@vorionsys/security 1.0.0

package/dist/security/siem/elastic.js

@@ -0,0 +1,514 @@
+/**
+ * Elasticsearch SIEM Connector
+ *
+ * Elasticsearch/OpenSearch integration for SIEM:
+ * - Bulk API for efficient ingestion
+ * - Index template management
+ * - API key or basic auth
+ * - Connection pooling
+ *
+ * @packageDocumentation
+ * @module security/siem/elastic
+ */
+import { createLogger } from '../../common/logger.js';
+import { BaseSIEMConnector, registerConnectorFactory } from './connector.js';
+const logger = createLogger({ component: 'siem-elastic' });
+// =============================================================================
+// Elasticsearch Connector
+// =============================================================================
+/**
+ * Elasticsearch connector for SIEM integration
+ *
+ * Features:
+ * - Bulk API for efficient ingestion
+ * - ECS (Elastic Common Schema) compliant
+ * - Multiple authentication methods
+ * - Connection pooling via node selection
+ */
+export class ElasticConnector extends BaseSIEMConnector {
+    type = 'elastic';
+    nodes;
+    auth;
+    apiKey;
+    username;
+    password;
+    bearerToken;
+    index;
+    pipeline;
+    verifySsl;
+    refresh;
+    currentNodeIndex = 0;
+    constructor(config) {
+        super(config);
+        this.nodes = config.nodes.map((n) => n.replace(/\/$/, ''));
+        this.auth = config.auth;
+        this.apiKey = config.apiKey;
+        this.username = config.username;
+        this.password = config.password;
+        this.bearerToken = config.bearerToken;
+        this.index = config.index;
+        this.pipeline = config.pipeline;
+        this.verifySsl = config.verifySsl ?? true;
+        this.refresh = config.refresh;
+        logger.info({
+            name: this.name,
+            nodes: this.nodes.length,
+            index: this.index,
+            auth: this.auth,
+        }, 'ElasticConnector initialized');
+    }
+    /**
+     * Connect to Elasticsearch cluster
+     */
+    async doConnect() {
+        // Verify cluster is accessible
+        const healthy = await this.doHealthCheck();
+        if (!healthy) {
+            throw new Error('Failed to connect to Elasticsearch cluster');
+        }
+        // Optionally create index template
+        await this.ensureIndexTemplate();
+    }
+    /**
+     * Disconnect from Elasticsearch (no-op for HTTP)
+     */
+    async doDisconnect() {
+        // HTTP-based connection, no persistent connection to close
+    }
+    /**
+     * Send events using Bulk API
+     */
+    async doSend(events) {
+        const batches = this.splitIntoBatches(events);
+        let totalSent = 0;
+        let totalFailed = 0;
+        const failedIds = [];
+        for (const batch of batches) {
+            try {
+                const result = await this.sendBulk(batch);
+                totalSent += result.eventsSent;
+                totalFailed += result.eventsFailed;
+                if (result.failedEventIds) {
+                    failedIds.push(...result.failedEventIds);
+                }
+            }
+            catch (error) {
+                totalFailed += batch.length;
+                failedIds.push(...batch.map((e) => e.id));
+                this.logger.error({ error, batchSize: batch.length }, 'Failed to send bulk to Elasticsearch');
+            }
+        }
+        return {
+            success: totalFailed === 0,
+            eventsSent: totalSent,
+            eventsFailed: totalFailed,
+            durationMs: 0,
+            failedEventIds: failedIds.length > 0 ? failedIds : undefined,
+        };
+    }
+    /**
+     * Send a bulk request to Elasticsearch
+     */
+    async sendBulk(events) {
+        // Build NDJSON body for bulk API
+        const lines = [];
+        for (const event of events) {
+            const action = {
+                index: {
+                    _index: this.resolveIndex(event),
+                    _id: event.id,
+                },
+            };
+            if (this.pipeline) {
+                action.index.pipeline = this.pipeline;
+            }
+            lines.push(JSON.stringify(action));
+            lines.push(JSON.stringify(this.toECSDocument(event)));
+        }
+        const body = lines.join('\n') + '\n';
+        let url = `${this.getNode()}/_bulk`;
+        if (this.refresh) {
+            url += `?refresh=${this.refresh}`;
+        }
+        const response = await this.httpRequest({
+            url,
+            method: 'POST',
+            headers: {
+                ...this.getAuthHeaders(),
+                'Content-Type': 'application/x-ndjson',
+            },
+            body,
+        });
+        if (!response.ok) {
+            throw new Error(`Elasticsearch bulk error: ${response.status} - ${response.text}`);
+        }
+        const result = response.data;
+        // Count successes and failures
+        let sent = 0;
+        let failed = 0;
+        const failedIds = [];
+        for (let i = 0; i < result.items.length; i++) {
+            const item = result.items[i];
+            if (item.index.status >= 200 && item.index.status < 300) {
+                sent++;
+            }
+            else {
+                failed++;
+                failedIds.push(events[i].id);
+                this.logger.warn({
+                    eventId: events[i].id,
+                    status: item.index.status,
+                    error: item.index.error,
+                }, 'Event indexing failed');
+            }
+        }
+        return {
+            success: failed === 0,
+            eventsSent: sent,
+            eventsFailed: failed,
+            durationMs: result.took,
+            response: { took: result.took, errors: result.errors },
+            failedEventIds: failedIds.length > 0 ? failedIds : undefined,
+        };
+    }
+    /**
+     * Health check - verify cluster is accessible
+     */
+    async doHealthCheck() {
+        try {
+            const response = await this.httpRequest({
+                url: `${this.getNode()}/_cluster/health`,
+                method: 'GET',
+                headers: this.getAuthHeaders(),
+                timeout: 5000,
+            });
+            if (!response.ok) {
+                return false;
+            }
+            const status = response.data.status;
+            return status === 'green' || status === 'yellow';
+        }
+        catch (error) {
+            this.logger.warn({ error: error.message }, 'Elasticsearch health check failed');
+            return false;
+        }
+    }
+    /**
+     * Ensure index template exists
+     */
+    async ensureIndexTemplate() {
+        const templateName = `vorion-security-events`;
+        const indexPattern = this.index.includes('*')
+            ? this.index
+            : `${this.index}-*`;
+        const template = {
+            index_patterns: [indexPattern],
+            template: {
+                settings: {
+                    number_of_shards: 1,
+                    number_of_replicas: 1,
+                    'index.lifecycle.name': 'vorion-security-events',
+                    'index.lifecycle.rollover_alias': this.index,
+                },
+                mappings: {
+                    properties: {
+                        '@timestamp': { type: 'date' },
+                        message: { type: 'text' },
+                        event: {
+                            properties: {
+                                id: { type: 'keyword' },
+                                kind: { type: 'keyword' },
+                                category: { type: 'keyword' },
+                                type: { type: 'keyword' },
+                                outcome: { type: 'keyword' },
+                                severity: { type: 'integer' },
+                                created: { type: 'date' },
+                            },
+                        },
+                        source: {
+                            properties: {
+                                ip: { type: 'ip' },
+                                port: { type: 'integer' },
+                                domain: { type: 'keyword' },
+                                mac: { type: 'keyword' },
+                            },
+                        },
+                        destination: {
+                            properties: {
+                                ip: { type: 'ip' },
+                                port: { type: 'integer' },
+                                domain: { type: 'keyword' },
+                                mac: { type: 'keyword' },
+                            },
+                        },
+                        user: {
+                            properties: {
+                                id: { type: 'keyword' },
+                                name: { type: 'keyword' },
+                                email: { type: 'keyword' },
+                                roles: { type: 'keyword' },
+                            },
+                        },
+                        organization: {
+                            properties: {
+                                id: { type: 'keyword' },
+                                name: { type: 'keyword' },
+                            },
+                        },
+                        geo: {
+                            properties: {
+                                country_name: { type: 'keyword' },
+                                country_iso_code: { type: 'keyword' },
+                                city_name: { type: 'keyword' },
+                                region_name: { type: 'keyword' },
+                                location: { type: 'geo_point' },
+                                timezone: { type: 'keyword' },
+                            },
+                        },
+                        threat: {
+                            properties: {
+                                indicator: {
+                                    properties: {
+                                        type: { type: 'keyword' },
+                                        confidence: { type: 'keyword' },
+                                        provider: { type: 'keyword' },
+                                    },
+                                },
+                            },
+                        },
+                        tags: { type: 'keyword' },
+                        labels: { type: 'object' },
+                        vorion: { type: 'object', enabled: false },
+                    },
+                },
+            },
+            priority: 100,
+        };
+        try {
+            await this.httpRequest({
+                url: `${this.getNode()}/_index_template/${templateName}`,
+                method: 'PUT',
+                headers: this.getAuthHeaders(),
+                body: template,
+            });
+            this.logger.info({ templateName }, 'Index template created/updated');
+        }
+        catch (error) {
+            this.logger.warn({ error: error.message }, 'Failed to create index template (may already exist)');
+        }
+    }
+    /**
+     * Convert security event to ECS document
+     */
+    toECSDocument(event) {
+        const doc = {
+            '@timestamp': event.timestamp.toISOString(),
+            event: {
+                id: event.id,
+                kind: 'event',
+                category: [event.category],
+                type: [event.eventType],
+                outcome: event.outcome,
+                severity: event.severity,
+                created: event.timestamp.toISOString(),
+            },
+            message: event.message,
+        };
+        // Source
+        if (event.sourceIp || event.sourcePort || event.sourceHost || event.sourceMac) {
+            doc.source = {
+                ip: event.sourceIp,
+                port: event.sourcePort,
+                domain: event.sourceHost,
+                mac: event.sourceMac,
+            };
+        }
+        // Destination
+        if (event.destinationIp ||
+            event.destinationPort ||
+            event.destinationHost ||
+            event.destinationMac) {
+            doc.destination = {
+                ip: event.destinationIp,
+                port: event.destinationPort,
+                domain: event.destinationHost,
+                mac: event.destinationMac,
+            };
+        }
+        // Network
+        if (event.protocol) {
+            doc.network = { protocol: event.protocol };
+        }
+        // HTTP
+        if (event.httpMethod || event.httpStatusCode) {
+            doc.http = {};
+            if (event.httpMethod) {
+                doc.http.request = { method: event.httpMethod };
+            }
+            if (event.httpStatusCode) {
+                doc.http.response = { status_code: event.httpStatusCode };
+            }
+        }
+        // URL
+        if (event.httpUrl) {
+            doc.url = { full: event.httpUrl };
+        }
+        // User agent
+        if (event.userAgent) {
+            doc.user_agent = { original: event.userAgent };
+        }
+        // Process
+        if (event.processName || event.processId) {
+            doc.process = {
+                name: event.processName,
+                pid: event.processId,
+            };
+        }
+        // File
+        if (event.filePath || event.fileHash) {
+            doc.file = {
+                path: event.filePath,
+            };
+            if (event.fileHash) {
+                doc.file.hash = { sha256: event.fileHash };
+            }
+        }
+        // User
+        if (event.user) {
+            doc.user = {
+                id: event.user.userId,
+                name: event.user.username,
+                email: event.user.email,
+                roles: event.user.roles,
+            };
+            if (event.user.groups && event.user.groups.length > 0) {
+                doc.user.group = { name: event.user.groups };
+            }
+        }
+        // Organization
+        if (event.user?.tenantId || event.user?.tenantName) {
+            doc.organization = {
+                id: event.user.tenantId,
+                name: event.user.tenantName,
+            };
+        }
+        // Geo
+        if (event.geo) {
+            doc.geo = {
+                country_name: event.geo.country,
+                country_iso_code: event.geo.countryCode,
+                city_name: event.geo.city,
+                region_name: event.geo.region,
+                timezone: event.geo.timezone,
+            };
+            if (event.geo.latitude !== undefined && event.geo.longitude !== undefined) {
+                doc.geo.location = {
+                    lat: event.geo.latitude,
+                    lon: event.geo.longitude,
+                };
+            }
+        }
+        // Threat
+        if (event.threat) {
+            doc.threat = {
+                indicator: {
+                    type: event.threat.threatType,
+                    confidence: event.threat.confidence?.toString(),
+                    provider: event.threat.source,
+                    first_seen: event.threat.firstSeen?.toISOString(),
+                    last_seen: event.threat.lastSeen?.toISOString(),
+                },
+            };
+            if (event.threat.malwareFamilies && event.threat.malwareFamilies.length > 0) {
+                doc.threat.software = { name: event.threat.malwareFamilies[0] };
+            }
+            if (event.threat.mitreAttack && event.threat.mitreAttack.length > 0) {
+                doc.threat.tactic = { id: event.threat.mitreAttack };
+            }
+        }
+        // Tags
+        if (event.tags && event.tags.length > 0) {
+            doc.tags = event.tags;
+        }
+        // Custom fields as labels
+        if (event.customFields) {
+            doc.labels = {};
+            for (const [key, value] of Object.entries(event.customFields)) {
+                if (typeof value === 'string') {
+                    doc.labels[key] = value;
+                }
+                else if (value !== null && value !== undefined) {
+                    doc.labels[key] = String(value);
+                }
+            }
+        }
+        // Vorion-specific data
+        doc.vorion = {
+            source: event.source,
+            component: event.component,
+            version: event.version,
+            environment: event.environment,
+            request_id: event.requestId,
+            raw: event.rawData,
+        };
+        return doc;
+    }
+    /**
+     * Resolve index name (supports date patterns)
+     */
+    resolveIndex(event) {
+        const date = event.timestamp;
+        return this.index
+            .replace('%{+yyyy}', date.getUTCFullYear().toString())
+            .replace('%{+MM}', String(date.getUTCMonth() + 1).padStart(2, '0'))
+            .replace('%{+dd}', String(date.getUTCDate()).padStart(2, '0'));
+    }
+    /**
+     * Get current node URL with round-robin
+     */
+    getNode() {
+        const node = this.nodes[this.currentNodeIndex];
+        this.currentNodeIndex = (this.currentNodeIndex + 1) % this.nodes.length;
+        return node;
+    }
+    /**
+     * Get authentication headers
+     */
+    getAuthHeaders() {
+        const headers = {};
+        switch (this.auth) {
+            case 'apiKey':
+                if (this.apiKey) {
+                    headers['Authorization'] = `ApiKey ${this.apiKey}`;
+                }
+                break;
+            case 'basic':
+                if (this.username && this.password) {
+                    const encoded = Buffer.from(`${this.username}:${this.password}`).toString('base64');
+                    headers['Authorization'] = `Basic ${encoded}`;
+                }
+                break;
+            case 'bearer':
+                if (this.bearerToken) {
+                    headers['Authorization'] = `Bearer ${this.bearerToken}`;
+                }
+                break;
+            case 'none':
+            default:
+                break;
+        }
+        return headers;
+    }
+}
+// =============================================================================
+// Factory Registration
+// =============================================================================
+/**
+ * Create an Elasticsearch connector
+ */
+export function createElasticConnector(config) {
+    return new ElasticConnector(config);
+}
+// Register the factory
+registerConnectorFactory('elastic', (config) => createElasticConnector(config));
+//# sourceMappingURL=elastic.js.map

package/dist/security/siem/elastic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elastic.js","sourceRoot":"","sources":["../../../src/security/siem/elastic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAG7E,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;AAqJ3D,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAiB,SAAQ,iBAAiB;IACrC,IAAI,GAAG,SAAS,CAAC;IAEhB,KAAK,CAAW;IAChB,IAAI,CAAiC;IACrC,MAAM,CAAU;IAChB,QAAQ,CAAU;IAClB,QAAQ,CAAU;IAClB,WAAW,CAAU;IACrB,KAAK,CAAS;IACd,QAAQ,CAAU;IAClB,SAAS,CAAU;IACnB,OAAO,CAAiC;IAEjD,gBAAgB,GAAG,CAAC,CAAC;IAE7B,YAAY,MAA8B;QACxC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEd,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE9B,MAAM,CAAC,IAAI,CACT;YACE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACxB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,EACD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,SAAS;QACvB,+BAA+B;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,mCAAmC;QACnC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,YAAY;QAC1B,2DAA2D;IAC7D,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,MAAM,CAAC,MAAuB;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC1C,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC;gBAC/B,WAAW,IAAI,MAAM,CAAC,YAAY,CAAC;gBACnC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC1B,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAClC,sCAAsC,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,WAAW,KAAK,CAAC;YAC1B,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,CAAC;YACb,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAQ,CAAC,MAAuB;QAC5C,iCAAiC;QACjC,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAe;gBACzB,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;oBAChC,GAAG,EAAE,KAAK,CAAC,EAAE;iBACd;aACF,CAAC;YAEF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YACxC,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAErC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;QACpC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,GAAG,IAAI,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAe;YACpD,GAAG;YACH,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,IAAI,CAAC,cAAc,EAAE;gBACxB,cAAc,EAAE,sBAAsB;aACvC;YACD,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;QAE7B,+BAA+B;QAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACxD,IAAI,EAAE,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,CAAC;gBACT,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;oBACE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;oBACrB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;oBACzB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;iBACxB,EACD,uBAAuB,CACxB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM,KAAK,CAAC;YACrB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YACtD,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,aAAa;QAC3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAwB;gBAC7D,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB;gBACxC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE;gBAC9B,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YACpC,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,EACnC,mCAAmC,CACpC,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB;QAC/B,MAAM,YAAY,GAAG,wBAAwB,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC3C,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QAEtB,MAAM,QAAQ,GAAG;YACf,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,QAAQ,EAAE;gBACR,QAAQ,EAAE;oBACR,gBAAgB,EAAE,CAAC;oBACnB,kBAAkB,EAAE,CAAC;oBACrB,sBAAsB,EAAE,wBAAwB;oBAChD,gCAAgC,EAAE,IAAI,CAAC,KAAK;iBAC7C;gBACD,QAAQ,EAAE;oBACR,UAAU,EAAE;wBACV,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBACzB,KAAK,EAAE;4BACL,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCACvB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCACzB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;6BAC1B;yBACF;wBACD,MAAM,EAAE;4BACN,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;gCAClB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCAC3B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;6BACzB;yBACF;wBACD,WAAW,EAAE;4BACX,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;gCAClB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCAC3B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;6BACzB;yBACF;wBACD,IAAI,EAAE;4BACJ,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCACvB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCACzB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;6BAC3B;yBACF;wBACD,YAAY,EAAE;4BACZ,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCACvB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;6BAC1B;yBACF;wBACD,GAAG,EAAE;4BACH,UAAU,EAAE;gCACV,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCACjC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCACrC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gCAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;6BAC9B;yBACF;wBACD,MAAM,EAAE;4BACN,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,UAAU,EAAE;wCACV,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wCACzB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wCAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;qCAC9B;iCACF;6BACF;yBACF;wBACD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wBACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;qBAC3C;iBACF;aACF;YACD,QAAQ,EAAE,GAAG;SACd,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,CAAC;gBACrB,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,oBAAoB,YAAY,EAAE;gBACxD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE;gBAC9B,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,EACnC,qDAAqD,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,KAAoB;QACxC,MAAM,GAAG,GAAoB;YAC3B,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YAC3C,KAAK,EAAE;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC1B,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;gBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;aACvC;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,SAAS;QACT,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC9E,GAAG,CAAC,MAAM,GAAG;gBACX,EAAE,EAAE,KAAK,CAAC,QAAQ;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,MAAM,EAAE,KAAK,CAAC,UAAU;gBACxB,GAAG,EAAE,KAAK,CAAC,SAAS;aACrB,CAAC;QACJ,CAAC;QAED,cAAc;QACd,IACE,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,eAAe;YACrB,KAAK,CAAC,eAAe;YACrB,KAAK,CAAC,cAAc,EACpB,CAAC;YACD,GAAG,CAAC,WAAW,GAAG;gBAChB,EAAE,EAAE,KAAK,CAAC,aAAa;gBACvB,IAAI,EAAE,KAAK,CAAC,eAAe;gBAC3B,MAAM,EAAE,KAAK,CAAC,eAAe;gBAC7B,GAAG,EAAE,KAAK,CAAC,cAAc;aAC1B,CAAC;QACJ,CAAC;QAED,UAAU;QACV,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,GAAG,CAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,OAAO;QACP,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YAClD,CAAC;YACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,MAAM;QACN,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC;QAED,aAAa;QACb,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,GAAG,CAAC,UAAU,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACjD,CAAC;QAED,UAAU;QACV,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,GAAG;gBACZ,IAAI,EAAE,KAAK,CAAC,WAAW;gBACvB,GAAG,EAAE,KAAK,CAAC,SAAS;aACrB,CAAC;QACJ,CAAC;QAED,OAAO;QACP,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,GAAG,CAAC,IAAI,GAAG;gBACT,IAAI,EAAE,KAAK,CAAC,QAAQ;aACrB,CAAC;YACF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,OAAO;QACP,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,GAAG;gBACT,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;gBACzB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;gBACvB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;aACxB,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,eAAe;QACf,IAAI,KAAK,CAAC,IAAI,EAAE,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;YACnD,GAAG,CAAC,YAAY,GAAG;gBACjB,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM;QACN,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,GAAG,GAAG;gBACR,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO;gBAC/B,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW;gBACvC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;gBACzB,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;gBAC7B,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;aAC7B,CAAC;YACF,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC1E,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG;oBACjB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;oBACvB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;iBACzB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,SAAS;QACT,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,GAAG;gBACX,SAAS,EAAE;oBACT,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;oBAC7B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE;oBAC/C,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;oBAC7B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;oBACjD,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE;iBAChD;aACF,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;QAED,OAAO;QACP,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,CAAC;QAED,0BAA0B;QAC1B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC1B,CAAC;qBAAM,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,GAAG,CAAC,MAAM,GAAG;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,GAAG,EAAE,KAAK,CAAC,OAAO;SACnB,CAAC;QAEF,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,KAAoB;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC;QAC7B,OAAO,IAAI,CAAC,KAAK;aACd,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC;aACrD,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAClE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACK,OAAO;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/C,IAAI,CAAC,gBAAgB,GAAG,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAE3C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,QAAQ;gBACX,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrD,CAAC;gBACD,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CACvE,QAAQ,CACT,CAAC;oBACF,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,OAAO,EAAE,CAAC;gBAChD,CAAC;gBACD,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1D,CAAC;gBACD,MAAM;YACR,KAAK,MAAM,CAAC;YACZ;gBACE,MAAM;QACV,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA8B;IAE9B,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,uBAAuB;AACvB,wBAAwB,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAC7C,sBAAsB,CAAC,MAAgC,CAAC,CACzD,CAAC"}

package/dist/security/siem/enrichment.d.ts

@@ -0,0 +1,133 @@
+/**
+ * SIEM Event Enrichment
+ *
+ * Provides event enrichment capabilities:
+ * - Geo-location data from IP addresses
+ * - Threat intelligence context
+ * - User context (role, tenant)
+ * - Field name normalization
+ *
+ * @packageDocumentation
+ * @module security/siem/enrichment
+ */
+import type { SecurityEvent, EnrichmentConfig, GeoLocation, ThreatContext, UserContext, GeoEnrichmentConfig, ThreatEnrichmentConfig, UserEnrichmentConfig } from './types.js';
+/**
+ * Enrichment result
+ */
+export interface EnrichmentResult {
+    /** Enriched event */
+    event: SecurityEvent;
+    /** Fields that were enriched */
+    enrichedFields: string[];
+    /** Errors during enrichment */
+    errors: Array<{
+        field: string;
+        error: string;
+    }>;
+    /** Time taken in milliseconds */
+    durationMs: number;
+}
+/**
+ * Provider interface for geo enrichment
+ */
+export interface GeoEnrichmentProvider {
+    /** Lookup geo data for an IP address */
+    lookup(ip: string): Promise<GeoLocation | null>;
+}
+/**
+ * Default geo enrichment provider using external service
+ */
+export declare class DefaultGeoProvider implements GeoEnrichmentProvider {
+    private readonly serviceUrl?;
+    private readonly cache;
+    private readonly cacheTtlMs;
+    constructor(config: GeoEnrichmentConfig);
+    lookup(ip: string): Promise<GeoLocation | null>;
+    private isPrivateIp;
+}
+/**
+ * Provider interface for threat intelligence enrichment
+ */
+export interface ThreatEnrichmentProvider {
+    /** Lookup threat data for an indicator */
+    lookup(indicator: string, type: string): Promise<ThreatContext | null>;
+}
+/**
+ * Default threat intelligence provider
+ */
+export declare class DefaultThreatProvider implements ThreatEnrichmentProvider {
+    private readonly serviceUrl?;
+    private readonly apiKey?;
+    private readonly cache;
+    private readonly cacheTtlMs;
+    constructor(config: ThreatEnrichmentConfig);
+    lookup(indicator: string, type: string): Promise<ThreatContext | null>;
+}
+/**
+ * Provider interface for user context enrichment
+ */
+export interface UserEnrichmentProvider {
+    /** Lookup user data by user ID */
+    lookup(userId: string): Promise<UserContext | null>;
+}
+/**
+ * Default user enrichment provider
+ */
+export declare class DefaultUserProvider implements UserEnrichmentProvider {
+    private readonly serviceUrl?;
+    private readonly includeRoles;
+    private readonly includeGroups;
+    private readonly includeTenant;
+    private readonly cache;
+    private readonly cacheTtlMs;
+    constructor(config: UserEnrichmentConfig);
+    lookup(userId: string): Promise<UserContext | null>;
+}
+/**
+ * Event enricher that combines multiple enrichment sources
+ */
+export declare class EventEnricher {
+    private readonly config;
+    private readonly geoProvider?;
+    private readonly threatProvider?;
+    private readonly userProvider?;
+    private readonly fieldNormalization;
+    constructor(config: EnrichmentConfig, options?: {
+        geoProvider?: GeoEnrichmentProvider;
+        threatProvider?: ThreatEnrichmentProvider;
+        userProvider?: UserEnrichmentProvider;
+    });
+    /**
+     * Enrich a security event
+     */
+    enrich(event: SecurityEvent): Promise<EnrichmentResult>;
+    /**
+     * Enrich multiple events
+     */
+    enrichBatch(events: SecurityEvent[]): Promise<EnrichmentResult[]>;
+    /**
+     * Get a field value from an event
+     */
+    private getFieldValue;
+    /**
+     * Get indicator type based on field name
+     */
+    private getIndicatorType;
+    /**
+     * Normalize field names
+     */
+    private normalizeFields;
+}
+/**
+ * Create an event enricher
+ */
+export declare function createEventEnricher(config: EnrichmentConfig, options?: {
+    geoProvider?: GeoEnrichmentProvider;
+    threatProvider?: ThreatEnrichmentProvider;
+    userProvider?: UserEnrichmentProvider;
+}): EventEnricher;
+/**
+ * Create a no-op enricher (passthrough)
+ */
+export declare function createNoOpEnricher(): EventEnricher;
+//# sourceMappingURL=enrichment.d.ts.map

package/dist/security/siem/enrichment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrichment.d.ts","sourceRoot":"","sources":["../../../src/security/siem/enrichment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EACV,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAQpB;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,KAAK,EAAE,aAAa,CAAC;IACrB,gCAAgC;IAChC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,+BAA+B;IAC/B,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB;AAcD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjD;AAED;;GAEG;AACH,qBAAa,kBAAmB,YAAW,qBAAqB;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqD;IAC3E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,MAAM,EAAE,mBAAmB;IAKjC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA+CrD,OAAO,CAAC,WAAW;CAgCpB;AAMD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,0CAA0C;IAC1C,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CACxE;AAED;;GAEG;AACH,qBAAa,qBAAsB,YAAW,wBAAwB;IACpE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuD;IAC7E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,MAAM,EAAE,sBAAsB;IAMpC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAqE7E;AAMD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kCAAkC;IAClC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,qBAAa,mBAAoB,YAAW,sBAAsB;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqD;IAC3E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,MAAM,EAAE,oBAAoB;IAQlC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;CAmD1D;AAMD;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAwB;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAyB;IACvD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyB;gBAG1D,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,qBAAqB,CAAC;QACpC,cAAc,CAAC,EAAE,wBAAwB,CAAC;QAC1C,YAAY,CAAC,EAAE,sBAAsB,CAAC;KACvC;IAoBH;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiG7D;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAgBvE;;OAEG;IACH,OAAO,CAAC,aAAa;IAcrB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAmBxB;;OAEG;IACH,OAAO,CAAC,eAAe;CAyBxB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE;IACR,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,YAAY,CAAC,EAAE,sBAAsB,CAAC;CACvC,GACA,aAAa,CAEf;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,aAAa,CAElD"}