@oneuptime/common 14.0.9 → 14.0.10

package/build/dist/Server/Utils/AI/ResourceAccess/ResourceAiAccessSettings.js

@@ -0,0 +1,640 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import UserService from "../../../Services/UserService";
+import QueryHelper from "../../../Types/Database/QueryHelper";
+import logger from "../../Logger";
+import { holdsAnyPermission } from "../../Runbook/RunbookExecutePermission";
+import CaptureSpan from "../../Telemetry/CaptureSpan";
+import { RESOURCE_AI_ACCESS_ADMIN_PERMISSIONS, RESOURCE_AI_ALLOWLIST_EXAMPLES, RESOURCE_AI_REMEDIATION_MODE_LABELS, getResourceAiAccessAdminRefusal, getResourceSentenceName, } from "../../../../Types/AI/ResourceAiAccessPermissions";
+import { Gray500, Yellow500 } from "../../../../Types/BrandColors";
+import LIMIT_MAX from "../../../../Types/Database/LimitMax";
+import OneUptimeDate from "../../../../Types/Date";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../../../Types/Exception/NotAuthorizedException";
+import { AI_RESOURCE_TYPE_INFO, } from "../../../../Types/ResourceAiAgent/AiResourceType";
+import { ResourceAiRemediationMode } from "../../../../Types/ResourceAiAgent/ResourceAiAccess";
+import ResourceCommandPolicy, { RESOURCE_ALLOWLIST_MAX_PATTERNS, } from "../../../../Utils/AiRemediation/Resource/ResourceCommandPolicy";
+/*
+ * The rules for an operator's write of a resource's OneUptime AI access
+ * settings — shared by every resource a resource AI agent serves (Docker,
+ * Podman and Docker Swarm hosts, Proxmox clusters, VMware vCenters, Ceph
+ * clusters, database servers and hosts), whose services call it from their
+ * create and update hooks. The same rules KubernetesClusterService applies
+ * to a cluster (getAiAccessLoosening and friends), minus the Runner and
+ * credential bindings a resource AI agent never has:
+ *
+ * - validation: the remediation mode must be a ResourceAiRemediationMode
+ *   value, and the command allowlist a list of at most
+ *   RESOURCE_ALLOWLIST_MAX_PATTERNS entries that
+ *   ResourceCommandPolicy.describeAllowlistPatternProblem accepts for the
+ *   resource's type (the ONE definition of a valid entry, which the matcher
+ *   and the dashboard share). Refused rather than stored: every reader fails
+ *   safe on an unusable value, so storing one would answer an API or
+ *   Terraform write with success for a setting that never takes effect;
+ * - who may make AI do MORE (any move of the mode up — Off to anything, up to
+ *   Automatic or Bypass approval — or adding an allowlist pattern): the
+ *   holders of RESOURCE_AI_ACCESS_ADMIN_PERMISSIONS, the people who may
+ *   author a FullAuto auto-remediation rule. Making AI do less, and the
+ *   investigation switch, stay open to every editor of the resource;
+ * - the aiAccess* columns (aiAccessConfiguredAt, aiAccessLastVerifiedAt,
+ *   aiAccessLastError) are the server's own and refused on every write but
+ *   the server's (root);
+ * - after an operator's write of any AI setting succeeded: the resource is
+ *   marked AI-configured (aiAccessConfiguredAt, never cleared — a resource
+ *   AI agent registering later then leaves every setting as chosen) and the
+ *   change is recorded on the resource's feed.
+ *
+ * Root writes — an agent's first-connection defaults, the outcome
+ * bookkeeping after each command — are the server's own and are validated
+ * but never gated, marked or recorded here.
+ */
+// Every AI access setting an operator can write (dashboard, API, Terraform).
+export const RESOURCE_AI_ACCESS_SETTING_KEYS = [
+    "isAiInvestigationEnabled",
+    "aiRemediationMode",
+    "aiCommandAllowlist",
+];
+// Written only by the server: refused on every write that is not root.
+export const RESOURCE_AI_ACCESS_SERVER_ONLY_KEYS = [
+    "aiAccessConfiguredAt",
+    "aiAccessLastVerifiedAt",
+    "aiAccessLastError",
+];
+/*
+ * How much each remediation mode lets OneUptime AI do without a human,
+ * least first. Automatic runs a strict subset of what Bypass approval runs
+ * (safe changes and allowlisted shapes, never an unlisted riskier change),
+ * so moving from Bypass approval to Automatic is a tightening.
+ */
+export const RESOURCE_REMEDIATION_MODES_BY_AUTONOMY = [
+    ResourceAiRemediationMode.Disabled,
+    ResourceAiRemediationMode.RequireApproval,
+    ResourceAiRemediationMode.Automatic,
+    ResourceAiRemediationMode.BypassApproval,
+];
+/*
+ * What a resource that was never AI-configured has: the column defaults
+ * (investigation off, remediation Disabled, no allowlist).
+ */
+export const NEVER_CONFIGURED_RESOURCE_AI_ACCESS = {
+    isAiInvestigationEnabled: false,
+    aiRemediationMode: ResourceAiRemediationMode.Disabled,
+    aiCommandAllowlist: [],
+};
+// The columns the settings snapshot reads off a resource row.
+const SETTINGS_SELECT = {
+    _id: true,
+    projectId: true,
+    isAiInvestigationEnabled: true,
+    aiRemediationMode: true,
+    aiCommandAllowlist: true,
+};
+// Undefined is an omitted property; null is an explicit clear, so a write.
+function isAnyKeyWritten(data, keys) {
+    return keys.some((key) => {
+        return data[key] !== undefined;
+    });
+}
+function describePatternCount(count) {
+    if (count === 0) {
+        return "none";
+    }
+    return `${count} pattern${count === 1 ? "" : "s"}`;
+}
+function isSameAllowlist(left, right) {
+    return (left.length === right.length &&
+        left.every((pattern, index) => {
+            return pattern === right[index];
+        }));
+}
+export default class ResourceAiAccessSettings {
+    // Whether a write carries any AI access setting (null counts: it clears).
+    static isSettingWritten(data) {
+        return isAnyKeyWritten(data, RESOURCE_AI_ACCESS_SETTING_KEYS);
+    }
+    /*
+     * Why a write that is not the server's may not carry one of the aiAccess*
+     * columns, or null when it carries none. The column ACLs already refuse
+     * them to every role; this also covers the callers those checks let
+     * through (a master admin, an API that skips them), because a hand-set
+     * aiAccessConfiguredAt would make an agent skip its first-connection
+     * defaults and a hand-set "Last verified" would claim access nobody saw
+     * work.
+     */
+    static getServerOnlyColumnRefusal(data) {
+        const written = RESOURCE_AI_ACCESS_SERVER_ONLY_KEYS.filter((key) => {
+            return data[key] !== undefined;
+        });
+        if (written.length === 0) {
+            return null;
+        }
+        return `${written.join(", ")} ${written.length === 1 ? "is" : "are"} written by OneUptime itself and cannot be set through the API.`;
+    }
+    // A mode as the readers see it: anything unknown is Disabled.
+    static readStoredMode(value) {
+        return RESOURCE_REMEDIATION_MODES_BY_AUTONOMY.includes(value)
+            ? value
+            : ResourceAiRemediationMode.Disabled;
+    }
+    /*
+     * A stored allowlist as the readers see it: trimmed non-empty strings, a
+     * JSON-encoded array accepted, anything else empty.
+     */
+    static readStoredAllowlist(value) {
+        let raw = value;
+        if (typeof raw === "string") {
+            try {
+                raw = JSON.parse(raw);
+            }
+            catch (_a) {
+                raw = [value];
+            }
+        }
+        if (!Array.isArray(raw)) {
+            return [];
+        }
+        return raw
+            .filter((pattern) => {
+            return typeof pattern === "string" && pattern.trim().length > 0;
+        })
+            .map((pattern) => {
+            return pattern.trim();
+        });
+    }
+    static getAllowlistShapeHint(resourceType) {
+        var _a;
+        const programs = (((_a = AI_RESOURCE_TYPE_INFO[resourceType]) === null || _a === void 0 ? void 0 : _a.programs) || []).join(", ");
+        return `The AI command allowlist must be a JSON array of command patterns for this ${getResourceSentenceName(resourceType)}'s AI agent (${programs}), for example ["${RESOURCE_AI_ALLOWLIST_EXAMPLES[resourceType] || ""}"].`;
+    }
+    /*
+     * What an operator's allowlist write stores: null (no allowlist) or an
+     * array of trimmed patterns the matcher can actually use. Refused, with the
+     * entry and the rule it broke:
+     *
+     * - anything but an array (a JSON-encoded array in a string is accepted,
+     *   the form the readers already understand, and stored as the array);
+     * - an entry that is not text;
+     * - more than RESOURCE_ALLOWLIST_MAX_PATTERNS entries — the matcher skips
+     *   every pattern past that silently;
+     * - an entry ResourceCommandPolicy.describeAllowlistPatternProblem says
+     *   can never pre-approve a change on this resource type (blank, too long,
+     *   not one command, another program, a read, a Denied command, ...).
+     */
+    static normalizeAllowlistForWrite(data) {
+        let raw = data.value;
+        if (raw === null) {
+            return null;
+        }
+        if (typeof raw === "string") {
+            if (raw.trim().length === 0) {
+                return null;
+            }
+            try {
+                raw = JSON.parse(raw);
+            }
+            catch (_a) {
+                throw new BadDataException(ResourceAiAccessSettings.getAllowlistShapeHint(data.resourceType));
+            }
+        }
+        if (!Array.isArray(raw)) {
+            throw new BadDataException(ResourceAiAccessSettings.getAllowlistShapeHint(data.resourceType));
+        }
+        if (raw.length > RESOURCE_ALLOWLIST_MAX_PATTERNS) {
+            throw new BadDataException(`The AI command allowlist can hold at most ${RESOURCE_ALLOWLIST_MAX_PATTERNS} patterns (got ${raw.length}).`);
+        }
+        return raw.map((entry, index) => {
+            const position = `Pattern ${index + 1} of the AI command allowlist`;
+            if (typeof entry !== "string") {
+                throw new BadDataException(`${position} must be text (got ${entry === null ? "null" : typeof entry}). ${ResourceAiAccessSettings.getAllowlistShapeHint(data.resourceType)}`);
+            }
+            // Stored trimmed, so it is judged exactly as it will be read.
+            const pattern = entry.trim();
+            const problem = ResourceCommandPolicy.describeAllowlistPatternProblem({
+                resourceType: data.resourceType,
+                pattern,
+            });
+            if (problem) {
+                throw new BadDataException(`${position} cannot be used: ${problem.endsWith(".") ? problem : `${problem}.`} Patterns are compared with the command word by word; * stands for exactly one whole word.`);
+            }
+            return pattern;
+        });
+    }
+    /*
+     * Refuse an unknown mode and store the allowlist in the one shape its
+     * readers expect. Runs on every write, the server's included, and
+     * normalizes `data` in place.
+     */
+    static validateSettings(data) {
+        const mode = data.data["aiRemediationMode"];
+        if (mode !== undefined &&
+            !RESOURCE_REMEDIATION_MODES_BY_AUTONOMY.includes(mode)) {
+            throw new BadDataException(`AI remediation mode must be one of ${RESOURCE_REMEDIATION_MODES_BY_AUTONOMY.join(", ")} (got ${JSON.stringify(mode)}).`);
+        }
+        if (data.data["aiCommandAllowlist"] !== undefined) {
+            data.data["aiCommandAllowlist"] =
+                ResourceAiAccessSettings.normalizeAllowlistForWrite({
+                    resourceType: data.resourceType,
+                    value: data.data["aiCommandAllowlist"],
+                });
+        }
+    }
+    /*
+     * Does this write let AI do more on a resource whose settings are
+     * `current`? Only a real change counts: the AI agent page posts every
+     * field of its form, so an editor who only flips the investigation switch
+     * re-posts an unchanged mode and allowlist, and must not be refused for
+     * settings someone else chose.
+     *
+     * - mode: ANY move up — turning fixes on from Off (even to Ask for
+     *   approval: that is the step that lets AI change the resource at all),
+     *   or up to Automatic or Bypass approval. Moving down (Bypass approval ->
+     *   Automatic, anything -> Off) tightens;
+     * - allowlist: adding a pattern the resource did not already have
+     *   (removing patterns, or clearing the list, tightens).
+     *
+     * `data` has been through validateSettings, so the mode is a known value
+     * and the allowlist a trimmed array or null.
+     */
+    static getLoosening(data) {
+        let loosens = false;
+        const mode = data.data["aiRemediationMode"];
+        if (mode !== undefined &&
+            mode !== null &&
+            RESOURCE_REMEDIATION_MODES_BY_AUTONOMY.indexOf(ResourceAiAccessSettings.readStoredMode(mode)) >
+                RESOURCE_REMEDIATION_MODES_BY_AUTONOMY.indexOf(data.current.aiRemediationMode)) {
+            loosens = true;
+        }
+        if (data.data["aiCommandAllowlist"] !== undefined) {
+            const patterns = ResourceAiAccessSettings.readStoredAllowlist(data.data["aiCommandAllowlist"]);
+            if (patterns.some((pattern) => {
+                return !data.current.aiCommandAllowlist.includes(pattern);
+            })) {
+                loosens = true;
+            }
+        }
+        return { loosens };
+    }
+    /*
+     * Why this caller may not make this write, or null when they may. A
+     * resource's AI mode does the job of a FullAuto AutoRemediationRule with
+     * no rule row, so making AI do MORE takes the same permissions as
+     * authoring such a rule (RESOURCE_AI_ACCESS_ADMIN_PERMISSIONS). The
+     * column ACLs stay open to every editor of the resource on purpose: a
+     * column ACL cannot say "tightening is free", and turning AI remediation
+     * off must never need more than editing the resource.
+     *
+     * `current` holds the settings of every resource the write reaches, and
+     * the permission must be held in each one's own project. When it matched
+     * none, the write is judged against the never-configured defaults in the
+     * caller's tenant, so the answer does not depend on whether the id exists;
+     * with no project to check against at all it fails closed.
+     *
+     * Root and master admins are the caller's business (see checkUpdate).
+     */
+    static getLooseningRefusal(data) {
+        const baselines = data.current.length > 0
+            ? data.current
+            : [
+                Object.assign(Object.assign({}, NEVER_CONFIGURED_RESOURCE_AI_ACCESS), { projectId: data.props.tenantId }),
+            ];
+        for (const baseline of baselines) {
+            if (!ResourceAiAccessSettings.getLoosening({
+                data: data.data,
+                current: baseline,
+            }).loosens) {
+                continue;
+            }
+            if (!baseline.projectId ||
+                !holdsAnyPermission({
+                    props: data.props,
+                    projectId: baseline.projectId,
+                    allowed: RESOURCE_AI_ACCESS_ADMIN_PERMISSIONS,
+                })) {
+                return getResourceAiAccessAdminRefusal(data.resourceType);
+            }
+        }
+        return null;
+    }
+    /*
+     * The whole update-hook rule, for a resource service's onBeforeUpdate:
+     * validate (every caller), refuse the server-only columns and gate a
+     * loosening (every caller but root; a master admin is not gated on who
+     * may loosen, as on a Kubernetes cluster). Returns the carry-forward for
+     * onUpdateSuccess — the settings as they stood — for an operator's write
+     * of an AI setting, else null.
+     */
+    static async checkUpdate(data) {
+        const updateData = (data.updateBy.data ||
+            {});
+        ResourceAiAccessSettings.validateSettings({
+            resourceType: data.resourceType,
+            data: updateData,
+        });
+        if (data.updateBy.props.isRoot) {
+            return null;
+        }
+        const serverOnlyRefusal = ResourceAiAccessSettings.getServerOnlyColumnRefusal(updateData);
+        if (serverOnlyRefusal) {
+            throw new NotAuthorizedException(serverOnlyRefusal);
+        }
+        if (!ResourceAiAccessSettings.isSettingWritten(updateData)) {
+            return null;
+        }
+        const previousResourceAiAccessSettings = await ResourceAiAccessSettings.readSettingsForUpdateQuery({
+            service: data.service,
+            updateBy: data.updateBy,
+        });
+        if (!data.updateBy.props.isMasterAdmin) {
+            const refusal = ResourceAiAccessSettings.getLooseningRefusal({
+                resourceType: data.resourceType,
+                data: updateData,
+                props: data.updateBy.props,
+                current: Object.values(previousResourceAiAccessSettings),
+            });
+            if (refusal) {
+                throw new NotAuthorizedException(refusal);
+            }
+        }
+        return {
+            resourceType: data.resourceType,
+            previousResourceAiAccessSettings,
+        };
+    }
+    /*
+     * The same rule for a resource service's onBeforeCreate, judged against
+     * the never-configured defaults a new resource starts from (as
+     * KubernetesClusterService.onBeforeCreate judges a new cluster): validate
+     * (every caller, root included), refuse the server-only columns (every
+     * caller but root — a master admin included, whom the create column ACLs
+     * never check) and gate a loosening (every caller but root and master
+     * admins). The create column ACLs of the AI columns are empty, so a
+     * user's create cannot carry them today and the gate is defence in depth.
+     * Normalizes the allowlist in `createBy.data` in place.
+     */
+    static checkCreate(data) {
+        const createData = (data.createBy.data ||
+            {});
+        const props = data.createBy.props;
+        ResourceAiAccessSettings.validateSettings({
+            resourceType: data.resourceType,
+            data: createData,
+        });
+        if (props.isRoot) {
+            return;
+        }
+        const serverOnlyRefusal = ResourceAiAccessSettings.getServerOnlyColumnRefusal(createData);
+        if (serverOnlyRefusal) {
+            throw new NotAuthorizedException(serverOnlyRefusal);
+        }
+        if (props.isMasterAdmin ||
+            !ResourceAiAccessSettings.isSettingWritten(createData)) {
+            return;
+        }
+        // The tenant column is stamped from props.tenantId before this hook.
+        const projectId = props.tenantId ||
+            createData["projectId"] ||
+            undefined;
+        const refusal = ResourceAiAccessSettings.getLooseningRefusal({
+            resourceType: data.resourceType,
+            data: createData,
+            props,
+            current: [Object.assign(Object.assign({}, NEVER_CONFIGURED_RESOURCE_AI_ACCESS), { projectId })],
+        });
+        if (refusal) {
+            throw new NotAuthorizedException(refusal);
+        }
+    }
+    /*
+     * The AI access settings of every resource an operator's update reaches,
+     * read before the write. onBeforeUpdate runs before the framework scopes
+     * the query to the caller's project, so scope it here: a caller must
+     * never learn anything about, or be judged against, another project's
+     * resource.
+     */
+    static async readSettingsForUpdateQuery(data) {
+        var _a, _b;
+        const rows = await data.service.findBy({
+            query: Object.assign(Object.assign({}, data.updateBy.query), (data.updateBy.props.tenantId
+                ? { projectId: data.updateBy.props.tenantId }
+                : {})),
+            select: SETTINGS_SELECT,
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const settings = {};
+        for (const row of rows) {
+            const record = row;
+            const resourceId = ((_a = row.id) === null || _a === void 0 ? void 0 : _a.toString()) || ((_b = row._id) === null || _b === void 0 ? void 0 : _b.toString());
+            if (!resourceId) {
+                continue;
+            }
+            settings[resourceId] = {
+                projectId: record["projectId"],
+                isAiInvestigationEnabled: record["isAiInvestigationEnabled"] === true,
+                aiRemediationMode: ResourceAiAccessSettings.readStoredMode(record["aiRemediationMode"]),
+                aiCommandAllowlist: ResourceAiAccessSettings.readStoredAllowlist(record["aiCommandAllowlist"]),
+            };
+        }
+        return settings;
+    }
+    static getWriteCarryForward(carryForward) {
+        if (carryForward &&
+            typeof carryForward === "object" &&
+            "previousResourceAiAccessSettings" in carryForward) {
+            return carryForward;
+        }
+        return null;
+    }
+    /*
+     * For a resource service's onUpdateSuccess: after an operator's write of
+     * an AI setting, record it on the resource's feed (fire and forget: the
+     * write has committed, so who changed what AI may do is recorded even
+     * when the marker write below fails) and mark each updated resource
+     * AI-configured (awaited: a registering agent reads the marker to tell an
+     * operator's "off" from a resource nobody ever configured, so a save that
+     * could not record it must not look like one that did).
+     *
+     * The service supplies its feed: how its resources are linked in
+     * markdown, and how an item is written (its own "updated" event type).
+     */
+    static async afterUpdate(data) {
+        const carryForward = ResourceAiAccessSettings.getWriteCarryForward(data.onUpdate.carryForward);
+        if (!carryForward || data.updatedItemIds.length === 0) {
+            return;
+        }
+        ResourceAiAccessSettings.writeSettingsChangedFeed({
+            service: data.service,
+            carryForward,
+            updateData: (data.onUpdate.updateBy.data || {}),
+            updatedByUserId: data.onUpdate.updateBy.props.userId || undefined,
+            updatedItemIds: data.updatedItemIds,
+            getResourceMarkdownLink: data.getResourceMarkdownLink,
+            createFeedItem: data.createFeedItem,
+        }).catch((error) => {
+            logger.error(error);
+        });
+        await ResourceAiAccessSettings.markConfigured({
+            service: data.service,
+            resourceIds: data.updatedItemIds,
+        });
+    }
+    /*
+     * Set aiAccessConfiguredAt on each resource that does not have it yet, and
+     * never touch one that does: the marker records when AI access was FIRST
+     * configured. A server-only column, so it is written here, as root, after
+     * the operator's own write succeeded, rather than slipped into that write.
+     */
+    static async markConfigured(data) {
+        if (data.resourceIds.length === 0) {
+            return;
+        }
+        await data.service.updateBy({
+            query: {
+                _id: QueryHelper.any(data.resourceIds),
+                aiAccessConfiguredAt: QueryHelper.isNull(),
+            },
+            data: {
+                aiAccessConfiguredAt: OneUptimeDate.getCurrentDate(),
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+    }
+    /*
+     * One line per AI access setting this write actually changed, old -> new.
+     * With no `previous` (the resource was not among those read before the
+     * write) every written setting is reported as set, without a "from".
+     */
+    static describeChanges(data) {
+        const changes = [];
+        const { updateData, previous } = data;
+        if (updateData["isAiInvestigationEnabled"] !== undefined) {
+            const isEnabled = updateData["isAiInvestigationEnabled"] === true;
+            if (!previous || previous.isAiInvestigationEnabled !== isEnabled) {
+                changes.push(`AI investigation with read-only commands turned **${isEnabled ? "on" : "off"}**`);
+            }
+        }
+        if (updateData["aiRemediationMode"] !== undefined) {
+            const mode = ResourceAiAccessSettings.readStoredMode(updateData["aiRemediationMode"]);
+            if (!previous) {
+                changes.push(`AI remediation set to **${RESOURCE_AI_REMEDIATION_MODE_LABELS[mode]}**`);
+            }
+            else if (previous.aiRemediationMode !== mode) {
+                changes.push(`AI remediation changed from **${RESOURCE_AI_REMEDIATION_MODE_LABELS[previous.aiRemediationMode]}** to **${RESOURCE_AI_REMEDIATION_MODE_LABELS[mode]}**`);
+            }
+        }
+        if (updateData["aiCommandAllowlist"] !== undefined) {
+            const patterns = ResourceAiAccessSettings.readStoredAllowlist(updateData["aiCommandAllowlist"]);
+            if (!previous ||
+                !isSameAllowlist(previous.aiCommandAllowlist, patterns)) {
+                changes.push(patterns.length === 0
+                    ? "AI command allowlist cleared"
+                    : `AI command allowlist changed to ${describePatternCount(patterns.length)}${previous
+                        ? ` (was ${describePatternCount(previous.aiCommandAllowlist.length)})`
+                        : ""}`);
+            }
+        }
+        return changes;
+    }
+    /*
+     * Who changed what OneUptime AI may do on a resource, and when. The
+     * generic "was updated" feed item only covers MEANINGFUL_UPDATE_COLUMNS
+     * (shared by every resource type and deliberately left alone), so
+     * without this an operator switching a production host to Bypass
+     * approval — or back off — left no trace.
+     *
+     * One item per resource that actually changed; a save that re-posts
+     * unchanged values (the AI page posts its whole form) records nothing.
+     * API-key and Terraform writes carry no user and are attributed to an API
+     * key rather than dropped.
+     */
+    static async writeSettingsChangedFeed(data) {
+        var _a;
+        for (const resourceId of data.updatedItemIds) {
+            const previous = data.carryForward.previousResourceAiAccessSettings[resourceId.toString()];
+            const changes = ResourceAiAccessSettings.describeChanges({
+                updateData: data.updateData,
+                previous,
+            });
+            if (changes.length === 0) {
+                continue;
+            }
+            const projectId = (previous === null || previous === void 0 ? void 0 : previous.projectId) ||
+                ((_a = ((await data.service.findOneById({
+                    id: resourceId,
+                    select: { projectId: true },
+                    props: { isRoot: true },
+                })))) === null || _a === void 0 ? void 0 : _a["projectId"]);
+            if (!projectId) {
+                continue;
+            }
+            const userMarkdown = data.updatedByUserId
+                ? (await UserService.getUserMarkdownString({
+                    userId: data.updatedByUserId,
+                    projectId,
+                })) || "A user"
+                : "";
+            const actor = userMarkdown ? `**${userMarkdown}**` : "An API key";
+            /*
+             * Yellow when the change lets AI do more (the same test the permission
+             * check applies), grey when it tightens or only flips investigation.
+             */
+            const displayColor = ResourceAiAccessSettings.getLoosening({
+                data: data.updateData,
+                current: previous || NEVER_CONFIGURED_RESOURCE_AI_ACCESS,
+            }).loosens
+                ? Yellow500
+                : Gray500;
+            const moreInformation = [
+                `**Changed by**: ${userMarkdown || "An API key (no user)"}`,
+            ];
+            const allowlist = ResourceAiAccessSettings.readStoredAllowlist(data.updateData["aiCommandAllowlist"]);
+            if (data.updateData["aiCommandAllowlist"] !== undefined &&
+                allowlist.length > 0) {
+                moreInformation.push(`**AI command allowlist**:\n\n${allowlist
+                    .map((pattern) => {
+                    return `- \`${pattern.replace(/`/g, "'")}\``;
+                })
+                    .join("\n")}`);
+            }
+            await data.createFeedItem({
+                resourceId,
+                projectId,
+                displayColor,
+                feedInfoInMarkdown: `🤖 ${actor} changed what OneUptime AI may do on ${await data.getResourceMarkdownLink(projectId, resourceId)}:\n\n${changes
+                    .map((change) => {
+                    return `- ${change}`;
+                })
+                    .join("\n")}`,
+                moreInformationInMarkdown: moreInformation.join("\n\n"),
+                userId: data.updatedByUserId,
+            });
+        }
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessSettings, "checkUpdate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessSettings, "afterUpdate", null);
+//# sourceMappingURL=ResourceAiAccessSettings.js.map

package/build/dist/Server/Utils/AI/ResourceAccess/ResourceAiAccessSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourceAiAccessSettings.js","sourceRoot":"","sources":["../../../../../../Server/Utils/AI/ResourceAccess/ResourceAiAccessSettings.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,WAAW,MAAM,+BAA+B,CAAC;AAGxD,OAAO,WAAW,MAAM,qCAAqC,CAAC;AAE9D,OAAO,MAAM,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,WAAW,MAAM,6BAA6B,CAAC;AAEtD,OAAO,EACL,oCAAoC,EACpC,8BAA8B,EAC9B,mCAAmC,EACnC,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,kDAAkD,CAAC;AAE1D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,SAAS,MAAM,qCAAqC,CAAC;AAC5D,OAAO,aAAa,MAAM,wBAAwB,CAAC;AACnD,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAC5E,OAAO,sBAAsB,MAAM,oDAAoD,CAAC;AAGxF,OAAuB,EACrB,qBAAqB,GACtB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,qBAAqB,EAAE,EAC5B,+BAA+B,GAChC,MAAM,gEAAgE,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,+BAA+B,GAA0B;IACpE,0BAA0B;IAC1B,mBAAmB;IACnB,oBAAoB;CACrB,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,mCAAmC,GAA0B;IACxE,sBAAsB;IACtB,wBAAwB;IACxB,mBAAmB;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD;IACE,yBAAyB,CAAC,QAAQ;IAClC,yBAAyB,CAAC,eAAe;IACzC,yBAAyB,CAAC,SAAS;IACnC,yBAAyB,CAAC,cAAc;CACzC,CAAC;AAiBJ;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C;IACE,wBAAwB,EAAE,KAAK;IAC/B,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ;IACrD,kBAAkB,EAAE,EAAE;CACvB,CAAC;AAgCJ,8DAA8D;AAC9D,MAAM,eAAe,GAA4B;IAC/C,GAAG,EAAE,IAAI;IACT,SAAS,EAAE,IAAI;IACf,wBAAwB,EAAE,IAAI;IAC9B,iBAAiB,EAAE,IAAI;IACvB,kBAAkB,EAAE,IAAI;CACzB,CAAC;AAEF,2EAA2E;AAC3E,SAAS,eAAe,CACtB,IAAgB,EAChB,IAA2B;IAE3B,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAW,EAAW,EAAE;QACxC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,GAAG,KAAK,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,eAAe,CAAC,IAAmB,EAAE,KAAoB;IAChE,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,OAAe,EAAE,KAAa,EAAW,EAAE;YACrD,OAAO,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,wBAAwB;IAC3C,0EAA0E;IACnE,MAAM,CAAC,gBAAgB,CAAC,IAAgB;QAC7C,OAAO,eAAe,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,0BAA0B,CAAC,IAAgB;QACvD,MAAM,OAAO,GAAkB,mCAAmC,CAAC,MAAM,CACvE,CAAC,GAAW,EAAW,EAAE;YACvB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QACjC,CAAC,CACF,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAC1B,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAChC,iEAAiE,CAAC;IACpE,CAAC;IAED,8DAA8D;IACvD,MAAM,CAAC,cAAc,CAAC,KAAc;QACzC,OAAO,sCAAsC,CAAC,QAAQ,CACpD,KAAkC,CACnC;YACC,CAAC,CAAE,KAAmC;YACtC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC;IACzC,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,mBAAmB,CAAC,KAAc;QAC9C,IAAI,GAAG,GAAY,KAAK,CAAC;QAEzB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YAAC,WAAM,CAAC;gBACP,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,GAAG;aACP,MAAM,CAAC,CAAC,OAAgB,EAAW,EAAE;YACpC,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAClE,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,OAAe,EAAU,EAAE;YAC/B,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,MAAM,CAAC,qBAAqB,CAAC,YAA4B;;QAC9D,MAAM,QAAQ,GAAW,CACvB,CAAA,MAAA,qBAAqB,CAAC,YAAY,CAAC,0CAAE,QAAQ,KAAI,EAAE,CACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,OAAO,8EAA8E,uBAAuB,CAC1G,YAAY,CACb,gBAAgB,QAAQ,oBACvB,8BAA8B,CAAC,YAAY,CAAC,IAAI,EAClD,KAAK,CAAC;IACR,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,0BAA0B,CAAC,IAGxC;QACC,IAAI,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC;QAE9B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,GAAG,+BAA+B,EAAE,CAAC;YACjD,MAAM,IAAI,gBAAgB,CACxB,6CAA6C,+BAA+B,kBAAkB,GAAG,CAAC,MAAM,IAAI,CAC7G,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,KAAa,EAAU,EAAE;YACvD,MAAM,QAAQ,GAAW,WAAW,KAAK,GAAG,CAAC,8BAA8B,CAAC;YAE5E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,gBAAgB,CACxB,GAAG,QAAQ,sBACT,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KACnC,MAAM,wBAAwB,CAAC,qBAAqB,CAClD,IAAI,CAAC,YAAY,CAClB,EAAE,CACJ,CAAC;YACJ,CAAC;YAED,8DAA8D;YAC9D,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC;YAErC,MAAM,OAAO,GACX,qBAAqB,CAAC,+BAA+B,CAAC;gBACpD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,OAAO;aACR,CAAC,CAAC;YAEL,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,gBAAgB,CACxB,GAAG,QAAQ,oBACT,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAC9C,4FAA4F,CAC7F,CAAC;YACJ,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,gBAAgB,CAAC,IAG9B;QACC,MAAM,IAAI,GAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAErD,IACE,IAAI,KAAK,SAAS;YAClB,CAAC,sCAAsC,CAAC,QAAQ,CAC9C,IAAiC,CAClC,EACD,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,sCAAsC,sCAAsC,CAAC,IAAI,CAC/E,IAAI,CACL,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CACnC,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;gBAC7B,wBAAwB,CAAC,0BAA0B,CAAC;oBAClD,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;iBACvC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,MAAM,CAAC,YAAY,CAAC,IAG1B;QACC,IAAI,OAAO,GAAY,KAAK,CAAC;QAE7B,MAAM,IAAI,GAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAErD,IACE,IAAI,KAAK,SAAS;YAClB,IAAI,KAAK,IAAI;YACb,sCAAsC,CAAC,OAAO,CAC5C,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,CAC9C;gBACC,sCAAsC,CAAC,OAAO,CAC5C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAC/B,EACH,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,QAAQ,GACZ,wBAAwB,CAAC,mBAAmB,CAC1C,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAChC,CAAC;YAEJ,IACE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE;gBACzC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC5D,CAAC,CAAC,EACF,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,MAAM,CAAC,mBAAmB,CAAC,IAKjC;QACC,MAAM,SAAS,GACb,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC;gDAEO,mCAAmC,KACtC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;aAEjC,CAAC;QAER,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IACE,CAAC,wBAAwB,CAAC,YAAY,CAAC;gBACrC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAC,OAAO,EACV,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IACE,CAAC,QAAQ,CAAC,SAAS;gBACnB,CAAC,kBAAkB,CAAC;oBAClB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,OAAO,EAAE,oCAAoC;iBAC9C,CAAC,EACF,CAAC;gBACD,OAAO,+BAA+B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,WAAW,CAA+B,IAI7D;QACC,MAAM,UAAU,GAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;YAChD,EAAE,CAA0B,CAAC;QAE/B,wBAAwB,CAAC,gBAAgB,CAAC;YACxC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,iBAAiB,GACrB,wBAAwB,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC;QAElE,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gCAAgC,GAGlC,MAAM,wBAAwB,CAAC,0BAA0B,CAAC;YAC5D,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,OAAO,GACX,wBAAwB,CAAC,mBAAmB,CAAC;gBAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;gBAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,gCAAgC,CAAC;aACzD,CAAC,CAAC;YAEL,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,gCAAgC;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,MAAM,CAAC,WAAW,CAA+B,IAGvD;QACC,MAAM,UAAU,GAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;YAChD,EAAE,CAA0B,CAAC;QAC/B,MAAM,KAAK,GAAmC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAElE,wBAAwB,CAAC,gBAAgB,CAAC;YACxC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,MAAM,iBAAiB,GACrB,wBAAwB,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC;QAElE,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;QACtD,CAAC;QAED,IACE,KAAK,CAAC,aAAa;YACnB,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,UAAU,CAAC,EACtD,CAAC;YACD,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ;YACb,UAAU,CAAC,WAAW,CAA0B;YACjD,SAAS,CAAC;QAEZ,MAAM,OAAO,GAAkB,wBAAwB,CAAC,mBAAmB,CACzE;YACE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,UAAU;YAChB,KAAK;YACL,OAAO,EAAE,iCAAM,mCAAmC,KAAE,SAAS,IAAG;SACjE,CACF,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAE5C,IAGD;;QACC,MAAM,IAAI,GAAsB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACxD,KAAK,EAAE,gCACF,IAAI,CAAC,QAAQ,CAAC,KAAK,GACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ;gBAC9B,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC,CACC;YACV,MAAM,EAAE,eAAwB;YAChC,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAqD,EAAE,CAAC;QAEtE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAA4B,GAGvC,CAAC;YACF,MAAM,UAAU,GACd,CAAA,MAAA,GAAG,CAAC,EAAE,0CAAE,QAAQ,EAAE,MAAI,MAAA,GAAG,CAAC,GAAG,0CAAE,QAAQ,EAAE,CAAA,CAAC;YAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,QAAQ,CAAC,UAAU,CAAC,GAAG;gBACrB,SAAS,EAAE,MAAM,CAAC,WAAW,CAAyB;gBACtD,wBAAwB,EAAE,MAAM,CAAC,0BAA0B,CAAC,KAAK,IAAI;gBACrE,iBAAiB,EAAE,wBAAwB,CAAC,cAAc,CACxD,MAAM,CAAC,mBAAmB,CAAC,CAC5B;gBACD,kBAAkB,EAAE,wBAAwB,CAAC,mBAAmB,CAC9D,MAAM,CAAC,oBAAoB,CAAC,CAC7B;aACF,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEM,MAAM,CAAC,oBAAoB,CAChC,YAAqB;QAErB,IACE,YAAY;YACZ,OAAO,YAAY,KAAK,QAAQ;YAChC,kCAAkC,IAAI,YAAY,EAClD,CAAC;YACD,OAAO,YAAiD,CAAC;QAC3D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;OAWG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,WAAW,CAA+B,IAS7D;QACC,MAAM,YAAY,GAChB,wBAAwB,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAE5E,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,wBAAwB,CAAC,wBAAwB,CAAC;YAChD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY;YACZ,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAA0B;YACxE,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS;YACjE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,wBAAwB,CAAC,cAAc,CAAC;YAC5C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,cAAc;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,KAAK,CAAC,cAAc,CAA+B,IAGhE;QACC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC1B,KAAK,EAAE;gBACL,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBACtC,oBAAoB,EAAE,WAAW,CAAC,MAAM,EAAE;aAClC;YACV,IAAI,EAAE;gBACJ,oBAAoB,EAAE,aAAa,CAAC,cAAc,EAAE;aAC5C;YACV,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,eAAe,CAAC,IAG7B;QACC,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,UAAU,CAAC,0BAA0B,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,MAAM,SAAS,GACb,UAAU,CAAC,0BAA0B,CAAC,KAAK,IAAI,CAAC;YAElD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBACjE,OAAO,CAAC,IAAI,CACV,qDACE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KACrB,IAAI,CACL,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,GACR,wBAAwB,CAAC,cAAc,CACrC,UAAU,CAAC,mBAAmB,CAAC,CAChC,CAAC;YAEJ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CACV,2BAA2B,mCAAmC,CAAC,IAAI,CAAC,IAAI,CACzE,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CACV,iCACE,mCAAmC,CAAC,QAAQ,CAAC,iBAAiB,CAChE,WAAW,mCAAmC,CAAC,IAAI,CAAC,IAAI,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,QAAQ,GACZ,wBAAwB,CAAC,mBAAmB,CAC1C,UAAU,CAAC,oBAAoB,CAAC,CACjC,CAAC;YAEJ,IACE,CAAC,QAAQ;gBACT,CAAC,eAAe,CAAC,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,EACvD,CAAC;gBACD,OAAO,CAAC,IAAI,CACV,QAAQ,CAAC,MAAM,KAAK,CAAC;oBACnB,CAAC,CAAC,8BAA8B;oBAChC,CAAC,CAAC,mCAAmC,oBAAoB,CACrD,QAAQ,CAAC,MAAM,CAChB,GACC,QAAQ;wBACN,CAAC,CAAC,SAAS,oBAAoB,CAC3B,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CACnC,GAAG;wBACN,CAAC,CAAC,EACN,EAAE,CACP,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAE3C,IAWD;;QACC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,MAAM,QAAQ,GACZ,IAAI,CAAC,YAAY,CAAC,gCAAgC,CAChD,UAAU,CAAC,QAAQ,EAAE,CACtB,CAAC;YAEJ,MAAM,OAAO,GAAkB,wBAAwB,CAAC,eAAe,CAAC;gBACtE,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ;aACT,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GACb,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,SAAS;iBAClB,MACC,CAAA,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC9B,EAAE,EAAE,UAAU;oBACd,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAW;oBACpC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC,CACJ,0CAAG,WAAW,CAA0B,CAAA,CAAC;YAE5C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAW,IAAI,CAAC,eAAe;gBAC/C,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,qBAAqB,CAAC;oBACvC,MAAM,EAAE,IAAI,CAAC,eAAe;oBAC5B,SAAS;iBACV,CAAC,CAAC,IAAI,QAAQ;gBACjB,CAAC,CAAC,EAAE,CAAC;YAEP,MAAM,KAAK,GAAW,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;YAE1E;;;eAGG;YACH,MAAM,YAAY,GAAU,wBAAwB,CAAC,YAAY,CAAC;gBAChE,IAAI,EAAE,IAAI,CAAC,UAAU;gBACrB,OAAO,EAAE,QAAQ,IAAI,mCAAmC;aACzD,CAAC,CAAC,OAAO;gBACR,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,OAAO,CAAC;YAEZ,MAAM,eAAe,GAAkB;gBACrC,mBAAmB,YAAY,IAAI,sBAAsB,EAAE;aAC5D,CAAC;YAEF,MAAM,SAAS,GACb,wBAAwB,CAAC,mBAAmB,CAC1C,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,CACtC,CAAC;YAEJ,IACE,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,KAAK,SAAS;gBACnD,SAAS,CAAC,MAAM,GAAG,CAAC,EACpB,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,gCAAgC,SAAS;qBACtC,GAAG,CAAC,CAAC,OAAe,EAAU,EAAE;oBAC/B,OAAO,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;gBAC/C,CAAC,CAAC;qBACD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,CAAC,cAAc,CAAC;gBACxB,UAAU;gBACV,SAAS;gBACT,YAAY;gBACZ,kBAAkB,EAAE,MAAM,KAAK,wCAAwC,MAAM,IAAI,CAAC,uBAAuB,CACvG,SAAS,EACT,UAAU,CACX,QAAQ,OAAO;qBACb,GAAG,CAAC,CAAC,MAAc,EAAU,EAAE;oBAC9B,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,CAAC,CAAC;qBACD,IAAI,CAAC,IAAI,CAAC,EAAE;gBACf,yBAAyB,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;gBACvD,MAAM,EAAE,IAAI,CAAC,eAAe;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAtcqB;IADnB,WAAW,EAAE;;;;iDAuDb;AAoJmB;IADnB,WAAW,EAAE;;;;iDAkCb"}