@asturiu/v0-sdk 0.0.0-stage → 1.0.0

package/src/recovery.ts

@@ -0,0 +1,269 @@
+/**
+ * Recovery contacts and recovery cards (ADR-050): the lists, codes and card
+ * format every surface shares, and what the Interface API answers. Pure and
+ * dependency-free: the Engine validates with these lists and checks a card's
+ * checksum itself; the Customer Portal and a Tenant's app read with them.
+ */
+import { PASS_CODE_ALPHABET, normalizePassCode } from "./passes.js";
+import { RECOVERY_WORDS } from "./recovery-words.js";
+
+export { RECOVERY_WORDS };
+
+/** A vault recovery ends in a Grant on that vault; a sign-in recovery in an Account reset (§1). */
+export const RECOVERY_SUBJECTS = ["vault", "sign_in"] as const;
+export type RecoverySubject = (typeof RECOVERY_SUBJECTS)[number];
+
+export const RECOVERY_LIMITS = {
+  contactsMin: 2,
+  contactsMax: 7,
+  quorumMin: 2,
+  note: 500,
+  name: 120,
+  notAfterDaysMax: 3650,
+  /** A claim never completes sooner than this after its last card (ADR-050 build note 27), whatever its waiting period. */
+  lastCardHours: 24,
+} as const;
+
+/** The waiting period in days (§3), counted from the first card (§6), never ending sooner than `lastCardHours` after the last; the owner can cancel during it. */
+export const RECOVERY_WAITING_DAYS = [1, 3, 7, 14, 30] as const;
+export type RecoveryWaitingDays = (typeof RECOVERY_WAITING_DAYS)[number];
+export const RECOVERY_DEFAULT_WAITING_DAYS: RecoveryWaitingDays = 3;
+
+/** What a completed vault claim grants unless the owner changes it, and what the owner may add (§3; `transfer` is added, build note 23). */
+export const RECOVERY_DEFAULT_CAPABILITIES = ["read", "reveal", "share"] as const;
+export const RECOVERY_OPTIONAL_CAPABILITIES = ["transfer", "update", "delete"] as const;
+export const RECOVERY_CAPABILITIES = [...RECOVERY_DEFAULT_CAPABILITIES, ...RECOVERY_OPTIONAL_CAPABILITIES] as const;
+export type RecoveryCapability = (typeof RECOVERY_CAPABILITIES)[number];
+
+/** What the owner sees per contact (§3). */
+export const RECOVERY_CONTACT_STATES = ["invited", "ready", "declined", "expired", "unreachable"] as const;
+export type RecoveryContactState = (typeof RECOVERY_CONTACT_STATES)[number];
+
+/** A claim's life (§6). `collecting` and `approved` are open; the rest are ends. */
+export const RECOVERY_CLAIM_STATES = ["collecting", "approved", "completed", "failed", "cancelled", "expired"] as const;
+export type RecoveryClaimState = (typeof RECOVERY_CLAIM_STATES)[number];
+export const RECOVERY_OPEN_CLAIM_STATES: readonly RecoveryClaimState[] = ["collecting", "approved"];
+
+/**
+ * Why a recovery call answered `409`: `reason` beside the English `detail`, so a frontend words it itself.
+ * `contact_address`: a sign-in claim's new address is one of that recovery's contacts (ADR-050 build notes).
+ */
+export const RECOVERY_CONFLICTS = ["not_set_up", "card_saved", "card_declined", "card_state", "claim_closed", "claim_expired", "card_given", "own_recovery", "not_a_claimant", "contact_address", "too_many_failures"] as const;
+export type RecoveryConflict = (typeof RECOVERY_CONFLICTS)[number];
+
+/**
+ * Why a well-typed card was refused (`card` on `401 recovery-attempt-failed` with `reason: card`; build note 25):
+ * its words don't fit together, no card has its card code (mistyped, or the cards were replaced), it serves the other
+ * kind of recovery or another Tenant's, the claim is bound to someone else's recovery, or its number was removed or
+ * replaced. Each still counts as a wrong try.
+ */
+export const RECOVERY_CARD_REFUSALS = ["unreadable", "unknown", "other_kind", "other_product", "other_person", "retired"] as const;
+export type RecoveryCardRefusal = (typeof RECOVERY_CARD_REFUSALS)[number];
+
+// ------------------------------------------------------------- codes
+
+/** The label printed on every card of one recovery: 8 characters from the pass alphabet, never the ARID (§4). */
+export const RECOVERY_HANDLE_LENGTH = 8;
+/** The code the claimant gives each contact by phone or in person (§6): 6 characters without look-alikes. */
+export const RECOVERY_CLAIM_CODE_LENGTH = 6;
+
+const ofAlphabet = (v: string, length: number) => v.length === length && [...v].every((c) => PASS_CODE_ALPHABET.includes(c));
+
+/** What a person typed, as the Engine compares it: capitals, with spaces, dashes and dots dropped. */
+export const normalizeRecoveryCode = normalizePassCode;
+
+export function isRecoveryHandle(value: string): boolean {
+  return ofAlphabet(value, RECOVERY_HANDLE_LENGTH);
+}
+
+export function isRecoveryClaimCode(value: string): boolean {
+  return ofAlphabet(value, RECOVERY_CLAIM_CODE_LENGTH);
+}
+
+/** `ABCDEFGH` → `ABCD-EFGH`; `ABCDEF` → `ABC-DEF`. */
+export function formatRecoveryCode(code: string): string {
+  const c = normalizeRecoveryCode(code);
+  const half = c.length / 2;
+  return c.length === RECOVERY_HANDLE_LENGTH || c.length === RECOVERY_CLAIM_CODE_LENGTH ? `${c.slice(0, half)}-${c.slice(half)}` : c;
+}
+
+// ------------------------------------------------------------- words
+
+/** 12 words: the 128-bit card and a 4-bit checksum, 11 bits a word, as BIP-39 encodes 128 bits (§4). */
+export const RECOVERY_CARD_WORDS = 12;
+
+const WORD_INDEX: ReadonlyMap<string, number> = new Map(RECOVERY_WORDS.map((w, i) => [w, i]));
+
+/** A word's 11-bit value, or -1. Every word of the list is fixed by its first four letters, so a word cut there still counts. */
+export function recoveryWordIndex(input: string): number {
+  const w = input.trim().toLowerCase();
+  const exact = WORD_INDEX.get(w);
+  if (exact !== undefined) return exact;
+  if (w.length < 4) return -1;
+  const matches = RECOVERY_WORDS.filter((x) => x.startsWith(w.slice(0, 4)) && (w.length === 4 || x.startsWith(w)));
+  return matches.length === 1 ? (WORD_INDEX.get(matches[0]) ?? -1) : -1;
+}
+
+/** The list's spelling of what was typed, or null. */
+export function recoveryWord(input: string): string | null {
+  const i = recoveryWordIndex(input);
+  return i < 0 ? null : RECOVERY_WORDS[i];
+}
+
+// ------------------------------------------------------------- the card
+
+/** What a card carries and what the helper page sends back (§4). */
+export interface RecoveryCardFace {
+  label: string;
+  /** The card's Shamir x, 1 to 7. */
+  number: number;
+  words: string[];
+}
+
+/** The text in a card's QR code. */
+export const RECOVERY_CARD_PREFIX = "ASTURIU-CARD";
+
+export function recoveryCardText(card: RecoveryCardFace): string {
+  return [RECOVERY_CARD_PREFIX, formatRecoveryCode(card.label), String(card.number), ...card.words].join(" ");
+}
+
+/**
+ * A card from what was scanned or typed: the QR code's text, or label,
+ * number and words in that order, with or without the prefix. Words are
+ * written out from the list; whether they hold a valid card is the Engine's
+ * check (the checksum). Null when the shape is wrong.
+ */
+export function parseRecoveryCard(text: string): RecoveryCardFace | null {
+  const parts = text.trim().split(/[\s,;]+/).filter(Boolean);
+  if (parts[0]?.toUpperCase() === RECOVERY_CARD_PREFIX) parts.shift();
+  if (parts.length !== RECOVERY_CARD_WORDS + 2) return null;
+  const label = normalizeRecoveryCode(parts[0]);
+  const number = Number.parseInt(parts[1], 10);
+  if (!isRecoveryHandle(label) || !Number.isInteger(number) || number < 1 || number > RECOVERY_LIMITS.contactsMax || String(number) !== parts[1]) return null;
+  const words = parts.slice(2).map(recoveryWord);
+  if (words.some((w) => w === null)) return null;
+  return { label, number, words: words as string[] };
+}
+
+// ------------------------------------------------------- what the API answers
+
+/** What a completed vault claim grants (§3). `claimants` null: any Customer of the Tenant may claim. */
+export interface RecoveryTerms {
+  capabilities: RecoveryCapability[];
+  /** The Grant ends this many days after completion; null for no end. */
+  not_after_days: number | null;
+  claimants: string[] | null;
+}
+
+export interface RecoveryContact {
+  /** The card's number, once cards are issued. */
+  number: number | null;
+  /** Vault recovery: the contact's Principal, and the owner's Contact for it (ADR-024). */
+  principal?: string;
+  contact?: string | null;
+  /** The name the owner gave (sign-in recovery) or the Principal's display name (vault recovery). */
+  name: string | null;
+  /** Sign-in recovery: the address the invitation goes to. */
+  email?: string;
+  state: RecoveryContactState;
+  invited_at: string | null;
+  collected_at: string | null;
+  /** Too many wrong codes on the invitation; Replace all cards sends a new one. */
+  locked: boolean;
+}
+
+/** A claim as the owner sees it on the recovery (§7). */
+export interface RecoveryClaimSummary {
+  id: string;
+  state: RecoveryClaimState;
+  received: number;
+  needed: number;
+  opened_at: string;
+  bound_at: string | null;
+  approved_at: string | null;
+  completes_at: string | null;
+}
+
+/** `GET /v0/recovery`, `/v0/me/recovery`, `/v0/customer/sign-in/recovery`. No answer carries a card. */
+export interface Recovery {
+  configured: boolean;
+  arid: string | null;
+  subject: RecoverySubject;
+  /** Vault recovery: the vault it covers. */
+  vault?: string;
+  contacts: RecoveryContact[];
+  quorum: number;
+  /** Contacts whose card is saved; below `quorum` the page warns. */
+  ready: number;
+  waiting_days: RecoveryWaitingDays;
+  /** Vault recovery only. */
+  terms?: RecoveryTerms;
+  cards_issued_at: string | null;
+  /** Open claims. */
+  claims: RecoveryClaimSummary[];
+}
+
+/** A claim as its claimant or the owner reads it (`GET /v0/recovery/claims/{id}`, `/v0/recovery/sign-in-claims/{id}`). */
+export interface RecoveryClaim {
+  id: string;
+  kind: RecoverySubject;
+  state: RecoveryClaimState;
+  role: "claimant" | "owner";
+  received: number;
+  /** Null until the first card binds the claim to a recovery. */
+  needed: number | null;
+  /** The display name of the person whose recovery the first card bound the claim to; null before that. */
+  owner_name: string | null;
+  note: string | null;
+  opened_at: string;
+  /** Collecting ends here, when the claim expires. */
+  expires_at: string;
+  bound_at: string | null;
+  approved_at: string | null;
+  completes_at: string | null;
+  closed_at: string | null;
+}
+
+/** What opening a claim answers, once: the code is never shown again (§6). */
+export interface OpenedRecoveryClaim {
+  claim: string;
+  code: string;
+  expires_at: string;
+}
+
+/** The contact page (`POST /v0/recovery/invites/open`): who asks, and where the card stands. */
+export interface RecoveryInvite {
+  subject: RecoverySubject;
+  owner_name: string | null;
+  /** The Tenant's product name, for a vault recovery and an `isolated` sign-in recovery. */
+  product: string | null;
+  contact_name: string | null;
+  state: RecoveryContactState;
+  number: number;
+}
+
+/** A card in transit to its contact (`POST /v0/recovery/invites/accept`). Shown until the contact types two words back. */
+export interface RecoveryCard extends RecoveryCardFace {
+  /** Which kind of recovery the card serves, printed on it: access to a vault, or a sign-in. */
+  subject: RecoverySubject;
+  owner_name: string | null;
+  product: string | null;
+  /** The helper page on the host the recovery belongs to. */
+  help_url: string;
+  /** The two word positions (1-based) the contact types back to confirm it was saved. */
+  confirm: [number, number];
+}
+
+/** The helper page after the claim code (`POST /v0/recovery/help/claim`). */
+export interface RecoveryHelpClaim {
+  claim: string;
+  kind: RecoverySubject;
+  /** Whose recovery the claim is bound to, so a contact who keeps several cards picks the right one; null before the first card. */
+  owner_name: string | null;
+  /** The product a vault claim's recovery lives in, or the platform's name for a sign-in claim on the shared realm, known before any card. */
+  product: string | null;
+  note: string | null;
+  received: number;
+  needed: number | null;
+  state: RecoveryClaimState;
+}

package/src/reveal.ts

@@ -0,0 +1,72 @@
+/**
+ * Reveal levels of a secret Field (ADR-018). Shared by the Engine (Definition
+ * schema, the reveal gate) and every frontend (what to ask of the person):
+ * pure and dependency-free so the Frontend kit can carry it.
+ */
+export const REVEAL_LEVELS = ["visible", "click", "captcha", "password", "2fa"] as const;
+export type RevealLevel = (typeof REVEAL_LEVELS)[number];
+
+/** What the reveal gate needs before it returns the value; `null` = nothing beyond the capability. */
+export type RevealStep = "captcha" | "password" | "mfa";
+
+export function revealStep(level: RevealLevel | null | undefined): RevealStep | null {
+  switch (level) {
+    case "captcha":
+      return "captcha";
+    case "password":
+      return "password";
+    case "2fa":
+      return "mfa";
+    default:
+      return null;
+  }
+}
+
+/** The level in effect for a Field Definition: `null` for a plain Field, `click` for a secret one that names none. */
+export function revealLevelOf(def: { secret?: boolean; reveal?: RevealLevel | string | null } | null | undefined): RevealLevel | null {
+  if (!def?.secret) return null;
+  return (REVEAL_LEVELS as readonly string[]).includes(def.reveal ?? "") ? (def.reveal as RevealLevel) : "click";
+}
+
+/** When a session last proved each factor (ISO timestamps). A second factor implies the password. */
+export interface StepUpState {
+  password?: string;
+  mfa?: string;
+}
+
+/**
+ * What a fresh OIDC token proves (components/11-authentik.md §Step-up flows).
+ * Authentik reports `pwd` for a password stage and `mfa` once an authenticator
+ * was validated in the same login; `auth_time` is that login's moment. A
+ * token whose login is older than `maxAgeSeconds` proves nothing now.
+ */
+export function stepUpFromClaims(claims: { amr?: string[]; auth_time?: number }, now: Date, maxAgeSeconds: number): StepUpState {
+  if (typeof claims.auth_time !== "number" || !Number.isFinite(claims.auth_time)) return {};
+  const at = new Date(claims.auth_time * 1000);
+  if (now.getTime() - at.getTime() > maxAgeSeconds * 1000 || at.getTime() - now.getTime() > 60_000) return {};
+  const amr = claims.amr ?? [];
+  const out: StepUpState = {};
+  if (amr.includes("mfa")) {
+    out.mfa = at.toISOString();
+    out.password = at.toISOString();
+  }
+  if (amr.includes("pwd")) out.password = at.toISOString();
+  return out;
+}
+
+/** Whether a recorded step-up still satisfies `step` at `now`. */
+export function stepUpSatisfies(step: RevealStep | null, state: StepUpState | undefined, now: Date, ttlSeconds: number): boolean {
+  if (step === null) return true;
+  if (step === "captcha") return false;
+  const at = state?.[step];
+  if (!at) return false;
+  const t = Date.parse(at);
+  return Number.isFinite(t) && now.getTime() - t <= ttlSeconds * 1000;
+}
+
+/** When a recorded step-up lapses, or `undefined` when there is none. */
+export function stepUpUntil(at: string | undefined, ttlSeconds: number): string | undefined {
+  if (!at) return undefined;
+  const t = Date.parse(at);
+  return Number.isFinite(t) ? new Date(t + ttlSeconds * 1000).toISOString() : undefined;
+}

package/src/session.ts

@@ -0,0 +1,93 @@
+/**
+ * What every Frontend component holds, and how (ADR-003; components/02 §Security):
+ * the opaque session identifier in an `HttpOnly` cookie, forwarded as
+ * `X-Asturiu-Session`. Nothing else — no token, no claims, no resource data.
+ */
+
+import { SIGNING_IN_CSS, signingInMarkup, signingInPhase } from "./signing-in.js";
+
+/** The header the Interface API reads on every request except `POST /v0/sessions`. */
+export const SESSION_HEADER = "x-asturiu-session";
+
+export interface CookiePolicy {
+  httpOnly: true;
+  sameSite: "strict" | "lax";
+  path: string;
+  /** `Secure` whenever the page is served over TLS; local development is the only exception. */
+  secure: boolean;
+  maxAge?: number;
+}
+
+/** The Engine session cookie: `HttpOnly`, `Secure`, `SameSite=Strict`, host-only. */
+export function sessionCookiePolicy(opts: { secure: boolean; maxAge?: number }): CookiePolicy {
+  return { httpOnly: true, sameSite: "strict", path: "/", secure: opts.secure, maxAge: opts.maxAge };
+}
+
+/**
+ * The login-attempt cookie (sealed PKCE verifier + `state`). `Lax`, not
+ * `Strict`: the browser arrives at the callback from Authentik's origin and a
+ * `Strict` cookie would not be sent on that top-level navigation.
+ */
+export function loginCookiePolicy(opts: { secure: boolean; maxAgeSeconds?: number; path?: string }): CookiePolicy {
+  return { httpOnly: true, sameSite: "lax", path: opts.path ?? "/auth", secure: opts.secure, maxAge: opts.maxAgeSeconds ?? 600 };
+}
+
+/** What one login attempt needs to remember between `/auth/login` and `/auth/callback`. */
+export interface LoginAttempt {
+  verifier: string;
+  state: string;
+  /** Site-relative path to land on afterwards. */
+  next: string;
+  created_at: string;
+  /** Set when the attempt is a step-up (ADR-018): the callback elevates the existing session instead of starting one. */
+  step_up?: "password" | "2fa";
+}
+
+/** Only site-relative paths may be used as post-login targets (no open redirect). */
+export function safeNextPath(candidate: string | null | undefined, fallback = "/"): string {
+  if (!candidate) return fallback;
+  if (!candidate.startsWith("/") || candidate.startsWith("//") || candidate.startsWith("/\\")) return fallback;
+  if (/[\r\n]/.test(candidate)) return fallback;
+  return candidate;
+}
+
+/** How `continuePage` writes its page. */
+export interface ContinuePageOptions {
+  /** The label and the page title. Default "Signing in". */
+  text?: string;
+  /** A Content-Security-Policy nonce for the page's one `<style>` element. */
+  nonce?: string;
+}
+
+/**
+ * The page a login callback answers with once the session cookie is set
+ * (ADR-032). The callback was reached through a redirect chain the sign-in host
+ * started — another site — so a redirect from it is still cross-site and a
+ * `SameSite=Strict` session cookie would not go with the next request: the app
+ * would see no session and start a login again, in a loop. A page that moves on
+ * by itself starts a fresh navigation from the app's own origin, which carries
+ * the cookie. `path` must already be a same-origin path (`safeNextPath`).
+ *
+ * The page is the "Signing in" screen the sign-in host showed while leaving,
+ * picked up at the same point of its animation, so the hand-over reads as one
+ * screen. It carries no script; its one `<style>` takes `nonce`.
+ */
+export function continuePage(path: string, options: string | ContinuePageOptions = {}): string {
+  const { text = "Signing in", nonce } = typeof options === "string" ? { text: options } : options;
+  const esc = (s: string) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+  const to = esc(safeNextPath(path, "/"));
+  const css = `html{background:#f4f4f1}@media (prefers-color-scheme:dark){html{background:#0a0b0d}}body{margin:0}.signing-in{--si-phase:${signingInPhase()}}${SIGNING_IN_CSS}`;
+  return (
+    `<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="refresh" content="0;url=${to}">` +
+    `<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover"><meta name="color-scheme" content="light dark"><meta name="robots" content="noindex">` +
+    `<title>${esc(text)}</title><style${nonce ? ` nonce="${esc(nonce)}"` : ""}>${css}</style></head>` +
+    `<body><div class="signing-in" role="status">${signingInMarkup({ text, href: safeNextPath(path, "/") })}</div></body></html>`
+  );
+}
+
+/** Seconds until an ISO timestamp, floored at zero. */
+export function secondsUntil(iso: string | undefined, fallbackSeconds = 3600): number {
+  if (!iso) return fallbackSeconds;
+  const ms = Date.parse(iso) - Date.now();
+  return Number.isFinite(ms) ? Math.max(0, Math.floor(ms / 1000)) : fallbackSeconds;
+}

package/src/signing-in-mark.ts

@@ -0,0 +1,23 @@
+/**
+ * The platform's mark as outlines, in the pixels of the 1015 × 967 brand
+ * image: the arch (gold head and arms, teal towards the left drop), the stem
+ * (teal head and drop) and the gloss highlights. Generated by
+ * `scripts/trace-mark.mjs` — regenerate it, never edit it.
+ */
+export const MARK = {
+  width: 1015,
+  height: 967,
+  arch: "M499 1C504 1 519 0 529 1C539 3 550 6 559 10C568 14 577 20 584 26C591 32 597 40 602 47C606 54 610 61 612 68C615 75 617 83 619 90C620 97 621 97 621 110C621 123 619 156 619 170C620 184 622 185 623 192C625 199 627 205 630 212C633 220 637 229 642 238C647 247 652 256 659 265C666 275 675 286 683 295C691 305 697 311 709 322C720 333 742 351 754 360C766 370 773 373 782 379C791 384 798 388 808 392C817 396 823 400 840 405C857 409 892 415 909 419C926 424 932 428 942 434C953 440 963 448 971 456C979 463 986 472 992 481C998 490 1002 500 1006 510C1009 519 1012 527 1013 537C1014 546 1014 557 1013 567C1012 576 1010 584 1007 592C1004 600 1000 608 995 615C989 622 982 630 975 636C967 642 960 646 952 649C944 653 935 655 927 656C918 657 910 657 901 656C892 655 881 652 872 648C863 645 856 642 849 636C842 631 834 624 828 618C821 611 816 604 811 597C807 590 808 597 801 578C793 559 776 505 767 483C759 461 758 461 750 445C741 429 727 405 716 388C706 371 699 361 686 344C672 326 651 299 636 284C621 268 610 258 597 249C585 240 571 233 561 229C551 224 544 222 536 221C528 219 522 218 515 218C508 217 501 218 494 219C487 220 479 222 472 224C465 226 459 229 452 232C446 235 443 236 433 243C423 251 405 265 391 279C377 292 364 308 351 323C338 339 323 357 313 372C303 386 299 391 289 409C279 426 267 448 255 476C244 504 227 554 218 575C208 597 205 596 198 605C192 614 183 621 176 627C169 634 162 638 155 641C147 645 138 649 131 651C123 654 118 655 111 655C104 656 95 656 89 655C82 654 76 653 69 651C62 648 56 645 49 641C43 637 36 632 31 627C26 621 22 618 18 610C13 602 7 587 4 579C1 570 1 566 1 560C0 554 -1 551 1 541C2 532 5 515 10 503C15 491 24 478 30 469C36 461 39 459 44 454C50 449 53 446 61 441C69 436 82 428 92 424C102 420 104 419 121 414C137 410 172 405 192 399C212 393 226 387 242 378C258 369 274 358 289 346C303 335 317 321 328 311C339 300 348 290 355 282C363 273 368 266 373 259C379 251 384 244 388 235C392 227 397 220 400 209C403 199 407 192 408 174C409 156 405 115 405 99C405 83 408 85 410 78C413 70 416 62 420 55C424 47 430 40 435 34C441 28 446 23 453 19C460 14 469 10 476 7C484 4 494 2 498 1C501 0 493 1 499 1Z",
+  stem: "M501 336C506 336 522 335 531 337C541 339 552 345 559 349C566 352 567 354 571 358C575 361 577 363 581 369C585 375 592 387 595 396C598 404 599 412 598 421C598 430 595 441 593 448C590 455 591 454 585 464C578 474 562 496 555 509C548 521 546 529 543 540C540 552 539 565 539 575C538 586 538 593 540 604C541 614 543 627 546 637C549 648 554 658 559 668C563 677 566 682 575 694C584 705 602 726 611 739C620 752 623 760 628 770C633 781 636 792 639 801C641 810 642 818 642 826C643 834 642 842 641 850C640 857 639 864 637 871C634 878 632 886 628 893C624 901 619 908 613 915C608 922 602 928 596 933C590 939 584 943 577 947C571 951 563 954 556 957C548 960 541 962 532 964C524 965 512 966 503 966C494 965 487 964 479 962C471 960 462 957 454 953C445 948 436 942 429 936C421 930 416 924 410 917C405 910 399 903 395 894C391 886 387 877 385 868C382 859 380 850 379 839C379 828 379 816 381 804C383 793 387 780 392 769C397 758 401 750 410 737C420 724 439 702 448 690C457 679 458 677 462 669C467 660 472 650 475 640C478 629 481 619 482 608C484 596 485 584 484 571C483 559 481 545 478 534C475 523 473 517 467 506C460 494 446 475 440 465C434 456 434 455 432 449C430 442 427 434 427 426C426 418 427 408 429 399C431 391 435 383 439 376C444 369 449 363 455 358C461 352 471 346 478 343C486 339 496 337 500 336C503 335 495 336 501 336Z",
+  gloss: [
+    "M492 14C493 14 495 14 497 14C498 14 499 14 500 16C500 17 501 20 500 22C500 23 502 23 499 25C497 26 491 30 486 32C481 34 473 38 469 39C465 39 464 38 463 38C461 37 460 35 459 34C458 33 458 33 459 32C459 31 460 29 461 28C462 26 463 25 465 24C468 22 471 20 475 19C479 17 488 15 491 14C493 13 490 14 492 14Z",
+    "M451 43C451 43 453 42 455 43C456 43 458 45 459 46C460 48 461 49 461 50C461 52 463 50 460 54C458 58 449 67 445 74C441 81 436 91 434 95C431 99 430 98 429 98C428 99 426 99 425 98C424 98 424 97 423 96C423 94 422 92 422 90C422 88 420 92 423 85C427 78 439 54 443 47C448 40 449 44 450 43C451 43 450 43 451 43Z",
+    "M599 80C599 80 601 80 602 82C603 84 604 85 605 92C606 98 607 117 607 122C607 127 606 123 606 123C605 122 605 127 604 120C603 113 600 87 599 80C598 73 598 79 599 80Z",
+    "M421 161C421 161 422 160 423 162C423 163 425 164 424 169C424 174 422 185 419 194C417 202 412 212 409 219C406 227 402 232 399 236C395 241 389 248 389 246C389 245 397 235 400 228C403 222 407 215 409 208C412 201 414 195 416 187C417 179 420 166 421 162C421 158 421 162 421 161Z",
+    "M305 343C305 343 306 343 306 344C306 344 308 342 304 346C301 349 291 359 284 366C277 372 265 382 260 386C256 390 257 388 256 389C254 389 255 387 253 388C251 388 246 389 244 390C243 391 245 391 243 393C240 394 234 396 231 398C228 399 229 401 227 401C225 402 217 401 218 400C218 399 224 399 230 395C236 392 243 387 254 380C266 373 289 357 297 351C305 345 303 345 304 344C305 342 304 343 305 343Z",
+    "M810 411C810 411 811 410 812 410C813 410 812 410 817 411C822 413 832 418 842 421C853 424 872 428 879 430C886 433 882 432 883 433C884 435 885 438 885 439C885 441 884 442 882 443C881 443 883 444 876 443C869 441 849 436 841 434C833 431 833 431 829 429C825 427 818 423 816 421C813 419 814 419 813 418C812 416 810 413 810 412C809 411 810 412 810 411Z",
+    "M76 450C76 450 78 450 79 450C80 450 81 450 81 451C82 452 82 454 82 455C82 456 84 456 81 459C79 461 70 466 66 470C61 474 58 478 54 482C51 486 47 491 44 497C41 502 37 510 35 514C33 518 32 518 31 519C30 520 30 519 29 519C28 519 27 519 27 518C26 516 25 514 26 510C26 506 29 500 31 496C33 491 34 490 37 485C41 480 48 471 53 466C58 461 62 458 66 456C70 453 73 451 75 450C76 449 75 450 76 450Z",
+    "M962 473C962 473 963 473 964 473C965 474 966 473 969 477C972 480 979 489 982 495C985 500 987 506 988 509C989 511 988 511 988 512C988 512 987 513 987 513C986 513 984 514 983 514C982 514 984 518 980 513C977 508 965 490 962 485C958 479 959 482 959 480C959 478 961 475 961 473C961 472 961 473 962 473Z",
+    "M435 732C436 732 437 732 436 734C436 735 437 734 432 742C427 750 412 776 408 783C403 789 406 782 407 781C407 780 406 779 408 775C409 771 415 759 417 755C420 750 419 751 422 748C425 744 433 735 435 732C437 730 435 732 435 732Z",
+  ],
+} as const;