libre-webui 0.21.3 → 0.22.0

package/backend/dist/services/legacyCiphertextIntegrity.js

@@ -0,0 +1,406 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import crypto from 'node:crypto';
+import { TextDecoder } from 'node:util';
+const TEXT_IV_BYTES = 16;
+const BINARY_IV_BYTES = 12;
+const AUTH_TAG_BYTES = 16;
+const BINARY_MAGIC = Buffer.from('LWB1', 'ascii');
+const DEFAULT_MAX_RECORDS = 1000000;
+const DEFAULT_MAX_CIPHERTEXT_BYTES = 16 * 1024 * 1024 * 1024;
+const DEFAULT_MAX_PLAINTEXT_BYTES = 16 * 1024 * 1024 * 1024;
+const TEXT_ENVELOPE_PATTERN = new RegExp(`^[0-9a-fA-F]{${TEXT_IV_BYTES * 2}}:[0-9a-fA-F]{${AUTH_TAG_BYTES * 2}}:(?:[0-9a-fA-F]{2})*$`);
+const TEXT_FIELDS = [
+    { table: 'users', column: 'email' },
+    { table: 'sessions', column: 'title' },
+    { table: 'sessions', column: 'settings' },
+    { table: 'session_messages', column: 'content' },
+    { table: 'session_messages', column: 'thinking' },
+    { table: 'session_messages', column: 'provider_metadata' },
+    { table: 'session_messages', column: 'images' },
+    { table: 'session_messages', column: 'statistics' },
+    { table: 'session_messages', column: 'artifacts' },
+    { table: 'knowledge_collections', column: 'name' },
+    { table: 'notes', column: 'title' },
+    { table: 'notes', column: 'content' },
+    { table: 'session_folders', column: 'name' },
+    { table: 'user_preferences', column: 'value' },
+    { table: 'documents', column: 'title' },
+    { table: 'documents', column: 'content' },
+    { table: 'documents', column: 'metadata' },
+    { table: 'document_chunks', column: 'content' },
+    { table: 'document_chunks', column: 'embedding' },
+    { table: 'plugin_credentials', column: 'api_key' },
+    {
+        table: 'plugin_variables',
+        column: 'variable_value',
+        predicate: 'is_encrypted = 1',
+        requireEnvelope: true,
+    },
+    { table: 'generated_images', column: 'prompt' },
+    { table: 'generated_images', column: 'image_data' },
+    { table: 'media_generation_jobs', column: 'prompt' },
+];
+export class LegacyCiphertextIntegrityError extends Error {
+    constructor(code) {
+        super('Legacy ciphertext recovery verification failed');
+        this.code = code;
+        this.name = 'LegacyCiphertextIntegrityError';
+    }
+}
+const quoteIdentifier = (value) => `"${value.replace(/"/g, '""')}"`;
+const positiveSafeInteger = (value, fallback) => {
+    const selected = value ?? fallback;
+    if (!Number.isSafeInteger(selected) || selected <= 0) {
+        throw new LegacyCiphertextIntegrityError('verification-limit');
+    }
+    return selected;
+};
+const resolveLimits = (limits) => ({
+    maxRecords: positiveSafeInteger(limits.maxRecords, DEFAULT_MAX_RECORDS),
+    maxCiphertextBytes: positiveSafeInteger(limits.maxCiphertextBytes, DEFAULT_MAX_CIPHERTEXT_BYTES),
+    maxPlaintextBytes: positiveSafeInteger(limits.maxPlaintextBytes, DEFAULT_MAX_PLAINTEXT_BYTES),
+});
+const addBounded = (left, right, maximum) => {
+    const result = left + right;
+    if (!Number.isSafeInteger(result) || right < 0 || result > maximum) {
+        throw new LegacyCiphertextIntegrityError('verification-limit');
+    }
+    return result;
+};
+const exactTextEnvelope = (value) => TEXT_ENVELOPE_PATTERN.test(value);
+const resemblesTextEnvelope = (value) => {
+    const parts = value.split(':');
+    if (parts.length !== 3)
+        return false;
+    const [iv, tag] = parts;
+    // Once either fixed-width envelope field is present, malformed hex must not
+    // turn authenticated data into an accepted legacy plaintext row.
+    return iv.length === TEXT_IV_BYTES * 2 || tag.length === AUTH_TAG_BYTES * 2;
+};
+const resemblesEncryptedEmailEnvelope = (value) => {
+    const parts = value.split(':');
+    return (parts.length === 3 &&
+        (parts[0]?.length === TEXT_IV_BYTES * 2 ||
+            parts[1]?.length === AUTH_TAG_BYTES * 2 ||
+            parts.every(part => /^[a-fA-F0-9]*$/.test(part))));
+};
+const decryptTextStrict = (value, key) => {
+    if (!exactTextEnvelope(value)) {
+        throw new LegacyCiphertextIntegrityError('integrity');
+    }
+    const [ivHex, authTagHex, ciphertextHex] = value.split(':');
+    try {
+        const decipher = crypto.createDecipheriv('aes-256-gcm', key, Buffer.from(ivHex, 'hex'), { authTagLength: AUTH_TAG_BYTES });
+        decipher.setAuthTag(Buffer.from(authTagHex, 'hex'));
+        return Buffer.concat([
+            decipher.update(Buffer.from(ciphertextHex, 'hex')),
+            decipher.final(),
+        ]);
+    }
+    catch {
+        throw new LegacyCiphertextIntegrityError('integrity');
+    }
+};
+const decryptBinaryStrict = (value, key, additionalData) => {
+    const minimumBytes = BINARY_MAGIC.length + BINARY_IV_BYTES + AUTH_TAG_BYTES;
+    if (value.length < minimumBytes ||
+        !value.subarray(0, BINARY_MAGIC.length).equals(BINARY_MAGIC)) {
+        throw new LegacyCiphertextIntegrityError('integrity');
+    }
+    const ivStart = BINARY_MAGIC.length;
+    const tagStart = ivStart + BINARY_IV_BYTES;
+    const ciphertextStart = tagStart + AUTH_TAG_BYTES;
+    try {
+        const decipher = crypto.createDecipheriv('aes-256-gcm', key, value.subarray(ivStart, tagStart), { authTagLength: AUTH_TAG_BYTES });
+        decipher.setAAD(additionalData);
+        decipher.setAuthTag(value.subarray(tagStart, ciphertextStart));
+        return Buffer.concat([
+            decipher.update(value.subarray(ciphertextStart)),
+            decipher.final(),
+        ]);
+    }
+    catch {
+        throw new LegacyCiphertextIntegrityError('integrity');
+    }
+};
+const tableColumns = (database, table, tables) => {
+    if (!tables.has(table))
+        return new Set();
+    return new Set(database
+        .prepare(`PRAGMA table_info(${quoteIdentifier(table)})`)
+        .all().map(column => column.name));
+};
+/**
+ * Authenticates every recognizable legacy AES-GCM field and every saved voice
+ * envelope without returning or logging plaintext. Plaintext rows from older
+ * schema generations remain compatible, except fields carrying an explicit
+ * encrypted marker and voice-profile fields whose schema requires envelopes.
+ */
+export const verifyLegacyCiphertextIntegrity = (database, encryptionKey, limits = {}, options = {}) => {
+    const resolvedLimits = resolveLimits(limits);
+    const requireIdentityLookupToken = options.requireIdentityLookupToken ?? true;
+    if (encryptionKey && encryptionKey.length !== 32) {
+        throw new LegacyCiphertextIntegrityError('key-unavailable');
+    }
+    const key = encryptionKey ? Buffer.from(encryptionKey) : undefined;
+    try {
+        return database.transaction(() => {
+            const tables = new Set(database
+                .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'")
+                .all().map(row => row.name));
+            const columnCache = new Map();
+            const columnsFor = (table) => {
+                const cached = columnCache.get(table);
+                if (cached)
+                    return cached;
+                const columns = tableColumns(database, table, tables);
+                columnCache.set(table, columns);
+                return columns;
+            };
+            const selectedTextFields = TEXT_FIELDS.filter(spec => {
+                const columns = columnsFor(spec.table);
+                if (!columns.has(spec.column))
+                    return false;
+                // Identity email has stricter damaged-envelope handling in every
+                // schema generation and, from v4 onward, a keyed lookup invariant.
+                if (spec.table === 'users' && spec.column === 'email')
+                    return false;
+                return !spec.predicate || columns.has('is_encrypted');
+            });
+            const verifyIdentityEmails = columnsFor('users').has('email');
+            const verifyEmailLookups = columnsFor('users').has('email_lookup');
+            const voiceColumns = columnsFor('voice_profiles');
+            const verifyVoiceProfiles = [
+                'id',
+                'user_id',
+                'name',
+                'reference_audio',
+                'reference_text',
+            ].every(column => voiceColumns.has(column));
+            let selectedRecords = 0;
+            let selectedBytes = 0;
+            for (const spec of selectedTextFields) {
+                const table = quoteIdentifier(spec.table);
+                const column = quoteIdentifier(spec.column);
+                const where = `${column} IS NOT NULL AND LENGTH(${column}) > 0${spec.predicate ? ` AND ${spec.predicate}` : ''}`;
+                const aggregate = database
+                    .prepare(`SELECT COUNT(*) AS records, COALESCE(SUM(LENGTH(CAST(${column} AS BLOB))), 0) AS bytes FROM ${table} WHERE ${where}`)
+                    .get();
+                selectedRecords = addBounded(selectedRecords, Number(aggregate.records), resolvedLimits.maxRecords);
+                selectedBytes = addBounded(selectedBytes, Number(aggregate.bytes), resolvedLimits.maxCiphertextBytes);
+            }
+            if (verifyIdentityEmails) {
+                const aggregate = database
+                    .prepare(`SELECT COUNT(*) AS records,
+                    COALESCE(SUM(COALESCE(LENGTH(CAST(email AS BLOB)), 0) +
+                                 ${verifyEmailLookups ? 'COALESCE(LENGTH(CAST(email_lookup AS BLOB)), 0)' : '0'}), 0) AS bytes
+             FROM users
+             WHERE email IS NOT NULL${verifyEmailLookups ? ' OR email_lookup IS NOT NULL' : ''}`)
+                    .get();
+                selectedRecords = addBounded(selectedRecords, Number(aggregate.records), resolvedLimits.maxRecords);
+                selectedBytes = addBounded(selectedBytes, Number(aggregate.bytes), resolvedLimits.maxCiphertextBytes);
+            }
+            if (verifyVoiceProfiles) {
+                const aggregate = database
+                    .prepare(`SELECT
+               COUNT(name) + COUNT(reference_audio) + COUNT(reference_text) AS records,
+               COALESCE(SUM(LENGTH(name) + LENGTH(reference_audio) + COALESCE(LENGTH(reference_text), 0)), 0) AS bytes
+             FROM voice_profiles`)
+                    .get();
+                selectedRecords = addBounded(selectedRecords, Number(aggregate.records), resolvedLimits.maxRecords);
+                selectedBytes = addBounded(selectedBytes, Number(aggregate.bytes), resolvedLimits.maxCiphertextBytes);
+            }
+            let textRecords = 0;
+            let binaryRecords = 0;
+            let ciphertextBytes = 0;
+            let plaintextBytes = 0;
+            const fatalUtf8 = new TextDecoder('utf-8', { fatal: true });
+            const authenticateText = (value) => {
+                if (!key) {
+                    throw new LegacyCiphertextIntegrityError('key-unavailable');
+                }
+                const plaintext = decryptTextStrict(value, key);
+                try {
+                    textRecords += 1;
+                    ciphertextBytes = addBounded(ciphertextBytes, Buffer.byteLength(value, 'utf8'), resolvedLimits.maxCiphertextBytes);
+                    plaintextBytes = addBounded(plaintextBytes, plaintext.length, resolvedLimits.maxPlaintextBytes);
+                }
+                catch (error) {
+                    if (error instanceof LegacyCiphertextIntegrityError)
+                        throw error;
+                    throw new LegacyCiphertextIntegrityError('integrity');
+                }
+                finally {
+                    plaintext.fill(0);
+                }
+            };
+            const authenticateBinary = (value, additionalData) => {
+                if (!Buffer.isBuffer(value) || !key) {
+                    throw new LegacyCiphertextIntegrityError(key ? 'integrity' : 'key-unavailable');
+                }
+                const plaintext = decryptBinaryStrict(value, key, additionalData);
+                try {
+                    binaryRecords += 1;
+                    ciphertextBytes = addBounded(ciphertextBytes, value.length, resolvedLimits.maxCiphertextBytes);
+                    plaintextBytes = addBounded(plaintextBytes, plaintext.length, resolvedLimits.maxPlaintextBytes);
+                }
+                catch (error) {
+                    if (error instanceof LegacyCiphertextIntegrityError)
+                        throw error;
+                    throw new LegacyCiphertextIntegrityError('integrity');
+                }
+                finally {
+                    plaintext.fill(0);
+                    additionalData.fill(0);
+                }
+            };
+            for (const spec of selectedTextFields) {
+                const table = quoteIdentifier(spec.table);
+                const column = quoteIdentifier(spec.column);
+                const where = `${column} IS NOT NULL AND LENGTH(${column}) > 0${spec.predicate ? ` AND ${spec.predicate}` : ''}`;
+                const rows = database
+                    .prepare(`SELECT ${column} AS value FROM ${table} WHERE ${where}`)
+                    .iterate();
+                for (const row of rows) {
+                    if (typeof row.value !== 'string') {
+                        throw new LegacyCiphertextIntegrityError('integrity');
+                    }
+                    if (exactTextEnvelope(row.value)) {
+                        authenticateText(row.value);
+                    }
+                    else if (spec.requireEnvelope || resemblesTextEnvelope(row.value)) {
+                        throw new LegacyCiphertextIntegrityError('integrity');
+                    }
+                }
+            }
+            if (verifyIdentityEmails) {
+                const rows = database
+                    .prepare(`SELECT email, ${verifyEmailLookups ? 'email_lookup' : 'NULL AS email_lookup'}
+             FROM users
+             WHERE email IS NOT NULL${verifyEmailLookups ? ' OR email_lookup IS NOT NULL' : ''}
+             ORDER BY id`)
+                    .iterate();
+                for (const row of rows) {
+                    if (row.email === null) {
+                        if (row.email_lookup !== null) {
+                            throw new LegacyCiphertextIntegrityError('integrity');
+                        }
+                        continue;
+                    }
+                    if (typeof row.email !== 'string' ||
+                        (!verifyEmailLookups && row.email_lookup !== null) ||
+                        (row.email_lookup !== null &&
+                            (typeof row.email_lookup !== 'string' ||
+                                !/^[0-9a-f]{64}$/.test(row.email_lookup))) ||
+                        (verifyEmailLookups &&
+                            row.email_lookup === null &&
+                            requireIdentityLookupToken)) {
+                        throw new LegacyCiphertextIntegrityError('integrity');
+                    }
+                    if (!verifyEmailLookups) {
+                        if (exactTextEnvelope(row.email)) {
+                            authenticateText(row.email);
+                        }
+                        else if (resemblesEncryptedEmailEnvelope(row.email)) {
+                            throw new LegacyCiphertextIntegrityError('integrity');
+                        }
+                        continue;
+                    }
+                    const permitInterruptedPlaintext = !requireIdentityLookupToken && row.email_lookup === null;
+                    if (!exactTextEnvelope(row.email)) {
+                        if (!permitInterruptedPlaintext ||
+                            resemblesEncryptedEmailEnvelope(row.email)) {
+                            throw new LegacyCiphertextIntegrityError('integrity');
+                        }
+                        // The identity repository will preserve and encrypt this legacy
+                        // value, or normalize it to NULL when blank, before serving.
+                        continue;
+                    }
+                    if (!key) {
+                        throw new LegacyCiphertextIntegrityError('key-unavailable');
+                    }
+                    const plaintext = decryptTextStrict(row.email, key);
+                    try {
+                        const decodedEmail = fatalUtf8.decode(plaintext);
+                        const expectedLookup = crypto
+                            .createHmac('sha256', key)
+                            .update('libre:identity-email:v1\0', 'utf8')
+                            .update(decodedEmail, 'utf8')
+                            .digest();
+                        if (typeof row.email_lookup === 'string') {
+                            const storedLookup = Buffer.from(row.email_lookup, 'hex');
+                            if (!crypto.timingSafeEqual(expectedLookup, storedLookup)) {
+                                throw new LegacyCiphertextIntegrityError('integrity');
+                            }
+                        }
+                        textRecords += 1;
+                        ciphertextBytes = addBounded(ciphertextBytes, Buffer.byteLength(row.email, 'utf8'), resolvedLimits.maxCiphertextBytes);
+                        plaintextBytes = addBounded(plaintextBytes, plaintext.length, resolvedLimits.maxPlaintextBytes);
+                    }
+                    catch (error) {
+                        if (error instanceof LegacyCiphertextIntegrityError)
+                            throw error;
+                        throw new LegacyCiphertextIntegrityError('integrity');
+                    }
+                    finally {
+                        plaintext.fill(0);
+                    }
+                }
+            }
+            if (verifyVoiceProfiles) {
+                const rows = database
+                    .prepare(`SELECT id, user_id, name, reference_audio, reference_text
+             FROM voice_profiles
+             ORDER BY id`)
+                    .iterate();
+                for (const row of rows) {
+                    if (typeof row.id !== 'string' || typeof row.user_id !== 'string') {
+                        throw new LegacyCiphertextIntegrityError('integrity');
+                    }
+                    authenticateBinary(row.name, Buffer.from(`voice-profile:${row.id}:${row.user_id}:name`, 'utf8'));
+                    authenticateBinary(row.reference_audio, Buffer.from(`voice-profile:${row.id}:${row.user_id}:audio`, 'utf8'));
+                    if (row.reference_text !== null) {
+                        authenticateBinary(row.reference_text, Buffer.from(`voice-profile:${row.id}:${row.user_id}:transcript`, 'utf8'));
+                    }
+                }
+            }
+            const records = textRecords + binaryRecords;
+            if (!Number.isSafeInteger(records)) {
+                throw new LegacyCiphertextIntegrityError('verification-limit');
+            }
+            return {
+                verified: true,
+                encryptedAuthenticated: true,
+                records,
+                textRecords,
+                binaryRecords,
+                ciphertextBytes,
+                plaintextBytes,
+            };
+        })();
+    }
+    catch (error) {
+        if (error instanceof LegacyCiphertextIntegrityError)
+            throw error;
+        throw new LegacyCiphertextIntegrityError('integrity');
+    }
+    finally {
+        key?.fill(0);
+    }
+};
+//# sourceMappingURL=legacyCiphertextIntegrity.js.map

package/backend/dist/services/legacyCiphertextIntegrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacyCiphertextIntegrity.js","sourceRoot":"","sources":["../../src/services/legacyCiphertextIntegrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAIxC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAClD,MAAM,mBAAmB,GAAG,OAAS,CAAC;AACtC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5D,MAAM,qBAAqB,GAAG,IAAI,MAAM,CACtC,gBAAgB,aAAa,GAAG,CAAC,iBAAiB,cAAc,GAAG,CAAC,wBAAwB,CAC7F,CAAC;AASF,MAAM,WAAW,GAA6B;IAC5C,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;IACnC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;IACtC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;IACzC,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,EAAE;IAChD,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE;IACjD,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,mBAAmB,EAAE;IAC1D,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC/C,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE;IACnD,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,WAAW,EAAE;IAClD,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,EAAE;IAClD,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;IACnC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;IACrC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE;IAC5C,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,OAAO,EAAE;IAC9C,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;IACvC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE;IACzC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;IAC1C,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE;IAC/C,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE;IACjD,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE;IAClD;QACE,KAAK,EAAE,kBAAkB;QACzB,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,kBAAkB;QAC7B,eAAe,EAAE,IAAI;KACtB;IACD,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC/C,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE;IACnD,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE;CAC5C,CAAC;AAgCX,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD,YACW,IAA4D;QAErE,KAAK,CAAC,gDAAgD,CAAC,CAAC;oBAF/C,IAAI;QAGb,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAqBD,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAChD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAEnC,MAAM,mBAAmB,GAAG,CAC1B,KAAyB,EACzB,QAAgB,EACR,EAAE;IACV,MAAM,QAAQ,GAAG,KAAK,IAAI,QAAQ,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,8BAA8B,CAAC,oBAAoB,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,MAAuC,EACvB,EAAE,CAAC,CAAC;IACpB,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACvE,kBAAkB,EAAE,mBAAmB,CACrC,MAAM,CAAC,kBAAkB,EACzB,4BAA4B,CAC7B;IACD,iBAAiB,EAAE,mBAAmB,CACpC,MAAM,CAAC,iBAAiB,EACxB,2BAA2B,CAC5B;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,OAAe,EAAU,EAAE;IAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,MAAM,GAAG,OAAO,EAAE,CAAC;QACnE,MAAM,IAAI,8BAA8B,CAAC,oBAAoB,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAW,EAAE,CACnD,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEpC,MAAM,qBAAqB,GAAG,CAAC,KAAa,EAAW,EAAE;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,4EAA4E;IAC5E,iEAAiE;IACjE,OAAO,EAAE,CAAC,MAAM,KAAK,aAAa,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,GAAG,CAAC,CAAC;AAC9E,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CAAC,KAAa,EAAW,EAAE;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,aAAa,GAAG,CAAC;YACrC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,cAAc,GAAG,CAAC;YACvC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACpD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAE,GAAW,EAAU,EAAE;IAC/D,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EACzB,EAAE,aAAa,EAAE,cAAc,EAAE,CACZ,CAAC;QACxB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAClD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,KAAa,EACb,GAAW,EACX,cAAsB,EACd,EAAE;IACV,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,GAAG,eAAe,GAAG,cAAc,CAAC;IAC5E,IACE,KAAK,CAAC,MAAM,GAAG,YAAY;QAC3B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,GAAG,eAAe,CAAC;IAC3C,MAAM,eAAe,GAAG,QAAQ,GAAG,cAAc,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,GAAG,EACH,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,EACjC,EAAE,aAAa,EAAE,cAAc,EAAE,CACZ,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAChC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;YAChD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,QAA2B,EAC3B,KAAa,EACb,MAA2B,EACN,EAAE;IACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACzC,OAAO,IAAI,GAAG,CAEV,QAAQ;SACL,OAAO,CAAC,qBAAqB,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC;SACvD,GAAG,EACP,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC7B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,QAA2B,EAC3B,aAAiC,EACjC,MAAM,GAAoC,EAAE,EAC5C,OAAO,GAAiD,EAAE,EACzB,EAAE;IACnC,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,IAAI,IAAI,CAAC;IAC9E,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnE,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE;YAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,CAElB,QAAQ;iBACL,OAAO,CACN,kFAAkF,CACnF;iBACA,GAAG,EACP,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CACvB,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,GAAG,EAA+B,CAAC;YAC3D,MAAM,UAAU,GAAG,CAAC,KAAa,EAAuB,EAAE;gBACxD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACtC,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;gBAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBACtD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAChC,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC;YACF,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBACnD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC5C,iEAAiE;gBACjE,mEAAmE;gBACnE,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;oBAAE,OAAO,KAAK,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACxD,CAAC,CAAC,CAAC;YACH,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9D,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACnE,MAAM,YAAY,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,mBAAmB,GAAG;gBAC1B,IAAI;gBACJ,SAAS;gBACT,MAAM;gBACN,iBAAiB;gBACjB,gBAAgB;aACjB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAE5C,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,MAAM,2BAA2B,MAAM,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACjH,MAAM,SAAS,GAAG,QAAQ;qBACvB,OAAO,CACN,wDAAwD,MAAM,iCAAiC,KAAK,UAAU,KAAK,EAAE,CACtH;qBACA,GAAG,EAAe,CAAC;gBACtB,eAAe,GAAG,UAAU,CAC1B,eAAe,EACf,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EACzB,cAAc,CAAC,UAAU,CAC1B,CAAC;gBACF,aAAa,GAAG,UAAU,CACxB,aAAa,EACb,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EACvB,cAAc,CAAC,kBAAkB,CAClC,CAAC;YACJ,CAAC;YACD,IAAI,oBAAoB,EAAE,CAAC;gBACzB,MAAM,SAAS,GAAG,QAAQ;qBACvB,OAAO,CACN;;mCAEuB,kBAAkB,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,GAAG;;sCAEzE,kBAAkB,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,EAAE,CACrF;qBACA,GAAG,EAAe,CAAC;gBACtB,eAAe,GAAG,UAAU,CAC1B,eAAe,EACf,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EACzB,cAAc,CAAC,UAAU,CAC1B,CAAC;gBACF,aAAa,GAAG,UAAU,CACxB,aAAa,EACb,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EACvB,cAAc,CAAC,kBAAkB,CAClC,CAAC;YACJ,CAAC;YACD,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,QAAQ;qBACvB,OAAO,CACN;;;iCAGqB,CACtB;qBACA,GAAG,EAAe,CAAC;gBACtB,eAAe,GAAG,UAAU,CAC1B,eAAe,EACf,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EACzB,cAAc,CAAC,UAAU,CAC1B,CAAC;gBACF,aAAa,GAAG,UAAU,CACxB,aAAa,EACb,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EACvB,cAAc,CAAC,kBAAkB,CAClC,CAAC;YACJ,CAAC;YAED,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,IAAI,cAAc,GAAG,CAAC,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAQ,EAAE;gBAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,MAAM,IAAI,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;gBAC9D,CAAC;gBACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAChD,IAAI,CAAC;oBACH,WAAW,IAAI,CAAC,CAAC;oBACjB,eAAe,GAAG,UAAU,CAC1B,eAAe,EACf,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAChC,cAAc,CAAC,kBAAkB,CAClC,CAAC;oBACF,cAAc,GAAG,UAAU,CACzB,cAAc,EACd,SAAS,CAAC,MAAM,EAChB,cAAc,CAAC,iBAAiB,CACjC,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,8BAA8B;wBAAE,MAAM,KAAK,CAAC;oBACjE,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;gBACxD,CAAC;wBAAS,CAAC;oBACT,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC,CAAC;YACF,MAAM,kBAAkB,GAAG,CACzB,KAAc,EACd,cAAsB,EAChB,EAAE;gBACR,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;oBACpC,MAAM,IAAI,8BAA8B,CACtC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CACtC,CAAC;gBACJ,CAAC;gBACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;gBAClE,IAAI,CAAC;oBACH,aAAa,IAAI,CAAC,CAAC;oBACnB,eAAe,GAAG,UAAU,CAC1B,eAAe,EACf,KAAK,CAAC,MAAM,EACZ,cAAc,CAAC,kBAAkB,CAClC,CAAC;oBACF,cAAc,GAAG,UAAU,CACzB,cAAc,EACd,SAAS,CAAC,MAAM,EAChB,cAAc,CAAC,iBAAiB,CACjC,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,8BAA8B;wBAAE,MAAM,KAAK,CAAC;oBACjE,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;gBACxD,CAAC;wBAAS,CAAC;oBACT,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC,CAAC;YAEF,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,MAAM,2BAA2B,MAAM,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACjH,MAAM,IAAI,GAAG,QAAQ;qBAClB,OAAO,CAAC,UAAU,MAAM,kBAAkB,KAAK,UAAU,KAAK,EAAE,CAAC;qBACjE,OAAO,EAAkC,CAAC;gBAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAClC,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;oBACxD,CAAC;oBACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACjC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAC9B,CAAC;yBAAM,IAAI,IAAI,CAAC,eAAe,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACpE,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,oBAAoB,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,QAAQ;qBAClB,OAAO,CACN,iBAAiB,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB;;sCAEnD,kBAAkB,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE;yBACrE,CACd;qBACA,OAAO,EAGR,CAAC;gBACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;wBACvB,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;4BAC9B,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;wBACxD,CAAC;wBACD,SAAS;oBACX,CAAC;oBACD,IACE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;wBAC7B,CAAC,CAAC,kBAAkB,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC;wBAClD,CAAC,GAAG,CAAC,YAAY,KAAK,IAAI;4BACxB,CAAC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;gCACnC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;wBAC9C,CAAC,kBAAkB;4BACjB,GAAG,CAAC,YAAY,KAAK,IAAI;4BACzB,0BAA0B,CAAC,EAC7B,CAAC;wBACD,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;oBACxD,CAAC;oBACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;wBACxB,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;4BACjC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;wBAC9B,CAAC;6BAAM,IAAI,+BAA+B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;4BACtD,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;wBACxD,CAAC;wBACD,SAAS;oBACX,CAAC;oBACD,MAAM,0BAA0B,GAC9B,CAAC,0BAA0B,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC;oBAC3D,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBAClC,IACE,CAAC,0BAA0B;4BAC3B,+BAA+B,CAAC,GAAG,CAAC,KAAK,CAAC,EAC1C,CAAC;4BACD,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;wBACxD,CAAC;wBACD,gEAAgE;wBAChE,6DAA6D;wBAC7D,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,GAAG,EAAE,CAAC;wBACT,MAAM,IAAI,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;oBAC9D,CAAC;oBACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBACpD,IAAI,CAAC;wBACH,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;wBACjD,MAAM,cAAc,GAAG,MAAM;6BAC1B,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;6BACzB,MAAM,CAAC,2BAA2B,EAAE,MAAM,CAAC;6BAC3C,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC;6BAC5B,MAAM,EAAE,CAAC;wBACZ,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;4BACzC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;4BAC1D,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC;gCAC1D,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;4BACxD,CAAC;wBACH,CAAC;wBACD,WAAW,IAAI,CAAC,CAAC;wBACjB,eAAe,GAAG,UAAU,CAC1B,eAAe,EACf,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,EACpC,cAAc,CAAC,kBAAkB,CAClC,CAAC;wBACF,cAAc,GAAG,UAAU,CACzB,cAAc,EACd,SAAS,CAAC,MAAM,EAChB,cAAc,CAAC,iBAAiB,CACjC,CAAC;oBACJ,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,8BAA8B;4BAAE,MAAM,KAAK,CAAC;wBACjE,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;oBACxD,CAAC;4BAAS,CAAC;wBACT,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,QAAQ;qBAClB,OAAO,CACN;;yBAEa,CACd;qBACA,OAAO,EAA+B,CAAC;gBAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAClE,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;oBACxD,CAAC;oBACD,kBAAkB,CAChB,GAAG,CAAC,IAAI,EACR,MAAM,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,OAAO,OAAO,EAAE,MAAM,CAAC,CACnE,CAAC;oBACF,kBAAkB,CAChB,GAAG,CAAC,eAAe,EACnB,MAAM,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,OAAO,QAAQ,EAAE,MAAM,CAAC,CACpE,CAAC;oBACF,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;wBAChC,kBAAkB,CAChB,GAAG,CAAC,cAAc,EAClB,MAAM,CAAC,IAAI,CACT,iBAAiB,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,OAAO,aAAa,EACnD,MAAM,CACP,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,WAAW,GAAG,aAAa,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,8BAA8B,CAAC,oBAAoB,CAAC,CAAC;YACjE,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,sBAAsB,EAAE,IAAI;gBAC5B,OAAO;gBACP,WAAW;gBACX,aAAa;gBACb,eAAe;gBACf,cAAc;aACN,CAAC;QACb,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,8BAA8B;YAAE,MAAM,KAAK,CAAC;QACjE,MAAM,IAAI,8BAA8B,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;YAAS,CAAC;QACT,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;AACH,CAAC,CAAC"}

package/backend/dist/services/mediaGenerationJobService.d.ts

@@ -1,3 +1,6 @@
+import type { MediaGenerationStatus } from '../platform/storage/platformDomainRepositories.js';
+import type { GeneratedMedia } from '../types/index.js';
+export declare const PREPARED_VIDEO_PROVIDER_JOB_ID = "libre:prepared";
 export interface MediaGenerationJob {
     id: string;
     userId: string;
@@ -5,7 +8,7 @@ export interface MediaGenerationJob {
     pluginId: string;
     model: string;
     prompt: string;
-    status: 'pending' | 'in_progress' | 'completed' | 'failed';
+    status: MediaGenerationStatus;
     options: Record<string, unknown>;
     galleryId?: string;
     error?: string;
@@ -13,12 +16,31 @@ export interface MediaGenerationJob {
     updatedAt: number;
 }
 declare class MediaGenerationJobService {
-    create(userId: string, input: Omit<MediaGenerationJob, 'id' | 'userId' | 'status' | 'createdAt' | 'updatedAt'>): MediaGenerationJob;
-    get(id: string, userId: string): MediaGenerationJob | null;
-    update(id: string, userId: string, status: MediaGenerationJob['status'], fields?: {
+    queueVideoSubmission(userId: string, input: Omit<MediaGenerationJob, 'id' | 'userId' | 'providerJobId' | 'status' | 'createdAt' | 'updatedAt'>): Promise<MediaGenerationJob>;
+    acceptSubmittedProviderJob(jobId: string, userId: string, providerJobId: string): Promise<void>;
+    create(userId: string, input: Omit<MediaGenerationJob, 'id' | 'userId' | 'status' | 'createdAt' | 'updatedAt'>): Promise<MediaGenerationJob>;
+    get(id: string, userId: string): Promise<MediaGenerationJob | null>;
+    list(userId: string, options?: {
+        limit?: number;
+        activeOnly?: boolean;
+    }): Promise<MediaGenerationJob[]>;
+    remove(id: string, userId: string): Promise<boolean>;
+    update(id: string, userId: string, status: MediaGenerationStatus, fields?: {
         galleryId?: string;
         error?: string;
-    }): void;
+    }): Promise<void>;
+    /**
+     * Persist a downloaded provider result and conditionally claim completion.
+     * A losing retry removes its duplicate blob and returns the durable winner.
+     */
+    completeWithMedia(jobId: string, userId: string, input: {
+        mimeType: string;
+        mediaData: string;
+        metadata?: Record<string, unknown>;
+    }, execution?: {
+        attemptCount?: number;
+        signal?: AbortSignal;
+    }): Promise<GeneratedMedia>;
 }
 declare const _default: MediaGenerationJobService;
 export default _default;

package/backend/dist/services/mediaGenerationJobService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mediaGenerationJobService.d.ts","sourceRoot":"","sources":["../../src/services/mediaGenerationJobService.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC3D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAiBD,cAAM,yBAAyB;IAC7B,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,IAAI,CACT,kBAAkB,EAClB,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CACvD,GACA,kBAAkB,CAqCpB;IAED,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CASzD;IAED,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EACpC,MAAM,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAClD,IAAI,CAgBN;CACF"}
+{"version":3,"file":"mediaGenerationJobService.d.ts","sourceRoot":"","sources":["../../src/services/mediaGenerationJobService.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAexD,eAAO,MAAM,8BAA8B,mBAAmB,CAAC;AA4C/D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,qBAAqB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,cAAM,yBAAyB;IACvB,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,IAAI,CACT,kBAAkB,EAClB,IAAI,GAAG,QAAQ,GAAG,eAAe,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CACzE,GACA,OAAO,CAAC,kBAAkB,CAAC,CAyD7B;IAEK,0BAA0B,CAC9B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CA+Cf;IAEK,MAAM,CACV,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,IAAI,CACT,kBAAkB,EAClB,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CACvD,GACA,OAAO,CAAC,kBAAkB,CAAC,CAmB7B;IAEK,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAOxE;IAEK,IAAI,CACR,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACrD,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAK/B;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKzD;IAEK,MAAM,CACV,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,EAC7B,MAAM,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAClD,OAAO,CAAC,IAAI,CAAC,CAUf;IAED;;;OAGG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EACD,SAAS,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAC9D,OAAO,CAAC,cAAc,CAAC,CA6CzB;CACF"}