infracensus-collector 0.1.0

package/LICENSE

@@ -0,0 +1,23 @@
+InfraCensus Collector
+Copyright (c) 2026 Zentrosoft. All rights reserved.
+
+This software is proprietary. It is published to the npm registry so that
+licensed InfraCensus tenants can install and update the collector with
+standard tooling; publication is not a grant of rights.
+
+You may install and run this software only to connect infrastructure you
+control to an InfraCensus deployment you are licensed to use. You may not
+copy (except as required to install and run it), modify, translate, reverse
+engineer, decompile, disassemble, sublicense, sell, lease, or redistribute
+this software, in whole or in part, except as permitted by applicable law
+notwithstanding this restriction, or with prior written permission.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+Contact: info@infracensus.com

package/README.md

@@ -0,0 +1,323 @@
+# InfraCensus Collector
+
+**This is the operator's page.** It is written for the person who runs the
+collector on their own hardware, inside their own network, holding their own
+device credentials — not for us.
+
+The collector is **outbound-only on your network**. It polls the control plane;
+the control plane never connects in, and nothing here listens on a network
+interface. There is exactly one listener anywhere in the product and it is
+pinned to `127.0.0.1` — the local status UI, described below, unreachable from
+any other machine by construction and asserted at startup, not assumed.
+
+---
+
+## How it is organized — three planes
+
+### 1. The data plane
+
+```
+your network                     this host                                InfraCensus cloud
+────────────                     ─────────                                ─────────────────
+
+                    config: /etc/netdoc-collector/collector.env  (0600)
+                    identity + the collector key + device credentials
+                                     │
+                                     ▼
+switches, hosts,   ◄── scan ──  scan modules                 poll (outbound) ──►  control plane
+hypervisors,                    network · vmware · hyperv    ◄── scan jobs,       (never connects
+vCenter, SQL,                   sql · lb · voice · identity      cancellations,    into your
+Entra ID, Azure                 azure · config-import            restart signal)   network)
+                                     │
+                                     │  raw facts — device credentials are used
+                                     │  HERE and go no further
+                                     ▼
+                                canonical snapshot / inventory
+                                (normalized, redacted, stamped
+                                 with tenant + site)
+                                     │
+                                     ▼
+                                authenticated push ── Bearer collector key ──►  ingest
+                                     │
+                                     ▼
+                                use log (JSONL ledger on this host —
+                                your evidence of what was touched)
+
+browser ON THIS HOST ──► http://127.0.0.1:9477   the local UI (status, log tail,
+                                                 run-a-scan) — loopback only
+```
+
+Configuration is resolved once, locally. Scan modules read it, talk to your
+equipment, and hand back raw facts. Those facts are normalized into the
+canonical model, redacted, and pushed outbound with the collector's key. In
+daemon mode the same loop runs in reverse order: the collector polls for a job,
+the job carries the targets and credentials, and the snapshot is stamped from
+the job. Nothing is ever pushed that was not first normalized and redacted.
+
+### 2. The security boundaries
+
+**The collector key** authenticates this host to the control plane.
+
+- At rest it lives in exactly one file (`collector.env` /
+  `collector.config.json`), created empty and locked to mode `0600` (Linux) or
+  an explicit three-SID ACL (Windows) *before* the key is written into it.
+- It is **never a process argument** — there is no `--api-key` flag, and a test
+  asserts there never will be. Enrolment takes it at a muted prompt or from a
+  file whose *path* (not contents) was the argument.
+- It is **never logged**. Every log line and every ledger record passes through
+  a redactor that knows the key's value before the first line is written.
+
+**Device credentials** (SSH, SNMP, WMI, vCenter, SQL, Graph, Azure) are
+resolved on this host and used from this process. They are never placed in a
+snapshot, never logged (the redactor learns per-job credentials the moment a
+job is claimed, before the job is logged at all), and never sent anywhere. What
+leaves the building is the *result* of using them — and device configuration
+text is redacted here, before it leaves.
+
+**The local UI** is loopback-only with cloud-verified login:
+
+- It binds `127.0.0.1` explicitly and the daemon *checks the address the OS
+  actually bound* after listen, refusing to serve on anything else.
+- There are **no local accounts**. Signing in forwards your email and password
+  (with the collector's own key as the Bearer) to the control plane, which
+  accepts only an **active account of this collector's own tenant**. Disable
+  the account in the portal and the UI closes with it. No password is ever
+  stored — or logged — on this host.
+- Sessions are cookies signed with a **secret generated fresh at every daemon
+  start**, so restarting the daemon invalidates every session, and there is no
+  session secret at rest to protect. Cookies are HttpOnly, SameSite=Strict,
+  and expire after 8 hours. Five failed logins in fifteen minutes lock the
+  login for everyone until the oldest failure ages out — one limiter across
+  all sessions, because on loopback there is only one address.
+
+### 3. The UI plane — what it serves, and what it refuses to
+
+Serves, to a signed-in operator on this host:
+
+- daemon status: version, when it started, when it last polled the control
+  plane, when data last left this host;
+- a per-module table of last runs (read from the use-log ledger — the same
+  file that is your evidence, so the UI can never claim more than the ledger
+  holds);
+- the tail of the daemon log;
+- a **Run scan** button per module (spawns the same one-shot
+  `netdoc-collector scan <module>` you could type) and a **Restart** button
+  (the same restart path the portal's restart signal uses).
+
+Refuses, by construction:
+
+- to be reachable from any other machine (loopback bind, asserted);
+- to display the collector key, or any stored credential, anywhere — the
+  status payload is built from an allowlist that does not contain them, the
+  page is a static string with nothing interpolated into it, and a test holds
+  both;
+- to accept credentials for storage — there are no device-credential fields in
+  the UI; credentials are configured in the config file, on disk, under its
+  permissions;
+- to answer anything stateful without the session cookie;
+- to serve at all when `COLLECTOR_UI=0` — disabled means no listener exists,
+  not a listener that says no.
+
+---
+
+## Install
+
+The collector is distributed on the npm registry as **`infracensus-collector`**.
+The package installs one command, `netdoc-collector` (package name and command
+name differ on purpose, the way `typescript` installs `tsc`). Node.js 20 or
+newer is the only prerequisite.
+
+If Node/npm is not on the host yet — Linux: install Node.js 20+ from your
+distro or nodejs.org; e.g. RHEL/Fedora: `sudo dnf install nodejs npm` —
+Debian/Ubuntu: `sudo apt install nodejs npm` — or nvm. Windows:
+`winget install OpenJS.NodeJS.LTS` (or the nodejs.org installer).
+
+### Linux
+
+```bash
+sudo npm install -g infracensus-collector
+sudo netdoc-collector enrol              # prompts for the enrolment token; never an argument
+sudo netdoc-collector service install    # systemd unit, enabled and started
+```
+
+The service runs as the `netdoc-collector` system account, keeps its identity
+at `/etc/netdoc-collector/collector.env` (mode `0600` root:root, read by
+systemd before privileges drop), and writes everything — logs, ledger, PID —
+to `/var/lib/netdoc-collector`. An `npm update -g infracensus-collector`
+replaces the code without touching either.
+
+### Windows
+
+From an **ADMIN PowerShell**:
+
+```powershell
+npm install -g infracensus-collector
+netdoc-collector enrol                # prompts; the key is typed hidden, never an argument
+netdoc-collector service install      # registers and starts the Windows service
+```
+
+This registers the **InfraCensus Collector** Windows service (the SCM-level id
+is `infracensuscollector.exe`, derived by the service host — check it with
+`netdoc-collector service status` or
+`Get-Service -DisplayName "InfraCensus Collector"`). The identity lives under
+`C:\ProgramData\InfraCensus Collector` — locked to SYSTEM and Administrators,
+and deliberately outside the npm package so an uninstall or update of the code
+cannot destroy a key that was shown exactly once.
+
+### From a checkout (development / air-gap)
+
+`pnpm install` in this directory, then the `pnpm` aliases below; `pnpm build`
+bundles `dist/`. The CLI is the same code either way: `npx tsx src/cli.ts
+<command>` in a checkout is `netdoc-collector <command>` on an installed host.
+On an air-gapped Linux host, `sudo ./scripts/install.sh` registers the
+from-source checkout as a service without touching a registry.
+
+### Enrolment
+
+An enrolment is six values shown in the portal under **Admin → Collectors**,
+wrapped in one `enrol_…` token beside the key. The token **contains the key**:
+it is shown once, belongs in a password manager, and the prompt that takes it
+does not echo. An all-sites collector's token carries an empty org and site on
+purpose — such a collector runs as a daemon and takes tenant, site and targets
+from each job.
+
+---
+
+## Command reference
+
+One installed command, `netdoc-collector` (npm's `bin` shim onto `dist/cli.js`).
+`enrol` / `doctor` / `uselog` are standalone scripts underneath — they must
+work before, or without, a built collector — and the CLI routes those three
+subcommands to them, wiring the platform's config paths on the way.
+
+| Command | What it does |
+|---|---|
+| `netdoc-collector run` | The daemon: poll the control plane for scan jobs, serve the local UI. This is what the service unit runs. |
+| `netdoc-collector scan [module]` | ONE scan in the foreground, then exit. Default module: `network`. `--dry-run` builds the result and prints a summary without pushing. |
+| `netdoc-collector status` | Local status: enrolment, daemon liveness, last run per module. |
+| `netdoc-collector enrol` | Enrol this host (muted prompt; `--replace` re-keys an existing install). |
+| `netdoc-collector doctor` | Is it running, and is it talking to the cloud. Prints no credential, ever. |
+| `netdoc-collector uselog` | What this collector did on your network, from your own ledger. |
+| `netdoc-collector service install` | Register and start the background service (Linux: `sudo`, systemd — Windows: elevated, SCM). Refuses politely until the host is enrolled. |
+| `netdoc-collector service uninstall` | Stop and deregister the service. The identity and ledgers stay on disk, and it says so. |
+| `netdoc-collector service status` | Registered/active? Exit `0` running · `1` registered but stopped · `2` not installed. |
+| `netdoc-collector --version` | Print the version. |
+| `netdoc-collector --help` | Print usage. |
+
+Anything else prints the help and exits `2`.
+
+Scan modules: `network` (ICMP/ARP/SNMP/SSH sweep), `vmware`, `hyperv`, `sql`,
+`lb` (A10), `voice` (CUCM/Unity/Webex), `identity` (Microsoft Entra ID),
+`azure` (CSPM), `config-import` (offline device configs). Each reads its own
+section of the config; a module with nothing configured says what is missing
+and exits non-zero.
+
+Checkout equivalents: `pnpm scan`, `pnpm scan:dry`, `pnpm scan:daemon`,
+`pnpm vmware-scan`, `pnpm hyperv-scan`, `pnpm sql-scan`, `pnpm lb-scan`,
+`pnpm voice-scan`, `pnpm identity-scan`, `pnpm azure-scan`,
+`pnpm config-import`, `pnpm enrol`, `pnpm doctor`, `pnpm uselog`.
+
+---
+
+## The local UI
+
+```
+http://localhost:9477        # from a browser ON the collector host
+```
+
+Sign in with your InfraCensus account (an active account of this collector's
+tenant — there is nothing local to sign in to). The page shows the daemon's
+status, the per-module last-run table with Run-scan buttons, a Restart button,
+and the daemon log tail, refreshing every five seconds. A scan started from the
+UI runs as a separate process and narrates itself into the same log tail the
+page is already showing.
+
+Two environment variables control it — the only two the UI has:
+
+| Variable | Effect |
+|---|---|
+| `COLLECTOR_UI_PORT` | Port for the UI (default `9477`; always `127.0.0.1`). An unusable value falls back to the default rather than stopping the daemon. |
+| `COLLECTOR_UI=0` | Disable the UI entirely. The daemon then opens no port at all. |
+
+On an installed host, set them in `/etc/netdoc-collector/collector.env` (Linux)
+or the service environment (Windows) and restart the service.
+
+If the UI fails to start — a squatted port, say — the daemon logs a warning and
+keeps scanning. The status page is a convenience; the scans are the job.
+
+---
+
+## Check it, and see what it did
+
+```bash
+netdoc-collector doctor            # elevated on Windows: the config is ACL'd
+netdoc-collector status
+netdoc-collector uselog            # your evidence ledger, rendered
+```
+
+`doctor` answers "is it running, and is it talking to the cloud" entirely
+locally, printing values only from an allowlist of non-secret config keys; the
+key itself appears only as a short fingerprint. `uselog` renders the collector's
+own ledger — a rotated, redacted JSONL file (`collector-use.log`, ~25 MB hard
+ceiling) recording what was scanned, what was contacted, and what was sent
+where. It is your record, not our telemetry: nothing in it is transmitted, and
+deleting it costs only your own evidence.
+
+---
+
+## Uninstall
+
+```bash
+sudo netdoc-collector service uninstall && sudo npm uninstall -g infracensus-collector
+# full purge of config + ledgers afterwards (the uninstall prints this too):
+sudo rm -rf /etc/netdoc-collector /var/lib/netdoc-collector
+```
+
+```powershell
+# elevated:
+netdoc-collector service uninstall
+npm uninstall -g infracensus-collector
+```
+
+The identity is left on disk on purpose (the key in it was shown once); the
+uninstall names the directory and the purge command. Then remove the collector
+in the portal under **Admin → Collectors** — the uninstaller says this too.
+Until you do, its key remains valid for anyone who kept a copy.
+
+---
+
+## If something is wrong
+
+**It stops with no error in the log — check EDR / antivirus.** The daemon logs
+uncaught exceptions and keeps running, so a code fault always leaves an `ERROR`
+line; silence means the process was killed from outside. To a behavioural
+engine, a process that sweeps thousands of addresses, opens SSH sessions with
+stored credentials and spawns PowerShell for AD/WMI looks like lateral
+movement. Add a tightly-scoped exclusion and check the OS event log around the
+time it vanished.
+
+**Scans sit at "Waiting for a collector."** Either no collector is authorized
+for that site (portal, Admin → Collectors) or the collector is not polling
+(`doctor` on its host, or the UI's "last poll" timestamp).
+
+**The UI shows the login form and rejects a good password.** The control plane
+must be reachable *from the collector host* for login to verify — a 502 on the
+login call means the uplink, not the password. Also check the account is active
+and belongs to the same tenant as the collector.
+
+**It starts and immediately exits.** Run it in the foreground:
+`netdoc-collector run` (checkout: `npx tsx src/cli.ts run`). The usual causes
+are a missing or malformed config, an unreachable control plane URL, or a
+revoked key.
+
+---
+
+## Files on this host
+
+| File | Path (installed / checkout) |
+|---|---|
+| Config — holds the key | Linux `/etc/netdoc-collector/collector.env` · Windows `C:\ProgramData\InfraCensus Collector\collector.config.json` · checkout `collector.config.json` (override: `COLLECTOR_CONFIG`) |
+| Daemon log | Linux service `/var/lib/netdoc-collector/collector-daemon.log` · otherwise `collector-daemon.log` beside the package |
+| Use-log ledger | Linux service `/var/lib/netdoc-collector/collector-use.log` · otherwise `collector-use.log` beside the package (override: `COLLECTOR_USE_LOG`) |
+| PID file | `.collector-daemon.pid` beside the package (best-effort — under the sandboxed systemd unit, liveness is systemd's answer, not the file's) |
+| Bundled entrypoint | `dist/cli.js` — what npm's `bin` shim, the systemd unit and the Windows service all run |

package/dist/a10-index.js

@@ -0,0 +1,91 @@
+import {
+  AxapiClient,
+  buildLoadBalancerInventory
+} from "./chunk-7EGPKFND.js";
+import {
+  ROUTES
+} from "./chunk-ZIUWFLKI.js";
+
+// src/a10-index.ts
+var LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 };
+function makeLogger(minLevel = "info") {
+  const min = LEVEL_RANK[minLevel];
+  return (level, msg, meta) => {
+    if (LEVEL_RANK[level] < min) return;
+    const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${level.toUpperCase().padEnd(5)} ${msg}`;
+    const out = level === "error" ? console.error : level === "warn" ? console.warn : console.log;
+    if (meta !== void 0) out(line, meta);
+    else out(line);
+  };
+}
+function reqEnv(name) {
+  const v = process.env[name];
+  if (!v || !v.trim()) throw new Error(`missing required env var ${name}`);
+  return v.trim();
+}
+function printSummary(inv, log) {
+  log("info", "=== DRY RUN \u2014 load-balancer inventory NOT pushed ===");
+  log("info", `appliance      : ${inv.appliance.hostname ?? inv.appliance.id}${inv.appliance.version ? ` (v${inv.appliance.version})` : ""}`);
+  log("info", `virtualServers : ${inv.virtualServers.length}`);
+  log("info", `serviceGroups  : ${inv.serviceGroups.length}`);
+  log("info", `healthMonitors : ${inv.healthMonitors.length}`);
+  log("info", `servers        : ${inv.servers.length}`);
+  for (const vs of inv.virtualServers.slice(0, 5)) {
+    const ports = vs.ports.map((p) => `${p.port}/${p.protocol}`).join(", ");
+    log("info", `  vip \u2022 ${vs.name} ${vs.ipAddress ?? ""} [${ports}]`);
+  }
+}
+async function main() {
+  const dryRun = process.argv.includes("--dry-run");
+  const debug = process.argv.includes("--debug") || process.env.LOG_LEVEL === "debug";
+  const log = makeLogger(debug ? "debug" : "info");
+  const a10Insecure = /^(1|true|yes)$/i.test(process.env.A10_INSECURE ?? "");
+  if (a10Insecure) {
+    log("warn", "A10_INSECURE=true \u2014 cert verification off + legacy TLS/ciphers allowed. Trusted appliance only.");
+  }
+  const controller = new AbortController();
+  const onSigint = () => {
+    log("warn", "SIGINT received \u2014 shutting down\u2026");
+    controller.abort();
+  };
+  process.on("SIGINT", onSigint);
+  const a10Url = reqEnv("A10_URL");
+  const client = new AxapiClient(
+    { baseUrl: a10Url, username: reqEnv("A10_USER"), password: reqEnv("A10_PASS"), signal: controller.signal, insecure: a10Insecure },
+    log
+  );
+  const tenancy = {
+    collectorId: reqEnv("COLLECTOR_ID"),
+    tenantId: reqEnv("TENANT_ID"),
+    orgId: reqEnv("ORG_ID"),
+    siteId: reqEnv("SITE_ID")
+  };
+  try {
+    log("info", `A10 collector starting (dryRun=${dryRun})`);
+    log("info", `appliance: ${a10Url}`);
+    await client.connect();
+    const inventory = await buildLoadBalancerInventory(client, tenancy, log);
+    if (dryRun) {
+      printSummary(inventory, log);
+      return;
+    }
+    const cpUrl = reqEnv("CONTROL_PLANE_URL").replace(/\/+$/, "");
+    log("info", `pushing load-balancer inventory to ${cpUrl}`);
+    const res = await fetch(`${cpUrl}${ROUTES.ingestLb}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${reqEnv("COLLECTOR_API_KEY")}` },
+      body: JSON.stringify(inventory),
+      signal: controller.signal
+    });
+    if (!res.ok) throw new Error(`push failed: HTTP ${res.status} ${await res.text()}`);
+    log("info", "=== PUSH OK ===");
+  } finally {
+    await client.close();
+    process.off("SIGINT", onSigint);
+  }
+}
+main().catch((err) => {
+  console.error(`${(/* @__PURE__ */ new Date()).toISOString()} ERROR ${err.message}`);
+  process.exitCode = 1;
+});
+//# sourceMappingURL=a10-index.js.map

package/dist/a10-index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/a10-index.ts"],
+  "sourcesContent": ["/**\r\n * A10 load-balancer collector CLI entry point.\r\n *\r\n *   tsx src/a10-index.ts            inventory the A10 via aXAPI and push to /ingest/loadbalancer\r\n *   tsx src/a10-index.ts --dry-run  inventory and print a summary WITHOUT pushing\r\n *\r\n * A SEPARATE one-shot command from the network `scan` (an appliance isn't a CIDR\r\n * target). Connects to ACOS over aXAPI v3, builds a canonical LoadBalancerInventory\r\n * (appliance + VIPs + service groups + monitors + servers) stamped with the tenancy\r\n * envelope, and either prints it (dry-run) or POSTs it outbound with the collector\r\n * Bearer key. Credentials come from env and are NEVER logged.\r\n */\r\nimport { AxapiClient } from \"./a10/axapi.js\";\r\nimport { buildLoadBalancerInventory } from \"./a10/scan.js\";\r\nimport { ROUTES, type LbIngestBody } from \"@netdoc/collector-contract\";\r\nimport type { LoadBalancerInventory } from \"@netdoc/canonical-model\";\r\nimport type { Logger } from \"./core/runner.js\";\r\n\r\nconst LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 } as const;\r\n\r\nfunction makeLogger(minLevel: keyof typeof LEVEL_RANK = \"info\"): Logger {\r\n  const min = LEVEL_RANK[minLevel];\r\n  return (level, msg, meta) => {\r\n    if (LEVEL_RANK[level] < min) return;\r\n    const line = `${new Date().toISOString()} ${level.toUpperCase().padEnd(5)} ${msg}`;\r\n    const out = level === \"error\" ? console.error : level === \"warn\" ? console.warn : console.log;\r\n    if (meta !== undefined) out(line, meta);\r\n    else out(line);\r\n  };\r\n}\r\n\r\nfunction reqEnv(name: string): string {\r\n  const v = process.env[name];\r\n  if (!v || !v.trim()) throw new Error(`missing required env var ${name}`);\r\n  return v.trim();\r\n}\r\n\r\nfunction printSummary(inv: LoadBalancerInventory, log: Logger): void {\r\n  log(\"info\", \"=== DRY RUN \u2014 load-balancer inventory NOT pushed ===\");\r\n  log(\"info\", `appliance      : ${inv.appliance.hostname ?? inv.appliance.id}${inv.appliance.version ? ` (v${inv.appliance.version})` : \"\"}`);\r\n  log(\"info\", `virtualServers : ${inv.virtualServers.length}`);\r\n  log(\"info\", `serviceGroups  : ${inv.serviceGroups.length}`);\r\n  log(\"info\", `healthMonitors : ${inv.healthMonitors.length}`);\r\n  log(\"info\", `servers        : ${inv.servers.length}`);\r\n  for (const vs of inv.virtualServers.slice(0, 5)) {\r\n    const ports = vs.ports.map((p) => `${p.port}/${p.protocol}`).join(\", \");\r\n    log(\"info\", `  vip \u2022 ${vs.name} ${vs.ipAddress ?? \"\"} [${ports}]`);\r\n  }\r\n}\r\n\r\nasync function main(): Promise<void> {\r\n  const dryRun = process.argv.includes(\"--dry-run\");\r\n  const debug = process.argv.includes(\"--debug\") || process.env.LOG_LEVEL === \"debug\";\r\n  const log = makeLogger(debug ? \"debug\" : \"info\");\r\n\r\n  // ACOS ships a self-signed cert; older boxes also only speak legacy TLS/ciphers.\r\n  // A10_INSECURE=1 relaxes both, via a per-client TLS agent (see AxapiClient).\r\n  const a10Insecure = /^(1|true|yes)$/i.test(process.env.A10_INSECURE ?? \"\");\r\n  if (a10Insecure) {\r\n    log(\"warn\", \"A10_INSECURE=true \u2014 cert verification off + legacy TLS/ciphers allowed. Trusted appliance only.\");\r\n  }\r\n\r\n  const controller = new AbortController();\r\n  const onSigint = (): void => {\r\n    log(\"warn\", \"SIGINT received \u2014 shutting down\u2026\");\r\n    controller.abort();\r\n  };\r\n  process.on(\"SIGINT\", onSigint);\r\n\r\n  const a10Url = reqEnv(\"A10_URL\");\r\n  const client = new AxapiClient(\r\n    { baseUrl: a10Url, username: reqEnv(\"A10_USER\"), password: reqEnv(\"A10_PASS\"), signal: controller.signal, insecure: a10Insecure },\r\n    log,\r\n  );\r\n  const tenancy = {\r\n    collectorId: reqEnv(\"COLLECTOR_ID\"),\r\n    tenantId: reqEnv(\"TENANT_ID\"),\r\n    orgId: reqEnv(\"ORG_ID\"),\r\n    siteId: reqEnv(\"SITE_ID\"),\r\n  };\r\n\r\n  try {\r\n    log(\"info\", `A10 collector starting (dryRun=${dryRun})`);\r\n    log(\"info\", `appliance: ${a10Url}`); // host only; credentials NEVER logged\r\n    await client.connect();\r\n\r\n    const inventory = await buildLoadBalancerInventory(client, tenancy, log);\r\n\r\n    if (dryRun) {\r\n      printSummary(inventory, log);\r\n      return;\r\n    }\r\n\r\n    const cpUrl = reqEnv(\"CONTROL_PLANE_URL\").replace(/\\/+$/, \"\");\r\n    log(\"info\", `pushing load-balancer inventory to ${cpUrl}`);\r\n    const res = await fetch(`${cpUrl}${ROUTES.ingestLb}`, {\r\n      method: \"POST\",\r\n      headers: { \"content-type\": \"application/json\", authorization: `Bearer ${reqEnv(\"COLLECTOR_API_KEY\")}` },\r\n      body: JSON.stringify(inventory satisfies LbIngestBody),\r\n      signal: controller.signal,\r\n    });\r\n    if (!res.ok) throw new Error(`push failed: HTTP ${res.status} ${await res.text()}`);\r\n    log(\"info\", \"=== PUSH OK ===\");\r\n  } finally {\r\n    await client.close();\r\n    process.off(\"SIGINT\", onSigint);\r\n  }\r\n}\r\n\r\nmain().catch((err) => {\r\n  console.error(`${new Date().toISOString()} ERROR ${(err as Error).message}`);\r\n  process.exitCode = 1;\r\n});\r\n"],
+  "mappings": ";;;;;;;;;AAkBA,IAAM,aAAa,EAAE,OAAO,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,GAAG;AAE9D,SAAS,WAAW,WAAoC,QAAgB;AACtE,QAAM,MAAM,WAAW,QAAQ;AAC/B,SAAO,CAAC,OAAO,KAAK,SAAS;AAC3B,QAAI,WAAW,KAAK,IAAI,IAAK;AAC7B,UAAM,OAAO,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG;AAChF,UAAM,MAAM,UAAU,UAAU,QAAQ,QAAQ,UAAU,SAAS,QAAQ,OAAO,QAAQ;AAC1F,QAAI,SAAS,OAAW,KAAI,MAAM,IAAI;AAAA,QACjC,KAAI,IAAI;AAAA,EACf;AACF;AAEA,SAAS,OAAO,MAAsB;AACpC,QAAM,IAAI,QAAQ,IAAI,IAAI;AAC1B,MAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAG,OAAM,IAAI,MAAM,4BAA4B,IAAI,EAAE;AACvE,SAAO,EAAE,KAAK;AAChB;AAEA,SAAS,aAAa,KAA4B,KAAmB;AACnE,MAAI,QAAQ,2DAAsD;AAClE,MAAI,QAAQ,oBAAoB,IAAI,UAAU,YAAY,IAAI,UAAU,EAAE,GAAG,IAAI,UAAU,UAAU,MAAM,IAAI,UAAU,OAAO,MAAM,EAAE,EAAE;AAC1I,MAAI,QAAQ,oBAAoB,IAAI,eAAe,MAAM,EAAE;AAC3D,MAAI,QAAQ,oBAAoB,IAAI,cAAc,MAAM,EAAE;AAC1D,MAAI,QAAQ,oBAAoB,IAAI,eAAe,MAAM,EAAE;AAC3D,MAAI,QAAQ,oBAAoB,IAAI,QAAQ,MAAM,EAAE;AACpD,aAAW,MAAM,IAAI,eAAe,MAAM,GAAG,CAAC,GAAG;AAC/C,UAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,IAAI;AACtE,QAAI,QAAQ,gBAAW,GAAG,IAAI,IAAI,GAAG,aAAa,EAAE,KAAK,KAAK,GAAG;AAAA,EACnE;AACF;AAEA,eAAe,OAAsB;AACnC,QAAM,SAAS,QAAQ,KAAK,SAAS,WAAW;AAChD,QAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS,KAAK,QAAQ,IAAI,cAAc;AAC5E,QAAM,MAAM,WAAW,QAAQ,UAAU,MAAM;AAI/C,QAAM,cAAc,kBAAkB,KAAK,QAAQ,IAAI,gBAAgB,EAAE;AACzE,MAAI,aAAa;AACf,QAAI,QAAQ,sGAAiG;AAAA,EAC/G;AAEA,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,WAAW,MAAY;AAC3B,QAAI,QAAQ,4CAAkC;AAC9C,eAAW,MAAM;AAAA,EACnB;AACA,UAAQ,GAAG,UAAU,QAAQ;AAE7B,QAAM,SAAS,OAAO,SAAS;AAC/B,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,SAAS,QAAQ,UAAU,OAAO,UAAU,GAAG,UAAU,OAAO,UAAU,GAAG,QAAQ,WAAW,QAAQ,UAAU,YAAY;AAAA,IAChI;AAAA,EACF;AACA,QAAM,UAAU;AAAA,IACd,aAAa,OAAO,cAAc;AAAA,IAClC,UAAU,OAAO,WAAW;AAAA,IAC5B,OAAO,OAAO,QAAQ;AAAA,IACtB,QAAQ,OAAO,SAAS;AAAA,EAC1B;AAEA,MAAI;AACF,QAAI,QAAQ,kCAAkC,MAAM,GAAG;AACvD,QAAI,QAAQ,cAAc,MAAM,EAAE;AAClC,UAAM,OAAO,QAAQ;AAErB,UAAM,YAAY,MAAM,2BAA2B,QAAQ,SAAS,GAAG;AAEvE,QAAI,QAAQ;AACV,mBAAa,WAAW,GAAG;AAC3B;AAAA,IACF;AAEA,UAAM,QAAQ,OAAO,mBAAmB,EAAE,QAAQ,QAAQ,EAAE;AAC5D,QAAI,QAAQ,sCAAsC,KAAK,EAAE;AACzD,UAAM,MAAM,MAAM,MAAM,GAAG,KAAK,GAAG,OAAO,QAAQ,IAAI;AAAA,MACpD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,eAAe,UAAU,OAAO,mBAAmB,CAAC,GAAG;AAAA,MACtG,MAAM,KAAK,UAAU,SAAgC;AAAA,MACrD,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,qBAAqB,IAAI,MAAM,IAAI,MAAM,IAAI,KAAK,CAAC,EAAE;AAClF,QAAI,QAAQ,iBAAiB;AAAA,EAC/B,UAAE;AACA,UAAM,OAAO,MAAM;AACnB,YAAQ,IAAI,UAAU,QAAQ;AAAA,EAChC;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,MAAM,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,UAAW,IAAc,OAAO,EAAE;AAC3E,UAAQ,WAAW;AACrB,CAAC;",
+  "names": []
+}

package/dist/azure-index.js

@@ -0,0 +1,114 @@
+import {
+  ArmClient,
+  buildAzureInventory,
+  listAccessibleSubscriptions
+} from "./chunk-DBJNP764.js";
+import {
+  pushAzureInventory
+} from "./chunk-ZCZOUDBC.js";
+import {
+  loadAzureConfig
+} from "./chunk-VEMGGUZ6.js";
+import "./chunk-ZIUWFLKI.js";
+
+// src/azure-index.ts
+var LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 };
+function makeLogger(minLevel = "info") {
+  const min = LEVEL_RANK[minLevel];
+  return (level, msg, meta) => {
+    if (LEVEL_RANK[level] < min) return;
+    const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${level.toUpperCase().padEnd(5)} ${msg}`;
+    const out = level === "error" ? console.error : level === "warn" ? console.warn : console.log;
+    if (meta !== void 0) out(line, meta);
+    else out(line);
+  };
+}
+function errMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function printSummary(inv, log) {
+  log("info", "=== DRY RUN \u2014 AzureInventory NOT pushed ===");
+  log("info", `subscription     : ${inv.subscription.name} (${inv.subscriptionId})`);
+  log("info", `tenant           : ${inv.tenantId}`);
+  log("info", `directory tenant : ${inv.tenantDirId}`);
+  log("info", `capturedAt       : ${inv.capturedAt}`);
+  log("info", `state            : ${inv.subscription.state}`);
+  log(
+    "info",
+    `management group : ${inv.subscription.managementGroupName ?? inv.subscription.managementGroupId ?? "not observed"}`
+  );
+  log("info", `resources        : ${inv.resources.length}`);
+  const internetFacingNsgs = inv.network.filter((n) => n.kind === "nsg" && n.hasRiskyInbound).length;
+  log("info", `network entities : ${inv.network.length} (${internetFacingNsgs} NSG(s) with any-source inbound)`);
+  log("info", `rbac assignments : ${inv.rbac.length} (${inv.rbac.filter((r) => r.isPrivileged).length} privileged)`);
+  if (inv.defender) {
+    log(
+      "info",
+      `defender         : secureScore=${inv.defender.secureScore ?? "?"} ${Object.keys(inv.defender.planCoverage).length} plan(s), ${inv.defender.recommendations.length} recommendation(s)`
+    );
+  } else {
+    log("info", "defender         : not observed (missing Microsoft.Security role/RP registration?)");
+  }
+  const nonCompliant = inv.policy.filter((p) => p.complianceState === "NonCompliant").length;
+  log("info", `policy           : ${inv.policy.length} assignment(s) (${nonCompliant} non-compliant)`);
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  const dryRun = argv.includes("--dry-run");
+  const debug = argv.includes("--debug") || process.env.LOG_LEVEL === "debug";
+  const log = makeLogger(debug ? "debug" : "info");
+  const config = loadAzureConfig();
+  const controller = new AbortController();
+  const onSigint = () => {
+    log("warn", "SIGINT received \u2014 shutting down\u2026");
+    controller.abort();
+  };
+  process.on("SIGINT", onSigint);
+  log("info", `Azure Cloud Posture (CSPM) collector starting (dryRun=${dryRun}) \u2014 ARM tenant ${config.azureTenantId}`);
+  try {
+    const client = new ArmClient(
+      {
+        tenantId: config.azureTenantId,
+        clientId: config.azureClientId,
+        clientSecret: config.azureClientSecret,
+        signal: controller.signal
+      },
+      log
+    );
+    const subs = await listAccessibleSubscriptions(client, config.azureSubscriptions);
+    log(
+      "info",
+      `found ${subs.length} accessible subscription(s): ${subs.map((s) => `${s.displayName} (${s.subscriptionId})`).join(", ")}`
+    );
+    for (const sub of subs) {
+      const stamp = {
+        collectorId: config.collectorId,
+        tenantId: config.tenantId,
+        siteId: config.siteId,
+        tenantDirId: config.azureTenantId
+      };
+      const inventory = await buildAzureInventory(client, sub, stamp, log);
+      if (dryRun) {
+        printSummary(inventory, log);
+        continue;
+      }
+      log("info", `pushing Azure inventory for subscription ${sub.subscriptionId} to ${config.controlPlaneUrl}`);
+      const result = await pushAzureInventory(
+        inventory,
+        { controlPlaneUrl: config.controlPlaneUrl, apiKey: config.apiKey },
+        log,
+        controller.signal
+      );
+      log("info", `=== PUSH OK (subscription ${sub.subscriptionId}) ===`);
+      if (result.snapshotId) log("info", `snapshotId  : ${result.snapshotId}`);
+      if (result.version !== void 0) log("info", `version     : ${result.version}`);
+    }
+  } finally {
+    process.off("SIGINT", onSigint);
+  }
+}
+main().catch((err) => {
+  console.error(`${(/* @__PURE__ */ new Date()).toISOString()} ERROR ${errMsg(err)}`);
+  process.exitCode = 1;
+});
+//# sourceMappingURL=azure-index.js.map

package/dist/azure-index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/azure-index.ts"],
+  "sourcesContent": ["/**\r\n * Azure Cloud Posture (CSPM) collector CLI entry point.\r\n *\r\n *   pnpm azure-scan       inventory every subscription the configured ARM\r\n *                         service principal can see (or the AZURE_SUBSCRIPTIONS\r\n *                         allow-list, if set) and push each to /ingest/azure\r\n *   pnpm azure-scan:dry   inventory and print a summary WITHOUT pushing\r\n *   tsx src/azure-index.ts --dry-run   (equivalent to azure-scan:dry)\r\n *\r\n * ONE service principal (ARM app registration, OAuth2 client-credentials) that\r\n * may see MANY subscriptions \u2014 unlike identity-index.ts's \"one Graph app\r\n * registration = one cloud org\", this loops {@link listAccessibleSubscriptions}\r\n * and builds + pushes ONE AzureInventory PER subscription, each versioned\r\n * independently on the control plane by subscriptionId. A gather that 403s on a\r\n * missing role/unregistered resource provider degrades that ONE signal\r\n * gracefully within a single subscription's build (see azure/plugin.ts); only a\r\n * failure to acquire a token or list subscriptions at all fails the whole run.\r\n *\r\n * Ctrl-C (SIGINT) triggers a cooperative AbortSignal so in-flight requests stop.\r\n */\r\nimport { loadAzureConfig } from \"./config.js\";\r\nimport { pushAzureInventory } from \"./core/push.js\";\r\nimport { ArmClient } from \"./azure/arm.js\";\r\nimport { buildAzureInventory, listAccessibleSubscriptions, type AzureStamp } from \"./azure/plugin.js\";\r\nimport type { Logger } from \"./core/runner.js\";\r\nimport type { AzureInventory } from \"@netdoc/collector-contract\";\r\n\r\nconst LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 } as const;\r\n\r\nfunction makeLogger(minLevel: keyof typeof LEVEL_RANK = \"info\"): Logger {\r\n  const min = LEVEL_RANK[minLevel];\r\n  return (level, msg, meta) => {\r\n    if (LEVEL_RANK[level] < min) return;\r\n    const line = `${new Date().toISOString()} ${level.toUpperCase().padEnd(5)} ${msg}`;\r\n    const out = level === \"error\" ? console.error : level === \"warn\" ? console.warn : console.log;\r\n    if (meta !== undefined) out(line, meta);\r\n    else out(line);\r\n  };\r\n}\r\n\r\nfunction errMsg(err: unknown): string {\r\n  return err instanceof Error ? err.message : String(err);\r\n}\r\n\r\nfunction printSummary(inv: AzureInventory, log: Logger): void {\r\n  log(\"info\", \"=== DRY RUN \u2014 AzureInventory NOT pushed ===\");\r\n  log(\"info\", `subscription     : ${inv.subscription.name} (${inv.subscriptionId})`);\r\n  log(\"info\", `tenant           : ${inv.tenantId}`);\r\n  log(\"info\", `directory tenant : ${inv.tenantDirId}`);\r\n  log(\"info\", `capturedAt       : ${inv.capturedAt}`);\r\n  log(\"info\", `state            : ${inv.subscription.state}`);\r\n  log(\r\n    \"info\",\r\n    `management group : ${inv.subscription.managementGroupName ?? inv.subscription.managementGroupId ?? \"not observed\"}`,\r\n  );\r\n  log(\"info\", `resources        : ${inv.resources.length}`);\r\n  // `hasRiskyInbound` is true when SOME inbound Allow rule names an any-source\r\n  // prefix; it says nothing about which port that rule opens, so an NSG fronting\r\n  // a public web server (443 from the internet, exactly as intended) sets it.\r\n  // Reporting that count as \"risky\" told the operator about an exposure this\r\n  // payload cannot substantiate \u2014 the per-port verdict belongs to the control\r\n  // plane's audit engine, which reads the rules shipped alongside the flag.\r\n  const internetFacingNsgs = inv.network.filter((n) => n.kind === \"nsg\" && n.hasRiskyInbound).length;\r\n  log(\"info\", `network entities : ${inv.network.length} (${internetFacingNsgs} NSG(s) with any-source inbound)`);\r\n  log(\"info\", `rbac assignments : ${inv.rbac.length} (${inv.rbac.filter((r) => r.isPrivileged).length} privileged)`);\r\n  if (inv.defender) {\r\n    log(\r\n      \"info\",\r\n      `defender         : secureScore=${inv.defender.secureScore ?? \"?\"} ` +\r\n        `${Object.keys(inv.defender.planCoverage).length} plan(s), ${inv.defender.recommendations.length} recommendation(s)`,\r\n    );\r\n  } else {\r\n    log(\"info\", \"defender         : not observed (missing Microsoft.Security role/RP registration?)\");\r\n  }\r\n  const nonCompliant = inv.policy.filter((p) => p.complianceState === \"NonCompliant\").length;\r\n  log(\"info\", `policy           : ${inv.policy.length} assignment(s) (${nonCompliant} non-compliant)`);\r\n}\r\n\r\nasync function main(): Promise<void> {\r\n  const argv = process.argv.slice(2);\r\n  const dryRun = argv.includes(\"--dry-run\");\r\n  const debug = argv.includes(\"--debug\") || process.env.LOG_LEVEL === \"debug\";\r\n  const log = makeLogger(debug ? \"debug\" : \"info\");\r\n\r\n  const config = loadAzureConfig();\r\n\r\n  const controller = new AbortController();\r\n  const onSigint = (): void => {\r\n    log(\"warn\", \"SIGINT received \u2014 shutting down\u2026\");\r\n    controller.abort();\r\n  };\r\n  process.on(\"SIGINT\", onSigint);\r\n\r\n  log(\"info\", `Azure Cloud Posture (CSPM) collector starting (dryRun=${dryRun}) \u2014 ARM tenant ${config.azureTenantId}`);\r\n\r\n  try {\r\n    const client = new ArmClient(\r\n      {\r\n        tenantId: config.azureTenantId,\r\n        clientId: config.azureClientId,\r\n        clientSecret: config.azureClientSecret,\r\n        signal: controller.signal,\r\n      },\r\n      log,\r\n    );\r\n\r\n    const subs = await listAccessibleSubscriptions(client, config.azureSubscriptions);\r\n    log(\r\n      \"info\",\r\n      `found ${subs.length} accessible subscription(s): ${subs.map((s) => `${s.displayName} (${s.subscriptionId})`).join(\", \")}`,\r\n    );\r\n\r\n    for (const sub of subs) {\r\n      const stamp: AzureStamp = {\r\n        collectorId: config.collectorId,\r\n        tenantId: config.tenantId,\r\n        siteId: config.siteId,\r\n        tenantDirId: config.azureTenantId,\r\n      };\r\n      const inventory = await buildAzureInventory(client, sub, stamp, log);\r\n\r\n      if (dryRun) {\r\n        printSummary(inventory, log);\r\n        continue;\r\n      }\r\n\r\n      log(\"info\", `pushing Azure inventory for subscription ${sub.subscriptionId} to ${config.controlPlaneUrl}`);\r\n      const result = await pushAzureInventory(\r\n        inventory,\r\n        { controlPlaneUrl: config.controlPlaneUrl, apiKey: config.apiKey },\r\n        log,\r\n        controller.signal,\r\n      );\r\n      log(\"info\", `=== PUSH OK (subscription ${sub.subscriptionId}) ===`);\r\n      if (result.snapshotId) log(\"info\", `snapshotId  : ${result.snapshotId}`);\r\n      if (result.version !== undefined) log(\"info\", `version     : ${result.version}`);\r\n    }\r\n  } finally {\r\n    process.off(\"SIGINT\", onSigint);\r\n  }\r\n}\r\n\r\nmain().catch((err) => {\r\n  console.error(`${new Date().toISOString()} ERROR ${errMsg(err)}`);\r\n  process.exitCode = 1;\r\n});\r\n"],
+  "mappings": ";;;;;;;;;;;;;;AA2BA,IAAM,aAAa,EAAE,OAAO,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,GAAG;AAE9D,SAAS,WAAW,WAAoC,QAAgB;AACtE,QAAM,MAAM,WAAW,QAAQ;AAC/B,SAAO,CAAC,OAAO,KAAK,SAAS;AAC3B,QAAI,WAAW,KAAK,IAAI,IAAK;AAC7B,UAAM,OAAO,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG;AAChF,UAAM,MAAM,UAAU,UAAU,QAAQ,QAAQ,UAAU,SAAS,QAAQ,OAAO,QAAQ;AAC1F,QAAI,SAAS,OAAW,KAAI,MAAM,IAAI;AAAA,QACjC,KAAI,IAAI;AAAA,EACf;AACF;AAEA,SAAS,OAAO,KAAsB;AACpC,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;AAEA,SAAS,aAAa,KAAqB,KAAmB;AAC5D,MAAI,QAAQ,kDAA6C;AACzD,MAAI,QAAQ,sBAAsB,IAAI,aAAa,IAAI,KAAK,IAAI,cAAc,GAAG;AACjF,MAAI,QAAQ,sBAAsB,IAAI,QAAQ,EAAE;AAChD,MAAI,QAAQ,sBAAsB,IAAI,WAAW,EAAE;AACnD,MAAI,QAAQ,sBAAsB,IAAI,UAAU,EAAE;AAClD,MAAI,QAAQ,sBAAsB,IAAI,aAAa,KAAK,EAAE;AAC1D;AAAA,IACE;AAAA,IACA,sBAAsB,IAAI,aAAa,uBAAuB,IAAI,aAAa,qBAAqB,cAAc;AAAA,EACpH;AACA,MAAI,QAAQ,sBAAsB,IAAI,UAAU,MAAM,EAAE;AAOxD,QAAM,qBAAqB,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,eAAe,EAAE;AAC5F,MAAI,QAAQ,sBAAsB,IAAI,QAAQ,MAAM,KAAK,kBAAkB,kCAAkC;AAC7G,MAAI,QAAQ,sBAAsB,IAAI,KAAK,MAAM,KAAK,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc;AACjH,MAAI,IAAI,UAAU;AAChB;AAAA,MACE;AAAA,MACA,kCAAkC,IAAI,SAAS,eAAe,GAAG,IAC5D,OAAO,KAAK,IAAI,SAAS,YAAY,EAAE,MAAM,aAAa,IAAI,SAAS,gBAAgB,MAAM;AAAA,IACpG;AAAA,EACF,OAAO;AACL,QAAI,QAAQ,oFAAoF;AAAA,EAClG;AACA,QAAM,eAAe,IAAI,OAAO,OAAO,CAAC,MAAM,EAAE,oBAAoB,cAAc,EAAE;AACpF,MAAI,QAAQ,sBAAsB,IAAI,OAAO,MAAM,mBAAmB,YAAY,iBAAiB;AACrG;AAEA,eAAe,OAAsB;AACnC,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,QAAM,SAAS,KAAK,SAAS,WAAW;AACxC,QAAM,QAAQ,KAAK,SAAS,SAAS,KAAK,QAAQ,IAAI,cAAc;AACpE,QAAM,MAAM,WAAW,QAAQ,UAAU,MAAM;AAE/C,QAAM,SAAS,gBAAgB;AAE/B,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,WAAW,MAAY;AAC3B,QAAI,QAAQ,4CAAkC;AAC9C,eAAW,MAAM;AAAA,EACnB;AACA,UAAQ,GAAG,UAAU,QAAQ;AAE7B,MAAI,QAAQ,yDAAyD,MAAM,uBAAkB,OAAO,aAAa,EAAE;AAEnH,MAAI;AACF,UAAM,SAAS,IAAI;AAAA,MACjB;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,cAAc,OAAO;AAAA,QACrB,QAAQ,WAAW;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,4BAA4B,QAAQ,OAAO,kBAAkB;AAChF;AAAA,MACE;AAAA,MACA,SAAS,KAAK,MAAM,gCAAgC,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,KAAK,EAAE,cAAc,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,IAC1H;AAEA,eAAW,OAAO,MAAM;AACtB,YAAM,QAAoB;AAAA,QACxB,aAAa,OAAO;AAAA,QACpB,UAAU,OAAO;AAAA,QACjB,QAAQ,OAAO;AAAA,QACf,aAAa,OAAO;AAAA,MACtB;AACA,YAAM,YAAY,MAAM,oBAAoB,QAAQ,KAAK,OAAO,GAAG;AAEnE,UAAI,QAAQ;AACV,qBAAa,WAAW,GAAG;AAC3B;AAAA,MACF;AAEA,UAAI,QAAQ,4CAA4C,IAAI,cAAc,OAAO,OAAO,eAAe,EAAE;AACzG,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,EAAE,iBAAiB,OAAO,iBAAiB,QAAQ,OAAO,OAAO;AAAA,QACjE;AAAA,QACA,WAAW;AAAA,MACb;AACA,UAAI,QAAQ,6BAA6B,IAAI,cAAc,OAAO;AAClE,UAAI,OAAO,WAAY,KAAI,QAAQ,iBAAiB,OAAO,UAAU,EAAE;AACvE,UAAI,OAAO,YAAY,OAAW,KAAI,QAAQ,iBAAiB,OAAO,OAAO,EAAE;AAAA,IACjF;AAAA,EACF,UAAE;AACA,YAAQ,IAAI,UAAU,QAAQ;AAAA,EAChC;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,MAAM,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,UAAU,OAAO,GAAG,CAAC,EAAE;AAChE,UAAQ,WAAW;AACrB,CAAC;",
+  "names": []
+}