libre-webui 0.21.3 → 0.22.0

package/backend/dist/main.js

@@ -0,0 +1,137 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ */
+// Validate every platform selector before importing the application graph.
+// Several legacy services still initialize local state during module
+// evaluation; an unavailable team adapter must fail without creating a local
+// database, key, plugin directory, or other misleading fallback state.
+import './env.js';
+import { assertPlatformRuntimeConfig, resolvePlatformRuntimeConfig, } from './platform/runtimeConfig.js';
+import { getOllamaRuntimeConfig, normalizeOllamaRuntimeEnvironment, } from './platform/ollamaRuntimeConfig.js';
+import { inspectStorageKeyConfiguration, provisionLegacyEncryptionKey, } from './platform/storage/storageFactory.js';
+import { initializePersistence, preflightExistingSQLiteDatabase, preflightIdentityMatchesMarker, readPreflightVerificationMarker, readSQLitePreflightIdentity, writePreflightVerificationMarker, } from './persistence/index.js';
+import { LegacyCiphertextIntegrityError, verifyLegacyCiphertextIntegrity, } from './services/legacyCiphertextIntegrity.js';
+import { createLogger } from './utils/logger.js';
+import { assertNoLegacyDataDirectoryConflict, assertPreflightDirectoryOutsideDataDirectory, ensurePrivateRuntimeDirectory, resolveDataDirectory, resolvePreflightDirectory, } from './utils/dataDirectory.js';
+import path from 'node:path';
+import fs from 'node:fs';
+// Provider limits are pure configuration. Reject malformed values before
+// resolving data paths, provisioning keys, or opening persistence.
+normalizeOllamaRuntimeEnvironment(getOllamaRuntimeConfig());
+const platformConfig = assertPlatformRuntimeConfig(resolvePlatformRuntimeConfig());
+// Preserve the raw relative-path provenance until compatibility checks have
+// run. Source launches historically resolved relative paths from backend/;
+// packaged launchers resolve caller-relative paths once and pass absolutes.
+assertNoLegacyDataDirectoryConflict();
+const dataDir = resolveDataDirectory();
+const databasePath = path.join(dataDir, 'data.sqlite');
+const preflightDirectory = platformConfig.database.backend === 'sqlite'
+    ? resolvePreflightDirectory()
+    : undefined;
+if (preflightDirectory) {
+    assertPreflightDirectoryOutsideDataDirectory(dataDir, preflightDirectory);
+}
+// Every stateful module consumes one absolute runtime selection. Do not let a
+// downstream service reinterpret a relative DATA_DIR using its own cwd.
+process.env.DATA_DIR = dataDir;
+if (preflightDirectory) {
+    process.env.PLATFORM_PREFLIGHT_TMP_DIR = preflightDirectory;
+}
+const initialStorageKeys = inspectStorageKeyConfiguration(process.env);
+if (initialStorageKeys.status === 'invalid') {
+    throw new Error('Invalid platform storage encryption configuration.');
+}
+if (platformConfig.mode === 'team' &&
+    !['versioned-keyring', 'legacy-encryption-key'].includes(initialStorageKeys.source)) {
+    throw new Error('Team mode requires encryption keys supplied by the deployment secret; per-replica key files are not supported.');
+}
+const encryptionKeyHex = provisionLegacyEncryptionKey(process.env);
+process.env.ENCRYPTION_KEY = encryptionKeyHex;
+const storageKeys = inspectStorageKeyConfiguration(process.env);
+if (storageKeys.status !== 'configured') {
+    throw new Error('Invalid platform storage encryption configuration.');
+}
+const startupLogger = createLogger('startup');
+let legacyEncryptionKey;
+try {
+    if (platformConfig.database.backend === 'sqlite' &&
+        fs.existsSync(databasePath)) {
+        // The deep preflight copies the whole database and authenticates every
+        // encrypted row. Data verified once stays verified: later rows are
+        // written by this code generation, so the scan only reruns when the
+        // schema generation or the database file itself changes. The identity
+        // probe opens the database and may create WAL bookkeeping, so it runs
+        // only when a marker from an earlier successful start exists; a first
+        // or rejected bootstrap keeps the source directory untouched.
+        const marker = readPreflightVerificationMarker(dataDir);
+        const verifiedBefore = marker !== null &&
+            preflightIdentityMatchesMarker(readSQLitePreflightIdentity(databasePath), marker);
+        const skipScanByEnv = process.env.LIBRE_SKIP_STARTUP_INTEGRITY_SCAN === '1';
+        if (!verifiedBefore) {
+            legacyEncryptionKey = Buffer.from(encryptionKeyHex, 'hex');
+            try {
+                preflightExistingSQLiteDatabase(databasePath, preflightDirectory, skipScanByEnv
+                    ? undefined
+                    : database => verifyLegacyCiphertextIntegrity(database, legacyEncryptionKey, {}, {
+                        // Migration v4 commits its nullable lookup column before
+                        // the identity repository can backfill it. Allow a
+                        // missing token with either an authenticated envelope or
+                        // a non-envelope legacy value through this
+                        // crash-recovery window.
+                        requireIdentityLookupToken: false,
+                    }));
+            }
+            catch (error) {
+                if (error instanceof LegacyCiphertextIntegrityError &&
+                    error.code === 'verification-limit') {
+                    // A database beyond the scan caps must still be able to start.
+                    startupLogger.warn('Legacy ciphertext verification exceeded its scan limits; continuing without full verification.');
+                }
+                else {
+                    throw error;
+                }
+            }
+            if (skipScanByEnv) {
+                startupLogger.warn('LIBRE_SKIP_STARTUP_INTEGRITY_SCAN=1: skipping legacy ciphertext verification.');
+            }
+        }
+    }
+}
+finally {
+    legacyEncryptionKey?.fill(0);
+}
+// The identity codec is safe to load only after key selection. Initialize the
+// selected database before importing routes and service singletons, which
+// prevents PostgreSQL mode from ever constructing a local SQLite fallback.
+const { encryptionService } = await import('./services/encryptionService.js');
+await initializePersistence({
+    dialect: platformConfig.database.backend,
+    emailCodec: encryptionService,
+    env: process.env,
+});
+if (platformConfig.database.backend === 'sqlite') {
+    // Record the settled post-migration identity so the next start can skip
+    // the copy and deep scan until the schema generation or file changes.
+    const settledIdentity = readSQLitePreflightIdentity(databasePath);
+    if (settledIdentity) {
+        writePreflightVerificationMarker(dataDir, settledIdentity);
+    }
+}
+if (platformConfig.mode === 'team') {
+    const teamPreflightDirectory = resolvePreflightDirectory();
+    assertPreflightDirectoryOutsideDataDirectory(dataDir, teamPreflightDirectory);
+    // Team DATA_DIR and preflight paths hold only per-replica scratch state.
+    // Create them after selectors, keys, and the shared schema are validated.
+    ensurePrivateRuntimeDirectory(dataDir);
+    ensurePrivateRuntimeDirectory(teamPreflightDirectory);
+}
+const { initializeSelectedWorkPersistence } = await import('./platform/workPersistence/index.js');
+initializeSelectedWorkPersistence(platformConfig.database.backend);
+process.env.LIBRE_PROCESS_ROLE =
+    platformConfig.jobs.workerMode === 'external'
+        ? 'app-external'
+        : 'app-embedded';
+await import('./index.js');
+//# sourceMappingURL=main.js.map

package/backend/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,2EAA2E;AAC3E,qEAAqE;AACrE,6EAA6E;AAC7E,uEAAuE;AACvE,OAAO,UAAU,CAAC;AAClB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,8BAA8B,EAC9B,+BAA+B,EAC/B,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,mCAAmC,EACnC,4CAA4C,EAC5C,6BAA6B,EAC7B,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,yEAAyE;AACzE,mEAAmE;AACnE,iCAAiC,CAAC,sBAAsB,EAAE,CAAC,CAAC;AAC5D,MAAM,cAAc,GAAG,2BAA2B,CAChD,4BAA4B,EAAE,CAC/B,CAAC;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,mCAAmC,EAAE,CAAC;AACtC,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;AACvC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AACvD,MAAM,kBAAkB,GACtB,cAAc,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;IAC1C,CAAC,CAAC,yBAAyB,EAAE;IAC7B,CAAC,CAAC,SAAS,CAAC;AAChB,IAAI,kBAAkB,EAAE,CAAC;IACvB,4CAA4C,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC5E,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;AAC/B,IAAI,kBAAkB,EAAE,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,0BAA0B,GAAG,kBAAkB,CAAC;AAC9D,CAAC;AACD,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACvE,IAAI,kBAAkB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;IAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AACxE,CAAC;AACD,IACE,cAAc,CAAC,IAAI,KAAK,MAAM;IAC9B,CAAC,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CACtD,kBAAkB,CAAC,MAAM,CAC1B,EACD,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;AACJ,CAAC;AACD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACnE,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,gBAAgB,CAAC;AAC9C,MAAM,WAAW,GAAG,8BAA8B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAChE,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;IACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AACxE,CAAC;AACD,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAC9C,IAAI,mBAAuC,CAAC;AAC5C,IAAI,CAAC;IACH,IACE,cAAc,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;QAC5C,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAC3B,CAAC;QACD,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,cAAc,GAClB,MAAM,KAAK,IAAI;YACf,8BAA8B,CAC5B,2BAA2B,CAAC,YAAY,CAAC,EACzC,MAAM,CACP,CAAC;QACJ,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,GAAG,CAAC;QAC5E,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACH,+BAA+B,CAC7B,YAAY,EACZ,kBAAkB,EAClB,aAAa;oBACX,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,CAAC,EAAE,CACT,+BAA+B,CAC7B,QAAQ,EACR,mBAAmB,EACnB,EAAE,EACF;wBACE,yDAAyD;wBACzD,mDAAmD;wBACnD,yDAAyD;wBACzD,2CAA2C;wBAC3C,yBAAyB;wBACzB,0BAA0B,EAAE,KAAK;qBAClC,CACF,CACR,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,KAAK,YAAY,8BAA8B;oBAC/C,KAAK,CAAC,IAAI,KAAK,oBAAoB,EACnC,CAAC;oBACD,+DAA+D;oBAC/D,aAAa,CAAC,IAAI,CAChB,gGAAgG,CACjG,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBAClB,aAAa,CAAC,IAAI,CAChB,+EAA+E,CAChF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;QAAS,CAAC;IACT,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;AAC9E,MAAM,qBAAqB,CAAC;IAC1B,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,OAAO;IACxC,UAAU,EAAE,iBAAiB;IAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;CACjB,CAAC,CAAC;AACH,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;IACjD,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,eAAe,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;IAClE,IAAI,eAAe,EAAE,CAAC;QACpB,gCAAgC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AACD,IAAI,cAAc,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IACnC,MAAM,sBAAsB,GAAG,yBAAyB,EAAE,CAAC;IAC3D,4CAA4C,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC9E,yEAAyE;IACzE,0EAA0E;IAC1E,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACvC,6BAA6B,CAAC,sBAAsB,CAAC,CAAC;AACxD,CAAC;AACD,MAAM,EAAE,iCAAiC,EAAE,GACzC,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;AACtD,iCAAiC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACnE,OAAO,CAAC,GAAG,CAAC,kBAAkB;IAC5B,cAAc,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU;QAC3C,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,cAAc,CAAC;AACrB,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC"}

package/backend/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAe,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAM3E,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,QAClB,oBAAoB,OACpB,QAAQ,QACP,YAAY,KACjB,OAAO,CAAC,IAAI,CAuDd,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,QAClB,oBAAoB,OACpB,QAAQ,QACP,YAAY,KACjB,OAAO,CAAC,IAAI,CAsCd,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,QAClB,oBAAoB,OACpB,QAAQ,QACP,YAAY,KACjB,OAAO,CAAC,IAAI,CAuBd,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAe,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAM3E,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,QAClB,oBAAoB,OACpB,QAAQ,QACP,YAAY,KACjB,OAAO,CAAC,IAAI,CAyDd,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,QAClB,oBAAoB,OACpB,QAAQ,QACP,YAAY,KACjB,OAAO,CAAC,IAAI,CAsCd,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,QAClB,oBAAoB,OACpB,QAAQ,QACP,YAAY,KACjB,OAAO,CAAC,IAAI,CAyBd,CAAC"}

package/backend/dist/middleware/auth.js

@@ -40,7 +40,7 @@ export const authenticate = async (req, res, next) => {
             });
             return;
         }
-        const currentUser = userModel.getUserById(payload.userId);
+        const currentUser = await userModel.getUserById(payload.userId);
         if (!currentUser) {
             res.status(401).json({
                 success: false,
@@ -63,6 +63,8 @@ export const authenticate = async (req, res, next) => {
             userId: currentUser.id,
             username: currentUser.username,
             role: currentUser.role,
+            ...(payload.iat !== undefined ? { iat: payload.iat } : {}),
+            ...(payload.exp !== undefined ? { exp: payload.exp } : {}),
         };
         next();
     }
@@ -86,7 +88,7 @@ export const requireAdmin = async (req, res, next) => {
         return;
     }
     try {
-        const currentUser = userModel.getUserById(req.user.userId);
+        const currentUser = await userModel.getUserById(req.user.userId);
         if (!currentUser ||
             currentUser.status !== 'active' ||
             currentUser.role !== 'admin') {
@@ -123,12 +125,14 @@ export const optionalAuth = async (req, res, next) => {
             const token = authHeader.substring(7);
             const payload = authService.verifyToken(token);
             if (payload) {
-                const currentUser = userModel.getUserById(payload.userId);
+                const currentUser = await userModel.getUserById(payload.userId);
                 if (currentUser?.status === 'active') {
                     req.user = {
                         userId: currentUser.id,
                         username: currentUser.username,
                         role: currentUser.role,
+                        ...(payload.iat !== undefined ? { iat: payload.iat } : {}),
+                        ...(payload.exp !== undefined ? { exp: payload.exp } : {}),
                     };
                 }
             }

package/backend/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAoB,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAO/C;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAyB,EACzB,GAAa,EACb,IAAkB,EACH,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,iCAAiC;aAC3C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,0BAA0B;aACpC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,oDAAoD;aAC9D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,yBAAyB;QACzB,GAAG,CAAC,IAAI,GAAG;YACT,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;SACvB,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAyB,EACzB,GAAa,EACb,IAAkB,EACH,EAAE;IACjB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3D,IACE,CAAC,WAAW;YACZ,WAAW,CAAC,MAAM,KAAK,QAAQ;YAC/B,WAAW,CAAC,IAAI,KAAK,OAAO,EAC5B,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,uBAAuB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,GAAG,CAAC,IAAI,GAAG;YACT,GAAG,GAAG,CAAC,IAAI;YACX,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;SACvB,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAyB,EACzB,GAAa,EACb,IAAkB,EACH,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAE7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC1D,IAAI,WAAW,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACrC,GAAG,CAAC,IAAI,GAAG;wBACT,MAAM,EAAE,WAAW,CAAC,EAAE;wBACtB,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;qBACvB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAoB,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAO/C;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAyB,EACzB,GAAa,EACb,IAAkB,EACH,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,iCAAiC;aAC3C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,0BAA0B;aACpC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,oDAAoD;aAC9D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,yBAAyB;QACzB,GAAG,CAAC,IAAI,GAAG;YACT,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAyB,EACzB,GAAa,EACb,IAAkB,EACH,EAAE;IACjB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,IACE,CAAC,WAAW;YACZ,WAAW,CAAC,MAAM,KAAK,QAAQ;YAC/B,WAAW,CAAC,IAAI,KAAK,OAAO,EAC5B,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,uBAAuB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,GAAG,CAAC,IAAI,GAAG;YACT,GAAG,GAAG,CAAC,IAAI;YACX,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;SACvB,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAyB,EACzB,GAAa,EACb,IAAkB,EACH,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAE7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAChE,IAAI,WAAW,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACrC,GAAG,CAAC,IAAI,GAAG;wBACT,MAAM,EAAE,WAAW,CAAC,EAAE;wBACtB,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;wBACtB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC3D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC,CAAC"}

package/backend/dist/middleware/chatCancellationAdmission.d.ts

@@ -0,0 +1,7 @@
+import type { Request } from 'express';
+/**
+ * Stop is an authenticated, idempotent SQL safety decision. It must not queue
+ * behind the ordinary chat admission buckets that it exists to terminate.
+ */
+export declare const isChatCancellationSafetyRequest: (request: Request) => boolean;
+//# sourceMappingURL=chatCancellationAdmission.d.ts.map

package/backend/dist/middleware/chatCancellationAdmission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chatCancellationAdmission.d.ts","sourceRoot":"","sources":["../../src/middleware/chatCancellationAdmission.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC;;;GAGG;AACH,eAAO,MAAM,+BAA+B,YAAa,OAAO,KAAG,OAIlE,CAAC"}

package/backend/dist/middleware/chatCancellationAdmission.js

@@ -0,0 +1,17 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ */
+const CHAT_CANCELLATION_PATH = /^\/api\/chat\/sessions\/[^/]+\/generations\/[^/]+\/cancel\/?$/;
+/**
+ * Stop is an authenticated, idempotent SQL safety decision. It must not queue
+ * behind the ordinary chat admission buckets that it exists to terminate.
+ */
+export const isChatCancellationSafetyRequest = (request) => {
+    if (request.method !== 'POST')
+        return false;
+    const mountedPath = `${request.baseUrl}${request.path}`;
+    return CHAT_CANCELLATION_PATH.test(mountedPath);
+};
+//# sourceMappingURL=chatCancellationAdmission.js.map

package/backend/dist/middleware/chatCancellationAdmission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chatCancellationAdmission.js","sourceRoot":"","sources":["../../src/middleware/chatCancellationAdmission.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,sBAAsB,GAC1B,+DAA+D,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,OAAgB,EAAW,EAAE;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC,CAAC"}

package/backend/dist/middleware/coordinatedRateLimit.d.ts

@@ -0,0 +1,18 @@
+import type { RequestHandler } from 'express';
+import type { Coordinator } from '../platform/coordination/types.js';
+export interface CoordinatedRateLimitOptions {
+    keyPrefix: string;
+    limit: number;
+    windowMs: number;
+    message: string;
+    /** Test seam; production uses the lifecycle-owned platform coordinator. */
+    coordinator?: Coordinator;
+    operationTimeoutMs?: number;
+}
+/**
+ * Security-sensitive rate limiting backed by the selected coordinator. Redis
+ * failures deliberately reject the request instead of creating a per-process
+ * bucket that attackers can bypass by changing replicas.
+ */
+export declare const coordinatedRateLimit: (options: CoordinatedRateLimitOptions) => RequestHandler;
+//# sourceMappingURL=coordinatedRateLimit.d.ts.map

package/backend/dist/middleware/coordinatedRateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinatedRateLimit.d.ts","sourceRoot":"","sources":["../../src/middleware/coordinatedRateLimit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAM/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAKrE,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,YACtB,2BAA2B,KACnC,cAiDF,CAAC"}

package/backend/dist/middleware/coordinatedRateLimit.js

@@ -0,0 +1,52 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ */
+import { createHash } from 'node:crypto';
+import { getCoordinator } from '../platform/coordination/service.js';
+import { SHARED_COORDINATION_OPERATION_TIMEOUT_MS, withCoordinationTimeout, } from '../platform/coordination/sharedAdmission.js';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('coordinated-rate-limit');
+/**
+ * Security-sensitive rate limiting backed by the selected coordinator. Redis
+ * failures deliberately reject the request instead of creating a per-process
+ * bucket that attackers can bypass by changing replicas.
+ */
+export const coordinatedRateLimit = (options) => {
+    if (!/^[a-z][a-z0-9.-]{0,63}$/.test(options.keyPrefix)) {
+        throw new Error('Invalid coordinated rate-limit key prefix');
+    }
+    if (!Number.isSafeInteger(options.limit) || options.limit < 1) {
+        throw new Error('Invalid coordinated rate-limit capacity');
+    }
+    if (!Number.isSafeInteger(options.windowMs) || options.windowMs < 1) {
+        throw new Error('Invalid coordinated rate-limit window');
+    }
+    return async (request, response, next) => {
+        const peer = request.ip || request.socket.remoteAddress || 'unknown';
+        const peerDigest = createHash('sha256').update(peer).digest('base64url');
+        try {
+            const coordinator = options.coordinator ?? getCoordinator();
+            const result = await withCoordinationTimeout(coordinator.consumeRateLimit(`${options.keyPrefix}:${peerDigest}`, options.limit, options.windowMs), options.operationTimeoutMs ?? SHARED_COORDINATION_OPERATION_TIMEOUT_MS);
+            const resetSeconds = Math.max(0, Math.ceil((result.resetAt - Date.now()) / 1000));
+            response.setHeader('RateLimit-Limit', String(options.limit));
+            response.setHeader('RateLimit-Remaining', String(result.remaining));
+            response.setHeader('RateLimit-Reset', String(resetSeconds));
+            if (!result.allowed) {
+                response.setHeader('Retry-After', String(resetSeconds));
+                response.status(429).json({ success: false, message: options.message });
+                return;
+            }
+            next();
+        }
+        catch {
+            logger.warn('Shared security rate limiting is unavailable');
+            response.status(503).json({
+                success: false,
+                message: 'Authentication protection is temporarily unavailable',
+            });
+        }
+    };
+};
+//# sourceMappingURL=coordinatedRateLimit.js.map

package/backend/dist/middleware/coordinatedRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinatedRateLimit.js","sourceRoot":"","sources":["../../src/middleware/coordinatedRateLimit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EACL,wCAAwC,EACxC,uBAAuB,GACxB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AAYtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAoC,EACpB,EAAE;IAClB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,KAAK,EACV,OAAgB,EAChB,QAAkB,EAClB,IAAkB,EACH,EAAE;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QACrE,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,WAAW,CAAC,gBAAgB,CAC1B,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE,EACpC,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,CACjB,EACD,OAAO,CAAC,kBAAkB,IAAI,wCAAwC,CACvE,CAAC;YACF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAC3B,CAAC,EACD,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAChD,CAAC;YACF,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,QAAQ,CAAC,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACpE,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;gBACxD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC5D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/backend/dist/middleware/sharedRateLimit.d.ts

@@ -0,0 +1,26 @@
+import type { Request, RequestHandler, Response } from 'express';
+import type { Coordinator } from '../platform/coordination/types.js';
+export interface SharedRateLimitOptions {
+    /** Stable route/policy identity; it is part of the shared Redis key. */
+    keyPrefix: string;
+    windowMs: number;
+    max: number;
+    message?: unknown;
+    keyGenerator?: (request: Request, response: Response) => string | Promise<string>;
+    standardHeaders?: boolean;
+    legacyHeaders?: boolean;
+    skipSuccessfulRequests?: boolean;
+    /** Bypass this policy before any coordinator operation. */
+    skip?: (request: Request, response: Response) => boolean | Promise<boolean>;
+    /** Test seam; production uses the lifecycle-owned platform coordinator. */
+    coordinator?: Coordinator;
+    operationTimeoutMs?: number;
+}
+/**
+ * Fixed-window request limiting backed exclusively by the selected platform
+ * coordinator. Team replicas share Redis state; a Redis failure returns 503
+ * instead of silently opening an independent in-memory bucket.
+ */
+export declare const sharedRateLimit: (options: SharedRateLimitOptions) => RequestHandler;
+export default sharedRateLimit;
+//# sourceMappingURL=sharedRateLimit.d.ts.map

package/backend/dist/middleware/sharedRateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharedRateLimit.d.ts","sourceRoot":"","sources":["../../src/middleware/sharedRateLimit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAgB,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAI/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AASrE,MAAM,WAAW,sBAAsB;IACrC,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,CACb,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,KACf,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,2DAA2D;IAC3D,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,2EAA2E;IAC3E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAQD;;;;GAIG;AACH,eAAO,MAAM,eAAe,YACjB,sBAAsB,KAC9B,cAqGF,CAAC;eAEa,eAAe"}

package/backend/dist/middleware/sharedRateLimit.js

@@ -0,0 +1,99 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ */
+import { createHash } from 'node:crypto';
+import { ipKeyGenerator } from 'express-rate-limit';
+import { getCoordinator } from '../platform/coordination/service.js';
+import { SHARED_COORDINATION_OPERATION_TIMEOUT_MS, withCoordinationTimeout, } from '../platform/coordination/sharedAdmission.js';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('shared-rate-limit');
+const clientDigest = (value) => createHash('sha256').update(value).digest('base64url');
+const responseMessage = (options) => options.message ?? 'Too many requests, please try again later.';
+/**
+ * Fixed-window request limiting backed exclusively by the selected platform
+ * coordinator. Team replicas share Redis state; a Redis failure returns 503
+ * instead of silently opening an independent in-memory bucket.
+ */
+export const sharedRateLimit = (options) => {
+    const prefix = options.keyPrefix.trim().toLowerCase();
+    if (!/^[a-z][a-z0-9.-]{0,95}$/.test(prefix)) {
+        throw new Error('Invalid shared rate-limit key prefix.');
+    }
+    if (!Number.isSafeInteger(options.max) || options.max < 1) {
+        throw new Error('Invalid shared rate-limit capacity.');
+    }
+    if (!Number.isSafeInteger(options.windowMs) || options.windowMs < 1) {
+        throw new Error('Invalid shared rate-limit window.');
+    }
+    return async (request, response, next) => {
+        let coordinationKey;
+        let windowToken;
+        let coordinator;
+        try {
+            if (options.skip && (await options.skip(request, response))) {
+                next();
+                return;
+            }
+            const rawClientKey = options.keyGenerator
+                ? await options.keyGenerator(request, response)
+                : ipKeyGenerator(request.ip || request.socket.remoteAddress || 'unknown');
+            coordinationKey = `http-rate:${prefix}:${clientDigest(rawClientKey)}`;
+            coordinator = options.coordinator ?? getCoordinator();
+            const result = await withCoordinationTimeout(coordinator.consumeRateLimit(coordinationKey, options.max, options.windowMs), options.operationTimeoutMs ?? SHARED_COORDINATION_OPERATION_TIMEOUT_MS);
+            windowToken = result.windowToken;
+            const resetSeconds = Math.max(0, Math.ceil((result.resetAt - Date.now()) / 1000));
+            if (options.standardHeaders !== false) {
+                response.setHeader('RateLimit-Limit', String(options.max));
+                response.setHeader('RateLimit-Remaining', String(result.remaining));
+                response.setHeader('RateLimit-Reset', String(resetSeconds));
+            }
+            if (options.legacyHeaders !== false) {
+                response.setHeader('X-RateLimit-Limit', String(options.max));
+                response.setHeader('X-RateLimit-Remaining', String(result.remaining));
+                response.setHeader('X-RateLimit-Reset', String(Math.ceil(result.resetAt / 1000)));
+            }
+            if (!result.allowed) {
+                response.setHeader('Retry-After', String(resetSeconds));
+                response.status(429).send(responseMessage(options));
+                return;
+            }
+        }
+        catch (error) {
+            logger.warn('Shared request rate limiting is unavailable', {
+                scope: prefix,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            response.status(503).json({
+                success: false,
+                message: 'Request admission is temporarily unavailable',
+            });
+            return;
+        }
+        if (options.skipSuccessfulRequests) {
+            let refunded = false;
+            response.once('finish', () => {
+                if (refunded || response.statusCode >= 400)
+                    return;
+                refunded = true;
+                try {
+                    void withCoordinationTimeout(coordinator.refundRateLimit(coordinationKey, windowToken), options.operationTimeoutMs ??
+                        SHARED_COORDINATION_OPERATION_TIMEOUT_MS).catch(error => logger.warn('Shared request rate-limit refund failed', {
+                        scope: prefix,
+                        error: error instanceof Error ? error.message : String(error),
+                    }));
+                }
+                catch (error) {
+                    logger.warn('Shared request rate-limit refund failed', {
+                        scope: prefix,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            });
+        }
+        next();
+    };
+};
+export default sharedRateLimit;
+//# sourceMappingURL=sharedRateLimit.js.map

package/backend/dist/middleware/sharedRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharedRateLimit.js","sourceRoot":"","sources":["../../src/middleware/sharedRateLimit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAErE,OAAO,EACL,wCAAwC,EACxC,uBAAuB,GACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AAsBjD,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE,CAC7C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,CAAC,OAA+B,EAAW,EAAE,CACnE,OAAO,CAAC,OAAO,IAAI,4CAA4C,CAAC;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAA+B,EACf,EAAE;IAClB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,KAAK,EACV,OAAgB,EAChB,QAAkB,EAClB,IAAkB,EACH,EAAE;QACjB,IAAI,eAAuB,CAAC;QAC5B,IAAI,WAAmB,CAAC;QACxB,IAAI,WAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY;gBACvC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAC/C,CAAC,CAAC,cAAc,CACZ,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CACxD,CAAC;YACN,eAAe,GAAG,aAAa,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;YACtE,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,WAAW,CAAC,gBAAgB,CAC1B,eAAe,EACf,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,QAAQ,CACjB,EACD,OAAO,CAAC,kBAAkB,IAAI,wCAAwC,CACvE,CAAC;YACF,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YACjC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAC3B,CAAC,EACD,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAChD,CAAC;YACF,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;gBACtC,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3D,QAAQ,CAAC,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpE,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;gBACpC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7D,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;gBACtE,QAAQ,CAAC,SAAS,CAChB,mBAAmB,EACnB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CACzC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;gBACxD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBACzD,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACnC,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;gBAC3B,IAAI,QAAQ,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG;oBAAE,OAAO;gBACnD,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC;oBACH,KAAK,uBAAuB,CAC1B,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,WAAW,CAAC,EACzD,OAAO,CAAC,kBAAkB;wBACxB,wCAAwC,CAC3C,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACd,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;wBACrD,KAAK,EAAE,MAAM;wBACb,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CACH,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;wBACrD,KAAK,EAAE,MAAM;wBACb,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/backend/dist/models/personaModel.d.ts

@@ -1,36 +1,11 @@
-import { Persona, CreatePersonaRequest, UpdatePersonaRequest } from '../types/index.js';
+import type { CreatePersonaRequest, Persona, UpdatePersonaRequest } from '../types/index.js';
 export declare class PersonaModel {
-    private db;
-    constructor();
-    private initializeDatabase;
-    private ensureDatabase;
-    /**
-     * Get all personas for a user
-     */
     getPersonas(userId?: string): Promise<Persona[]>;
-    /**
-     * Get a specific persona by ID
-     */
     getPersonaById(id: string, userId?: string): Promise<Persona | null>;
-    /**
-     * Create a new persona
-     */
     createPersona(data: CreatePersonaRequest, userId?: string): Promise<Persona>;
-    /**
-     * Update an existing persona
-     */
     updatePersona(id: string, data: UpdatePersonaRequest, userId?: string): Promise<Persona | null>;
-    /**
-     * Delete a persona
-     */
     deletePersona(id: string, userId?: string): Promise<boolean>;
-    /**
-     * Get persona by name (for duplicate checking)
-     */
     getPersonaByName(name: string, userId?: string): Promise<Persona | null>;
-    /**
-     * Get personas count for a user
-     */
     getPersonasCount(userId?: string): Promise<number>;
 }
 export declare const personaModel: PersonaModel;

package/backend/dist/models/personaModel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personaModel.d.ts","sourceRoot":"","sources":["../../src/models/personaModel.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,OAAO,EACP,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAsB3B,qBAAa,YAAY;IACvB,OAAO,CAAC,EAAE,CAAkC;IAE5C,cAEC;IAED,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,cAAc;IAOtB;;OAEG;IACG,WAAW,CAAC,MAAM,GAAE,MAAkB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAiChE;IAED;;OAEG;IACG,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,MAAM,GAAE,MAAkB,GACzB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CA8BzB;IAED;;OAEG;IACG,aAAa,CACjB,IAAI,EAAE,oBAAoB,EAC1B,MAAM,GAAE,MAAkB,GACzB,OAAO,CAAC,OAAO,CAAC,CAsClB;IAED;;OAEG;IACG,aAAa,CACjB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,oBAAoB,EAC1B,MAAM,GAAE,MAAkB,GACzB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CA+EzB;IAED;;OAEG;IACG,aAAa,CACjB,EAAE,EAAE,MAAM,EACV,MAAM,GAAE,MAAkB,GACzB,OAAO,CAAC,OAAO,CAAC,CAclB;IAED;;OAEG;IACG,gBAAgB,CACpB,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,MAAkB,GACzB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CA8BzB;IAED;;OAEG;IACG,gBAAgB,CAAC,MAAM,GAAE,MAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAelE;CACF;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}
+{"version":3,"file":"personaModel.d.ts","sourceRoot":"","sources":["../../src/models/personaModel.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,oBAAoB,EACpB,OAAO,EACP,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAE3B,qBAAa,YAAY;IACjB,WAAW,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAExD;IAEK,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAOzB;IAEK,aAAa,CACjB,IAAI,EAAE,oBAAoB,EAC1B,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CAyBlB;IAEK,aAAa,CACjB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,oBAAoB,EAC1B,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CA8BzB;IAEK,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAKpE;IAEK,gBAAgB,CACpB,IAAI,EAAE,MAAM,EACZ,MAAM,SAAY,GACjB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAGzB;IAEK,gBAAgB,CAAC,MAAM,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1D;CACF;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}