libre-webui 0.25.0 → 0.27.0

package/backend/dist/services/toolServerService.js

@@ -0,0 +1,521 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Registered external tool servers (TOOL-02/TOOL-03). Registration is
+ * administrator-only; the server's OpenAPI specification or MCP tool list is
+ * fetched once and pinned with a digest, so the executable surface cannot
+ * drift without an explicit administrator refresh. Availability is scoped
+ * per server: admins-only, all users, or grant-based through the common
+ * resource-grant model. Per-user credentials are encrypted with additional
+ * authenticated data binding them to the exact user and server identity.
+ */
+import { createHash } from 'node:crypto';
+import { v4 as uuidv4 } from 'uuid';
+import { getPersistence } from '../persistence/index.js';
+import { MAX_TOOL_SERVERS, MAX_TOOL_SERVER_DESCRIPTION_LENGTH, MAX_TOOL_SERVER_NAME_LENGTH, MAX_TOOL_SERVER_SECRET_LENGTH, MAX_TOOL_SERVER_SPEC_BYTES, MAX_TOOL_SERVER_TOOLS, ResourcePolicyError, } from '../utils/resourceLimits.js';
+import { secureToolRequest, validateToolServerUrl, } from '../utils/toolEgress.js';
+import { encryptionService } from './encryptionService.js';
+import { authorize } from './authorizationService.js';
+import { deleteGrantsForResource } from './resourceGrantService.js';
+import { recordAuditEvent } from './securityAuditService.js';
+import { mcpInitialize, mcpListTools, } from './mcpClientService.js';
+import { parseOpenApiSpec } from './openApiToolService.js';
+const DEFAULT_TIMEOUT_MS = 30000;
+const MIN_TIMEOUT_MS = 1000;
+const MAX_TIMEOUT_MS = 120000;
+const DEFAULT_MAX_RESPONSE_BYTES = 256 * 1024;
+const MAX_RESPONSE_BYTES_CEILING = 4 * 1024 * 1024;
+const SERVER_KINDS = ['openapi', 'mcp'];
+const AUTH_MODES = ['none', 'bearer', 'header'];
+const ACCESS_MODES = [
+    'admins-only',
+    'all-users',
+    'granted',
+];
+const resources = () => getPersistence(encryptionService).repositories.resources;
+const credentialAad = (serverId, userId) => Buffer.from(`tool-server-credential\0${serverId}\0${userId}`, 'utf-8');
+export const mapToolServerRow = (row) => ({
+    id: row.id,
+    name: encryptionService.decrypt(row.name),
+    ...(row.description
+        ? { description: encryptionService.decrypt(row.description) }
+        : {}),
+    kind: row.kind,
+    baseUrl: encryptionService.decrypt(row.base_url),
+    ...(row.spec_digest ? { specDigest: row.spec_digest } : {}),
+    specRevision: row.spec_revision,
+    authMode: row.auth_mode,
+    ...(row.auth_header ? { authHeader: row.auth_header } : {}),
+    accessMode: row.access_mode,
+    enabled: row.enabled === 1,
+    timeoutMs: row.timeout_ms,
+    maxResponseBytes: row.max_response_bytes,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    ownerUserId: row.user_id,
+});
+export const mapToolRow = (row) => ({
+    name: row.name,
+    ...(row.description
+        ? { description: encryptionService.decrypt(row.description) }
+        : {}),
+    ...(row.params_schema
+        ? {
+            paramsSchema: JSON.parse(encryptionService.decrypt(row.params_schema)),
+        }
+        : {}),
+    sideEffect: row.side_effect === 1,
+    enabled: row.enabled === 1,
+    ...(row.detail
+        ? {
+            detail: JSON.parse(encryptionService.decrypt(row.detail)),
+        }
+        : {}),
+});
+const validateInput = (input) => {
+    if (!input.name?.trim() || input.name.length > MAX_TOOL_SERVER_NAME_LENGTH) {
+        throw new ResourcePolicyError('Invalid tool server name', 400);
+    }
+    if (input.description !== undefined &&
+        input.description.length > MAX_TOOL_SERVER_DESCRIPTION_LENGTH) {
+        throw new ResourcePolicyError('Tool server description is too long', 400);
+    }
+    if (!SERVER_KINDS.includes(input.kind)) {
+        throw new ResourcePolicyError('Invalid tool server kind', 400);
+    }
+    if (!AUTH_MODES.includes(input.authMode)) {
+        throw new ResourcePolicyError('Invalid tool server auth mode', 400);
+    }
+    if (!ACCESS_MODES.includes(input.accessMode)) {
+        throw new ResourcePolicyError('Invalid tool server access mode', 400);
+    }
+    if (input.authMode === 'header' &&
+        !/^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/.test(input.authHeader ?? '')) {
+        throw new ResourcePolicyError('A header auth mode requires a valid header name', 400);
+    }
+    validateToolServerUrl(input.baseUrl);
+    if (input.specUrl !== undefined)
+        validateToolServerUrl(input.specUrl);
+};
+const clampTimeout = (value) => Math.min(Math.max(Math.trunc(value ?? DEFAULT_TIMEOUT_MS), MIN_TIMEOUT_MS), MAX_TIMEOUT_MS);
+const clampResponseBytes = (value) => Math.min(Math.max(Math.trunc(value ?? DEFAULT_MAX_RESPONSE_BYTES), 1024), MAX_RESPONSE_BYTES_CEILING);
+const specEnvelope = (sourceUrl, document) => JSON.stringify({ sourceUrl, document });
+const readSpecEnvelope = (encrypted) => {
+    if (!encrypted)
+        return null;
+    try {
+        const parsed = JSON.parse(encryptionService.decrypt(encrypted));
+        return typeof parsed?.sourceUrl === 'string' ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+};
+/** Fetch and pin the server's tool inventory (OpenAPI spec or MCP list). */
+const pinInventory = async (input, timeoutMs) => {
+    if (input.kind === 'openapi') {
+        const response = await secureToolRequest({
+            url: input.specUrl ?? input.baseUrl,
+            method: 'GET',
+            headers: { Accept: 'application/json' },
+            timeoutMs,
+            maxResponseBytes: MAX_TOOL_SERVER_SPEC_BYTES,
+        });
+        if (response.status >= 400 || response.truncated) {
+            throw new ResourcePolicyError('The OpenAPI specification could not be fetched', 400);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(response.bodyText);
+        }
+        catch {
+            throw new ResourcePolicyError('The OpenAPI specification is not valid JSON', 400);
+        }
+        const { tools } = parseOpenApiSpec(parsed, MAX_TOOL_SERVER_TOOLS);
+        const specJson = JSON.stringify(parsed);
+        return {
+            specJson,
+            digest: createHash('sha256').update(specJson).digest('hex'),
+            tools,
+        };
+    }
+    const endpoint = {
+        url: input.baseUrl,
+        headers: {},
+        timeoutMs,
+        maxResponseBytes: MAX_TOOL_SERVER_SPEC_BYTES,
+    };
+    const session = await mcpInitialize(endpoint);
+    const descriptors = await mcpListTools(endpoint, session);
+    if (descriptors.length === 0) {
+        throw new ResourcePolicyError('The MCP server exposes no tools', 400);
+    }
+    const tools = descriptors
+        .slice(0, MAX_TOOL_SERVER_TOOLS)
+        .map(descriptor => ({
+        name: descriptor.name.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64),
+        ...(descriptor.description
+            ? { description: descriptor.description.slice(0, 1024) }
+            : {}),
+        ...(descriptor.inputSchema
+            ? { paramsSchema: descriptor.inputSchema }
+            : {}),
+        sideEffect: descriptor.readOnlyHint !== true,
+        enabled: true,
+    }));
+    const specJson = JSON.stringify(descriptors);
+    return {
+        specJson,
+        digest: createHash('sha256').update(specJson).digest('hex'),
+        tools,
+    };
+};
+const toolRows = (serverId, tools, now) => tools.map(tool => ({
+    id: uuidv4(),
+    server_id: serverId,
+    name: tool.name,
+    description: tool.description
+        ? encryptionService.encrypt(tool.description)
+        : null,
+    params_schema: tool.paramsSchema
+        ? encryptionService.encrypt(JSON.stringify(tool.paramsSchema))
+        : null,
+    detail: tool.detail
+        ? encryptionService.encrypt(JSON.stringify(tool.detail))
+        : null,
+    side_effect: tool.sideEffect ? 1 : 0,
+    enabled: tool.enabled ? 1 : 0,
+    created_at: now,
+    updated_at: now,
+}));
+export async function registerToolServer(adminUserId, input) {
+    validateInput(input);
+    const timeoutMs = clampTimeout(input.timeoutMs);
+    const inventory = await pinInventory(input, timeoutMs);
+    const now = Date.now();
+    const record = {
+        id: uuidv4(),
+        user_id: adminUserId,
+        name: encryptionService.encrypt(input.name.trim()),
+        description: input.description
+            ? encryptionService.encrypt(input.description)
+            : null,
+        kind: input.kind,
+        base_url: encryptionService.encrypt(input.baseUrl),
+        spec: encryptionService.encrypt(specEnvelope(input.specUrl ?? input.baseUrl, inventory.specJson)),
+        spec_digest: inventory.digest,
+        spec_revision: 1,
+        auth_mode: input.authMode,
+        auth_header: input.authMode === 'header' ? (input.authHeader ?? null) : null,
+        access_mode: input.accessMode,
+        enabled: input.enabled === false ? 0 : 1,
+        timeout_ms: timeoutMs,
+        max_response_bytes: clampResponseBytes(input.maxResponseBytes),
+        created_at: now,
+        updated_at: now,
+    };
+    try {
+        await resources().toolServers.replaceWithLimit(record, MAX_TOOL_SERVERS);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.name === 'PersistenceResourceLimitError') {
+            throw new ResourcePolicyError(`This instance may register at most ${MAX_TOOL_SERVERS} tool servers`, 409);
+        }
+        throw error;
+    }
+    await resources().toolServerTools.replaceAllForServer(record.id, toolRows(record.id, inventory.tools, now));
+    recordAuditEvent({
+        action: 'tool-server.register',
+        result: 'success',
+        actorUserId: adminUserId,
+        targetType: 'tool-server',
+        targetId: record.id,
+        details: { kind: input.kind, digest: inventory.digest },
+    });
+    return mapToolServerRow(record);
+}
+/** Update mutable policy fields. The destination and pinned spec never change here. */
+export async function updateToolServer(adminUserId, serverId, update) {
+    const existing = await resources().toolServers.findById(serverId);
+    if (!existing)
+        return null;
+    const merged = { ...existing };
+    if (update.name !== undefined) {
+        if (!update.name.trim() ||
+            update.name.length > MAX_TOOL_SERVER_NAME_LENGTH) {
+            throw new ResourcePolicyError('Invalid tool server name', 400);
+        }
+        merged.name = encryptionService.encrypt(update.name.trim());
+    }
+    if (update.description !== undefined) {
+        if (update.description !== null &&
+            update.description.length > MAX_TOOL_SERVER_DESCRIPTION_LENGTH) {
+            throw new ResourcePolicyError('Tool server description is too long', 400);
+        }
+        merged.description = update.description
+            ? encryptionService.encrypt(update.description)
+            : null;
+    }
+    if (update.authMode !== undefined) {
+        if (!AUTH_MODES.includes(update.authMode)) {
+            throw new ResourcePolicyError('Invalid tool server auth mode', 400);
+        }
+        merged.auth_mode = update.authMode;
+    }
+    if (update.authHeader !== undefined)
+        merged.auth_header = update.authHeader;
+    if (merged.auth_mode === 'header' &&
+        !/^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/.test(merged.auth_header ?? '')) {
+        throw new ResourcePolicyError('A header auth mode requires a valid header name', 400);
+    }
+    if (update.accessMode !== undefined) {
+        if (!ACCESS_MODES.includes(update.accessMode)) {
+            throw new ResourcePolicyError('Invalid tool server access mode', 400);
+        }
+        merged.access_mode = update.accessMode;
+    }
+    if (update.enabled !== undefined)
+        merged.enabled = update.enabled ? 1 : 0;
+    if (update.timeoutMs !== undefined) {
+        merged.timeout_ms = clampTimeout(update.timeoutMs);
+    }
+    if (update.maxResponseBytes !== undefined) {
+        merged.max_response_bytes = clampResponseBytes(update.maxResponseBytes);
+    }
+    merged.updated_at = Date.now();
+    await resources().toolServers.replaceWithLimit(merged, MAX_TOOL_SERVERS);
+    recordAuditEvent({
+        action: 'tool-server.update',
+        result: 'success',
+        actorUserId: adminUserId,
+        targetType: 'tool-server',
+        targetId: serverId,
+    });
+    return mapToolServerRow(merged);
+}
+/** Re-fetch the inventory; a changed digest advances the pinned revision. */
+export async function refreshToolServer(adminUserId, serverId) {
+    const existing = await resources().toolServers.findById(serverId);
+    if (!existing)
+        return null;
+    const server = mapToolServerRow(existing);
+    const storedEnvelope = readSpecEnvelope(existing.spec);
+    const inventory = await pinInventory({
+        kind: server.kind,
+        baseUrl: server.baseUrl,
+        ...(storedEnvelope ? { specUrl: storedEnvelope.sourceUrl } : {}),
+    }, server.timeoutMs);
+    const now = Date.now();
+    const changed = inventory.digest !== existing.spec_digest;
+    const merged = {
+        ...existing,
+        spec: encryptionService.encrypt(specEnvelope(storedEnvelope?.sourceUrl ?? server.baseUrl, inventory.specJson)),
+        spec_digest: inventory.digest,
+        spec_revision: changed
+            ? existing.spec_revision + 1
+            : existing.spec_revision,
+        updated_at: now,
+    };
+    await resources().toolServers.replaceWithLimit(merged, MAX_TOOL_SERVERS);
+    await resources().toolServerTools.replaceAllForServer(serverId, toolRows(serverId, inventory.tools, now));
+    recordAuditEvent({
+        action: 'tool-server.refresh',
+        result: 'success',
+        actorUserId: adminUserId,
+        targetType: 'tool-server',
+        targetId: serverId,
+        details: { digest: inventory.digest, changed },
+    });
+    return mapToolServerRow(merged);
+}
+export async function deleteToolServer(adminUserId, serverId) {
+    const deleted = await resources().toolServers.delete(serverId);
+    if (deleted) {
+        await deleteGrantsForResource('tool-server', serverId);
+        recordAuditEvent({
+            action: 'tool-server.delete',
+            result: 'success',
+            actorUserId: adminUserId,
+            targetType: 'tool-server',
+            targetId: serverId,
+        });
+    }
+    return deleted;
+}
+export async function getToolServer(serverId) {
+    const row = await resources().toolServers.findById(serverId);
+    return row ? mapToolServerRow(row) : null;
+}
+export async function listToolServers() {
+    const rows = await resources().toolServers.list(MAX_TOOL_SERVERS);
+    return rows.map(mapToolServerRow);
+}
+export async function listServerTools(serverId) {
+    const rows = await resources().toolServerTools.listByServer(serverId);
+    return rows.map(mapToolRow);
+}
+export async function overrideServerTool(adminUserId, serverId, toolName, overrides) {
+    const row = await resources().toolServerTools.updateOverrides(serverId, toolName, {
+        ...(overrides.enabled !== undefined
+            ? { enabled: overrides.enabled ? 1 : 0 }
+            : {}),
+        ...(overrides.sideEffect !== undefined
+            ? { side_effect: overrides.sideEffect ? 1 : 0 }
+            : {}),
+    }, Date.now());
+    if (row) {
+        recordAuditEvent({
+            action: 'tool-server.tool-override',
+            result: 'success',
+            actorUserId: adminUserId,
+            targetType: 'tool-server',
+            targetId: serverId,
+            details: { tool: toolName, ...overrides },
+        });
+    }
+    return row ? mapToolRow(row) : null;
+}
+/** Whether one server is usable by this actor (feature gate checked separately). */
+export async function actorCanUseServer(actor, server) {
+    if (!server.enabled)
+        return false;
+    if (actor.role === 'admin')
+        return true;
+    if (server.accessMode === 'admins-only')
+        return false;
+    if (server.accessMode === 'all-users')
+        return true;
+    const decision = await authorize(actor, 'use', {
+        type: 'tool-server',
+        id: server.id,
+        ownerUserId: server.ownerUserId,
+    });
+    // The registering admin "owns" the row, but grant-scoped servers are
+    // available to non-owners only through explicit grants.
+    return decision.allowed;
+}
+export async function listVisibleToolServers(actor) {
+    const servers = await listToolServers();
+    const visible = [];
+    for (const server of servers) {
+        if (await actorCanUseServer(actor, server))
+            visible.push(server);
+    }
+    return visible;
+}
+const NAMESPACE_PATTERN = /[^a-z0-9_]/g;
+export const serverNamespace = (name) => {
+    const base = name.toLowerCase().replace(NAMESPACE_PATTERN, '_').slice(0, 24);
+    return base.replace(/^_+|_+$/g, '') || 'server';
+};
+/**
+ * The effective server-tool catalog for one actor: enabled tools of every
+ * visible enabled server, namespaced `<server>__<tool>` for the provider.
+ */
+export async function effectiveServerTools(actor, serverIds) {
+    const servers = await listVisibleToolServers(actor);
+    const selected = serverIds
+        ? servers.filter(server => serverIds.includes(server.id))
+        : servers;
+    const catalog = [];
+    const usedNamespaces = new Map();
+    for (const server of selected) {
+        let namespace = serverNamespace(server.name);
+        const collisions = usedNamespaces.get(namespace) ?? 0;
+        usedNamespaces.set(namespace, collisions + 1);
+        if (collisions > 0)
+            namespace = `${namespace}${collisions + 1}`;
+        const tools = await listServerTools(server.id);
+        for (const tool of tools) {
+            if (!tool.enabled)
+                continue;
+            catalog.push({
+                name: `${namespace}__${tool.name}`.slice(0, 64),
+                ...(tool.description ? { description: tool.description } : {}),
+                ...(tool.paramsSchema ? { paramsSchema: tool.paramsSchema } : {}),
+                sideEffect: tool.sideEffect,
+                source: server.kind,
+                serverId: server.id,
+                serverName: server.name,
+                toolName: tool.name,
+            });
+        }
+    }
+    return catalog;
+}
+// === Per-user credentials ===
+export async function setToolServerCredential(userId, serverId, secret) {
+    if (!secret || secret.length > MAX_TOOL_SERVER_SECRET_LENGTH) {
+        throw new ResourcePolicyError('Invalid tool server credential', 400);
+    }
+    const server = await resources().toolServers.findById(serverId);
+    if (!server)
+        throw new ResourcePolicyError('Unknown tool server', 400);
+    const now = Date.now();
+    await resources().toolServerCredentials.upsert({
+        id: uuidv4(),
+        server_id: serverId,
+        user_id: userId,
+        secret: encryptionService
+            .encryptBuffer(Buffer.from(secret, 'utf-8'), credentialAad(serverId, userId))
+            .toString('base64'),
+        created_at: now,
+        updated_at: now,
+    });
+    recordAuditEvent({
+        action: 'tool-server.credential-set',
+        result: 'success',
+        actorUserId: userId,
+        targetType: 'tool-server',
+        targetId: serverId,
+    });
+}
+export async function deleteToolServerCredential(userId, serverId) {
+    const deleted = await resources().toolServerCredentials.delete(serverId, userId);
+    if (deleted) {
+        recordAuditEvent({
+            action: 'tool-server.credential-delete',
+            result: 'success',
+            actorUserId: userId,
+            targetType: 'tool-server',
+            targetId: serverId,
+        });
+    }
+    return deleted;
+}
+export async function hasToolServerCredential(userId, serverId) {
+    return Boolean(await resources().toolServerCredentials.find(serverId, userId));
+}
+/** Resolve the outbound auth headers for this user on this server. */
+export async function resolveAuthHeaders(userId, server) {
+    if (server.authMode === 'none')
+        return {};
+    const row = await resources().toolServerCredentials.find(server.id, userId);
+    if (!row) {
+        throw new ResourcePolicyError('This tool server requires a personal credential; add one in Tools', 400);
+    }
+    const secret = encryptionService
+        .decryptBuffer(Buffer.from(row.secret, 'base64'), credentialAad(server.id, userId))
+        .toString('utf-8')
+        .replace(/[\r\n]/g, '');
+    if (server.authMode === 'bearer') {
+        return { Authorization: `Bearer ${secret}` };
+    }
+    return { [server.authHeader ?? 'X-Api-Key']: secret };
+}
+//# sourceMappingURL=toolServerService.js.map

package/backend/dist/services/toolServerService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolServerService.js","sourceRoot":"","sources":["../../src/services/toolServerService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAczD,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAmB,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,YAAY,GAEb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAClC,MAAM,cAAc,GAAG,IAAK,CAAC;AAC7B,MAAM,cAAc,GAAG,MAAO,CAAC;AAC/B,MAAM,0BAA0B,GAAG,GAAG,GAAG,IAAI,CAAC;AAC9C,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD,MAAM,YAAY,GAA8B,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACnE,MAAM,UAAU,GAAkC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC/E,MAAM,YAAY,GAAoC;IACpD,aAAa;IACb,WAAW;IACX,SAAS;CACV,CAAC;AAEF,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC;AAE3D,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,MAAc,EAAU,EAAE,CACjE,MAAM,CAAC,IAAI,CAAC,2BAA2B,QAAQ,KAAK,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAA2B,EAAc,EAAE,CAAC,CAAC;IAC5E,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,WAAW;QACjB,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;QAC7D,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,EAAE,GAAG,CAAC,IAAsB;IAChC,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,YAAY,EAAE,GAAG,CAAC,aAAa;IAC/B,QAAQ,EAAE,GAAG,CAAC,SAA+B;IAC7C,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,UAAU,EAAE,GAAG,CAAC,WAAmC;IACnD,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;IAC1B,SAAS,EAAE,GAAG,CAAC,UAAU;IACzB,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;IACxC,SAAS,EAAE,GAAG,CAAC,UAAU;IACzB,SAAS,EAAE,GAAG,CAAC,UAAU;IACzB,WAAW,EAAE,GAAG,CAAC,OAAO;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,GAA+B,EACf,EAAE,CAAC,CAAC;IACpB,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,GAAG,CAAC,GAAG,CAAC,WAAW;QACjB,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;QAC7D,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,GAAG,CAAC,aAAa;QACnB,CAAC,CAAC;YACE,YAAY,EAAE,IAAI,CAAC,KAAK,CACtB,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAClB;SAC7B;QACH,CAAC,CAAC,EAAE,CAAC;IACP,UAAU,EAAE,GAAG,CAAC,WAAW,KAAK,CAAC;IACjC,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;IAC1B,GAAG,CAAC,GAAG,CAAC,MAAM;QACZ,CAAC,CAAC;YACE,MAAM,EAAE,IAAI,CAAC,KAAK,CAChB,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CACZ;SAC5B;QACH,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CAAC;AAiBH,MAAM,aAAa,GAAG,CAAC,KAAsB,EAAQ,EAAE;IACrD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC3E,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,IACE,KAAK,CAAC,WAAW,KAAK,SAAS;QAC/B,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,kCAAkC,EAC7D,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EACnE,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,iDAAiD,EACjD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAyB,EAAU,EAAE,CACzD,IAAI,CAAC,GAAG,CACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,kBAAkB,CAAC,EAAE,cAAc,CAAC,EACjE,cAAc,CACf,CAAC;AAEJ,MAAM,kBAAkB,GAAG,CAAC,KAAyB,EAAU,EAAE,CAC/D,IAAI,CAAC,GAAG,CACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,0BAA0B,CAAC,EAAE,IAAI,CAAC,EAC/D,0BAA0B,CAC3B,CAAC;AAkBJ,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAU,EAAE,CACnE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAA+B,CAAC,CAAC;AAEvE,MAAM,gBAAgB,GAAG,CACvB,SAAwB,EACG,EAAE;IAC7B,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CACf,CAAC;QACxB,OAAO,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,YAAY,GAAG,KAAK,EACxB,KAA4D,EAC5D,SAAiB,EACS,EAAE;IAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;YACvC,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;YACnC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,SAAS;YACT,gBAAgB,EAAE,0BAA0B;SAC7C,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,mBAAmB,CAC3B,gDAAgD,EAChD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,mBAAmB,CAC3B,6CAA6C,EAC7C,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3D,KAAK;SACN,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAgB;QAC5B,GAAG,EAAE,KAAK,CAAC,OAAO;QAClB,OAAO,EAAE,EAAE;QACX,SAAS;QACT,gBAAgB,EAAE,0BAA0B;KAC7C,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,KAAK,GAAqB,WAAW;SACxC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC;SAC/B,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClB,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAClE,GAAG,CAAC,UAAU,CAAC,WAAW;YACxB,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,WAAW;YACxB,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,WAAW,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE,UAAU,CAAC,YAAY,KAAK,IAAI;QAC5C,OAAO,EAAE,IAAI;KACd,CAAC,CAAC,CAAC;IACN,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC7C,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3D,KAAK;KACN,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CACf,QAAgB,EAChB,KAAuB,EACvB,GAAW,EACmB,EAAE,CAChC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,EAAE,EAAE,MAAM,EAAE;IACZ,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI,CAAC,IAAI;IACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC3B,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QAC7C,CAAC,CAAC,IAAI;IACR,aAAa,EAAE,IAAI,CAAC,YAAY;QAC9B,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9D,CAAC,CAAC,IAAI;IACR,MAAM,EAAE,IAAI,CAAC,MAAM;QACjB,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC,CAAC,IAAI;IACR,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,UAAU,EAAE,GAAG;IACf,UAAU,EAAE,GAAG;CAChB,CAAC,CAAC,CAAC;AAEN,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,KAAsB;IAEtB,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAA2B;QACrC,EAAE,EAAE,MAAM,EAAE;QACZ,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC5B,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;YAC9C,CAAC,CAAC,IAAI;QACR,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAClD,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAC7B,YAAY,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,CACjE;QACD,WAAW,EAAE,SAAS,CAAC,MAAM;QAC7B,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,WAAW,EACT,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACjE,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,UAAU,EAAE,SAAS;QACrB,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC9D,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KAChB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,SAAS,EAAE,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,KAAK;YACtB,KAAK,CAAC,IAAI,KAAK,+BAA+B,EAC9C,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,sCAAsC,gBAAgB,eAAe,EACrE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,SAAS,EAAE,CAAC,eAAe,CAAC,mBAAmB,CACnD,MAAM,CAAC,EAAE,EACT,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAC1C,CAAC;IACF,gBAAgB,CAAC;QACf,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,WAAW;QACxB,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;KACxD,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAaD,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,QAAgB,EAChB,MAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,MAAM,GAA2B,EAAE,GAAG,QAAQ,EAAE,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IACE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;YACnB,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,2BAA2B,EAChD,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,CAAC,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,IACE,MAAM,CAAC,WAAW,KAAK,IAAI;YAC3B,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,kCAAkC,EAC9D,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW;YACrC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;IAC5E,IACE,MAAM,CAAC,SAAS,KAAK,QAAQ;QAC7B,CAAC,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,iDAAiD,EACjD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,CAAC,kBAAkB,GAAG,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,SAAS,EAAE,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACzE,gBAAgB,CAAC;QACf,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,WAAW;QACxB,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,YAAY,CAClC;QACE,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,EACD,MAAM,CAAC,SAAS,CACjB,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,WAAW,CAAC;IAC1D,MAAM,MAAM,GAA2B;QACrC,GAAG,QAAQ;QACX,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAC7B,YAAY,CACV,cAAc,EAAE,SAAS,IAAI,MAAM,CAAC,OAAO,EAC3C,SAAS,CAAC,QAAQ,CACnB,CACF;QACD,WAAW,EAAE,SAAS,CAAC,MAAM;QAC7B,aAAa,EAAE,OAAO;YACpB,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,CAAC;YAC5B,CAAC,CAAC,QAAQ,CAAC,aAAa;QAC1B,UAAU,EAAE,GAAG;KAChB,CAAC;IACF,MAAM,SAAS,EAAE,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACzE,MAAM,SAAS,EAAE,CAAC,eAAe,CAAC,mBAAmB,CACnD,QAAQ,EACR,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CACzC,CAAC;IACF,gBAAgB,CAAC;QACf,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,WAAW;QACxB,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE;KAC/C,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,QAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,SAAS,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,uBAAuB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACvD,gBAAgB,CAAC;YACf,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,WAAW;YACxB,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,QAAgB,EAChB,QAAgB,EAChB,SAAsD;IAEtD,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,eAAe,CAAC,eAAe,CAC3D,QAAQ,EACR,QAAQ,EACR;QACE,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;KACR,EACD,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;IACF,IAAI,GAAG,EAAE,CAAC;QACR,gBAAgB,CAAC;YACf,MAAM,EAAE,2BAA2B;YACnC,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,WAAW;YACxB,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAiB,EACjB,MAAkB;IAElB,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,MAAM,CAAC,UAAU,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE;QAC7C,IAAI,EAAE,aAAa;QACnB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,qEAAqE;IACrE,wDAAwD;IACxD,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;IACxC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAExC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAU,EAAE;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;AAClD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAiB,EACjB,SAA6B;IAE7B,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,SAAS;QACxB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtD,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,UAAU,GAAG,CAAC;YAAE,SAAS,GAAG,GAAG,SAAS,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAC5B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,GAAG,SAAS,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC/C,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+BAA+B;AAE/B,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,QAAgB,EAChB,MAAc;IAEd,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,6BAA6B,EAAE,CAAC;QAC7D,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;QAC7C,EAAE,EAAE,MAAM,EAAE;QACZ,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,iBAAiB;aACtB,aAAa,CACZ,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAChC;aACA,QAAQ,CAAC,QAAQ,CAAC;QACrB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KAChB,CAAC,CAAC;IACH,gBAAgB,CAAC;QACf,MAAM,EAAE,4BAA4B;QACpC,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,QAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,SAAS,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAC5D,QAAQ,EACR,MAAM,CACP,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,gBAAgB,CAAC;YACf,MAAM,EAAE,+BAA+B;YACvC,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,QAAgB;IAEhB,OAAO,OAAO,CACZ,MAAM,SAAS,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,MAAkB;IAElB,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,mBAAmB,CAC3B,mEAAmE,EACnE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB;SAC7B,aAAa,CACZ,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EACjC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CACjC;SACA,QAAQ,CAAC,OAAO,CAAC;SACjB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;AACxD,CAAC"}

package/backend/dist/services/voiceAccessService.d.ts

@@ -0,0 +1,10 @@
+export type VoiceAccessMode = 'admins' | 'all-users';
+export type VoiceFeatureKey = 'stt' | 'tts' | 'voice-mode' | 'voice-cloning';
+export declare const VOICE_FEATURE_KEYS: readonly VoiceFeatureKey[];
+export declare function isVoiceAccessMode(value: unknown): value is VoiceAccessMode;
+export declare function isVoiceFeatureKey(value: unknown): value is VoiceFeatureKey;
+/** Whether the environment pins the setting, locking the admin toggle. */
+export declare function voiceAccessModeLockedByEnv(feature: VoiceFeatureKey): boolean;
+export declare function getVoiceAccessMode(feature: VoiceFeatureKey): Promise<VoiceAccessMode>;
+export declare function setVoiceAccessMode(feature: VoiceFeatureKey, mode: VoiceAccessMode): Promise<void>;
+//# sourceMappingURL=voiceAccessService.d.ts.map

package/backend/dist/services/voiceAccessService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"voiceAccessService.d.ts","sourceRoot":"","sources":["../../src/services/voiceAccessService.ts"],"names":[],"mappings":"AA6BA,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,WAAW,CAAC;AAErD,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,GAAG,eAAe,CAAC;AAE7E,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAKxD,CAAC;AAgBF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAE1E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAK1E;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAE5E;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,eAAe,CAAC,CAS1B;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/backend/dist/services/voiceAccessService.js

@@ -0,0 +1,74 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Voice governance (AUDIO-03): separate administrator-controlled access
+ * modes for speech-to-text, text-to-speech, hands-free voice mode, and
+ * voice cloning. Each mode is a persisted system setting read on every
+ * check, mirroring the tool access mode. Defaults stay open ('all-users')
+ * so upgrades do not silently take audio features away; restricting them
+ * is an administrator decision. An environment variable per feature pins
+ * the value and locks the runtime toggle.
+ */
+import { getSystemSetting, setSystemSetting } from './systemSettingsService.js';
+export const VOICE_FEATURE_KEYS = [
+    'stt',
+    'tts',
+    'voice-mode',
+    'voice-cloning',
+];
+const SETTING_KEYS = {
+    stt: 'stt_access_mode',
+    tts: 'tts_access_mode',
+    'voice-mode': 'voice_mode_access_mode',
+    'voice-cloning': 'voice_cloning_access_mode',
+};
+const ENV_KEYS = {
+    stt: 'STT_ACCESS_MODE',
+    tts: 'TTS_ACCESS_MODE',
+    'voice-mode': 'VOICE_MODE_ACCESS_MODE',
+    'voice-cloning': 'VOICE_CLONING_ACCESS_MODE',
+};
+export function isVoiceAccessMode(value) {
+    return value === 'admins' || value === 'all-users';
+}
+export function isVoiceFeatureKey(value) {
+    return (typeof value === 'string' &&
+        VOICE_FEATURE_KEYS.includes(value));
+}
+/** Whether the environment pins the setting, locking the admin toggle. */
+export function voiceAccessModeLockedByEnv(feature) {
+    return isVoiceAccessMode(process.env[ENV_KEYS[feature]]);
+}
+export async function getVoiceAccessMode(feature) {
+    const env = process.env[ENV_KEYS[feature]];
+    if (isVoiceAccessMode(env))
+        return env;
+    try {
+        const value = await getSystemSetting(SETTING_KEYS[feature]);
+        return isVoiceAccessMode(value) ? value : 'all-users';
+    }
+    catch {
+        return 'all-users';
+    }
+}
+export async function setVoiceAccessMode(feature, mode) {
+    if (!isVoiceAccessMode(mode)) {
+        throw new Error(`Invalid voice access mode "${String(mode)}".`);
+    }
+    await setSystemSetting(SETTING_KEYS[feature], mode);
+}
+//# sourceMappingURL=voiceAccessService.js.map

package/backend/dist/services/voiceAccessService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"voiceAccessService.js","sourceRoot":"","sources":["../../src/services/voiceAccessService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAMhF,MAAM,CAAC,MAAM,kBAAkB,GAA+B;IAC5D,KAAK;IACL,KAAK;IACL,YAAY;IACZ,eAAe;CAChB,CAAC;AAEF,MAAM,YAAY,GAAoC;IACpD,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,iBAAiB;IACtB,YAAY,EAAE,wBAAwB;IACtC,eAAe,EAAE,2BAA2B;CAC7C,CAAC;AAEF,MAAM,QAAQ,GAAoC;IAChD,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,iBAAiB;IACtB,YAAY,EAAE,wBAAwB;IACtC,eAAe,EAAE,2BAA2B;CAC7C,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,WAAW,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B,CAAC,OAAwB;IACjE,OAAO,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAwB;IAExB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAwB,EACxB,IAAqB;IAErB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC"}