libre-webui 0.22.0 → 0.23.0

package/backend/dist/services/groupService.d.ts

@@ -0,0 +1,27 @@
+import type { StoredGroupMemberRecord, StoredGroupRecord } from '../persistence/index.js';
+export declare class GroupError extends Error {
+    readonly statusCode: number;
+    constructor(message: string, statusCode: number);
+}
+export interface GroupWithMembers extends StoredGroupRecord {
+    members: StoredGroupMemberRecord[];
+}
+export declare const listGroups: () => Promise<StoredGroupRecord[]>;
+export declare const listGroupsWithMembers: () => Promise<GroupWithMembers[]>;
+export declare const getGroup: (groupId: string) => Promise<StoredGroupRecord | null>;
+export declare const getGroupByName: (name: string) => Promise<StoredGroupRecord | null>;
+export declare const listGroupsForUser: (userId: string) => Promise<StoredGroupRecord[]>;
+export declare const createGroup: (input: {
+    name: string;
+    description?: string | null;
+}, actorUserId: string) => Promise<StoredGroupRecord>;
+export declare const updateGroup: (groupId: string, patch: {
+    name?: string;
+    description?: string | null;
+}, actorUserId: string) => Promise<StoredGroupRecord | null>;
+export declare const deleteGroup: (groupId: string, actorUserId: string) => Promise<boolean>;
+export declare const addGroupMember: (groupId: string, userId: string, actorUserId: string) => Promise<boolean>;
+export declare const removeGroupMember: (groupId: string, userId: string, actorUserId: string) => Promise<boolean>;
+/** Deletion hygiene: strip a retiring user from groups and their grants. */
+export declare const removeUserFromSecurityPrincipals: (userId: string) => Promise<void>;
+//# sourceMappingURL=groupService.d.ts.map

package/backend/dist/services/groupService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupService.d.ts","sourceRoot":"","sources":["../../src/services/groupService.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAKjC,qBAAa,UAAW,SAAQ,KAAK;IAGjC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAF7B,YACE,OAAO,EAAE,MAAM,EACN,UAAU,EAAE,MAAM,EAI5B;CACF;AAiBD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,OAAO,EAAE,uBAAuB,EAAE,CAAC;CACpC;AAED,eAAO,MAAM,UAAU,QAAO,OAAO,CAAC,iBAAiB,EAAE,CAC/B,CAAC;AAE3B,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC,gBAAgB,EAAE,CAQxE,CAAC;AAEF,eAAO,MAAM,QAAQ,YAAa,MAAM,KAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CACtC,CAAC;AAEtC,eAAO,MAAM,cAAc,SACnB,MAAM,KACX,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAuC,CAAC;AAE3E,eAAO,MAAM,iBAAiB,WACpB,MAAM,KACb,OAAO,CAAC,iBAAiB,EAAE,CAAgD,CAAC;AAE/E,eAAO,MAAM,WAAW,UACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,eACvC,MAAM,KAClB,OAAO,CAAC,iBAAiB,CAwC3B,CAAC;AAEF,eAAO,MAAM,WAAW,YACb,MAAM,SACR;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,eACxC,MAAM,KAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CA6ClC,CAAC;AAEF,eAAO,MAAM,WAAW,YACb,MAAM,eACF,MAAM,KAClB,OAAO,CAAC,OAAO,CAwBjB,CAAC;AAEF,eAAO,MAAM,cAAc,YAChB,MAAM,UACP,MAAM,eACD,MAAM,KAClB,OAAO,CAAC,OAAO,CAoCjB,CAAC;AAEF,eAAO,MAAM,iBAAiB,YACnB,MAAM,UACP,MAAM,eACD,MAAM,KAClB,OAAO,CAAC,OAAO,CAsBjB,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,gCAAgC,WACnC,MAAM,KACb,OAAO,CAAC,IAAI,CAGd,CAAC"}

package/backend/dist/services/groupService.js

@@ -0,0 +1,245 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Groups and memberships (IAM-02).
+ *
+ * Groups are administrator-managed principals for grants and external
+ * identity mapping. Every mutation commits atomically with its security
+ * audit event (AUDIT-02): the SQLite path runs both writes in one owned
+ * synchronous transaction, the PostgreSQL path in one serializable
+ * transaction, so a group change can never exist without its audit trail.
+ *
+ * Revocation is immediate by construction: membership is read from the
+ * database at decision time, never cached.
+ */
+import { randomUUID } from 'node:crypto';
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+import { buildAuditEvent } from './securityAuditService.js';
+import { userModel } from '../models/userModel.js';
+export class GroupError extends Error {
+    constructor(message, statusCode) {
+        super(message);
+        this.statusCode = statusCode;
+        this.name = 'GroupError';
+    }
+}
+const GROUP_NAME_PATTERN = /^[\p{L}\p{N}][\p{L}\p{N} ._-]{0,127}$/u;
+const normalizeName = (name) => {
+    const trimmed = name.trim();
+    if (!GROUP_NAME_PATTERN.test(trimmed)) {
+        throw new GroupError('Group names are 1-128 letters, numbers, spaces, dots, underscores, or dashes', 400);
+    }
+    return trimmed;
+};
+const security = () => getPersistence(encryptionService).repositories.security;
+export const listGroups = () => security().groups.list();
+export const listGroupsWithMembers = async () => {
+    const groups = await security().groups.list();
+    return Promise.all(groups.map(async (group) => ({
+        ...group,
+        members: await security().groups.listMembers(group.id),
+    })));
+};
+export const getGroup = (groupId) => security().groups.findById(groupId);
+export const getGroupByName = (name) => security().groups.findByName(name);
+export const listGroupsForUser = (userId) => security().groups.listGroupsForUser(userId);
+export const createGroup = async (input, actorUserId) => {
+    const name = normalizeName(input.name);
+    const now = Date.now();
+    const record = {
+        id: randomUUID(),
+        name,
+        description: input.description?.trim() || null,
+        created_by: actorUserId,
+        created_at: now,
+        updated_at: now,
+    };
+    const audit = buildAuditEvent({
+        action: 'group.create',
+        result: 'success',
+        actorUserId,
+        targetType: 'group',
+        targetId: record.id,
+        details: { name },
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        await persistence.transaction(({ security: tx }) => {
+            if (tx.groups.findByName(name)) {
+                throw new GroupError('A group with this name already exists', 409);
+            }
+            tx.groups.insert(record);
+            tx.audit.insert(audit);
+            return undefined;
+        });
+        return record;
+    }
+    await persistence.transaction(async ({ security: tx }) => {
+        if (await tx.groups.findByName(name)) {
+            throw new GroupError('A group with this name already exists', 409);
+        }
+        await tx.groups.insert(record);
+        await tx.audit.insert(audit);
+    });
+    return record;
+};
+export const updateGroup = async (groupId, patch, actorUserId) => {
+    const name = patch.name !== undefined ? normalizeName(patch.name) : undefined;
+    const update = {
+        ...(name !== undefined ? { name } : {}),
+        ...(patch.description !== undefined
+            ? { description: patch.description?.trim() || null }
+            : {}),
+        updated_at: Date.now(),
+    };
+    const audit = buildAuditEvent({
+        action: 'group.update',
+        result: 'success',
+        actorUserId,
+        targetType: 'group',
+        targetId: groupId,
+        details: { ...(name !== undefined ? { name } : {}) },
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        const updated = await persistence.transaction(({ security: tx }) => {
+            if (name !== undefined) {
+                const existing = tx.groups.findByName(name);
+                if (existing && existing.id !== groupId) {
+                    throw new GroupError('A group with this name already exists', 409);
+                }
+            }
+            const applied = tx.groups.update(groupId, update);
+            if (applied)
+                tx.audit.insert(audit);
+            return applied;
+        });
+        return updated ? security().groups.findById(groupId) : null;
+    }
+    const updated = await persistence.transaction(async ({ security: tx }) => {
+        if (name !== undefined) {
+            const existing = await tx.groups.findByName(name);
+            if (existing && existing.id !== groupId) {
+                throw new GroupError('A group with this name already exists', 409);
+            }
+        }
+        const applied = await tx.groups.update(groupId, update);
+        if (applied)
+            await tx.audit.insert(audit);
+        return applied;
+    });
+    return updated ? security().groups.findById(groupId) : null;
+};
+export const deleteGroup = async (groupId, actorUserId) => {
+    const audit = buildAuditEvent({
+        action: 'group.delete',
+        result: 'success',
+        actorUserId,
+        targetType: 'group',
+        targetId: groupId,
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        return persistence.transaction(({ security: tx }) => {
+            // Grants held by the group disappear with it; memberships cascade.
+            tx.grants.deleteForPrincipal('group', groupId);
+            const deleted = tx.groups.delete(groupId);
+            if (deleted)
+                tx.audit.insert(audit);
+            return deleted;
+        });
+    }
+    return persistence.transaction(async ({ security: tx }) => {
+        await tx.grants.deleteForPrincipal('group', groupId);
+        const deleted = await tx.groups.delete(groupId);
+        if (deleted)
+            await tx.audit.insert(audit);
+        return deleted;
+    });
+};
+export const addGroupMember = async (groupId, userId, actorUserId) => {
+    const user = await userModel.getUserById(userId);
+    if (!user)
+        throw new GroupError('User not found', 404);
+    const member = {
+        group_id: groupId,
+        user_id: userId,
+        added_by: actorUserId,
+        added_at: Date.now(),
+    };
+    const audit = buildAuditEvent({
+        action: 'group.member-add',
+        result: 'success',
+        actorUserId,
+        targetType: 'group',
+        targetId: groupId,
+        details: { userId },
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        return persistence.transaction(({ security: tx }) => {
+            if (!tx.groups.findById(groupId)) {
+                throw new GroupError('Group not found', 404);
+            }
+            const added = tx.groups.addMember(member);
+            if (added)
+                tx.audit.insert(audit);
+            return added;
+        });
+    }
+    return persistence.transaction(async ({ security: tx }) => {
+        if (!(await tx.groups.findById(groupId))) {
+            throw new GroupError('Group not found', 404);
+        }
+        const added = await tx.groups.addMember(member);
+        if (added)
+            await tx.audit.insert(audit);
+        return added;
+    });
+};
+export const removeGroupMember = async (groupId, userId, actorUserId) => {
+    const audit = buildAuditEvent({
+        action: 'group.member-remove',
+        result: 'success',
+        actorUserId,
+        targetType: 'group',
+        targetId: groupId,
+        details: { userId },
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        return persistence.transaction(({ security: tx }) => {
+            const removed = tx.groups.removeMember(groupId, userId);
+            if (removed)
+                tx.audit.insert(audit);
+            return removed;
+        });
+    }
+    return persistence.transaction(async ({ security: tx }) => {
+        const removed = await tx.groups.removeMember(groupId, userId);
+        if (removed)
+            await tx.audit.insert(audit);
+        return removed;
+    });
+};
+/** Deletion hygiene: strip a retiring user from groups and their grants. */
+export const removeUserFromSecurityPrincipals = async (userId) => {
+    await security().groups.removeUserFromAllGroups(userId);
+    await security().grants.deleteForPrincipal('user', userId);
+};
+//# sourceMappingURL=groupService.js.map

package/backend/dist/services/groupService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupService.js","sourceRoot":"","sources":["../../src/services/groupService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAKzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YACE,OAAe,EACN,UAAkB;QAE3B,KAAK,CAAC,OAAO,CAAC,CAAC;0BAFN,UAAU;QAGnB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AAEpE,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAClB,8EAA8E,EAC9E,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;AAM/E,MAAM,CAAC,MAAM,UAAU,GAAG,GAAiC,EAAE,CAC3D,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAE3B,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,IAAiC,EAAE;IAC3E,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9C,OAAO,OAAO,CAAC,GAAG,CAChB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,CAAC;QACzB,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;KACvD,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAqC,EAAE,CAC7E,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAEtC,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,IAAY,EACuB,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAAc,EACgB,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE/E,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,KAAoD,EACpD,WAAmB,EACS,EAAE;IAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAsB;QAChC,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI;QAC9C,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KAChB,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE;KAClB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YACjD,IAAI,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACvD,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAe,EACf,KAAqD,EACrD,WAAmB,EACgB,EAAE;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;KACvB,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KACrD,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YACjE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;oBACxC,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,IAAI,OAAO;gBAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBACxC,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,OAAO;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAe,EACf,WAAmB,EACD,EAAE;IACpB,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YAClD,mEAAmE;YACnE,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,OAAO;gBAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACxD,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,OAAO;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAAe,EACf,MAAc,EACd,WAAmB,EACD,EAAE;IACpB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,MAAM,GAA4B;QACtC,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YAClD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,KAAK;gBAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACxD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,KAAK;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,OAAe,EACf,MAAc,EACd,WAAmB,EACD,EAAE;IACpB,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YAClD,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxD,IAAI,OAAO;gBAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,OAAO;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,EACnD,MAAc,EACC,EAAE;IACjB,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC,CAAC"}

package/backend/dist/services/groupVectorPrincipalResolver.d.ts

@@ -0,0 +1,12 @@
+import type { VectorPrincipalResolver } from '../platform/storage/vectorStore.js';
+/**
+ * Resolves a user's group principals from the trust-foundation membership
+ * table, so vector-store ACL predicates can honor group grants. Memberships
+ * are read fresh on every query: removing a member revokes their
+ * group-granted retrieval immediately.
+ */
+export declare class GroupVectorPrincipalResolver implements VectorPrincipalResolver {
+    resolveGroupIds(userId: string): Promise<readonly string[]>;
+}
+export declare const groupVectorPrincipalResolver: GroupVectorPrincipalResolver;
+//# sourceMappingURL=groupVectorPrincipalResolver.d.ts.map

package/backend/dist/services/groupVectorPrincipalResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupVectorPrincipalResolver.d.ts","sourceRoot":"","sources":["../../src/services/groupVectorPrincipalResolver.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAIlF;;;;;GAKG;AACH,qBAAa,4BAA6B,YAAW,uBAAuB;IACpE,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAKhE;CACF;AAED,eAAO,MAAM,4BAA4B,8BAAqC,CAAC"}

package/backend/dist/services/groupVectorPrincipalResolver.js

@@ -0,0 +1,33 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+/**
+ * Resolves a user's group principals from the trust-foundation membership
+ * table, so vector-store ACL predicates can honor group grants. Memberships
+ * are read fresh on every query: removing a member revokes their
+ * group-granted retrieval immediately.
+ */
+export class GroupVectorPrincipalResolver {
+    async resolveGroupIds(userId) {
+        if (!userId)
+            return [];
+        return getPersistence(encryptionService).repositories.security.groups.listGroupIdsForUser(userId);
+    }
+}
+export const groupVectorPrincipalResolver = new GroupVectorPrincipalResolver();
+//# sourceMappingURL=groupVectorPrincipalResolver.js.map

package/backend/dist/services/groupVectorPrincipalResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupVectorPrincipalResolver.js","sourceRoot":"","sources":["../../src/services/groupVectorPrincipalResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,OAAO,4BAA4B;IACvC,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,OAAO,cAAc,CACnB,iBAAiB,CAClB,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,4BAA4B,EAAE,CAAC"}

package/backend/dist/services/modelAccessService.d.ts

@@ -6,6 +6,7 @@ export declare function getModelDownloadMode(): Promise<ModelDownloadMode>;
 export declare function setModelDownloadMode(mode: ModelDownloadMode): Promise<void>;
 /** Whether a user may pull models right now. */
 export declare function userCanDownloadModels(user: {
+    id?: string;
     role?: string;
     status?: string;
 }): Promise<boolean>;

package/backend/dist/services/modelAccessService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modelAccessService.d.ts","sourceRoot":"","sources":["../../src/services/modelAccessService.ts"],"names":[],"mappings":"AA4BA,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAG5D,CAAC;AAEF,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAK5B;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAOvE;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,gDAAgD;AAChD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAInB"}
+{"version":3,"file":"modelAccessService.d.ts","sourceRoot":"","sources":["../../src/services/modelAccessService.ts"],"names":[],"mappings":"AA4BA,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAG5D,CAAC;AAEF,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAK5B;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAOvE;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,gDAAgD;AAChD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAQnB"}

package/backend/dist/services/modelAccessService.js

@@ -49,10 +49,8 @@ export async function setModelDownloadMode(mode) {
 }
 /** Whether a user may pull models right now. */
 export async function userCanDownloadModels(user) {
-    if (user.status !== undefined && user.status !== 'active')
-        return false;
-    if (user.role === 'admin')
-        return true;
-    return (await getModelDownloadMode()) === 'all-users';
+    const { authorize } = await import('./authorizationService.js');
+    const decision = await authorize({ userId: user.id ?? '', role: user.role, status: user.status }, 'use', { type: 'feature', id: 'model-download' });
+    return decision.allowed;
 }
 //# sourceMappingURL=modelAccessService.js.map

package/backend/dist/services/modelAccessService.js.map

@@ -1 +1 @@
-{"version":3,"file":"modelAccessService.js","sourceRoot":"","sources":["../../src/services/modelAccessService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAIhF,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE,QAAQ;IACR,WAAW;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QAC9D,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAuB;IAEvB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gBAAgB,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAG3C;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CAAC,MAAM,oBAAoB,EAAE,CAAC,KAAK,WAAW,CAAC;AACxD,CAAC"}
+{"version":3,"file":"modelAccessService.js","sourceRoot":"","sources":["../../src/services/modelAccessService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAIhF,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE,QAAQ;IACR,WAAW;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QAC9D,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAuB;IAEvB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gBAAgB,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAI3C;IACC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,KAAK,EACL,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAC1C,CAAC;IACF,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC"}

package/backend/dist/services/oauthSecurity.d.ts

@@ -1,7 +1,18 @@
 import type { Request, Response } from 'express';
-export type OAuthProvider = 'github' | 'huggingface';
+export type OAuthProvider = 'github' | 'huggingface' | 'oidc';
 /** Start a browser-bound OAuth flow and return the state sent to the provider. */
 export declare const beginOAuthFlow: (req: Request, res: Response, provider: OAuthProvider) => string;
+/**
+ * Start a browser-bound OAuth flow that also needs per-flow secrets (PKCE
+ * verifier, OIDC nonce). The payload rides in the same HttpOnly state
+ * cookie, encoded alongside the CSRF state.
+ */
+export declare const beginOAuthFlowWithPayload: (req: Request, res: Response, provider: OAuthProvider, payload: Record<string, string>) => string;
+/**
+ * Validate state and return the per-flow payload stored at flow start.
+ * The cookie is always cleared, so a callback cannot be replayed.
+ */
+export declare const consumeOAuthStatePayload: (req: Request, res: Response, provider: OAuthProvider, receivedState: string) => Record<string, string> | null;
 /** Validate and clear OAuth state so a callback cannot be replayed in-browser. */
 export declare const consumeOAuthState: (req: Request, res: Response, provider: OAuthProvider, receivedState: string) => boolean;
 /**

package/backend/dist/services/oauthSecurity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthSecurity.d.ts","sourceRoot":"","sources":["../../src/services/oauthSecurity.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAiB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEhE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;AAgErD,kFAAkF;AAClF,eAAO,MAAM,cAAc,QACpB,OAAO,OACP,QAAQ,YACH,aAAa,KACtB,MAQF,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,QACvB,OAAO,OACP,QAAQ,YACH,aAAa,iBACR,MAAM,KACpB,OAQF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,SAC1B,OAAO,OACR,QAAQ,SACN,MAAM,KACZ,IAQF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,QAC/B,OAAO,OACP,QAAQ,KACZ,MAAM,GAAG,SASX,CAAC"}
+{"version":3,"file":"oauthSecurity.d.ts","sourceRoot":"","sources":["../../src/services/oauthSecurity.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAiB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEhE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,aAAa,GAAG,MAAM,CAAC;AAgE9D,kFAAkF;AAClF,eAAO,MAAM,cAAc,QACpB,OAAO,OACP,QAAQ,YACH,aAAa,KACtB,MAQF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAC/B,OAAO,OACP,QAAQ,YACH,aAAa,WACd,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC9B,MAYF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAC9B,OAAO,OACP,QAAQ,YACH,aAAa,iBACR,MAAM,KACpB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAyB3B,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,QACvB,OAAO,OACP,QAAQ,YACH,aAAa,iBACR,MAAM,KACpB,OAQF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,SAC1B,OAAO,OACR,QAAQ,SACN,MAAM,KACZ,IAQF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,QAC/B,OAAO,OACP,QAAQ,KACZ,MAAM,GAAG,SASX,CAAC"}

package/backend/dist/services/oauthSecurity.js

@@ -67,6 +67,47 @@ export const beginOAuthFlow = (req, res, provider) => {
     res.cookie(stateCookieName(provider), state, cookieOptions(req, stateCookiePath(provider), STATE_TTL_MS));
     return state;
 };
+/**
+ * Start a browser-bound OAuth flow that also needs per-flow secrets (PKCE
+ * verifier, OIDC nonce). The payload rides in the same HttpOnly state
+ * cookie, encoded alongside the CSRF state.
+ */
+export const beginOAuthFlowWithPayload = (req, res, provider, payload) => {
+    const state = randomBytes(32).toString('base64url');
+    const envelope = Buffer.from(JSON.stringify({ state, ...payload }), 'utf8').toString('base64url');
+    res.cookie(stateCookieName(provider), envelope, cookieOptions(req, stateCookiePath(provider), STATE_TTL_MS));
+    return state;
+};
+/**
+ * Validate state and return the per-flow payload stored at flow start.
+ * The cookie is always cleared, so a callback cannot be replayed.
+ */
+export const consumeOAuthStatePayload = (req, res, provider, receivedState) => {
+    const path = stateCookiePath(provider);
+    const raw = readCookie(req, stateCookieName(provider));
+    res.clearCookie(stateCookieName(provider), clearCookieOptions(req, path));
+    if (!raw || !receivedState)
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(raw, 'base64url').toString('utf8'));
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        const envelope = parsed;
+        if (typeof envelope.state !== 'string' ||
+            !secureEqual(envelope.state, receivedState)) {
+            return null;
+        }
+        const payload = {};
+        for (const [key, value] of Object.entries(envelope)) {
+            if (key !== 'state' && typeof value === 'string')
+                payload[key] = value;
+        }
+        return payload;
+    }
+    catch {
+        return null;
+    }
+};
 /** Validate and clear OAuth state so a callback cannot be replayed in-browser. */
 export const consumeOAuthState = (req, res, provider, receivedState) => {
     const path = stateCookiePath(provider);

package/backend/dist/services/oauthSecurity.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthSecurity.js","sourceRoot":"","sources":["../../src/services/oauthSecurity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAKtD,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAClD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,MAAM,eAAe,GAAG,CAAC,QAAuB,EAAU,EAAE,CAC1D,qBAAqB,QAAQ,EAAE,CAAC;AAElC,MAAM,eAAe,GAAG,CAAC,QAAuB,EAAU,EAAE,CAC1D,mBAAmB,QAAQ,EAAE,CAAC;AAEhC,MAAM,eAAe,GAAG,CAAC,GAAY,EAAW,EAAE,CAChD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;AAEzC,MAAM,aAAa,GAAG,CACpB,GAAY,EACZ,IAAY,EACZ,MAAc,EACC,EAAE,CAAC,CAAC;IACnB,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC;IAC5B,QAAQ,EAAE,KAAK;IACf,IAAI;IACJ,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAE,IAAY,EAAiB,EAAE,CAAC,CAAC;IACzE,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC;IAC5B,QAAQ,EAAE,KAAK;IACf,IAAI;CACL,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,IAAY,EAAsB,EAAE;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAAY,EACZ,GAAa,EACb,QAAuB,EACf,EAAE;IACV,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,GAAG,CAAC,MAAM,CACR,eAAe,CAAC,QAAQ,CAAC,EACzB,KAAK,EACL,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAC5D,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAY,EACZ,GAAa,EACb,QAAuB,EACvB,aAAqB,EACZ,EAAE;IACX,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1E,OAAO,OAAO,CACZ,aAAa,IAAI,aAAa,IAAI,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,CAC5E,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAAa,EACb,GAAa,EACb,KAAa,EACP,EAAE;IACR,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,EAAE;QACrC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,uBAAuB;KAChC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAY,EACZ,GAAa,EACO,EAAE;IACtB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACnD,GAAG,CAAC,WAAW,CAAC,mBAAmB,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}
+{"version":3,"file":"oauthSecurity.js","sourceRoot":"","sources":["../../src/services/oauthSecurity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAKtD,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAClD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,MAAM,eAAe,GAAG,CAAC,QAAuB,EAAU,EAAE,CAC1D,qBAAqB,QAAQ,EAAE,CAAC;AAElC,MAAM,eAAe,GAAG,CAAC,QAAuB,EAAU,EAAE,CAC1D,mBAAmB,QAAQ,EAAE,CAAC;AAEhC,MAAM,eAAe,GAAG,CAAC,GAAY,EAAW,EAAE,CAChD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;AAEzC,MAAM,aAAa,GAAG,CACpB,GAAY,EACZ,IAAY,EACZ,MAAc,EACC,EAAE,CAAC,CAAC;IACnB,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC;IAC5B,QAAQ,EAAE,KAAK;IACf,IAAI;IACJ,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAE,IAAY,EAAiB,EAAE,CAAC,CAAC;IACzE,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC;IAC5B,QAAQ,EAAE,KAAK;IACf,IAAI;CACL,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,IAAY,EAAsB,EAAE;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAAY,EACZ,GAAa,EACb,QAAuB,EACf,EAAE;IACV,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,GAAG,CAAC,MAAM,CACR,eAAe,CAAC,QAAQ,CAAC,EACzB,KAAK,EACL,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAC5D,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAY,EACZ,GAAa,EACb,QAAuB,EACvB,OAA+B,EACvB,EAAE;IACV,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,EACrC,MAAM,CACP,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,GAAG,CAAC,MAAM,CACR,eAAe,CAAC,QAAQ,CAAC,EACzB,QAAQ,EACR,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAC5D,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,GAAY,EACZ,GAAa,EACb,QAAuB,EACvB,aAAqB,EACU,EAAE;IACjC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAChC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/C,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAiC,CAAC;QACnD,IACE,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;YAClC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,EAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,GAAG,KAAK,OAAO,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAY,EACZ,GAAa,EACb,QAAuB,EACvB,aAAqB,EACZ,EAAE;IACX,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1E,OAAO,OAAO,CACZ,aAAa,IAAI,aAAa,IAAI,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,CAC5E,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAAa,EACb,GAAa,EACb,KAAa,EACP,EAAE;IACR,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,EAAE;QACrC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,uBAAuB;KAChC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAY,EACZ,GAAa,EACO,EAAE;IACtB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACnD,GAAG,CAAC,WAAW,CAAC,mBAAmB,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/backend/dist/services/pluginService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pluginService.d.ts","sourceRoot":"","sources":["../../src/services/pluginService.ts"],"names":[],"mappings":"AAsBA,OAAO,EACL,cAAc,EACd,cAAc,EACd,wBAAwB,EACxB,MAAM,EACN,YAAY,EACZ,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,cAAc,EACf,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAIjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AASjF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AA6IzC,KAAK,2BAA2B,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/E;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GACrC,SAAS,GAAG,WAAW,GAAG,qBAAqB,GAAG,aAAa,CAAC;AAElE,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,2BAA2B,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkFD,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACrC;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,iBAAiB,CAAW;IACpC,OAAO,CAAC,4BAA4B,CAAW;IAC/C,OAAO,CAAC,cAAc,CAAW;IACjC,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,yBAAyB,CAA6B;IAC9D,OAAO,CAAC,oBAAoB,CAA6B;IACzD,OAAO,CAAC,iBAAiB,CAGrB;IACJ,OAAO,CAAC,+BAA+B,CAAsC;IAC7E,OAAO,CAAC,mCAAmC,CAA6B;IACxE,OAAO,CAAC,8BAA8B,CAA6B;IACnE,OAAO,CAAC,2BAA2B,CAG/B;IACJ,OAAO,CAAC,uBAAuB,CAA6B;IAC5D,OAAO,CAAC,iCAAiC,CAA6B;IACtE,OAAO,CAAC,+BAA+B,CAA2B;IAClE,OAAO,CAAC,gBAAgB,CAAyB;IACjD,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,sBAAsB,CAA+B;IAC7D,OAAO,CAAC,sBAAsB,CAA+B;IAC7D,OAAO,CAAC,sBAAsB,CAA+B;IAC7D,OAAO,CAAC,yBAAyB,CAAkC;IACnE,OAAO,CAAC,6BAA6B,CAAoC;IACzE,OAAO,CAAC,yBAAyB,CAA4B;IAC7D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAU;IAClD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,YAAY,OAAO,GAAE,oBAAyB,EA6F7C;IAED,OAAO,CAAC,YAAY;YAIN,uBAAuB;IAQrC,OAAO,CAAC,qBAAqB;IAO7B,OAAO,CAAC,+BAA+B;IAOvC,OAAO,CAAC,uBAAuB;IA4D/B,OAAO,CAAC,+BAA+B;IAevC;;;;;OAKG;IACH,OAAO,CAAC,8BAA8B;IA8BtC,OAAO,CAAC,2BAA2B;IAsBnC,OAAO,CAAC,wBAAwB;IAIhC,OAAO,CAAC,kCAAkC;YAQ5B,6BAA6B;YA4D7B,+BAA+B;YAgC/B,mBAAmB;YAuDnB,qBAAqB;IAkC7B,qBAAqB,CACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA+Cf;YAEa,+BAA+B;YAyC/B,qBAAqB;IAgDnC,OAAO,CAAC,sBAAsB;IA4F9B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,2BAA2B;YAUrB,0BAA0B;YAyB1B,uBAAuB;YAiBvB,8BAA8B;YAM9B,6BAA6B;IAI3C,OAAO,CAAC,0BAA0B;IAiBlC,OAAO,CAAC,8BAA8B;IAoCtC,OAAO,CAAC,2BAA2B;IA6CnC,OAAO,CAAC,yBAAyB;YAkBnB,cAAc;YASd,+BAA+B;IAa7C;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgCvE;IAED;;;OAGG;IACG,mCAAmC,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAsDjB;IAED;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAsBpD;IAED;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;;;;OAKG;YACW,wBAAwB;IAUtC;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGzE;IAED;;;;OAIG;IACG,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,0BAA0B,CAAC,CAmBrC;IAED;;;;OAIG;YACW,mBAAmB;IAoBjC;;;;;OAKG;IACG,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBvD;IAEK,wBAAwB,CAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,2BAA2B,EACvC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,0BAA0B,CAAC,CAuBrC;YAEa,6BAA6B;IAyBrC,4BAA4B,CAChC,UAAU,EAAE,2BAA2B,EACvC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA8Bf;YAEa,2BAA2B;IAyHzC;;;;;OAKG;IACH,OAAO,CAAC,yBAAyB;YAanB,iBAAiB;YA+GjB,sBAAsB;IA2H9B,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAStD;IAED;;;OAGG;YACW,qBAAqB;YAWrB,UAAU;YA+CV,kBAAkB;IAQ1B,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMnE;IAGK,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CA+DjB;IAGK,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA0D/C;IAGK,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgClE;IAGD,gBAAgB,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG/D;IAGK,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6CxB;IAGK,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAIzD;YAEa,yBAAyB;IAOjC,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG7D;IAGK,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAW9D;IAGK,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,WAAW,EAAE,EACvB,OAAO,GAAE,iBAAsB,EAC/B,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,CAAC,CA2JzB;IAED;;;;OAIG;IACI,0BAA0B,CAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,WAAW,EAAE,EACvB,OAAO,GAAE,iBAAsB,EAC/B,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,CA+NlD;IAGD,OAAO,CAAC,cAAc;IAmDhB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEtE;IAGK,YAAY,CAChB,UAAU,EAAE,OAAO,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CA+CjB;IAMK,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;IAEK,qBAAqB,CACzB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;IAEK,2BAA2B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACzD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;QACrC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,uBAAuB,CAAC,EAAE,OAAO,CAAC;KACnC,CAAC,CACH,CAEA;IAEK,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAQnC;IAEK,qBAAqB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACnD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC;KACpB,CAAC,CACH,CAEA;IAEK,qBAAqB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACnD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC;KACpB,CAAC,CACH,CAEA;IAED,iBAAiB,CACf,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EACpD,OAAO,EAAE,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,mEAGvD;IAEK,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;QAClE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,WAAW,CAAC;KACjB,GACL,OAAO,CAAC,MAAM,CAAC,CAEjB;IAEK,wBAAwB,CAC5B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,cAAc,EAAE;QACd,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,EACD,OAAO,GAAE;QACP,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;QAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,WAAW,CAAC;KACjB,GACL,OAAO,CAAC,MAAM,CAAC,CAOjB;IAEK,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE3B;IAEK,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;IAEK,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACxD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;KACzB,CAAC,CACH,CAEA;IAEK,sBAAsB,CAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,eAAe,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;QACrC,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GACA,OAAO,CAAC,gBAAgB,CAAC,CAM3B;IAEK,iBAAiB,CACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAEhC;IAEK,sBAAsB,CAC1B,cAAc,EAAE,UAAU,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;IAEK,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACxD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;KACzB,CAAC,CACH,CAEA;IAED,sBAAsB,CACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,8EAGjE;IAEK,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACxD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;KACzB,CAAC,CACH,CAEA;IAED,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;;;OAG/D;IAED,mBAAmB,CACjB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,WAAW,iFASrB;IAED,sBAAsB,CACpB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,WAAW;;;OASrB;IAEK,wBAAwB,CAC5B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAMlB;IAED,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,WAAW,iBASrB;IAEK,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa5C;CACF"}
+{"version":3,"file":"pluginService.d.ts","sourceRoot":"","sources":["../../src/services/pluginService.ts"],"names":[],"mappings":"AAsBA,OAAO,EACL,cAAc,EACd,cAAc,EACd,wBAAwB,EACxB,MAAM,EACN,YAAY,EACZ,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,cAAc,EACf,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAIjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AASjF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AA6IzC,KAAK,2BAA2B,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/E;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GACrC,SAAS,GAAG,WAAW,GAAG,qBAAqB,GAAG,aAAa,CAAC;AAElE,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,2BAA2B,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkFD,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACrC;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,iBAAiB,CAAW;IACpC,OAAO,CAAC,4BAA4B,CAAW;IAC/C,OAAO,CAAC,cAAc,CAAW;IACjC,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,yBAAyB,CAA6B;IAC9D,OAAO,CAAC,oBAAoB,CAA6B;IACzD,OAAO,CAAC,iBAAiB,CAGrB;IACJ,OAAO,CAAC,+BAA+B,CAAsC;IAC7E,OAAO,CAAC,mCAAmC,CAA6B;IACxE,OAAO,CAAC,8BAA8B,CAA6B;IACnE,OAAO,CAAC,2BAA2B,CAG/B;IACJ,OAAO,CAAC,uBAAuB,CAA6B;IAC5D,OAAO,CAAC,iCAAiC,CAA6B;IACtE,OAAO,CAAC,+BAA+B,CAA2B;IAClE,OAAO,CAAC,gBAAgB,CAAyB;IACjD,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,sBAAsB,CAA+B;IAC7D,OAAO,CAAC,sBAAsB,CAA+B;IAC7D,OAAO,CAAC,sBAAsB,CAA+B;IAC7D,OAAO,CAAC,yBAAyB,CAAkC;IACnE,OAAO,CAAC,6BAA6B,CAAoC;IACzE,OAAO,CAAC,yBAAyB,CAA4B;IAC7D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAU;IAClD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,YAAY,OAAO,GAAE,oBAAyB,EA6F7C;IAED,OAAO,CAAC,YAAY;YAIN,uBAAuB;IAQrC,OAAO,CAAC,qBAAqB;IAO7B,OAAO,CAAC,+BAA+B;IAOvC,OAAO,CAAC,uBAAuB;IA4D/B,OAAO,CAAC,+BAA+B;IAevC;;;;;OAKG;IACH,OAAO,CAAC,8BAA8B;IA8BtC,OAAO,CAAC,2BAA2B;IAsBnC,OAAO,CAAC,wBAAwB;IAIhC,OAAO,CAAC,kCAAkC;YAQ5B,6BAA6B;YA4D7B,+BAA+B;YAgC/B,mBAAmB;YAuDnB,qBAAqB;IAkC7B,qBAAqB,CACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA+Cf;YAEa,+BAA+B;YAyC/B,qBAAqB;IAgDnC,OAAO,CAAC,sBAAsB;IA4F9B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,2BAA2B;YAUrB,0BAA0B;YAyB1B,uBAAuB;YAiBvB,8BAA8B;YAM9B,6BAA6B;IAI3C,OAAO,CAAC,0BAA0B;IAiBlC,OAAO,CAAC,8BAA8B;IAoCtC,OAAO,CAAC,2BAA2B;IA6CnC,OAAO,CAAC,yBAAyB;YAkBnB,cAAc;YASd,+BAA+B;IAa7C;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgCvE;IAED;;;OAGG;IACG,mCAAmC,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAsDjB;IAED;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAsBpD;IAED;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;;;;OAKG;YACW,wBAAwB;IAUtC;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGzE;IAED;;;;OAIG;IACG,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,0BAA0B,CAAC,CAmBrC;IAED;;;;OAIG;YACW,mBAAmB;IAoBjC;;;;;OAKG;IACG,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBvD;IAEK,wBAAwB,CAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,2BAA2B,EACvC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,0BAA0B,CAAC,CAuBrC;YAEa,6BAA6B;IAyBrC,4BAA4B,CAChC,UAAU,EAAE,2BAA2B,EACvC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA8Bf;YAEa,2BAA2B;IAyHzC;;;;;OAKG;IACH,OAAO,CAAC,yBAAyB;YAanB,iBAAiB;YA+GjB,sBAAsB;IA2H9B,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAStD;IAED;;;OAGG;YACW,qBAAqB;YAWrB,UAAU;YA+CV,kBAAkB;IAQ1B,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMnE;IAGK,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CA+DjB;IAGK,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA0D/C;IAGK,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgClE;IAGD,gBAAgB,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG/D;IAGK,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqFxB;IAGK,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAIzD;YAEa,yBAAyB;IAOjC,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG7D;IAGK,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAW9D;IAGK,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,WAAW,EAAE,EACvB,OAAO,GAAE,iBAAsB,EAC/B,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,CAAC,CA2JzB;IAED;;;;OAIG;IACI,0BAA0B,CAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,WAAW,EAAE,EACvB,OAAO,GAAE,iBAAsB,EAC/B,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,CA+NlD;IAGD,OAAO,CAAC,cAAc;IAmDhB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEtE;IAGK,YAAY,CAChB,UAAU,EAAE,OAAO,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CA+CjB;IAMK,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;IAEK,qBAAqB,CACzB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;IAEK,2BAA2B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACzD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;QACrC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,uBAAuB,CAAC,EAAE,OAAO,CAAC;KACnC,CAAC,CACH,CAEA;IAEK,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAQnC;IAEK,qBAAqB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACnD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC;KACpB,CAAC,CACH,CAEA;IAEK,qBAAqB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACnD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC;KACpB,CAAC,CACH,CAEA;IAED,iBAAiB,CACf,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EACpD,OAAO,EAAE,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,mEAGvD;IAEK,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;QAClE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,WAAW,CAAC;KACjB,GACL,OAAO,CAAC,MAAM,CAAC,CAEjB;IAEK,wBAAwB,CAC5B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,cAAc,EAAE;QACd,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,EACD,OAAO,GAAE;QACP,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;QAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,WAAW,CAAC;KACjB,GACL,OAAO,CAAC,MAAM,CAAC,CAOjB;IAEK,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE3B;IAEK,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;IAEK,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACxD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;KACzB,CAAC,CACH,CAEA;IAEK,sBAAsB,CAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,eAAe,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;QACrC,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GACA,OAAO,CAAC,gBAAgB,CAAC,CAM3B;IAEK,iBAAiB,CACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAEhC;IAEK,sBAAsB,CAC1B,cAAc,EAAE,UAAU,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;IAEK,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACxD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;KACzB,CAAC,CACH,CAEA;IAED,sBAAsB,CACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,8EAGjE;IAEK,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CACxD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;KACzB,CAAC,CACH,CAEA;IAED,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;;;OAG/D;IAED,mBAAmB,CACjB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,WAAW,iFASrB;IAED,sBAAsB,CACpB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,WAAW;;;OASrB;IAEK,wBAAwB,CAC5B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAMlB;IAED,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,WAAW,iBASrB;IAEK,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa5C;CACF"}

package/backend/dist/services/pluginService.js

@@ -1555,7 +1555,7 @@ export class PluginService {
     // Get the active plugin for a specific model
     async getActivePluginForModel(model, userId, pluginId) {
         if (pluginId) {
-            const plugin = await this.getPlugin(pluginId, userId);
+            let plugin = await this.getPlugin(pluginId, userId);
             if (!plugin) {
                 throw new Error(`Plugin not found: ${pluginId}`);
             }
@@ -1563,7 +1563,18 @@ export class PluginService {
                 throw new Error(`Plugin is not active: ${pluginId}`);
             }
             if (!plugin.model_map.includes(model)) {
-                throw new Error(`Model ${model} is not supported by plugin ${pluginId}`);
+                // The UI offers a live-fetched catalog, so a just-released provider
+                // model can be requested before the shared store carries it — and an
+                // external worker resolves from the shared store only. Refresh a due
+                // catalog once before rejecting; the discovery backoff keeps a
+                // mistyped model from probing the provider on every request.
+                if (await this.isModelDiscoveryDue(pluginId, userId)) {
+                    await this.discoverModelsResult(pluginId, userId).catch(() => undefined);
+                    plugin = await this.getPlugin(pluginId, userId);
+                }
+                if (!plugin?.model_map.includes(model)) {
+                    throw new Error(`Model ${model} is not supported by plugin ${pluginId}`);
+                }
             }
             await this.resolveOperationEndpoint(plugin, userId);
             const apiKey = await this.getApiKey(plugin, userId);
@@ -1587,6 +1598,28 @@ export class PluginService {
                 return plugin;
             }
         }
+        // Same store-vs-catalog skew guard for sessions without an explicit
+        // provider: refresh every due catalog once, then rescan before giving up.
+        let refreshedAnyCatalog = false;
+        for (const plugin of activePlugins) {
+            if ((plugin.type === 'completion' || plugin.type === 'chat') &&
+                (await this.isModelDiscoveryDue(plugin.id, userId))) {
+                await this.discoverModelsResult(plugin.id, userId).catch(() => undefined);
+                refreshedAnyCatalog = true;
+            }
+        }
+        if (refreshedAnyCatalog) {
+            for (const plugin of await this.getActivePlugins(userId)) {
+                if (plugin.model_map.includes(model)) {
+                    await this.resolveOperationEndpoint(plugin, userId);
+                    const apiKey = await this.getApiKey(plugin, userId);
+                    if (pluginRequiresApiKey(plugin) && !apiKey) {
+                        continue;
+                    }
+                    return plugin;
+                }
+            }
+        }
         return null;
     }
     // Get all currently active plugins