@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Audit Event Dispatcher Backend Service
+ *
+ * Layer 2 of the three-layer audit event pipeline (Step 18).
+ * Receives audit events after MongoDB write and dispatches them
+ * to the organization's SIEM endpoint if configured.
+ *
+ * This is fire-and-forget — if dispatch fails, the audit log
+ * in MongoDB remains authoritative.
+ */
+import 'reflect-metadata';
+import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
+import { AppConfigurationService } from '../../../config/services/app-configuration.backend.service.js';
+import { AuthOrganizationConfigurationService } from '../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
+import { RepositoriesRegistryHandlerBackendService } from '../../../base-classes/services/repositories/repositories-registry-handler.backend.service.js';
+import { QueueBackendService } from '../../../queue/queue.backend.service.js';
+import { type SecurityAuditEventEnvelope, type AuditableEvent } from '@wildo-ai/saas-models';
+import type { ExecutionContext } from '../../../runtime/models/execution-context.backend.schemas.js';
+export declare class AuditEventDispatcherBackendService {
+    private readonly logger;
+    private readonly appConfigService;
+    private readonly orgConfigService;
+    private readonly queueService;
+    private readonly repositoriesRegistry;
+    private readonly logDebug;
+    /** F3: Lightweight org name cache to avoid per-event DB lookups */
+    private readonly _orgNameCache;
+    constructor(logger: LoggerService, appConfigService: AppConfigurationService, orgConfigService: AuthOrganizationConfigurationService, queueService: QueueBackendService, repositoriesRegistry: RepositoriesRegistryHandlerBackendService);
+    /**
+     * Dispatch an audit event to the organization's SIEM endpoint.
+     *
+     * Called after the audit event is written to MongoDB (Layer 1).
+     * This is fire-and-forget: failures are logged but never thrown.
+     *
+     * Critical Note #7: This wires directly into AuditLogsBackendService
+     * after MongoDB write — NOT as a resource pipeline post-hook.
+     */
+    dispatchToOrganizationSIEM(ec: ExecutionContext<any>, auditEvent: Omit<AuditableEvent, '_id' | 'createdAt' | 'updatedAt'>, organizationId: string): Promise<void>;
+    /**
+     * Check if an event passes the org's SIEM event filter.
+     */
+    private _passesEventFilter;
+    /**
+     * Build a SecurityAuditEventEnvelope from an audit event.
+     */
+    private _buildEnvelope;
+    /**
+     * Infer success/failure outcome from event type.
+     */
+    private _inferOutcome;
+    /**
+     * F3: Resolve organization name with a lightweight in-memory cache.
+     * Cache entries expire after ORG_NAME_CACHE_TTL_MS to pick up renames.
+     * Returns undefined if lookup fails (fire-and-forget context — don't throw).
+     */
+    private _resolveOrgName;
+    /**
+     * F6: Compute HMAC-SHA256 over the serialized envelope for integrity protection.
+     * The delivery service verifies this HMAC before processing, detecting queue tampering.
+     */
+    private _computeEnvelopeHmac;
+    /**
+     * Derive a 256-bit HMAC key from the app's session encryption key
+     * using SHA-256 with a domain separator (consistent with SIEM encryption key derivation).
+     */
+    private _getHmacKey;
+    /**
+     * F6: Public static-like method to verify envelope HMAC on the delivery side.
+     * Returns true if the HMAC matches, false otherwise.
+     */
+    verifyEnvelopeHmac(envelope: SecurityAuditEventEnvelope, expectedHmac: string): boolean;
+}
+//# sourceMappingURL=audit-event-dispatcher.backend.service.d.ts.map

package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-event-dispatcher.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/services/audit-event-dispatcher.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAKL,KAAK,0BAA0B,EAG/B,KAAK,cAAc,EAGpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAgB5G,qBACa,kCAAkC;IAOR,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY;IACd,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAVtG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyD;gBAGjC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACrB,gBAAgB,EAAE,oCAAoC,EACvE,YAAY,EAAE,mBAAmB,EAClB,oBAAoB,EAAE,yCAAyC;IAMjJ;;;;;;;;OAQG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,WAAW,GAAG,WAAW,CAAC,EACnE,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC;IA2EhB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA6B1B;;OAEG;IACH,OAAO,CAAC,cAAc;IA2CtB;;OAEG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;OAIG;YACW,eAAe;IAiC7B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;;OAGG;IACH,OAAO,CAAC,WAAW;IAMnB;;;OAGG;IACI,kBAAkB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;CAQ/F"}

package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.js

@@ -0,0 +1,291 @@
+/**
+ * Audit Event Dispatcher Backend Service
+ *
+ * Layer 2 of the three-layer audit event pipeline (Step 18).
+ * Receives audit events after MongoDB write and dispatches them
+ * to the organization's SIEM endpoint if configured.
+ *
+ * This is fire-and-forget — if dispatch fails, the audit log
+ * in MongoDB remains authoritative.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import 'reflect-metadata';
+import { inject, injectable } from 'inversify';
+import { v4 as uuidv4 } from 'uuid';
+import { createHmac, createHash, timingSafeEqual } from 'crypto';
+import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
+import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
+import { AppConfigurationService } from '../../../config/services/app-configuration.backend.service.js';
+import { AuthOrganizationConfigurationService } from '../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
+import { RepositoriesRegistryHandlerBackendService } from '../../../base-classes/services/repositories/repositories-registry-handler.backend.service.js';
+import { QueueBackendService } from '../../../queue/queue.backend.service.js';
+import { AuditEventOutcome, CoreAuditableEventType, CoreResourceType, getAuditEventClassification, AuthScopeType, } from '@wildo-ai/saas-models';
+/** F6: HMAC domain separator for event integrity */
+const SIEM_HMAC_DOMAIN = 'wildo:siem:event-integrity:v1';
+/** F3: Org name cache TTL (5 minutes) */
+const ORG_NAME_CACHE_TTL_MS = 5 * 60 * 1000;
+/** B4: Max entries in org name cache to prevent unbounded growth */
+const ORG_NAME_CACHE_MAX_SIZE = 1000;
+/** Severity ordering for minimum severity filtering */
+const SEVERITY_ORDER = {
+    'info': 0,
+    'warning': 1,
+    'critical': 2,
+};
+let AuditEventDispatcherBackendService = class AuditEventDispatcherBackendService {
+    logger;
+    appConfigService;
+    orgConfigService;
+    queueService;
+    repositoriesRegistry;
+    logDebug;
+    /** F3: Lightweight org name cache to avoid per-event DB lookups */
+    _orgNameCache = new Map();
+    constructor(logger, appConfigService, orgConfigService, queueService, repositoriesRegistry) {
+        this.logger = logger;
+        this.appConfigService = appConfigService;
+        this.orgConfigService = orgConfigService;
+        this.queueService = queueService;
+        this.repositoriesRegistry = repositoriesRegistry;
+        this.logDebug = this.logger.debugByType('AuditEventDispatcherBackendService');
+        this.logger.setDebugTypeLogging('AuditEventDispatcherBackendService', false);
+    }
+    /**
+     * Dispatch an audit event to the organization's SIEM endpoint.
+     *
+     * Called after the audit event is written to MongoDB (Layer 1).
+     * This is fire-and-forget: failures are logged but never thrown.
+     *
+     * Critical Note #7: This wires directly into AuditLogsBackendService
+     * after MongoDB write — NOT as a resource pipeline post-hook.
+     */
+    async dispatchToOrganizationSIEM(ec, auditEvent, organizationId) {
+        try {
+            // No org → no SIEM dispatch
+            if (!organizationId)
+                return;
+            // Two-level feature gate for CoreFeature.SECURITY_EVENT_EXPORT:
+            // Level 1 (here): Check config.enabled — this is the runtime gate.
+            // Level 2 (Step 19 admin API): FeatureGateService checks the org's subscription
+            //   tier has SECURITY_EVENT_EXPORT before allowing config.enabled = true.
+            // We cannot use FeatureResolutionService here because:
+            //   - This runs in an async fire-and-forget context (no user ExecutionContext)
+            //   - Internal ExecutionContexts bypass feature resolution (return all enabled)
+            // The config.enabled flag IS the pre-validated per-org gate.
+            const siemConfig = await this.orgConfigService.loadSiemExportConfig(ec, AuthScopeType.ORGANIZATION, organizationId);
+            if (!siemConfig || !siemConfig.enabled)
+                return;
+            // Classify the event (always returns a value; defaults to data_access/info for unknown types)
+            const classification = getAuditEventClassification(auditEvent.eventType);
+            // Apply event filter
+            if (!this._passesEventFilter(auditEvent.eventType, classification, siemConfig)) {
+                this.logDebug('Event filtered out by SIEM config', {
+                    eventType: auditEvent.eventType,
+                    organizationId,
+                });
+                return;
+            }
+            // F3: Resolve org name for SIEM analyst readability
+            const orgName = await this._resolveOrgName(ec, organizationId);
+            // Extract application context from eventData if available
+            const appId = auditEvent.eventData?.applicationId;
+            const appName = auditEvent.eventData?.applicationName;
+            // Build the envelope (F3: includes orgName, Task 3.12c: includes app context)
+            const envelope = this._buildEnvelope(auditEvent, organizationId, classification, orgName, appId, appName);
+            // F6: Compute HMAC integrity signature over the envelope payload
+            const envelopeHmac = this._computeEnvelopeHmac(envelope);
+            // Enqueue for async delivery via the SIEM webhook delivery worker
+            await this.queueService.enqueueCustomBatch('siem.webhook-delivery', {
+                envelope,
+                envelopeHmac,
+                organizationId,
+                siemConfig: {
+                    webhookUrl: siemConfig.webhookUrl,
+                    authMethod: siemConfig.authMethod,
+                    authCredential: siemConfig.authCredential,
+                    authHeaderName: siemConfig.authHeaderName,
+                    eventFormat: siemConfig.eventFormat,
+                    customHeaders: siemConfig.customHeaders,
+                    delivery: siemConfig.delivery,
+                },
+            });
+            this.logDebug('Audit event enqueued for SIEM delivery', {
+                eventId: envelope.eventId,
+                eventType: auditEvent.eventType,
+                organizationId,
+            });
+        }
+        catch (error) {
+            // Fire-and-forget: never throw from SIEM dispatch
+            this.logger.error?.('Failed to dispatch audit event to SIEM', {
+                error,
+                eventType: auditEvent.eventType,
+                organizationId,
+            });
+        }
+    }
+    /**
+     * Check if an event passes the org's SIEM event filter.
+     */
+    _passesEventFilter(eventType, classification, config) {
+        const filter = config.eventFilter;
+        // Check category filter
+        if (!filter.categories.includes(classification.category)) {
+            return false;
+        }
+        // Check severity minimum
+        const eventSeverityOrder = SEVERITY_ORDER[classification.severity] ?? 0;
+        const minimumSeverityOrder = SEVERITY_ORDER[filter.severityMinimum] ?? 0;
+        if (eventSeverityOrder < minimumSeverityOrder) {
+            return false;
+        }
+        // Check specific event type filter (if configured)
+        if (filter.specificEventTypes && filter.specificEventTypes.length > 0) {
+            if (!filter.specificEventTypes.includes(eventType)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Build a SecurityAuditEventEnvelope from an audit event.
+     */
+    _buildEnvelope(auditEvent, organizationId, classification, organizationName, applicationId, applicationName) {
+        const eventData = auditEvent.eventData;
+        return {
+            eventId: uuidv4(),
+            eventType: auditEvent.eventType,
+            eventCategory: classification.category,
+            severity: classification.severity,
+            timestamp: new Date().toISOString(),
+            organizationId,
+            organizationName, // F3: Populated via org name cache
+            applicationId,
+            applicationName,
+            userId: auditEvent.userId,
+            userEmail: eventData.email || undefined,
+            sourceService: this.appConfigService.applicationId,
+            sourceVersion: process.env.APP_VERSION || '0.0.0',
+            sourceEnvironment: this.appConfigService.applicationEnv,
+            // Auth-specific context from eventData (when applicable)
+            authMethod: eventData.authMethod || undefined,
+            authSource: eventData.authSource || undefined,
+            providerRef: eventData.providerRef || undefined,
+            connectionType: eventData.connectionType || undefined,
+            ipAddress: eventData.ipAddress || undefined,
+            userAgent: eventData.userAgent || undefined,
+            eventData: eventData,
+            outcome: this._inferOutcome(auditEvent.eventType),
+            outcomeReason: eventData.failureReason || eventData.reason || undefined,
+        };
+    }
+    /**
+     * Infer success/failure outcome from event type.
+     */
+    _inferOutcome(eventType) {
+        const failureEventTypes = [
+            CoreAuditableEventType.USER_LOGIN_FAILED,
+            CoreAuditableEventType.USER_ACCOUNT_LOCKED,
+            CoreAuditableEventType.USER_SSO_LOGIN_FAILED,
+            CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED,
+            CoreAuditableEventType.SAML_LOGIN_FAILED,
+            CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED,
+        ];
+        return failureEventTypes.includes(eventType) ? AuditEventOutcome.FAILURE : AuditEventOutcome.SUCCESS;
+    }
+    // ─────────────────────────────────────────────────────────────
+    // F3: Organization Name Cache
+    // ─────────────────────────────────────────────────────────────
+    /**
+     * F3: Resolve organization name with a lightweight in-memory cache.
+     * Cache entries expire after ORG_NAME_CACHE_TTL_MS to pick up renames.
+     * Returns undefined if lookup fails (fire-and-forget context — don't throw).
+     */
+    async _resolveOrgName(ec, organizationId) {
+        // Check cache first
+        const cached = this._orgNameCache.get(organizationId);
+        if (cached && (Date.now() - cached.cachedAt) < ORG_NAME_CACHE_TTL_MS) {
+            return cached.name;
+        }
+        try {
+            const orgsRepo = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.ORGANIZATIONS);
+            const org = await orgsRepo.read(ec, organizationId);
+            if (org?.name) {
+                // B4: Evict oldest entries when cache exceeds max size (simple LRU approximation)
+                if (this._orgNameCache.size >= ORG_NAME_CACHE_MAX_SIZE) {
+                    const oldestKey = this._orgNameCache.keys().next().value;
+                    if (oldestKey !== undefined) {
+                        this._orgNameCache.delete(oldestKey);
+                    }
+                }
+                this._orgNameCache.set(organizationId, { name: org.name, cachedAt: Date.now() });
+                return org.name;
+            }
+        }
+        catch {
+            // Fire-and-forget — org name is optional in the envelope
+        }
+        return undefined;
+    }
+    // ─────────────────────────────────────────────────────────────
+    // F6: Event Integrity (HMAC)
+    // ─────────────────────────────────────────────────────────────
+    /**
+     * F6: Compute HMAC-SHA256 over the serialized envelope for integrity protection.
+     * The delivery service verifies this HMAC before processing, detecting queue tampering.
+     */
+    _computeEnvelopeHmac(envelope) {
+        const hmacKey = this._getHmacKey();
+        return createHmac('sha256', hmacKey)
+            .update(JSON.stringify(envelope))
+            .digest('hex');
+    }
+    /**
+     * Derive a 256-bit HMAC key from the app's session encryption key
+     * using SHA-256 with a domain separator (consistent with SIEM encryption key derivation).
+     */
+    _getHmacKey() {
+        return createHash('sha256')
+            .update(`${SIEM_HMAC_DOMAIN}:${this.appConfigService.secrets.security.session.encryptionKey}`)
+            .digest();
+    }
+    /**
+     * F6: Public static-like method to verify envelope HMAC on the delivery side.
+     * Returns true if the HMAC matches, false otherwise.
+     */
+    verifyEnvelopeHmac(envelope, expectedHmac) {
+        const computedHmac = this._computeEnvelopeHmac(envelope);
+        // Use crypto.timingSafeEqual for constant-time comparison (prevents timing attacks)
+        const computedBuf = Buffer.from(computedHmac, 'utf-8');
+        const expectedBuf = Buffer.from(expectedHmac, 'utf-8');
+        if (computedBuf.length !== expectedBuf.length)
+            return false;
+        return timingSafeEqual(computedBuf, expectedBuf);
+    }
+};
+AuditEventDispatcherBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.QueueBackendService)),
+    __param(4, inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService)),
+    __metadata("design:paramtypes", [LoggerService,
+        AppConfigurationService,
+        AuthOrganizationConfigurationService,
+        QueueBackendService,
+        RepositoriesRegistryHandlerBackendService])
+], AuditEventDispatcherBackendService);
+export { AuditEventDispatcherBackendService };
+//# sourceMappingURL=audit-event-dispatcher.backend.service.js.map

package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-event-dispatcher.backend.service.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/services/audit-event-dispatcher.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,EAM3B,aAAa,GACd,MAAM,uBAAuB,CAAC;AAG/B,oDAAoD;AACpD,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,yCAAyC;AACzC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,oEAAoE;AACpE,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,uDAAuD;AACvD,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,CAAC;IACT,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;CACd,CAAC;AAGK,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAOS;IACU;IACoB;IACjB;IACe;IAVjE,QAAQ,CAA+D;IAExF,mEAAmE;IAClD,aAAa,GAAG,IAAI,GAAG,EAA8C,CAAC;IAEvF,YACsD,MAAqB,EACX,gBAAyC,EACrB,gBAAsD,EACvE,YAAiC,EAClB,oBAA+D;QAJ3F,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACrB,qBAAgB,GAAhB,gBAAgB,CAAsC;QACvE,iBAAY,GAAZ,YAAY,CAAqB;QAClB,yBAAoB,GAApB,oBAAoB,CAA2C;QAE/I,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,0BAA0B,CACrC,EAAyB,EACzB,UAAmE,EACnE,cAAsB;QAEtB,IAAI,CAAC;YACH,4BAA4B;YAC5B,IAAI,CAAC,cAAc;gBAAE,OAAO;YAE5B,gEAAgE;YAChE,mEAAmE;YACnE,gFAAgF;YAChF,0EAA0E;YAC1E,uDAAuD;YACvD,+EAA+E;YAC/E,gFAAgF;YAChF,6DAA6D;YAC7D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YACpH,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO;gBAAE,OAAO;YAE/C,8FAA8F;YAC9F,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAEzE,qBAAqB;YACrB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC/E,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE;oBACjD,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,cAAc;iBACf,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,oDAAoD;YACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;YAE/D,0DAA0D;YAC1D,MAAM,KAAK,GAAI,UAAU,CAAC,SAAqC,EAAE,aAAmC,CAAC;YACrG,MAAM,OAAO,GAAI,UAAU,CAAC,SAAqC,EAAE,eAAqC,CAAC;YAEzG,8EAA8E;YAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAE1G,iEAAiE;YACjE,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAEzD,kEAAkE;YAClE,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CACxC,uBAAuB,EACvB;gBACE,QAAQ;gBACR,YAAY;gBACZ,cAAc;gBACd,UAAU,EAAE;oBACV,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,cAAc,EAAE,UAAU,CAAC,cAAc;oBACzC,cAAc,EAAE,UAAU,CAAC,cAAc;oBACzC,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,aAAa,EAAE,UAAU,CAAC,aAAa;oBACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;iBAC9B;aACF,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACtD,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kDAAkD;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,wCAAwC,EAAE;gBAC5D,KAAK;gBACL,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,SAAiB,EACjB,cAA8F,EAC9F,MAA4B;QAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;QAElC,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yBAAyB;QACzB,MAAM,kBAAkB,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,oBAAoB,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mDAAmD;QACnD,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,UAAmE,EACnE,cAAsB,EACtB,cAA8F,EAC9F,gBAAyB,EACzB,aAAsB,EACtB,eAAwB;QAExB,MAAM,SAAS,GAAG,UAAU,CAAC,SAAoC,CAAC;QAElE,OAAO;YACL,OAAO,EAAE,MAAM,EAAE;YACjB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,cAAc,CAAC,QAAQ;YACtC,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAEnC,cAAc;YACd,gBAAgB,EAAE,mCAAmC;YACrD,aAAa;YACb,eAAe;YACf,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAG,SAAS,CAAC,KAAgB,IAAI,SAAS;YAEnD,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;YAClD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO;YACjD,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc;YAEvD,yDAAyD;YACzD,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,SAAS;YACzD,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,SAAS;YACzD,WAAW,EAAG,SAAS,CAAC,WAAsB,IAAI,SAAS;YAC3D,cAAc,EAAG,SAAS,CAAC,cAAyB,IAAI,SAAS;YACjE,SAAS,EAAG,SAAS,CAAC,SAAoB,IAAI,SAAS;YACvD,SAAS,EAAG,SAAS,CAAC,SAAoB,IAAI,SAAS;YAEvD,SAAS,EAAE,SAAgC;YAE3C,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,aAAa,EAAG,SAAS,CAAC,aAAwB,IAAK,SAAS,CAAC,MAAiB,IAAI,SAAS;SAChG,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,SAAiB;QACrC,MAAM,iBAAiB,GAAG;YACxB,sBAAsB,CAAC,iBAAiB;YACxC,sBAAsB,CAAC,mBAAmB;YAC1C,sBAAsB,CAAC,qBAAqB;YAC5C,sBAAsB,CAAC,4BAA4B;YACnD,sBAAsB,CAAC,iBAAiB;YACxC,sBAAsB,CAAC,8BAA8B;SACtD,CAAC;QAEF,OAAO,iBAAiB,CAAC,QAAQ,CAAC,SAAmC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC;IACjI,CAAC;IAED,gEAAgE;IAChE,8BAA8B;IAC9B,gEAAgE;IAEhE;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,cAAsB;QAC7E,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,qBAAqB,EAAE,CAAC;YACrE,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAChG,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAgC,EAAE,EAAE,cAAc,CAAC,CAAC;YAEnF,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC;gBACd,kFAAkF;gBAClF,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,uBAAuB,EAAE,CAAC;oBACvD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;oBACzD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACjF,OAAO,GAAG,CAAC,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,gEAAgE;IAChE,6BAA6B;IAC7B,gEAAgE;IAEhE;;;OAGG;IACK,oBAAoB,CAAC,QAAoC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;aACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;aAChC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,WAAW;QACjB,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,GAAG,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;aAC7F,MAAM,EAAE,CAAC;IACd,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,QAAoC,EAAE,YAAoB;QAClF,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACzD,oFAAoF;QACpF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC5D,OAAO,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAlRY,kCAAkC;IAD9C,UAAU,EAAE;IAQR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;qCAJF,aAAa;QACO,uBAAuB;QACH,oCAAoC;QACzD,mBAAmB;QACI,yCAAyC;GAXtI,kCAAkC,CAkR9C"}