libre-webui 0.22.0 → 0.23.0

package/backend/dist/persistence/postgresTrustFoundationMigration.js

@@ -0,0 +1,151 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { createHash } from 'node:crypto';
+/**
+ * Trust-foundation schema: groups, resource grants, auth sessions, API
+ * tokens, OAuth identities, and the append-only security audit log.
+ */
+// CHECK expressions use the exact form PostgreSQL reconstructs in
+// pg_get_constraintdef (no BETWEEN), so the schema inspector's declared and
+// actual constraint texts normalize identically.
+export const POSTGRES_TRUST_FOUNDATION_SQL = `CREATE TABLE user_groups (
+  id text PRIMARY KEY,
+  name text NOT NULL UNIQUE CHECK (length(name) >= 1 AND length(name) <= 128),
+  description text,
+  created_by text,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL
+);
+
+CREATE TABLE user_group_members (
+  group_id text NOT NULL REFERENCES user_groups(id) ON DELETE CASCADE,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  added_by text,
+  added_at bigint NOT NULL,
+  PRIMARY KEY (group_id, user_id)
+);
+
+CREATE INDEX idx_user_group_members_user
+  ON user_group_members(user_id, group_id);
+
+CREATE TABLE resource_grants (
+  id text PRIMARY KEY,
+  resource_type text NOT NULL
+    CHECK (length(resource_type) >= 1 AND length(resource_type) <= 64),
+  resource_id text NOT NULL
+    CHECK (length(resource_id) >= 1 AND length(resource_id) <= 256),
+  owner_user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  principal_type text NOT NULL CHECK (principal_type IN ('user', 'group')),
+  principal_id text NOT NULL,
+  permission text NOT NULL CHECK (permission IN ('read', 'write', 'admin')),
+  created_by text NOT NULL,
+  created_at bigint NOT NULL,
+  UNIQUE (resource_type, resource_id, principal_type, principal_id)
+);
+
+CREATE INDEX idx_resource_grants_resource
+  ON resource_grants(resource_type, resource_id);
+
+CREATE INDEX idx_resource_grants_principal
+  ON resource_grants(principal_type, principal_id);
+
+CREATE TABLE auth_sessions (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  kind text NOT NULL,
+  ip_hash text,
+  user_agent text,
+  created_at bigint NOT NULL,
+  last_seen_at bigint NOT NULL,
+  expires_at bigint NOT NULL,
+  revoked_at bigint,
+  revoked_by text
+);
+
+CREATE INDEX idx_auth_sessions_user
+  ON auth_sessions(user_id, last_seen_at);
+
+CREATE INDEX idx_auth_sessions_expires
+  ON auth_sessions(expires_at);
+
+CREATE TABLE api_tokens (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  name text NOT NULL CHECK (length(name) >= 1 AND length(name) <= 128),
+  token_hash text NOT NULL UNIQUE,
+  token_prefix text NOT NULL,
+  scopes text NOT NULL,
+  created_at bigint NOT NULL,
+  expires_at bigint,
+  last_used_at bigint,
+  revoked_at bigint
+);
+
+CREATE INDEX idx_api_tokens_user
+  ON api_tokens(user_id, created_at);
+
+CREATE TABLE oauth_identities (
+  provider text NOT NULL,
+  subject text NOT NULL,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  email text,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL,
+  PRIMARY KEY (provider, subject)
+);
+
+CREATE INDEX idx_oauth_identities_user
+  ON oauth_identities(user_id);
+
+CREATE TABLE security_audit_events (
+  id text PRIMARY KEY,
+  occurred_at bigint NOT NULL,
+  actor_user_id text,
+  actor_kind text NOT NULL,
+  action text NOT NULL CHECK (length(action) >= 1 AND length(action) <= 128),
+  target_type text,
+  target_id text,
+  result text NOT NULL CHECK (result IN ('success', 'denied', 'failure')),
+  request_id text,
+  ip_hash text,
+  details text
+);
+
+CREATE INDEX idx_security_audit_occurred
+  ON security_audit_events(occurred_at, id);
+
+CREATE INDEX idx_security_audit_actor
+  ON security_audit_events(actor_user_id, occurred_at);
+
+CREATE INDEX idx_security_audit_action
+  ON security_audit_events(action, occurred_at);`;
+const version = 13;
+const name = 'trust-foundation';
+export const POSTGRES_TRUST_FOUNDATION_MIGRATION = Object.freeze({
+    version,
+    name,
+    checksum: createHash('sha256')
+        .update(`${version}\n${name}\n${POSTGRES_TRUST_FOUNDATION_SQL}`)
+        .digest('hex'),
+    sql: POSTGRES_TRUST_FOUNDATION_SQL,
+    rollbackPlan: 'DROP TABLE security_audit_events, oauth_identities, api_tokens, ' +
+        'auth_sessions, resource_grants, user_group_members, user_groups; ' +
+        'delete ledger row 13. Existing bearer tokens keep working because ' +
+        'sid-less JWTs remain accepted; issued API tokens stop resolving.',
+    minimumCompatibleVersion: 13,
+});
+//# sourceMappingURL=postgresTrustFoundationMigration.js.map

package/backend/dist/persistence/postgresTrustFoundationMigration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresTrustFoundationMigration.js","sourceRoot":"","sources":["../../src/persistence/postgresTrustFoundationMigration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;GAGG;AACH,kEAAkE;AAClE,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iDA8GI,CAAC;AAElD,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,IAAI,GAAG,kBAAkB,CAAC;AAEhC,MAAM,CAAC,MAAM,mCAAmC,GAC9C,MAAM,CAAC,MAAM,CAAC;IACZ,OAAO;IACP,IAAI;IACJ,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,GAAG,OAAO,KAAK,IAAI,KAAK,6BAA6B,EAAE,CAAC;SAC/D,MAAM,CAAC,KAAK,CAAC;IAChB,GAAG,EAAE,6BAA6B;IAClC,YAAY,EACV,kEAAkE;QAClE,mEAAmE;QACnE,oEAAoE;QACpE,kEAAkE;IACpE,wBAAwB,EAAE,EAAE;CAC7B,CAAC,CAAC"}

package/backend/dist/persistence/securityTypes.d.ts

@@ -0,0 +1,196 @@
+/**
+ * Trust-foundation persistence contracts: groups, resource grants, auth
+ * sessions, API tokens, OAuth identities, and the security audit log.
+ *
+ * Repositories exchange snake_case row shapes with epoch-millisecond
+ * timestamps, mirroring the resource repositories. Values arrive already
+ * validated; secrets (API tokens) arrive already hashed. The audit log is
+ * append-only: there is no update or delete surface beyond retention pruning.
+ */
+export type GrantPrincipalType = 'user' | 'group';
+export type GrantPermission = 'read' | 'write' | 'admin';
+export type AuditResult = 'success' | 'denied' | 'failure';
+export interface StoredGroupRecord {
+    id: string;
+    name: string;
+    description: string | null;
+    created_by: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface StoredGroupMemberRecord {
+    group_id: string;
+    user_id: string;
+    added_by: string | null;
+    added_at: number;
+}
+export interface StoredResourceGrantRecord {
+    id: string;
+    resource_type: string;
+    resource_id: string;
+    owner_user_id: string;
+    principal_type: GrantPrincipalType;
+    principal_id: string;
+    permission: GrantPermission;
+    created_by: string;
+    created_at: number;
+}
+export interface StoredAuthSessionRecord {
+    id: string;
+    user_id: string;
+    kind: string;
+    ip_hash: string | null;
+    user_agent: string | null;
+    created_at: number;
+    last_seen_at: number;
+    expires_at: number;
+    revoked_at: number | null;
+    revoked_by: string | null;
+}
+export interface StoredApiTokenRecord {
+    id: string;
+    user_id: string;
+    name: string;
+    token_hash: string;
+    token_prefix: string;
+    scopes: string;
+    created_at: number;
+    expires_at: number | null;
+    last_used_at: number | null;
+    revoked_at: number | null;
+}
+export interface StoredOAuthIdentityRecord {
+    provider: string;
+    subject: string;
+    user_id: string;
+    email: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface StoredSecurityAuditEventRecord {
+    id: string;
+    occurred_at: number;
+    actor_user_id: string | null;
+    actor_kind: string;
+    action: string;
+    target_type: string | null;
+    target_id: string | null;
+    result: AuditResult;
+    request_id: string | null;
+    ip_hash: string | null;
+    details: string | null;
+}
+export interface SecurityAuditQuery {
+    action?: string;
+    actorUserId?: string;
+    result?: AuditResult;
+    targetType?: string;
+    before?: number;
+    after?: number;
+    limit: number;
+}
+export interface GroupRepository {
+    list(): Promise<StoredGroupRecord[]>;
+    findById(groupId: string): Promise<StoredGroupRecord | null>;
+    findByName(name: string): Promise<StoredGroupRecord | null>;
+    insert(group: StoredGroupRecord): Promise<void>;
+    update(groupId: string, patch: {
+        name?: string;
+        description?: string | null;
+        updated_at: number;
+    }): Promise<boolean>;
+    delete(groupId: string): Promise<boolean>;
+    listMembers(groupId: string): Promise<StoredGroupMemberRecord[]>;
+    listGroupIdsForUser(userId: string): Promise<string[]>;
+    listGroupsForUser(userId: string): Promise<StoredGroupRecord[]>;
+    addMember(member: StoredGroupMemberRecord): Promise<boolean>;
+    removeMember(groupId: string, userId: string): Promise<boolean>;
+    removeUserFromAllGroups(userId: string): Promise<number>;
+}
+export interface ResourceGrantRepository {
+    listForResource(resourceType: string, resourceId: string): Promise<StoredResourceGrantRecord[]>;
+    listForPrincipal(principalType: GrantPrincipalType, principalId: string): Promise<StoredResourceGrantRecord[]>;
+    findById(grantId: string): Promise<StoredResourceGrantRecord | null>;
+    /**
+     * Effective grants for a user against one resource: direct user grants
+     * plus grants held by any of the supplied group ids.
+     */
+    listEffective(resourceType: string, resourceId: string, userId: string, groupIds: readonly string[]): Promise<StoredResourceGrantRecord[]>;
+    upsert(grant: StoredResourceGrantRecord): Promise<void>;
+    delete(grantId: string): Promise<boolean>;
+    deleteForResource(resourceType: string, resourceId: string): Promise<number>;
+    deleteForPrincipal(principalType: GrantPrincipalType, principalId: string): Promise<number>;
+    deleteForOwner(ownerUserId: string): Promise<number>;
+}
+export interface AuthSessionRepository {
+    insert(session: StoredAuthSessionRecord): Promise<void>;
+    findById(sessionId: string): Promise<StoredAuthSessionRecord | null>;
+    listByUser(userId: string): Promise<StoredAuthSessionRecord[]>;
+    touch(sessionId: string, lastSeenAt: number): Promise<boolean>;
+    revoke(sessionId: string, revokedAt: number, revokedBy: string): Promise<boolean>;
+    revokeAllForUser(userId: string, revokedAt: number, revokedBy: string, exceptSessionId?: string): Promise<string[]>;
+    deleteExpired(before: number): Promise<number>;
+    deleteForUser(userId: string): Promise<number>;
+}
+export interface ApiTokenRepository {
+    insert(token: StoredApiTokenRecord): Promise<void>;
+    findByHash(tokenHash: string): Promise<StoredApiTokenRecord | null>;
+    findById(tokenId: string): Promise<StoredApiTokenRecord | null>;
+    listByUser(userId: string): Promise<StoredApiTokenRecord[]>;
+    listAll(): Promise<StoredApiTokenRecord[]>;
+    touchLastUsed(tokenId: string, lastUsedAt: number): Promise<boolean>;
+    revoke(tokenId: string, revokedAt: number): Promise<boolean>;
+    deleteForUser(userId: string): Promise<number>;
+}
+export interface OAuthIdentityRepository {
+    find(provider: string, subject: string): Promise<StoredOAuthIdentityRecord | null>;
+    listByUser(userId: string): Promise<StoredOAuthIdentityRecord[]>;
+    upsert(identity: StoredOAuthIdentityRecord): Promise<void>;
+    deleteForUser(userId: string): Promise<number>;
+}
+export interface SecurityAuditRepository {
+    insert(event: StoredSecurityAuditEventRecord): Promise<void>;
+    query(query: SecurityAuditQuery): Promise<StoredSecurityAuditEventRecord[]>;
+    deleteBefore(before: number): Promise<number>;
+}
+export interface SecurityRepositories {
+    groups: GroupRepository;
+    grants: ResourceGrantRepository;
+    authSessions: AuthSessionRepository;
+    apiTokens: ApiTokenRepository;
+    oauthIdentities: OAuthIdentityRepository;
+    audit: SecurityAuditRepository;
+}
+/**
+ * Synchronous variants used inside owned SQLite transactions, so a
+ * security-critical mutation and its audit event commit atomically.
+ */
+export interface GroupSyncRepository {
+    findById(groupId: string): StoredGroupRecord | null;
+    findByName(name: string): StoredGroupRecord | null;
+    insert(group: StoredGroupRecord): void;
+    update(groupId: string, patch: {
+        name?: string;
+        description?: string | null;
+        updated_at: number;
+    }): boolean;
+    delete(groupId: string): boolean;
+    addMember(member: StoredGroupMemberRecord): boolean;
+    removeMember(groupId: string, userId: string): boolean;
+}
+export interface ResourceGrantSyncRepository {
+    findById(grantId: string): StoredResourceGrantRecord | null;
+    upsert(grant: StoredResourceGrantRecord): void;
+    delete(grantId: string): boolean;
+    deleteForResource(resourceType: string, resourceId: string): number;
+    deleteForPrincipal(principalType: GrantPrincipalType, principalId: string): number;
+}
+export interface SecurityAuditSyncRepository {
+    insert(event: StoredSecurityAuditEventRecord): void;
+}
+export interface SecuritySyncRepositories {
+    groups: GroupSyncRepository;
+    grants: ResourceGrantSyncRepository;
+    audit: SecurityAuditSyncRepository;
+}
+//# sourceMappingURL=securityTypes.d.ts.map

package/backend/dist/persistence/securityTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityTypes.d.ts","sourceRoot":"","sources":["../../src/persistence/securityTypes.ts"],"names":[],"mappings":"AAiBA;;;;;;;;GAQG;AAEH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,OAAO,CAAC;AAClD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AACzD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,kBAAkB,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,eAAe,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC7D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CACJ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GACxE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACjE,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAChE,SAAS,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACxC,gBAAgB,CACd,aAAa,EAAE,kBAAkB,EACjC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IACrE;;;OAGG;IACH,aAAa,CACX,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,kBAAkB,CAChB,aAAa,EAAE,kBAAkB,EACjC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IACrE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC/D,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,CACJ,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,gBAAgB,CACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAChE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAC5D,OAAO,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAC3C,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,CACF,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAC7C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACjE,MAAM,CAAC,QAAQ,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAAC;IAC5E,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,uBAAuB,CAAC;IAChC,YAAY,EAAE,qBAAqB,CAAC;IACpC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,eAAe,EAAE,uBAAuB,CAAC;IACzC,KAAK,EAAE,uBAAuB,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAAC;IACpD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACvC,MAAM,CACJ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GACxE,OAAO,CAAC;IACX,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,SAAS,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC;IACpD,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CACxD;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACpE,kBAAkB,CAChB,aAAa,EAAE,kBAAkB,EACjC,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC;CACX;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,KAAK,EAAE,8BAA8B,GAAG,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,2BAA2B,CAAC;IACpC,KAAK,EAAE,2BAA2B,CAAC;CACpC"}

package/backend/dist/persistence/securityTypes.js

@@ -0,0 +1,18 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {};
+//# sourceMappingURL=securityTypes.js.map

package/backend/dist/persistence/securityTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityTypes.js","sourceRoot":"","sources":["../../src/persistence/securityTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/backend/dist/persistence/sqliteMigrations.d.ts

@@ -20,6 +20,7 @@ export declare const WORK_PREVIEW_UPSTREAM_SCHEMA_SQL = "\n  ALTER TABLE work_ta
 export declare const DURABLE_EVENT_IDEMPOTENCY_SCHEMA_SQL = "\n  ALTER TABLE platform_events ADD COLUMN request_fingerprint TEXT NOT NULL\n    DEFAULT '0000000000000000000000000000000000000000000000000000000000000000'\n    CHECK (\n      length(request_fingerprint) = 64\n      AND request_fingerprint NOT GLOB '*[^0-9a-f]*'\n    );\n";
 export declare const DURABLE_EVENT_REPLAY_INDEX_SCHEMA_SQL = "\n  CREATE INDEX IF NOT EXISTS idx_platform_events_stream_subject_cursor\n    ON platform_events(stream_id, subject_id, global_cursor);\n";
 export declare const RESOURCE_DELETION_LIFECYCLE_SCHEMA_SQL = "\n  CREATE TABLE IF NOT EXISTS platform_resource_deletion_tombstones (\n    resource_type TEXT NOT NULL\n      CHECK (resource_type IN ('document', 'generated-media', 'persona')),\n    resource_id TEXT NOT NULL CHECK (length(resource_id) BETWEEN 1 AND 256),\n    owner_user_id TEXT NOT NULL CHECK (length(owner_user_id) BETWEEN 1 AND 256),\n    deletion_incarnation INTEGER NOT NULL CHECK (deletion_incarnation > 0),\n    deletion_token TEXT NOT NULL UNIQUE\n      CHECK (\n        length(deletion_token) = 64\n        AND deletion_token NOT GLOB '*[^0-9a-f]*'\n      ),\n    deleted_at INTEGER NOT NULL CHECK (deleted_at >= 0),\n    completed_at INTEGER CHECK (\n      completed_at IS NULL OR completed_at >= deleted_at\n    ),\n    PRIMARY KEY (resource_type, resource_id)\n  );\n\n  CREATE INDEX IF NOT EXISTS idx_platform_resource_tombstones_owner\n    ON platform_resource_deletion_tombstones(\n      owner_user_id,\n      deleted_at,\n      resource_type,\n      resource_id\n    );\n";
+export declare const TRUST_FOUNDATION_SCHEMA_SQL = "\n  CREATE TABLE IF NOT EXISTS user_groups (\n    id TEXT PRIMARY KEY,\n    name TEXT UNIQUE NOT NULL CHECK (length(name) BETWEEN 1 AND 128),\n    description TEXT,\n    created_by TEXT,\n    created_at INTEGER NOT NULL,\n    updated_at INTEGER NOT NULL\n  );\n\n  CREATE TABLE IF NOT EXISTS user_group_members (\n    group_id TEXT NOT NULL REFERENCES user_groups(id) ON DELETE CASCADE,\n    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n    added_by TEXT,\n    added_at INTEGER NOT NULL,\n    PRIMARY KEY (group_id, user_id)\n  );\n\n  CREATE INDEX IF NOT EXISTS idx_user_group_members_user\n    ON user_group_members(user_id, group_id);\n\n  CREATE TABLE IF NOT EXISTS resource_grants (\n    id TEXT PRIMARY KEY,\n    resource_type TEXT NOT NULL CHECK (length(resource_type) BETWEEN 1 AND 64),\n    resource_id TEXT NOT NULL CHECK (length(resource_id) BETWEEN 1 AND 256),\n    owner_user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n    principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'group')),\n    principal_id TEXT NOT NULL,\n    permission TEXT NOT NULL CHECK (permission IN ('read', 'write', 'admin')),\n    created_by TEXT NOT NULL,\n    created_at INTEGER NOT NULL,\n    UNIQUE (resource_type, resource_id, principal_type, principal_id)\n  );\n\n  CREATE INDEX IF NOT EXISTS idx_resource_grants_resource\n    ON resource_grants(resource_type, resource_id);\n\n  CREATE INDEX IF NOT EXISTS idx_resource_grants_principal\n    ON resource_grants(principal_type, principal_id);\n\n  CREATE TABLE IF NOT EXISTS auth_sessions (\n    id TEXT PRIMARY KEY,\n    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n    kind TEXT NOT NULL,\n    ip_hash TEXT,\n    user_agent TEXT,\n    created_at INTEGER NOT NULL,\n    last_seen_at INTEGER NOT NULL,\n    expires_at INTEGER NOT NULL,\n    revoked_at INTEGER,\n    revoked_by TEXT\n  );\n\n  CREATE INDEX IF NOT EXISTS idx_auth_sessions_user\n    ON auth_sessions(user_id, last_seen_at);\n\n  CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires\n    ON auth_sessions(expires_at);\n\n  CREATE TABLE IF NOT EXISTS api_tokens (\n    id TEXT PRIMARY KEY,\n    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n    name TEXT NOT NULL CHECK (length(name) BETWEEN 1 AND 128),\n    token_hash TEXT UNIQUE NOT NULL,\n    token_prefix TEXT NOT NULL,\n    scopes TEXT NOT NULL,\n    created_at INTEGER NOT NULL,\n    expires_at INTEGER,\n    last_used_at INTEGER,\n    revoked_at INTEGER\n  );\n\n  CREATE INDEX IF NOT EXISTS idx_api_tokens_user\n    ON api_tokens(user_id, created_at);\n\n  CREATE TABLE IF NOT EXISTS oauth_identities (\n    provider TEXT NOT NULL,\n    subject TEXT NOT NULL,\n    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n    email TEXT,\n    created_at INTEGER NOT NULL,\n    updated_at INTEGER NOT NULL,\n    PRIMARY KEY (provider, subject)\n  );\n\n  CREATE INDEX IF NOT EXISTS idx_oauth_identities_user\n    ON oauth_identities(user_id);\n\n  CREATE TABLE IF NOT EXISTS security_audit_events (\n    id TEXT PRIMARY KEY,\n    occurred_at INTEGER NOT NULL,\n    actor_user_id TEXT,\n    actor_kind TEXT NOT NULL,\n    action TEXT NOT NULL CHECK (length(action) BETWEEN 1 AND 128),\n    target_type TEXT,\n    target_id TEXT,\n    result TEXT NOT NULL CHECK (result IN ('success', 'denied', 'failure')),\n    request_id TEXT,\n    ip_hash TEXT,\n    details TEXT\n  );\n\n  CREATE INDEX IF NOT EXISTS idx_security_audit_occurred\n    ON security_audit_events(occurred_at, id);\n\n  CREATE INDEX IF NOT EXISTS idx_security_audit_actor\n    ON security_audit_events(actor_user_id, occurred_at);\n\n  CREATE INDEX IF NOT EXISTS idx_security_audit_action\n    ON security_audit_events(action, occurred_at);\n";
 export type SchemaCompatibilityStatus = 'uninitialized' | 'migrating' | 'compatible' | 'incompatible';
 export interface SchemaCompatibilityState {
     dialect: 'sqlite';

package/backend/dist/persistence/sqliteMigrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqliteMigrations.d.ts","sourceRoot":"","sources":["../../src/persistence/sqliteMigrations.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAK3C,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AA2RvD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,4rEAwEtC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,svHAqG1C,CAAC;AAuKF,eAAO,MAAM,gCAAgC,yKAK5C,CAAC;AAEF,eAAO,MAAM,oCAAoC,2NAKhD,CAAC;AAEF,eAAO,MAAM,4BAA4B,okBAkBxC,CAAC;AAEF,eAAO,MAAM,sCAAsC,ugBAgBlD,CAAC;AAEF,eAAO,MAAM,gCAAgC,4WAW5C,CAAC;AAEF,eAAO,MAAM,oCAAoC,sRAOhD,CAAC;AAEF,eAAO,MAAM,qCAAqC,8IAGjD,CAAC;AAEF,eAAO,MAAM,sCAAsC,m+BA0BlD,CAAC;AAqEF,MAAM,MAAM,yBAAyB,GACnC,eAAe,GAAG,WAAW,GAAG,YAAY,GAAG,cAAc,CAAC;AAEhE,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,yBAAyB,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAQD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,EAAE,KAAK,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA4wCD;;;;;GAKG;AACH,eAAO,MAAM,+CAA+C,mBAC1C,MAAM,KACrB,OAKA,CAAC;AAEJ,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;IAQrC,CAAC;AA4GF;;;GAGG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,IAAI,CAkBN;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,IAAI,CAmBN;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,sBAAsB,CAuIxB;AAUD,eAAO,MAAM,2BAA2B,QAAO,wBAE7C,CAAC;AAkBH,eAAO,MAAM,yBAAyB,UAC7B,OAAO,KACb,wBAC2D,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CAsD1B;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CA0B1B;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CAgN1B"}
+{"version":3,"file":"sqliteMigrations.d.ts","sourceRoot":"","sources":["../../src/persistence/sqliteMigrations.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAK3C,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AA2RvD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,4rEAwEtC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,svHAqG1C,CAAC;AA2OF,eAAO,MAAM,gCAAgC,yKAK5C,CAAC;AAEF,eAAO,MAAM,oCAAoC,2NAKhD,CAAC;AAEF,eAAO,MAAM,4BAA4B,okBAkBxC,CAAC;AAEF,eAAO,MAAM,sCAAsC,ugBAgBlD,CAAC;AAEF,eAAO,MAAM,gCAAgC,4WAW5C,CAAC;AAEF,eAAO,MAAM,oCAAoC,sRAOhD,CAAC;AAEF,eAAO,MAAM,qCAAqC,8IAGjD,CAAC;AAEF,eAAO,MAAM,sCAAsC,m+BA0BlD,CAAC;AAEF,eAAO,MAAM,2BAA2B,+qHA8GvC,CAAC;AAqEF,MAAM,MAAM,yBAAyB,GACnC,eAAe,GAAG,WAAW,GAAG,YAAY,GAAG,cAAc,CAAC;AAEhE,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,yBAAyB,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAQD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,EAAE,KAAK,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA05CD;;;;;GAKG;AACH,eAAO,MAAM,+CAA+C,mBAC1C,MAAM,KACrB,OAKA,CAAC;AAEJ,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;IAQrC,CAAC;AA4GF;;;GAGG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,IAAI,CAkBN;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,IAAI,CAmBN;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,sBAAsB,CAuIxB;AAUD,eAAO,MAAM,2BAA2B,QAAO,wBAE7C,CAAC;AAkBH,eAAO,MAAM,yBAAyB,UAC7B,OAAO,KACb,wBAC2D,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CAsD1B;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CA0B1B;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CAgN1B"}