@vorionsys/security 1.0.0

package/dist/security/incident/playbooks/denial-of-service.js

@@ -0,0 +1,540 @@
+/**
+ * Denial of Service Response Playbook
+ *
+ * Comprehensive playbook for responding to denial of service (DoS/DDoS) incidents.
+ * Covers detection, mitigation, traffic analysis, scaling, and recovery.
+ *
+ * This playbook uses automated actions from the actions module that
+ * provide real implementations with rollback capabilities.
+ */
+import { createLogger } from '../../../common/logger.js';
+import { IncidentType, IncidentSeverity, NotificationChannel, StepType, } from '../types.js';
+const logger = createLogger({ component: 'incident-response' });
+// ============================================================================
+// Playbook Definition
+// ============================================================================
+/**
+ * Denial of service response steps using automated actions
+ *
+ * Steps are designed to:
+ * - Quickly verify and assess the attack
+ * - Implement immediate mitigation measures
+ * - Analyze traffic patterns and attack sources
+ * - Scale infrastructure to absorb attack traffic
+ * - Communicate with stakeholders throughout
+ * - Restore normal operations once attack subsides
+ * - Document lessons learned for future defense improvements
+ */
+const denialOfServiceSteps = [
+    // Phase 1: Detection and Verification
+    {
+        id: 'dos-step-1',
+        name: 'Verify DoS Attack Indicators',
+        type: StepType.MANUAL,
+        description: `
+      Verify the denial of service alert is legitimate:
+      1. Review monitoring alerts (high latency, error rates, traffic spikes)
+      2. Check system metrics (CPU, memory, network bandwidth, connection counts)
+      3. Verify service degradation or unavailability
+      4. Distinguish between DoS attack and legitimate traffic surge
+      5. Identify affected services and endpoints
+      6. Estimate attack volume and type (volumetric, protocol, application layer)
+      7. Document initial findings
+
+      Mark this step complete once verification is done.
+    `,
+        requiresApproval: false,
+        onFailure: 'halt',
+    },
+    {
+        id: 'dos-step-1b',
+        name: 'Classify Attack Type',
+        type: StepType.MANUAL,
+        description: `
+      Classify the type of DoS/DDoS attack:
+      1. Volumetric attacks (UDP flood, ICMP flood, amplification)
+      2. Protocol attacks (SYN flood, Ping of Death, fragmented packets)
+      3. Application layer attacks (HTTP flood, Slowloris, DNS query flood)
+      4. Determine if attack is distributed (DDoS) or single source (DoS)
+      5. Identify attack vectors being used
+      6. Document classification for mitigation strategy
+
+      This helps determine the appropriate mitigation approach.
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['dos-step-1'],
+    },
+    // Phase 2: Immediate Mitigation (Automated)
+    {
+        id: 'dos-step-2',
+        name: 'Enable Rate Limiting',
+        type: StepType.AUTOMATED,
+        description: 'Enable aggressive rate limiting at application and infrastructure levels to throttle malicious traffic and protect backend services.',
+        actionId: 'enable-rate-limiting',
+        timeout: 60000, // 1 minute
+        requiresApproval: false, // Critical action - execute immediately
+        onFailure: 'continue', // Continue with other mitigations if this fails
+        retryAttempts: 2,
+        dependencies: ['dos-step-1'],
+        metadata: {
+            rateLimit: 'aggressive',
+            notifyOnComplete: true,
+        },
+    },
+    {
+        id: 'dos-step-2b',
+        name: 'Block Attacking IPs',
+        type: StepType.AUTOMATED,
+        description: 'Block identified attacking IP addresses at firewall, WAF, and network edge levels.',
+        actionId: 'block-ip', // Uses the block-ip action
+        timeout: 120000, // 2 minutes
+        requiresApproval: false,
+        onFailure: 'continue', // Non-critical - continue if fails
+        retryAttempts: 3,
+        dependencies: ['dos-step-1'],
+        metadata: {
+            blockType: 'ddos-mitigation',
+            blockDurationMinutes: 60,
+            autoExtend: true,
+        },
+    },
+    {
+        id: 'dos-step-2c',
+        name: 'Enable CDN Protection',
+        type: StepType.AUTOMATED,
+        description: 'Enable enhanced CDN protection mode including DDoS mitigation, bot protection, and geographic filtering.',
+        actionId: 'enable-cdn-protection',
+        timeout: 180000, // 3 minutes
+        requiresApproval: false,
+        onFailure: 'continue',
+        retryAttempts: 2,
+        dependencies: ['dos-step-1'],
+        metadata: {
+            protectionLevel: 'under-attack',
+            enableBotProtection: true,
+            enableGeoFiltering: true,
+        },
+    },
+    {
+        id: 'dos-step-2d',
+        name: 'Enable Enhanced Monitoring',
+        type: StepType.AUTOMATED,
+        description: 'Activate enhanced monitoring for traffic analysis, attack pattern detection, and real-time alerting.',
+        actionId: 'scale-monitoring', // Uses the scale-monitoring action
+        timeout: 180000,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['dos-step-1'],
+        metadata: {
+            monitoringLevel: 'high',
+            enableTrafficAnalysis: true,
+            enableAnomalyDetection: true,
+        },
+    },
+    // Phase 3: Traffic Analysis (Manual)
+    {
+        id: 'dos-step-3',
+        name: 'Analyze Attack Patterns',
+        type: StepType.MANUAL,
+        description: `
+      Analyze attack traffic patterns:
+      1. Review network traffic logs and flow data
+      2. Identify attack signatures and patterns
+      3. Analyze request characteristics (headers, payloads, timing)
+      4. Identify common user agents, referers, or request patterns
+      5. Look for botnet indicators
+      6. Document attack patterns for mitigation tuning
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['dos-step-2d'],
+    },
+    {
+        id: 'dos-step-3b',
+        name: 'Identify Attack Sources',
+        type: StepType.MANUAL,
+        description: `
+      Identify and document attack sources:
+      1. Compile list of attacking IP addresses
+      2. Analyze geographic distribution of attack traffic
+      3. Identify ASNs and hosting providers involved
+      4. Check for compromised infrastructure (botnets)
+      5. Cross-reference with threat intelligence feeds
+      6. Prioritize IP blocks for blocking
+      7. Document findings for potential reporting to ISPs/authorities
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['dos-step-2d'],
+    },
+    {
+        id: 'dos-step-3c',
+        name: 'Tune Mitigation Rules',
+        type: StepType.MANUAL,
+        description: `
+      Fine-tune mitigation based on analysis:
+      1. Update WAF rules based on attack patterns
+      2. Adjust rate limiting thresholds
+      3. Add custom blocking rules for identified patterns
+      4. Configure geographic blocking if applicable
+      5. Update bot detection signatures
+      6. Test rules to minimize legitimate user impact
+    `,
+        requiresApproval: true,
+        approvers: ['security-lead', 'network-engineer'],
+        onFailure: 'continue',
+        dependencies: ['dos-step-3', 'dos-step-3b'],
+    },
+    // Phase 4: Infrastructure Scaling (Automated)
+    {
+        id: 'dos-step-4',
+        name: 'Scale Infrastructure',
+        type: StepType.AUTOMATED,
+        description: 'Scale up infrastructure to absorb attack traffic including additional servers, load balancers, and network capacity.',
+        actionId: 'scale-infrastructure',
+        timeout: 300000, // 5 minutes
+        requiresApproval: true, // Cost implications - requires approval
+        approvers: ['incident-commander', 'operations-lead'],
+        onFailure: 'continue',
+        retryAttempts: 2,
+        dependencies: ['dos-step-1'],
+        metadata: {
+            scaleFactor: 2,
+            maxInstances: 100,
+            scaleComponents: ['web', 'api', 'loadbalancer'],
+        },
+    },
+    {
+        id: 'dos-step-4b',
+        name: 'Enable Auto-Scaling',
+        type: StepType.AUTOMATED,
+        description: 'Enable aggressive auto-scaling policies to dynamically respond to traffic changes.',
+        actionId: 'enable-autoscaling',
+        timeout: 120000,
+        requiresApproval: false,
+        onFailure: 'continue',
+        retryAttempts: 2,
+        dependencies: ['dos-step-4'],
+        metadata: {
+            scalingPolicy: 'aggressive',
+            cooldownSeconds: 60,
+            targetCpuPercent: 50,
+        },
+    },
+    // Phase 5: Communication (Automated and Manual)
+    {
+        id: 'dos-step-5',
+        name: 'Notify Stakeholders',
+        type: StepType.AUTOMATED,
+        description: 'Send automated notifications to relevant stakeholders including security team, operations, and management.',
+        actionId: 'notify-stakeholders', // Uses the notify-stakeholders action
+        timeout: 120000,
+        requiresApproval: false,
+        onFailure: 'continue',
+        retryAttempts: 3,
+        dependencies: ['dos-step-1'],
+        metadata: {
+            notificationType: 'dos-incident',
+            includeSeverity: true,
+            includeImpactAssessment: true,
+        },
+    },
+    {
+        id: 'dos-step-5b',
+        name: 'Update Status Page',
+        type: StepType.MANUAL,
+        description: `
+      Update public status page:
+      1. Create incident on status page
+      2. Describe service impact (without revealing attack details)
+      3. Set appropriate severity level
+      4. Provide estimated time to resolution if possible
+      5. Schedule regular updates (every 15-30 minutes)
+      6. Keep communications professional and user-focused
+    `,
+        requiresApproval: true,
+        approvers: ['communications', 'incident-commander'],
+        onFailure: 'continue',
+        dependencies: ['dos-step-1'],
+    },
+    {
+        id: 'dos-step-5c',
+        name: 'Customer Communication',
+        type: StepType.MANUAL,
+        description: `
+      Communicate with affected customers:
+      1. Draft customer communication (focus on impact, not attack details)
+      2. Review with communications and legal team
+      3. Send via appropriate channels (email, in-app, support)
+      4. Prepare support team for incoming inquiries
+      5. Document customer impact for later reporting
+    `,
+        requiresApproval: true,
+        approvers: ['communications', 'legal'],
+        onFailure: 'continue',
+        dependencies: ['dos-step-5b'],
+    },
+    // Phase 6: Ongoing Monitoring (Manual)
+    {
+        id: 'dos-step-6',
+        name: 'Monitor Attack Status',
+        type: StepType.MANUAL,
+        description: `
+      Continuously monitor attack and mitigation effectiveness:
+      1. Track attack volume trends
+      2. Monitor service availability and latency
+      3. Verify mitigation measures are effective
+      4. Watch for attack pattern changes
+      5. Adjust mitigation as needed
+      6. Document attack timeline
+      7. Estimate when attack may subside
+
+      Continue monitoring until attack subsides significantly.
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['dos-step-2', 'dos-step-2b', 'dos-step-2c', 'dos-step-4'],
+    },
+    // Phase 7: Recovery (Manual with Approvals)
+    {
+        id: 'dos-step-7',
+        name: 'Verify Attack Subsided',
+        type: StepType.MANUAL,
+        description: `
+      Confirm attack has subsided:
+      1. Monitor traffic patterns for sustained normal levels
+      2. Verify no new attack vectors emerging
+      3. Check error rates and latency returning to normal
+      4. Confirm service availability restored
+      5. Wait sufficient time to ensure attack is truly over (minimum 30 minutes)
+      6. Document end of attack timeline
+    `,
+        requiresApproval: false,
+        onFailure: 'halt',
+        dependencies: ['dos-step-6'],
+    },
+    {
+        id: 'dos-step-7b',
+        name: 'Restore Normal Operations',
+        type: StepType.MANUAL,
+        description: `
+      Gradually restore normal operations:
+      1. Reduce rate limiting to normal levels
+      2. Disable under-attack mode on CDN
+      3. Review and remove temporary IP blocks (keep persistent threats blocked)
+      4. Scale down infrastructure to normal levels
+      5. Return auto-scaling to normal policies
+      6. Verify services functioning normally
+      7. Update status page to resolved
+
+      Requires approval to ensure attack has truly subsided.
+    `,
+        requiresApproval: true,
+        approvers: ['incident-commander', 'operations-lead'],
+        onFailure: 'halt',
+        dependencies: ['dos-step-7'],
+    },
+    {
+        id: 'dos-step-7c',
+        name: 'Final Status Update',
+        type: StepType.MANUAL,
+        description: `
+      Publish final status update:
+      1. Update status page to resolved
+      2. Send final customer communication
+      3. Provide summary of incident duration and impact
+      4. Thank users for patience
+      5. Close status page incident
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['dos-step-7b'],
+    },
+    // Phase 8: Post-Incident (Manual)
+    {
+        id: 'dos-step-8',
+        name: 'Document Attack Details',
+        type: StepType.MANUAL,
+        description: `
+      Comprehensive attack documentation:
+      1. Attack timeline (detection to resolution)
+      2. Attack type and vectors used
+      3. Peak attack volume and duration
+      4. Source IPs and geographic distribution
+      5. Services and systems affected
+      6. Mitigation actions taken and effectiveness
+      7. Customer impact assessment
+      8. Cost of incident (infrastructure, revenue, labor)
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['dos-step-7b'],
+    },
+    {
+        id: 'dos-step-8b',
+        name: 'Lessons Learned Review',
+        type: StepType.MANUAL,
+        description: `
+      Conduct lessons learned review:
+      1. Schedule post-mortem meeting with all stakeholders
+      2. Review what worked well in the response
+      3. Identify gaps in detection and response
+      4. Evaluate mitigation effectiveness
+      5. Assess communication effectiveness
+      6. Document actionable improvements
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['dos-step-8'],
+    },
+    {
+        id: 'dos-step-8c',
+        name: 'Improve Defenses',
+        type: StepType.MANUAL,
+        description: `
+      Implement defense improvements:
+      1. Update DDoS protection configurations
+      2. Enhance rate limiting rules
+      3. Improve traffic analysis capabilities
+      4. Update auto-scaling policies
+      5. Enhance monitoring and alerting
+      6. Update incident response procedures
+      7. Consider additional DDoS protection services
+      8. Update playbook based on lessons learned
+      9. Schedule regular DDoS drills
+    `,
+        requiresApproval: true,
+        approvers: ['security-lead', 'cto'],
+        onFailure: 'continue',
+        dependencies: ['dos-step-8b'],
+    },
+    {
+        id: 'dos-step-8d',
+        name: 'External Reporting',
+        type: StepType.MANUAL,
+        description: `
+      Report attack to external parties if appropriate:
+      1. Report to ISPs/hosting providers of attacking IPs
+      2. Report to law enforcement if warranted
+      3. Share indicators with threat intelligence communities
+      4. Update security vendors with attack signatures
+      5. Document all external communications
+    `,
+        requiresApproval: true,
+        approvers: ['legal', 'security-lead'],
+        onFailure: 'continue',
+        dependencies: ['dos-step-8'],
+    },
+];
+const triggerConditions = [
+    {
+        field: 'type',
+        operator: 'equals',
+        value: IncidentType.DENIAL_OF_SERVICE,
+    },
+];
+const notifications = [
+    {
+        channel: NotificationChannel.SLACK,
+        target: '#security-incidents',
+        enabled: true,
+        retryAttempts: 3,
+        retryDelayMs: 5000,
+    },
+    {
+        channel: NotificationChannel.SLACK,
+        target: '#ops-alerts',
+        enabled: true,
+        retryAttempts: 3,
+        retryDelayMs: 5000,
+    },
+    {
+        channel: NotificationChannel.PAGERDUTY,
+        target: 'network-oncall',
+        severityFilter: [IncidentSeverity.P1, IncidentSeverity.P2],
+        enabled: true,
+        retryAttempts: 3,
+        retryDelayMs: 5000,
+    },
+    {
+        channel: NotificationChannel.PAGERDUTY,
+        target: 'security-oncall',
+        severityFilter: [IncidentSeverity.P1],
+        enabled: true,
+        retryAttempts: 3,
+        retryDelayMs: 5000,
+    },
+    {
+        channel: NotificationChannel.EMAIL,
+        target: 'security@company.com',
+        enabled: true,
+        retryAttempts: 3,
+        retryDelayMs: 5000,
+    },
+    {
+        channel: NotificationChannel.EMAIL,
+        target: 'operations@company.com',
+        enabled: true,
+        retryAttempts: 3,
+        retryDelayMs: 5000,
+    },
+];
+const escalation = {
+    enabled: true,
+    levels: [
+        {
+            level: 1,
+            afterMinutes: 5,
+            targets: ['network-team', 'security-team'],
+            channels: [NotificationChannel.SLACK, NotificationChannel.PAGERDUTY],
+            message: 'DoS attack detected - immediate response required',
+        },
+        {
+            level: 2,
+            afterMinutes: 15,
+            targets: ['security-lead', 'network-lead', 'incident-commander'],
+            channels: [NotificationChannel.SLACK, NotificationChannel.PAGERDUTY, NotificationChannel.EMAIL],
+            message: 'DoS attack ongoing - escalating to leadership',
+        },
+        {
+            level: 3,
+            afterMinutes: 30,
+            targets: ['ciso', 'cto', 'vp-engineering'],
+            channels: [NotificationChannel.PAGERDUTY, NotificationChannel.EMAIL, NotificationChannel.SMS],
+            message: 'Major DoS attack - executive escalation',
+        },
+        {
+            level: 4,
+            afterMinutes: 60,
+            targets: ['ceo', 'board-security-committee'],
+            channels: [NotificationChannel.EMAIL, NotificationChannel.SMS],
+            message: 'Extended DoS attack affecting service availability - executive notification',
+        },
+    ],
+    maxLevel: 4,
+    resetOnAcknowledge: true,
+};
+// ============================================================================
+// Export Playbook
+// ============================================================================
+export const denialOfServicePlaybook = {
+    id: 'playbook-denial-of-service-v1',
+    name: 'Denial of Service Response',
+    description: `
+    Comprehensive playbook for responding to denial of service (DoS/DDoS) incidents.
+    Covers attack verification, immediate mitigation, traffic analysis, infrastructure
+    scaling, stakeholder communication, service recovery, and defense improvements.
+  `.trim(),
+    version: '1.0.0',
+    triggerConditions,
+    steps: denialOfServiceSteps,
+    notifications,
+    escalation,
+    enabled: true,
+    tags: ['dos', 'ddos', 'denial-of-service', 'availability', 'network', 'critical'],
+    createdAt: new Date('2024-01-01'),
+    updatedAt: new Date('2024-01-15'),
+};
+export default denialOfServicePlaybook;
+//# sourceMappingURL=denial-of-service.js.map

package/dist/security/incident/playbooks/denial-of-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"denial-of-service.js","sourceRoot":"","sources":["../../../../src/security/incident/playbooks/denial-of-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAML,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,QAAQ,GACT,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAEhE,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAwB;IAChD,sCAAsC;IACtC;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,8BAA8B;QACpC,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;;KAWZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,MAAM;KAClB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,sBAAsB;QAC5B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;KAUZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;IAED,4CAA4C;IAC5C;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,sBAAsB;QAC5B,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,WAAW,EAAE,sIAAsI;QACnJ,QAAQ,EAAE,sBAAsB;QAChC,OAAO,EAAE,KAAK,EAAE,WAAW;QAC3B,gBAAgB,EAAE,KAAK,EAAE,wCAAwC;QACjE,SAAS,EAAE,UAAU,EAAE,gDAAgD;QACvE,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE;YACR,SAAS,EAAE,YAAY;YACvB,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,WAAW,EAAE,oFAAoF;QACjG,QAAQ,EAAE,UAAU,EAAE,2BAA2B;QACjD,OAAO,EAAE,MAAM,EAAE,YAAY;QAC7B,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU,EAAE,mCAAmC;QAC1D,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE;YACR,SAAS,EAAE,iBAAiB;YAC5B,oBAAoB,EAAE,EAAE;YACxB,UAAU,EAAE,IAAI;SACjB;KACF;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,WAAW,EAAE,0GAA0G;QACvH,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,MAAM,EAAE,YAAY;QAC7B,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE;YACR,eAAe,EAAE,cAAc;YAC/B,mBAAmB,EAAE,IAAI;YACzB,kBAAkB,EAAE,IAAI;SACzB;KACF;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,WAAW,EAAE,sGAAsG;QACnH,QAAQ,EAAE,kBAAkB,EAAE,mCAAmC;QACjE,OAAO,EAAE,MAAM;QACf,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE;YACR,eAAe,EAAE,MAAM;YACvB,qBAAqB,EAAE,IAAI;YAC3B,sBAAsB,EAAE,IAAI;SAC7B;KACF;IAED,qCAAqC;IACrC;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;KAQZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,aAAa,CAAC;KAC9B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;KASZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,aAAa,CAAC;KAC9B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;KAQZ;QACD,gBAAgB,EAAE,IAAI;QACtB,SAAS,EAAE,CAAC,eAAe,EAAE,kBAAkB,CAAC;QAChD,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;KAC5C;IAED,8CAA8C;IAC9C;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,sBAAsB;QAC5B,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,WAAW,EAAE,sHAAsH;QACnI,QAAQ,EAAE,sBAAsB;QAChC,OAAO,EAAE,MAAM,EAAE,YAAY;QAC7B,gBAAgB,EAAE,IAAI,EAAE,wCAAwC;QAChE,SAAS,EAAE,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;QACpD,SAAS,EAAE,UAAU;QACrB,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE;YACR,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,GAAG;YACjB,eAAe,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC;SAChD;KACF;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,WAAW,EAAE,oFAAoF;QACjG,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EAAE,MAAM;QACf,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE;YACR,aAAa,EAAE,YAAY;YAC3B,eAAe,EAAE,EAAE;YACnB,gBAAgB,EAAE,EAAE;SACrB;KACF;IAED,gDAAgD;IAChD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,WAAW,EAAE,4GAA4G;QACzH,QAAQ,EAAE,qBAAqB,EAAE,sCAAsC;QACvE,OAAO,EAAE,MAAM;QACf,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE;YACR,gBAAgB,EAAE,cAAc;YAChC,eAAe,EAAE,IAAI;YACrB,uBAAuB,EAAE,IAAI;SAC9B;KACF;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;KAQZ;QACD,gBAAgB,EAAE,IAAI;QACtB,SAAS,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;QACnD,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;KAOZ;QACD,gBAAgB,EAAE,IAAI;QACtB,SAAS,EAAE,CAAC,gBAAgB,EAAE,OAAO,CAAC;QACtC,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,aAAa,CAAC;KAC9B;IAED,uCAAuC;IACvC;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;;KAWZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,CAAC;KACzE;IAED,4CAA4C;IAC5C;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;KAQZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,MAAM;QACjB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,2BAA2B;QACjC,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;;KAWZ;QACD,gBAAgB,EAAE,IAAI;QACtB,SAAS,EAAE,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;QACpD,SAAS,EAAE,MAAM;QACjB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;KAOZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,aAAa,CAAC;KAC9B;IAED,kCAAkC;IAClC;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;KAUZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,aAAa,CAAC;KAC9B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;KAQZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;;KAWZ;QACD,gBAAgB,EAAE,IAAI;QACtB,SAAS,EAAE,CAAC,eAAe,EAAE,KAAK,CAAC;QACnC,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,aAAa,CAAC;KAC9B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;KAOZ;QACD,gBAAgB,EAAE,IAAI;QACtB,SAAS,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC;QACrC,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAuB;IAC5C;QACE,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,YAAY,CAAC,iBAAiB;KACtC;CACF,CAAC;AAEF,MAAM,aAAa,GAAyB;IAC1C;QACE,OAAO,EAAE,mBAAmB,CAAC,KAAK;QAClC,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,IAAI;KACnB;IACD;QACE,OAAO,EAAE,mBAAmB,CAAC,KAAK;QAClC,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,IAAI;KACnB;IACD;QACE,OAAO,EAAE,mBAAmB,CAAC,SAAS;QACtC,MAAM,EAAE,gBAAgB;QACxB,cAAc,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,IAAI;KACnB;IACD;QACE,OAAO,EAAE,mBAAmB,CAAC,SAAS;QACtC,MAAM,EAAE,iBAAiB;QACzB,cAAc,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,IAAI;KACnB;IACD;QACE,OAAO,EAAE,mBAAmB,CAAC,KAAK;QAClC,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,IAAI;KACnB;IACD;QACE,OAAO,EAAE,mBAAmB,CAAC,KAAK;QAClC,MAAM,EAAE,wBAAwB;QAChC,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,IAAI;KACnB;CACF,CAAC;AAEF,MAAM,UAAU,GAAqB;IACnC,OAAO,EAAE,IAAI;IACb,MAAM,EAAE;QACN;YACE,KAAK,EAAE,CAAC;YACR,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;YAC1C,QAAQ,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,CAAC,SAAS,CAAC;YACpE,OAAO,EAAE,mDAAmD;SAC7D;QACD;YACE,KAAK,EAAE,CAAC;YACR,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,oBAAoB,CAAC;YAChE,QAAQ,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC;YAC/F,OAAO,EAAE,+CAA+C;SACzD;QACD;YACE,KAAK,EAAE,CAAC;YACR,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC;YAC1C,QAAQ,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;YAC7F,OAAO,EAAE,yCAAyC;SACnD;QACD;YACE,KAAK,EAAE,CAAC;YACR,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,CAAC,KAAK,EAAE,0BAA0B,CAAC;YAC5C,QAAQ,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;YAC9D,OAAO,EAAE,6EAA6E;SACvF;KACF;IACD,QAAQ,EAAE,CAAC;IACX,kBAAkB,EAAE,IAAI;CACzB,CAAC;AAEF,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAkB;IACpD,EAAE,EAAE,+BAA+B;IACnC,IAAI,EAAE,4BAA4B;IAClC,WAAW,EAAE;;;;GAIZ,CAAC,IAAI,EAAE;IACR,OAAO,EAAE,OAAO;IAChB,iBAAiB;IACjB,KAAK,EAAE,oBAAoB;IAC3B,aAAa;IACb,UAAU;IACV,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;IACjF,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC;IACjC,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC;CAClC,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/security/incident/playbooks/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Incident Response Playbooks
+ *
+ * This module exports all available incident response playbooks.
+ * Each playbook defines the steps, notifications, and escalation
+ * procedures for handling specific incident types.
+ *
+ * @packageDocumentation
+ * @module security/incident/playbooks
+ */
+export { accountCompromisePlaybook } from './account-compromise.js';
+export { configurationErrorPlaybook } from './configuration-error.js';
+export { dataBreachPlaybook } from './data-breach.js';
+export { denialOfServicePlaybook } from './denial-of-service.js';
+export { insiderThreatPlaybook } from './insider-threat.js';
+export { malwarePlaybook } from './malware.js';
+export { ransomwarePlaybook } from './ransomware.js';
+export { unauthorizedAccessPlaybook } from './unauthorized-access.js';
+import type { PlaybookInput } from '../types.js';
+/**
+ * All available incident response playbooks indexed by their ID.
+ */
+export declare const allPlaybooks: Record<string, PlaybookInput>;
+/**
+ * Array of all available playbooks for iteration.
+ */
+export declare const playbookList: PlaybookInput[];
+/**
+ * Get a playbook by its ID.
+ */
+export declare function getPlaybookById(id: string): PlaybookInput | undefined;
+/**
+ * Get all enabled playbooks.
+ */
+export declare function getEnabledPlaybooks(): PlaybookInput[];
+//# sourceMappingURL=index.d.ts.map

package/dist/security/incident/playbooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/security/incident/playbooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAUtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAStD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,aAAa,EAAgC,CAAC;AAEzE;;GAEG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAErE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,aAAa,EAAE,CAErD"}

package/dist/security/incident/playbooks/index.js

@@ -0,0 +1,56 @@
+/**
+ * Incident Response Playbooks
+ *
+ * This module exports all available incident response playbooks.
+ * Each playbook defines the steps, notifications, and escalation
+ * procedures for handling specific incident types.
+ *
+ * @packageDocumentation
+ * @module security/incident/playbooks
+ */
+export { accountCompromisePlaybook } from './account-compromise.js';
+export { configurationErrorPlaybook } from './configuration-error.js';
+export { dataBreachPlaybook } from './data-breach.js';
+export { denialOfServicePlaybook } from './denial-of-service.js';
+export { insiderThreatPlaybook } from './insider-threat.js';
+export { malwarePlaybook } from './malware.js';
+export { ransomwarePlaybook } from './ransomware.js';
+export { unauthorizedAccessPlaybook } from './unauthorized-access.js';
+import { accountCompromisePlaybook } from './account-compromise.js';
+import { configurationErrorPlaybook } from './configuration-error.js';
+import { dataBreachPlaybook } from './data-breach.js';
+import { denialOfServicePlaybook } from './denial-of-service.js';
+import { insiderThreatPlaybook } from './insider-threat.js';
+import { malwarePlaybook } from './malware.js';
+import { ransomwarePlaybook } from './ransomware.js';
+import { unauthorizedAccessPlaybook } from './unauthorized-access.js';
+/**
+ * All available incident response playbooks indexed by their ID.
+ */
+export const allPlaybooks = {
+    [accountCompromisePlaybook.id]: accountCompromisePlaybook,
+    [configurationErrorPlaybook.id]: configurationErrorPlaybook,
+    [dataBreachPlaybook.id]: dataBreachPlaybook,
+    [denialOfServicePlaybook.id]: denialOfServicePlaybook,
+    [insiderThreatPlaybook.id]: insiderThreatPlaybook,
+    [malwarePlaybook.id]: malwarePlaybook,
+    [ransomwarePlaybook.id]: ransomwarePlaybook,
+    [unauthorizedAccessPlaybook.id]: unauthorizedAccessPlaybook,
+};
+/**
+ * Array of all available playbooks for iteration.
+ */
+export const playbookList = Object.values(allPlaybooks);
+/**
+ * Get a playbook by its ID.
+ */
+export function getPlaybookById(id) {
+    return allPlaybooks[id];
+}
+/**
+ * Get all enabled playbooks.
+ */
+export function getEnabledPlaybooks() {
+    return playbookList.filter(p => p.enabled);
+}
+//# sourceMappingURL=index.js.map

package/dist/security/incident/playbooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/incident/playbooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAGtE;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAkC;IACzD,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,yBAAyB;IACzD,CAAC,0BAA0B,CAAC,EAAE,CAAC,EAAE,0BAA0B;IAC3D,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,kBAAkB;IAC3C,CAAC,uBAAuB,CAAC,EAAE,CAAC,EAAE,uBAAuB;IACrD,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,qBAAqB;IACjD,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,eAAe;IACrC,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,kBAAkB;IAC3C,CAAC,0BAA0B,CAAC,EAAE,CAAC,EAAE,0BAA0B;CAC5D,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAoB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAEzE;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,OAAO,YAAY,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/security/incident/playbooks/insider-threat.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Insider Threat Response Playbook
+ *
+ * Playbook for responding to insider threat incidents including
+ * data exfiltration, unauthorized access by employees, policy violations,
+ * and malicious insider activity.
+ *
+ * IMPORTANT: Insider threats require careful handling with legal and HR
+ * coordination BEFORE taking most actions to protect the organization
+ * and ensure proper evidence preservation.
+ *
+ * This playbook uses automated actions from the actions module that
+ * provide real implementations with rollback capabilities.
+ */
+import { PlaybookInput } from '../types.js';
+export declare const insiderThreatPlaybook: PlaybookInput;
+export default insiderThreatPlaybook;
+//# sourceMappingURL=insider-threat.d.ts.map

package/dist/security/incident/playbooks/insider-threat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"insider-threat.d.ts","sourceRoot":"","sources":["../../../../src/security/incident/playbooks/insider-threat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,aAAa,EASd,MAAM,aAAa,CAAC;AA4jBrB,eAAO,MAAM,qBAAqB,EAAE,aAyBnC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}