QACK,oBAAe,GAAY,KAAK,CAAC;QAGvC,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,qBAAqB,CACpD,OAAO,CAAC,YAAY,CACrB,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAErD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,gBAAgB,CACxB,mEAAmE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,gBAAgB,CAAC,GAAW;QACxC,IAAI,MAAW,CAAC;QAEhB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CACxB,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,gBAAgB,CACxB,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvE,MAAM,IAAI,gBAAgB,CACxB,iFAAiF,CAClF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAW,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEzD,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;IACnC,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,qBAAqB,CAAC,GAAW;QAC7C,IAAI,MAAM,GAAW,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAExC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,qBAAqB,CAAC;QACjC,CAAC;QAED,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAElD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,gBAAgB,CACxB,qGAAqG,CACtG,CAAC;QACJ,CAAC;QAED,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,gBAAgB,CACxB,uFAAuF,CACxF,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACI,eAAe;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEM,sBAAsB;QAC3B,MAAM,GAAG,GAAQ,IAAI,GAAG,CACtB,GAAG,IAAI,CAAC,GAAG,0CAA0C,CACtD,CAAC;QACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEM,cAAc,CAAC,OAAoB;QACxC,OAAO,OAAO,KAAK,IAAI;YACrB,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,iCAAiC;YAC9C,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,8BAA8B,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACI,iBAAiB,CAAC,OAAe,EAAE,WAAoB;QAC5D;;;WAGG;QACH,MAAM,IAAI,GACR,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;YACtC,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,CAAC,CAAC,CAAC;QAEhE;;;WAGG;QACH,MAAM,KAAK,GAAW,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;QAE3D,OAAO,UAAU,IAAI,CAAC,YAAY,cAAc,KAAK,WAAW,IAAI,EAAE,CAAC;IACzE,CAAC;IAEM,gBAAgB;QACrB,OAAO,UAAU,IAAI,CAAC,YAAY,gBAAgB,CAAC;IACrD,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,IAAY;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,cAAc,CAAC,IAAU,EAAE,OAAgB;QACvD,MAAM,OAAO,GAAW,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,CAAC;IAEM,wBAAwB;QAC7B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnC,CAAC;QAED,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,iBAAiB;QAC5B,MAAM,QAAQ,GAA2B,MAAM,IAAI,CAAC,IAAI,CACtD,wBAAwB,EACxB;YACE,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,IAAI,CAAC,sBAAsB,EAAE;YAClC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,WAAW,EAAE,IAAI,CAAC,kBAAkB;YACpC,aAAa,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;SACzC,CACF,CAAC;QAEF,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,wCAAwC,QAAQ,CAAC,UAAU,MAAM,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBAC/H,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC9D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAc,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,mDAAmD;gBAChE,YAAY,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACtD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAc,IAAI,CAAC,OAAO,CAAc,CAAC;QACtD,MAAM,KAAK,GAA0B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACzD,CAAC,CAAE,OAAqB,CAAC,CAAC,CAAC;YAC3B,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GAA0B,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC;YACrE,CAAC,CAAE,KAAK,CAAC,SAAS,CAAe;YACjC,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,oEAAoE,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CACrI,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC3C,KAAK,EAAE,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAc,CAAC;YAC9D,YAAY,EAAE,YAAY,CAAC,WAAW,CACpC,OAAO,CAAC,cAAc,CAAc,CACrC;SACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,YAAY,CACvB,IAAyB;QAEzB,MAAM,GAAG,GAAW,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAW,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,sBAAsB,GAAG,CAAC,CAAC,CAAC;QACpE,MAAM,WAAW,GAAY,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC;QAExD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/C,eAAe,EACf,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,EAC1C,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,CACb,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC3B,SAAS,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG;YAC5B,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CAAC,IAGxB;QACC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CACnC,cAAc,EACd,IAAI,CAAC,gBAAgB,EAAE,EACvB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,CACb,CAAC;QAEF,MAAM,KAAK,GAA2B,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAW,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,0DAA0D,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAC7H,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,IAAY,EACZ,MAAc,EACd,SAAe,EACf,OAAa;QAEb,MAAM,IAAI,GAAuB;YAC/B,MAAM;YACN,aAAa,EAAE,YAAY,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC;YAC5D,WAAW,EAAE,YAAY,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;YACvD,WAAW,EAAE,MAAM;SACpB,CAAC;QAEF,IAAI,UAAU,GAAgB,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,QAAQ,GAA2B,MAAM,IAAI,CAAC,UAAU,CAC1D,IAAI,EACJ,UAAU,EACV,IAAI,CACL,CAAC;QAEF;;;;WAIG;QACH,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACvD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,UAAU,GAAG,IAAI,CAAC;YAClB,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,IAAI,IAAI,iBAAiB,QAAQ,CAAC,UAAU,MAAM,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBAChH,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC9D,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAY,EACZ,UAAuB,EACvB,IAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;YACpC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI;YACJ,cAAc,EAAE,IAAI;YACpB,WAAW,EAAE,IAAI,CAAC,kBAAkB;YACpC,aAAa,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;SACzC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CAAC,IAAY,EAAE,QAAgB;QACpD,MAAM,IAAI,GAAsB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAkB,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAW,IAAI,CAAC,IAAI,EAAE,CAAC;YAEpC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YAED,IAAI,MAAiB,CAAC;YAEtB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;YAC5C,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,IAAI,IAAI,sDAAsD;oBAC3E,YAAY,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAC7C,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,SAAS;YACX,CAAC;YAED;;;;eAIG;YACH,MAAM,KAAK,GAAW,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAE5D,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,IAAI,IAAI,2CAA2C,eAAe,CAAC,KAAK,CAAC,EAAE,CAC3F,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/B,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAc,MAAM,CAAC,QAAQ,CAAc,CAAC;YAExD,IAAI,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,GAAe;QAC7C,MAAM,QAAQ,GAAc,GAAG,CAAC,UAAU,CAAc,CAAC;QAEzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,QAAqB,EAAE,CAAC;YAC5C,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxC,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAEjE,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,YAAY;QAClB,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,wBAAwB,EAAE;YAC9C,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,OAA8B;QAE9B,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAW,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE;gBAC7D,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,MAAM,KAAK,GAA4B,OAAO,CAAC,KAAK,CAClD,uDAAuD,CACxD,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,IAAI,QAAQ,GAAY,SAAS,CAAC;gBAElC,IAAI,CAAC;oBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClC,CAAC;gBAAC,WAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;gBAED,OAAO;oBACL,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC5B,QAAQ;oBACR,QAAQ;oBACR,OAAO,EAAE,EAAE;iBACZ,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,YAAY,CACpB,GAAG,YAAY,IAAI,IAAI,sBAAsB,eAAe,CAAC,OAAO,CAAC,EAAE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,aAAa,CAAC,QAAgC;QAC3D,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,QAAqB,CAAC;QACxC,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAc,CAAC;QAC1D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,KAAc;QACxC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,KAAgB;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAQ,KAAmB;aACxB,MAAM,CAAC,CAAC,IAAe,EAAW,EAAE;YACnC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC9D,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,IAAe,EAAU,EAAE;YAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,eAAe,CAAC,IAAY;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,mBAAmB,CAAC,IAAY;QAC7C,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YACrC,OAAO,sJAAsJ,CAAC;QAChK,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,eAAe,CAC5B,MAAc,EACd,QAAgC;QAEhC,IAAI,IAAI,GAAW,EAAE,CAAC;QAEtB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI;gBACF,yNAAyN,CAAC;QAC9N,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,mLAAmL,CAAC;QACxL,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,+LAA+L,CAAC;QACpM,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAW,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACzE,IAAI,GAAG,UAAU;gBACf,CAAC,CAAC,yDAAyD,eAAe,CAAC,UAAU,CAAC,kDAAkD;gBACxI,CAAC,CAAC,sEAAsE,CAAC;QAC7E,CAAC;aAAM,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,IAAI;gBACF,sIAAsI,CAAC;QAC3I,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,+JAA+J,CAAC;QACpK,CAAC;QAED,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;CACF"}