libre-webui 0.21.3 → 0.22.1

package/backend/dist/persistence/postgresCoreMigration.js

@@ -0,0 +1,179 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ */
+import { createHash } from 'node:crypto';
+/**
+ * PostgreSQL schema for the domains that have crossed the repository boundary:
+ * identity, chats/messages, notes, folders, collections, and preferences.
+ */
+export const POSTGRES_CORE_PERSISTENCE_SQL = `
+CREATE TABLE users (
+  id text PRIMARY KEY,
+  username text NOT NULL UNIQUE,
+  email text UNIQUE,
+  email_lookup text UNIQUE,
+  password_hash text NOT NULL,
+  role text NOT NULL DEFAULT 'user' CHECK (role IN ('admin', 'user')),
+  account_status text NOT NULL DEFAULT 'active'
+    CHECK (account_status IN ('pending', 'active')),
+  approved_at bigint,
+  approved_by text,
+  avatar text,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL
+);
+
+CREATE TABLE personas (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  description text,
+  model text NOT NULL,
+  parameters text NOT NULL,
+  avatar text,
+  background text,
+  embedding_model text,
+  memory_settings text,
+  mutation_settings text,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL
+);
+
+CREATE TABLE session_folders (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL
+);
+
+CREATE TABLE knowledge_collections (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL
+);
+
+CREATE TABLE sessions (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  title text NOT NULL,
+  model text NOT NULL,
+  persona_id text REFERENCES personas(id) ON DELETE SET NULL,
+  provider_type text,
+  provider_id text,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL,
+  archived smallint NOT NULL DEFAULT 0 CHECK (archived IN (0, 1)),
+  settings text,
+  folder_id text REFERENCES session_folders(id) ON DELETE SET NULL,
+  pinned smallint NOT NULL DEFAULT 0 CHECK (pinned IN (0, 1))
+);
+
+CREATE TABLE session_messages (
+  id text PRIMARY KEY,
+  session_id text NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
+  role text NOT NULL,
+  content text NOT NULL,
+  thinking text,
+  timestamp bigint NOT NULL,
+  message_index integer NOT NULL,
+  model text,
+  provider_metadata text,
+  images text,
+  statistics text,
+  artifacts text,
+  parent_id text REFERENCES session_messages(id) ON DELETE SET NULL,
+  branch_index integer NOT NULL DEFAULT 0,
+  is_active smallint NOT NULL DEFAULT 1 CHECK (is_active IN (0, 1)),
+  rating integer
+);
+
+CREATE TABLE notes (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  title text NOT NULL,
+  content text NOT NULL,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL
+);
+
+CREATE TABLE documents (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  filename text NOT NULL,
+  title text,
+  content text,
+  file_type text,
+  size bigint,
+  session_id text REFERENCES sessions(id) ON DELETE SET NULL,
+  collection_id text REFERENCES knowledge_collections(id) ON DELETE SET NULL,
+  metadata text,
+  uploaded_at bigint NOT NULL,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL
+);
+
+CREATE TABLE document_chunks (
+  id text PRIMARY KEY,
+  document_id text NOT NULL REFERENCES documents(id) ON DELETE CASCADE,
+  chunk_index integer NOT NULL,
+  content text NOT NULL,
+  start_char integer,
+  end_char integer,
+  embedding text,
+  created_at bigint NOT NULL,
+  UNIQUE (document_id, chunk_index)
+);
+
+CREATE TABLE user_preferences (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  key text NOT NULL,
+  value text NOT NULL,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL,
+  UNIQUE (user_id, key)
+);
+
+CREATE TABLE system_settings (
+  key text PRIMARY KEY,
+  value text NOT NULL,
+  updated_at bigint NOT NULL
+);
+
+CREATE INDEX idx_personas_user_id ON personas(user_id);
+CREATE INDEX idx_sessions_user_updated ON sessions(user_id, updated_at DESC);
+CREATE INDEX idx_sessions_folder ON sessions(user_id, folder_id);
+CREATE INDEX idx_session_messages_order
+  ON session_messages(session_id, message_index, branch_index);
+CREATE INDEX idx_session_messages_parent ON session_messages(parent_id);
+CREATE INDEX idx_notes_user_updated ON notes(user_id, updated_at DESC);
+CREATE INDEX idx_session_folders_user_name
+  ON session_folders(user_id, lower(name));
+CREATE INDEX idx_knowledge_collections_user_name
+  ON knowledge_collections(user_id, lower(name));
+CREATE INDEX idx_documents_user_updated ON documents(user_id, updated_at DESC);
+CREATE INDEX idx_documents_collection
+  ON documents(user_id, collection_id);
+CREATE INDEX idx_document_chunks_document
+  ON document_chunks(document_id, chunk_index);
+CREATE INDEX idx_user_preferences_user_key
+  ON user_preferences(user_id, key);
+`;
+const version = 1;
+const name = 'core-persistence';
+export const POSTGRES_CORE_MIGRATION = Object.freeze({
+    version,
+    name,
+    checksum: createHash('sha256')
+        .update(`${version}\n${name}\n${POSTGRES_CORE_PERSISTENCE_SQL}`)
+        .digest('hex'),
+    sql: POSTGRES_CORE_PERSISTENCE_SQL,
+    rollbackPlan: 'Stop Libre, export and verify the PostgreSQL database, then downgrade the application before dropping only empty core tables in reverse foreign-key order. In-place destructive rollback is unsupported.',
+    minimumCompatibleVersion: 1,
+});
+//# sourceMappingURL=postgresCoreMigration.js.map

package/backend/dist/persistence/postgresCoreMigration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresCoreMigration.js","sourceRoot":"","sources":["../../src/persistence/postgresCoreMigration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2J5C,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,IAAI,GAAG,kBAAkB,CAAC;AAEhC,MAAM,CAAC,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtE,OAAO;IACP,IAAI;IACJ,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,GAAG,OAAO,KAAK,IAAI,KAAK,6BAA6B,EAAE,CAAC;SAC/D,MAAM,CAAC,KAAK,CAAC;IAChB,GAAG,EAAE,6BAA6B;IAClC,YAAY,EACV,0MAA0M;IAC5M,wBAAwB,EAAE,CAAC;CAC5B,CAAC,CAAC"}

package/backend/dist/persistence/postgresDatabase.d.ts

@@ -0,0 +1,40 @@
+import { Pool, type PoolClient, type QueryResult, type QueryResultRow } from 'pg';
+import type { PostgresRuntimeConfig } from './postgresConfig.js';
+import type { PersistenceHealth } from './types.js';
+export interface PostgresQueryExecutor {
+    query<Row extends QueryResultRow = QueryResultRow>(text: string, parameters?: readonly unknown[]): Promise<QueryResult<Row>>;
+}
+export interface PostgresTransactionOptions {
+    isolationLevel?: 'read committed' | 'repeatable read' | 'serializable';
+    readOnly?: boolean;
+    /** Last-moment authority fence awaited directly before COMMIT is sent. */
+    beforeCommit?: () => void | Promise<void>;
+}
+export interface PostgresPoolLike extends PostgresQueryExecutor {
+    readonly totalCount: number;
+    readonly idleCount: number;
+    readonly waitingCount: number;
+    connect(): Promise<PoolClient>;
+    end(): Promise<void>;
+    on?(event: 'error', listener: (error: Error) => void): unknown;
+}
+export declare const createPostgresPool: (config: PostgresRuntimeConfig) => Pool;
+/**
+ * Thin pool boundary for PostgreSQL-specific repositories. Transactions always
+ * pin one pooled client, release it in finally, and never expose the pool URL.
+ */
+export declare class PostgresDatabase implements PostgresQueryExecutor {
+    readonly pool: PostgresPoolLike;
+    private closing;
+    private closed;
+    private closePromise;
+    constructor(pool: PostgresPoolLike);
+    private assertOpen;
+    query<Row extends QueryResultRow = QueryResultRow>(text: string, parameters?: readonly unknown[]): Promise<QueryResult<Row>>;
+    withClient<T>(operation: (client: PoolClient) => Promise<T>): Promise<T>;
+    transaction<T>(operation: (client: PoolClient) => Promise<T>, options?: PostgresTransactionOptions): Promise<T>;
+    health(): Promise<PersistenceHealth>;
+    close(): Promise<void>;
+}
+export declare const createPostgresDatabase: (config: PostgresRuntimeConfig) => PostgresDatabase;
+//# sourceMappingURL=postgresDatabase.d.ts.map

package/backend/dist/persistence/postgresDatabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresDatabase.d.ts","sourceRoot":"","sources":["../../src/persistence/postgresDatabase.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,IAAI,EACJ,KAAK,UAAU,EAEf,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,IAAI,CAAC;AACZ,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAKpD,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,GAAG,SAAS,cAAc,GAAG,cAAc,EAC/C,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,SAAS,OAAO,EAAE,GAC9B,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,cAAc,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,cAAc,CAAC;IACvE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,gBAAiB,SAAQ,qBAAqB;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/B,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC;CAChE;AAQD,eAAO,MAAM,kBAAkB,WAAY,qBAAqB,KAAG,IAW/D,CAAC;AAOL;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,qBAAqB;IAKhD,QAAQ,CAAC,IAAI,EAAE,gBAAgB;IAJ3C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAA4B;IAEhD,YAAqB,IAAI,EAAE,gBAAgB,EAO1C;IAED,OAAO,CAAC,UAAU;IAMZ,KAAK,CAAC,GAAG,SAAS,cAAc,GAAG,cAAc,EACrD,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,SAAS,OAAO,EAAO,GAClC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAG3B;IAEK,UAAU,CAAC,CAAC,EAChB,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAYZ;IAEK,WAAW,CAAC,CAAC,EACjB,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EAC7C,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,CAAC,CAAC,CA4BZ;IAEK,MAAM,IAAI,OAAO,CAAC,iBAAiB,CAAC,CA2BzC;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAc3B;CACF;AAED,eAAO,MAAM,sBAAsB,WACzB,qBAAqB,KAC5B,gBAAoE,CAAC"}

package/backend/dist/persistence/postgresDatabase.js

@@ -0,0 +1,148 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ */
+import { Pool, } from 'pg';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('postgres-persistence');
+const sslFor = (config) => {
+    if (config.sslMode === 'disable')
+        return false;
+    if (config.sslMode === 'require')
+        return { rejectUnauthorized: false };
+    return { rejectUnauthorized: true };
+};
+export const createPostgresPool = (config) => new Pool({
+    connectionString: config.connectionString,
+    application_name: config.applicationName,
+    max: config.poolMaximum,
+    connectionTimeoutMillis: config.connectionTimeoutMs,
+    idleTimeoutMillis: config.idleTimeoutMs,
+    statement_timeout: config.statementTimeoutMs,
+    query_timeout: config.statementTimeoutMs + 1000,
+    ssl: sslFor(config),
+    allowExitOnIdle: false,
+});
+const beginStatement = (options) => {
+    const isolation = (options.isolationLevel || 'read committed').toUpperCase();
+    return `BEGIN ISOLATION LEVEL ${isolation}${options.readOnly ? ' READ ONLY' : ''}`;
+};
+/**
+ * Thin pool boundary for PostgreSQL-specific repositories. Transactions always
+ * pin one pooled client, release it in finally, and never expose the pool URL.
+ */
+export class PostgresDatabase {
+    constructor(pool) {
+        this.pool = pool;
+        this.closing = false;
+        this.closed = false;
+        // node-postgres emits idle-client failures on the pool. Without a listener
+        // Node treats them as uncaught errors. Keep the log deliberately generic:
+        // driver errors may carry connection endpoints or server details.
+        pool.on?.('error', () => {
+            logger.error('An idle PostgreSQL client failed and was removed');
+        });
+    }
+    assertOpen() {
+        if (this.closing || this.closed) {
+            throw new Error('PostgreSQL pool is closed');
+        }
+    }
+    async query(text, parameters = []) {
+        this.assertOpen();
+        return this.pool.query(text, [...parameters]);
+    }
+    async withClient(operation) {
+        this.assertOpen();
+        const client = await this.pool.connect();
+        let releaseError;
+        try {
+            return await operation(client);
+        }
+        catch (error) {
+            releaseError = error instanceof Error ? error : new Error(String(error));
+            throw error;
+        }
+        finally {
+            client.release(releaseError);
+        }
+    }
+    async transaction(operation, options = {}) {
+        return this.withClient(async (client) => {
+            await client.query(beginStatement(options));
+            try {
+                const result = await operation(client);
+                await options.beforeCommit?.();
+                await client.query('COMMIT');
+                return result;
+            }
+            catch (error) {
+                try {
+                    await client.query('ROLLBACK');
+                }
+                catch (rollbackError) {
+                    const combined = new Error('PostgreSQL transaction and rollback both failed');
+                    Object.defineProperty(combined, 'cause', {
+                        value: error,
+                        enumerable: false,
+                    });
+                    Object.defineProperty(combined, 'rollbackError', {
+                        value: rollbackError,
+                        enumerable: false,
+                    });
+                    throw combined;
+                }
+                throw error;
+            }
+        });
+    }
+    async health() {
+        const startedAt = performance.now();
+        try {
+            await this.query('SELECT 1 AS healthy');
+            return {
+                ready: true,
+                dialect: 'postgres',
+                latencyMs: performance.now() - startedAt,
+                pool: {
+                    total: this.pool.totalCount,
+                    idle: this.pool.idleCount,
+                    waiting: this.pool.waitingCount,
+                },
+            };
+        }
+        catch {
+            return {
+                ready: false,
+                dialect: 'postgres',
+                latencyMs: performance.now() - startedAt,
+                message: 'PostgreSQL query failed',
+                pool: {
+                    total: this.pool.totalCount,
+                    idle: this.pool.idleCount,
+                    waiting: this.pool.waitingCount,
+                },
+            };
+        }
+    }
+    async close() {
+        if (this.closed)
+            return;
+        if (this.closePromise)
+            return this.closePromise;
+        this.closing = true;
+        this.closePromise = this.pool
+            .end()
+            .then(() => {
+            this.closed = true;
+        })
+            .finally(() => {
+            this.closing = false;
+            this.closePromise = undefined;
+        });
+        return this.closePromise;
+    }
+}
+export const createPostgresDatabase = (config) => new PostgresDatabase(createPostgresPool(config));
+//# sourceMappingURL=postgresDatabase.js.map

package/backend/dist/persistence/postgresDatabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresDatabase.js","sourceRoot":"","sources":["../../src/persistence/postgresDatabase.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,IAAI,GAKL,MAAM,IAAI,CAAC;AAGZ,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAyBpD,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAqB,EAAE;IAClE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IACvE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA6B,EAAQ,EAAE,CACxE,IAAI,IAAI,CAAC;IACP,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;IACzC,gBAAgB,EAAE,MAAM,CAAC,eAAe;IACxC,GAAG,EAAE,MAAM,CAAC,WAAW;IACvB,uBAAuB,EAAE,MAAM,CAAC,mBAAmB;IACnD,iBAAiB,EAAE,MAAM,CAAC,aAAa;IACvC,iBAAiB,EAAE,MAAM,CAAC,kBAAkB;IAC5C,aAAa,EAAE,MAAM,CAAC,kBAAkB,GAAG,IAAK;IAChD,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;IACnB,eAAe,EAAE,KAAK;CACvB,CAAC,CAAC;AAEL,MAAM,cAAc,GAAG,CAAC,OAAmC,EAAU,EAAE;IACrE,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7E,OAAO,yBAAyB,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACrF,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAK3B,YAAqB,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;QAJnC,YAAO,GAAG,KAAK,CAAC;QAChB,WAAM,GAAG,KAAK,CAAC;QAIrB,2EAA2E;QAC3E,0EAA0E;QAC1E,kEAAkE;QAClE,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CACT,IAAY,EACZ,UAAU,GAAuB,EAAE;QAEnC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAM,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,UAAU,CACd,SAA6C;QAE7C,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,YAA+B,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,SAA6C,EAC7C,OAAO,GAA+B,EAAE;QAExC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;YACpC,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;gBAC/B,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACjC,CAAC;gBAAC,OAAO,aAAa,EAAE,CAAC;oBACvB,MAAM,QAAQ,GAAG,IAAI,KAAK,CACxB,iDAAiD,CAClD,CAAC;oBACF,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE;wBACvC,KAAK,EAAE,KAAK;wBACZ,UAAU,EAAE,KAAK;qBAClB,CAAC,CAAC;oBACH,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,EAAE;wBAC/C,KAAK,EAAE,aAAa;wBACpB,UAAU,EAAE,KAAK;qBAClB,CAAC,CAAC;oBACH,MAAM,QAAQ,CAAC;gBACjB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACxC,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,UAAU;gBACnB,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;gBACxC,IAAI,EAAE;oBACJ,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;oBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;oBACzB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;iBAChC;aACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,UAAU;gBACnB,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;gBACxC,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE;oBACJ,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;oBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;oBACzB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;iBAChC;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI;aAC1B,GAAG,EAAE;aACL,IAAI,CAAC,GAAG,EAAE;YACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,MAA6B,EACX,EAAE,CAAC,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC"}

package/backend/dist/persistence/postgresExtensionMigration.d.ts

@@ -0,0 +1,4 @@
+import type { PostgresMigration } from './postgresMigrationTypes.js';
+export declare const POSTGRES_EXTENSION_PERSISTENCE_SQL = "\nCREATE TABLE plugin_credentials (\n  id text PRIMARY KEY,\n  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  plugin_id text NOT NULL,\n  api_key text NOT NULL,\n  routing_auth_fingerprint char(64),\n  created_at bigint NOT NULL,\n  updated_at bigint NOT NULL,\n  UNIQUE (user_id, plugin_id),\n  CHECK (\n    routing_auth_fingerprint IS NULL\n    OR routing_auth_fingerprint ~ '^[0-9a-f]{64}$'\n  )\n);\n\nCREATE TABLE plugin_variables (\n  id text PRIMARY KEY,\n  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  plugin_id text NOT NULL,\n  variable_name text NOT NULL,\n  variable_value text NOT NULL,\n  is_encrypted smallint NOT NULL DEFAULT 0 CHECK (is_encrypted IN (0, 1)),\n  created_at bigint NOT NULL,\n  updated_at bigint NOT NULL,\n  UNIQUE (user_id, plugin_id, variable_name)\n);\n\nCREATE TABLE plugin_discovered_models (\n  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  plugin_id text NOT NULL,\n  models_json text NOT NULL,\n  updated_at bigint NOT NULL,\n  PRIMARY KEY (user_id, plugin_id)\n);\n\nCREATE TABLE plugin_discovered_capability_models (\n  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  plugin_id text NOT NULL,\n  capability text NOT NULL\n    CHECK (capability IN ('image', 'stt', 'tts', 'audio', 'video')),\n  models_json text NOT NULL,\n  updated_at bigint NOT NULL,\n  PRIMARY KEY (user_id, plugin_id, capability)\n);\n\nCREATE TABLE plugin_activations (\n  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  plugin_id text NOT NULL,\n  activated_at bigint NOT NULL,\n  PRIMARY KEY (user_id, plugin_id)\n);\n\nCREATE TABLE plugin_definition_approvals (\n  plugin_id text PRIMARY KEY,\n  definition_fingerprint char(64) NOT NULL\n    CHECK (definition_fingerprint ~ '^[0-9a-f]{64}$'),\n  source_path text NOT NULL,\n  approved_by_user_id text NOT NULL,\n  approved_at bigint NOT NULL\n);\n\nCREATE TABLE plugin_usage_events (\n  id text PRIMARY KEY,\n  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  plugin_id text NOT NULL,\n  plugin_name text NOT NULL,\n  capability text NOT NULL\n    CHECK (capability IN ('chat', 'embedding', 'image', 'stt', 'tts', 'audio', 'video')),\n  model text NOT NULL,\n  status text NOT NULL CHECK (status IN ('success', 'error', 'cancelled')),\n  prompt_tokens bigint CHECK (prompt_tokens IS NULL OR prompt_tokens >= 0),\n  completion_tokens bigint CHECK (completion_tokens IS NULL OR completion_tokens >= 0),\n  total_tokens bigint CHECK (total_tokens IS NULL OR total_tokens >= 0),\n  input_units bigint NOT NULL DEFAULT 0 CHECK (input_units >= 0),\n  output_units bigint NOT NULL DEFAULT 0 CHECK (output_units >= 0),\n  unit_kind text,\n  duration_ms bigint NOT NULL CHECK (duration_ms >= 0),\n  created_at bigint NOT NULL\n);\n\nCREATE TABLE voice_profiles (\n  id text PRIMARY KEY,\n  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  name bytea NOT NULL,\n  name_lookup char(64) NOT NULL CHECK (name_lookup ~ '^[0-9a-f]{64}$'),\n  plugin_id text NOT NULL,\n  model text NOT NULL,\n  routing_fingerprint char(64) NOT NULL\n    CHECK (routing_fingerprint ~ '^[0-9a-f]{64}$'),\n  reference_audio bytea NOT NULL,\n  reference_text bytea,\n  audio_mime_type text NOT NULL,\n  audio_format text NOT NULL CHECK (audio_format IN ('wav', 'mp3', 'flac', 'ogg', 'm4a')),\n  audio_size bigint NOT NULL CHECK (audio_size > 0),\n  consent_confirmed_at bigint NOT NULL,\n  created_at bigint NOT NULL,\n  updated_at bigint NOT NULL,\n  UNIQUE (user_id, plugin_id, model, name_lookup)\n);\n\nCREATE INDEX idx_plugin_credentials_user ON plugin_credentials(user_id);\nCREATE INDEX idx_plugin_credentials_plugin ON plugin_credentials(plugin_id);\nCREATE INDEX idx_plugin_variables_user_plugin\n  ON plugin_variables(user_id, plugin_id);\nCREATE INDEX idx_plugin_discovered_models_plugin\n  ON plugin_discovered_models(plugin_id);\nCREATE INDEX idx_plugin_discovered_capability_models_plugin\n  ON plugin_discovered_capability_models(plugin_id, capability);\nCREATE INDEX idx_plugin_activations_plugin ON plugin_activations(plugin_id);\nCREATE INDEX idx_plugin_definition_approvals_approver\n  ON plugin_definition_approvals(approved_by_user_id);\nCREATE INDEX idx_plugin_usage_created ON plugin_usage_events(created_at DESC);\nCREATE INDEX idx_plugin_usage_plugin_created\n  ON plugin_usage_events(plugin_id, created_at DESC);\nCREATE INDEX idx_plugin_usage_model_created\n  ON plugin_usage_events(model, created_at DESC);\nCREATE INDEX idx_plugin_usage_user_created\n  ON plugin_usage_events(user_id, created_at DESC);\nCREATE INDEX idx_voice_profiles_user_updated\n  ON voice_profiles(user_id, updated_at DESC);\nCREATE INDEX idx_voice_profiles_user_route\n  ON voice_profiles(user_id, plugin_id, model);\n";
+export declare const POSTGRES_EXTENSION_MIGRATION: PostgresMigration;
+//# sourceMappingURL=postgresExtensionMigration.d.ts.map

package/backend/dist/persistence/postgresExtensionMigration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresExtensionMigration.d.ts","sourceRoot":"","sources":["../../src/persistence/postgresExtensionMigration.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE,eAAO,MAAM,kCAAkC,2qJA2H9C,CAAC;AAKF,eAAO,MAAM,4BAA4B,EAAE,iBAUzC,CAAC"}

package/backend/dist/persistence/postgresExtensionMigration.js

@@ -0,0 +1,143 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ */
+import { createHash } from 'node:crypto';
+export const POSTGRES_EXTENSION_PERSISTENCE_SQL = `
+CREATE TABLE plugin_credentials (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  plugin_id text NOT NULL,
+  api_key text NOT NULL,
+  routing_auth_fingerprint char(64),
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL,
+  UNIQUE (user_id, plugin_id),
+  CHECK (
+    routing_auth_fingerprint IS NULL
+    OR routing_auth_fingerprint ~ '^[0-9a-f]{64}$'
+  )
+);
+
+CREATE TABLE plugin_variables (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  plugin_id text NOT NULL,
+  variable_name text NOT NULL,
+  variable_value text NOT NULL,
+  is_encrypted smallint NOT NULL DEFAULT 0 CHECK (is_encrypted IN (0, 1)),
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL,
+  UNIQUE (user_id, plugin_id, variable_name)
+);
+
+CREATE TABLE plugin_discovered_models (
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  plugin_id text NOT NULL,
+  models_json text NOT NULL,
+  updated_at bigint NOT NULL,
+  PRIMARY KEY (user_id, plugin_id)
+);
+
+CREATE TABLE plugin_discovered_capability_models (
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  plugin_id text NOT NULL,
+  capability text NOT NULL
+    CHECK (capability IN ('image', 'stt', 'tts', 'audio', 'video')),
+  models_json text NOT NULL,
+  updated_at bigint NOT NULL,
+  PRIMARY KEY (user_id, plugin_id, capability)
+);
+
+CREATE TABLE plugin_activations (
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  plugin_id text NOT NULL,
+  activated_at bigint NOT NULL,
+  PRIMARY KEY (user_id, plugin_id)
+);
+
+CREATE TABLE plugin_definition_approvals (
+  plugin_id text PRIMARY KEY,
+  definition_fingerprint char(64) NOT NULL
+    CHECK (definition_fingerprint ~ '^[0-9a-f]{64}$'),
+  source_path text NOT NULL,
+  approved_by_user_id text NOT NULL,
+  approved_at bigint NOT NULL
+);
+
+CREATE TABLE plugin_usage_events (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  plugin_id text NOT NULL,
+  plugin_name text NOT NULL,
+  capability text NOT NULL
+    CHECK (capability IN ('chat', 'embedding', 'image', 'stt', 'tts', 'audio', 'video')),
+  model text NOT NULL,
+  status text NOT NULL CHECK (status IN ('success', 'error', 'cancelled')),
+  prompt_tokens bigint CHECK (prompt_tokens IS NULL OR prompt_tokens >= 0),
+  completion_tokens bigint CHECK (completion_tokens IS NULL OR completion_tokens >= 0),
+  total_tokens bigint CHECK (total_tokens IS NULL OR total_tokens >= 0),
+  input_units bigint NOT NULL DEFAULT 0 CHECK (input_units >= 0),
+  output_units bigint NOT NULL DEFAULT 0 CHECK (output_units >= 0),
+  unit_kind text,
+  duration_ms bigint NOT NULL CHECK (duration_ms >= 0),
+  created_at bigint NOT NULL
+);
+
+CREATE TABLE voice_profiles (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  name bytea NOT NULL,
+  name_lookup char(64) NOT NULL CHECK (name_lookup ~ '^[0-9a-f]{64}$'),
+  plugin_id text NOT NULL,
+  model text NOT NULL,
+  routing_fingerprint char(64) NOT NULL
+    CHECK (routing_fingerprint ~ '^[0-9a-f]{64}$'),
+  reference_audio bytea NOT NULL,
+  reference_text bytea,
+  audio_mime_type text NOT NULL,
+  audio_format text NOT NULL CHECK (audio_format IN ('wav', 'mp3', 'flac', 'ogg', 'm4a')),
+  audio_size bigint NOT NULL CHECK (audio_size > 0),
+  consent_confirmed_at bigint NOT NULL,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL,
+  UNIQUE (user_id, plugin_id, model, name_lookup)
+);
+
+CREATE INDEX idx_plugin_credentials_user ON plugin_credentials(user_id);
+CREATE INDEX idx_plugin_credentials_plugin ON plugin_credentials(plugin_id);
+CREATE INDEX idx_plugin_variables_user_plugin
+  ON plugin_variables(user_id, plugin_id);
+CREATE INDEX idx_plugin_discovered_models_plugin
+  ON plugin_discovered_models(plugin_id);
+CREATE INDEX idx_plugin_discovered_capability_models_plugin
+  ON plugin_discovered_capability_models(plugin_id, capability);
+CREATE INDEX idx_plugin_activations_plugin ON plugin_activations(plugin_id);
+CREATE INDEX idx_plugin_definition_approvals_approver
+  ON plugin_definition_approvals(approved_by_user_id);
+CREATE INDEX idx_plugin_usage_created ON plugin_usage_events(created_at DESC);
+CREATE INDEX idx_plugin_usage_plugin_created
+  ON plugin_usage_events(plugin_id, created_at DESC);
+CREATE INDEX idx_plugin_usage_model_created
+  ON plugin_usage_events(model, created_at DESC);
+CREATE INDEX idx_plugin_usage_user_created
+  ON plugin_usage_events(user_id, created_at DESC);
+CREATE INDEX idx_voice_profiles_user_updated
+  ON voice_profiles(user_id, updated_at DESC);
+CREATE INDEX idx_voice_profiles_user_route
+  ON voice_profiles(user_id, plugin_id, model);
+`;
+const version = 5;
+const name = 'extension-persistence';
+export const POSTGRES_EXTENSION_MIGRATION = Object.freeze({
+    version,
+    name,
+    checksum: createHash('sha256')
+        .update(`${version}\n${name}\n${POSTGRES_EXTENSION_PERSISTENCE_SQL}`)
+        .digest('hex'),
+    sql: POSTGRES_EXTENSION_PERSISTENCE_SQL,
+    rollbackPlan: 'Stop every app and worker, export credentials/variables/usage/voice inventories with the matching encryption key, remove dependent data, then drop voice_profiles, plugin_usage_events, plugin_definition_approvals, plugin_activations, discovery, variables, and credentials in that order. In-place downgrade is unsupported.',
+    minimumCompatibleVersion: 5,
+});
+//# sourceMappingURL=postgresExtensionMigration.js.map

package/backend/dist/persistence/postgresExtensionMigration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresExtensionMigration.js","sourceRoot":"","sources":["../../src/persistence/postgresExtensionMigration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,CAAC,MAAM,kCAAkC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2HjD,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,IAAI,GAAG,uBAAuB,CAAC;AAErC,MAAM,CAAC,MAAM,4BAA4B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC3E,OAAO;IACP,IAAI;IACJ,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,GAAG,OAAO,KAAK,IAAI,KAAK,kCAAkC,EAAE,CAAC;SACpE,MAAM,CAAC,KAAK,CAAC;IAChB,GAAG,EAAE,kCAAkC;IACvC,YAAY,EACV,kUAAkU;IACpU,wBAAwB,EAAE,CAAC;CAC5B,CAAC,CAAC"}

package/backend/dist/persistence/postgresExtensionRepositories.d.ts

@@ -0,0 +1,6 @@
+import type { PoolClient } from 'pg';
+import type { PostgresDatabase } from './postgresDatabase.js';
+import type { ExtensionRepositories } from './extensionTypes.js';
+export declare const createPostgresExtensionRepositories: (database: PostgresDatabase) => ExtensionRepositories;
+export declare const createPostgresTransactionalExtensionRepositories: (client: PoolClient) => ExtensionRepositories;
+//# sourceMappingURL=postgresExtensionRepositories.d.ts.map

package/backend/dist/persistence/postgresExtensionRepositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresExtensionRepositories.d.ts","sourceRoot":"","sources":["../../src/persistence/postgresExtensionRepositories.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,IAAI,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EACV,qBAAqB,EAkBtB,MAAM,qBAAqB,CAAC;AAy0B7B,eAAO,MAAM,mCAAmC,aACpC,gBAAgB,KACzB,qBASD,CAAC;AAEH,eAAO,MAAM,gDAAgD,WACnD,UAAU,KACjB,qBAOF,CAAC"}