@endora-commerce/mod-mfa 0.100.0

package/dist/backend/routes.admin.d.ts

@@ -0,0 +1,23 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { MfaEnrolmentService } from './services/mfa-enrolment-service.js';
+import type { MfaOrgPolicyService } from './services/mfa-org-policy-service.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+/**
+ * Admin MFA management endpoints (feature 042). 2FA reset is a Platform-Admin
+ * capability (`mfa:reset`, US6); per-organization enforcement is `mfa:manage`
+ * (US3). Every mutation is audited.
+ */
+export interface MfaAdminDeps {
+    enrolmentService: MfaEnrolmentService;
+    orgPolicyService: MfaOrgPolicyService;
+    auditLogService: AuditPort;
+    requireAdmin: RequireAdminFactory;
+    resolveAdminActor: (req: FastifyRequest) => {
+        adminUserId: string;
+    };
+    /** Lists the customer-account ids belonging to an organization (US6 bulk). */
+    resolveOrganizationCustomerIds: (organizationId: string) => Promise<string[]>;
+}
+export declare function registerMfaAdminRoutes(app: FastifyInstance, deps: MfaAdminDeps): Promise<void>;
+//# sourceMappingURL=routes.admin.d.ts.map

package/dist/backend/routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.d.ts","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAQ/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,eAAe,EAAE,SAAS,CAAC;IAC3B,YAAY,EAAE,mBAAmB,CAAC;IAClC,iBAAiB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,8EAA8E;IAC9E,8BAA8B,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC/E;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC,CAyGf"}

package/dist/backend/routes.admin.js

@@ -0,0 +1,93 @@
+import { ERROR_CODES, mfaResetBulkRequestSchema, mfaOrgPolicyRequestSchema, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { isOrgInScope } from '@endora-commerce/platform/tenancy';
+export async function registerMfaAdminRoutes(app, deps) {
+    const { enrolmentService, auditLogService, requireAdmin, resolveAdminActor } = deps;
+    // Single-account reset (FR-025).
+    app.post('/api/v1/admin/customers/:customerId/mfa/reset', { preHandler: requireAdmin('mfa:reset') }, async (request) => {
+        const { customerId } = request.params;
+        const affected = await enrolmentService.reset({
+            subjectType: 'customer',
+            subjectId: customerId,
+        });
+        await auditLogService.record({
+            actorAdminUserId: resolveAdminActor(request).adminUserId,
+            action: 'mfa.reset',
+            objectType: 'customer_account',
+            objectId: customerId,
+            stateAfter: { affected },
+            ...(request.ip ? { ipAddress: request.ip } : {}),
+        });
+        return { data: { affected } };
+    });
+    // Bulk reset by explicit ids or by organization (FR-026/028).
+    app.post('/api/v1/admin/mfa/reset-bulk', { preHandler: requireAdmin('mfa:reset'), schema: { body: mfaResetBulkRequestSchema } }, async (request) => {
+        const body = mfaResetBulkRequestSchema.parse(request.body);
+        const actorAdminUserId = resolveAdminActor(request).adminUserId;
+        const customerIds = 'customerIds' in body
+            ? body.customerIds
+            : await deps.resolveOrganizationCustomerIds(body.organizationId);
+        let affected = 0;
+        for (const customerId of customerIds) {
+            const did = await enrolmentService.reset({
+                subjectType: 'customer',
+                subjectId: customerId,
+            });
+            if (did) {
+                affected += 1;
+                await auditLogService.record({
+                    actorAdminUserId,
+                    action: 'mfa.reset',
+                    objectType: 'customer_account',
+                    objectId: customerId,
+                    ...(request.ip ? { ipAddress: request.ip } : {}),
+                });
+            }
+        }
+        const requested = customerIds.length;
+        await auditLogService.record({
+            actorAdminUserId,
+            action: 'mfa.reset_bulk',
+            objectType: 'customer_account',
+            objectId: 'organizationId' in body ? body.organizationId : 'selection',
+            stateAfter: { requested, affected, skipped: requested - affected },
+            ...(request.ip ? { ipAddress: request.ip } : {}),
+        });
+        return { data: { requested, affected, skipped: requested - affected } };
+    });
+    // Per-organization enforcement (FR-014, US3).
+    app.post('/api/v1/admin/organizations/:organizationId/mfa-policy', { preHandler: requireAdmin('mfa:manage'), schema: { body: mfaOrgPolicyRequestSchema } }, async (request) => {
+        const body = mfaOrgPolicyRequestSchema.parse(request.body);
+        const { organizationId } = request.params;
+        // D-260/B — the organization id arrives from the caller and selects whose
+        // 2FA enforcement is written, so no column filter reaches it:
+        // `MfaOrganizationPolicy` is `@GlobalEntity()` and correctly so (D-259
+        // category 2 — the row *is* the per-organization rule, keyed by an id it
+        // does not own). A `sales_representative` holding `mfa:manage` therefore
+        // forced and lifted TOTP for an organization it was never assigned;
+        // measured at 200 on both.
+        //
+        // 404 rather than 403 because the id **addresses the resource** — it is
+        // the path parameter and the row's own key — which is FR-008's
+        // indistinguishable answer, modelled on `credit_limits/routes.ts:135-141`.
+        // This is not the `mode: 'all'` arm of D-260's criterion: that arm is for
+        // a write that changes the *actor's* own authority, and this one changes
+        // an organization's login policy while leaving `allowedOrganizationIds`
+        // untouched. A scoped admin keeps the capability for its own assignments.
+        if (!isOrgInScope(organizationId)) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Organization not found.');
+        }
+        const actor = resolveAdminActor(request).adminUserId;
+        const res = await deps.orgPolicyService.setEnforcement(organizationId, body.enforceTotp, actor);
+        await auditLogService.record({
+            actorAdminUserId: actor,
+            action: 'mfa.org_enforced',
+            objectType: 'organization',
+            objectId: organizationId,
+            stateAfter: { enforceTotp: body.enforceTotp },
+            ...(request.ip ? { ipAddress: request.ip } : {}),
+        });
+        return { data: res };
+    });
+}
+//# sourceMappingURL=routes.admin.js.map

package/dist/backend/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAqBjE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAoB,EACpB,IAAkB;IAElB,MAAM,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAEpF,iCAAiC;IACjC,GAAG,CAAC,IAAI,CACN,+CAA+C,EAC/C,EAAE,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,EAAE,EACzC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC;YAC5C,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,UAAU;SACtB,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,MAAM,CAAC;YAC3B,gBAAgB,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,WAAW;YACxD,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,kBAAkB;YAC9B,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,EAAE,QAAQ,EAAE;YACxB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;IAChC,CAAC,CACF,CAAC;IAEF,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CACN,8BAA8B,EAC9B,EAAE,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,EACtF,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC;QAChE,MAAM,WAAW,GACf,aAAa,IAAI,IAAI;YACnB,CAAC,CAAC,IAAI,CAAC,WAAW;YAClB,CAAC,CAAC,MAAM,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAErE,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC;gBACvC,WAAW,EAAE,UAAU;gBACvB,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;YACH,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,IAAI,CAAC,CAAC;gBACd,MAAM,eAAe,CAAC,MAAM,CAAC;oBAC3B,gBAAgB;oBAChB,MAAM,EAAE,WAAW;oBACnB,UAAU,EAAE,kBAAkB;oBAC9B,QAAQ,EAAE,UAAU;oBACpB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC;QACrC,MAAM,eAAe,CAAC,MAAM,CAAC;YAC3B,gBAAgB;YAChB,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,kBAAkB;YAC9B,QAAQ,EAAE,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW;YACtE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,EAAE;YAClE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,EAAE,EAAE,CAAC;IAC1E,CAAC,CACF,CAAC;IAEF,8CAA8C;IAC9C,GAAG,CAAC,IAAI,CACN,wDAAwD,EACxD,EAAE,UAAU,EAAE,YAAY,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,EACvF,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC1C,0EAA0E;QAC1E,8DAA8D;QAC9D,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,2BAA2B;QAC3B,EAAE;QACF,wEAAwE;QACxE,+DAA+D;QAC/D,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAChG,MAAM,eAAe,CAAC,MAAM,CAAC;YAC3B,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,cAAc;YACxB,UAAU,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC7C,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACvB,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/backend/routes.oauth.d.ts

@@ -0,0 +1,26 @@
+import type { FastifyInstance } from 'fastify';
+import type { AuthSessionPort } from '@endora-commerce/contracts';
+import type { ChallengeStore } from './services/challenge-store.js';
+import type { MfaPolicyResolver } from './services/mfa-policy-resolver.js';
+import type { SocialIdentityService } from './services/social-identity-service.js';
+import type { OAuthProviderPort } from './services/oauth-provider-service.js';
+/**
+ * Federated sign-in routes (feature 042, US4 customer / US5 admin). Per surface
+ * + provider: a `start` endpoint that redirects to the IdP, and a `callback`
+ * that validates the transaction, exchanges the code, resolves the account, and
+ * issues a session. A social-authenticated session is granted directly — no
+ * additional TOTP step (R10).
+ */
+export interface MfaOAuthDeps {
+    oauthProvider: OAuthProviderPort;
+    challengeStore: ChallengeStore;
+    policyResolver: MfaPolicyResolver;
+    socialIdentityService: SocialIdentityService;
+    sessionService: AuthSessionPort;
+    /** Public base URL of the backend (for the provider redirect_uri). */
+    backendBaseUrl: string;
+    storefrontBaseUrl: string;
+    adminBaseUrl: string;
+}
+export declare function registerMfaOAuthRoutes(app: FastifyInstance, deps: MfaOAuthDeps): Promise<void>;
+//# sourceMappingURL=routes.oauth.d.ts.map

package/dist/backend/routes.oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.oauth.d.ts","sourceRoot":"","sources":["../../src/backend/routes.oauth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAG7D,OAAO,KAAK,EAAE,eAAe,EAAkC,MAAM,4BAA4B,CAAC;AAElG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,EAAE,iBAAiB,CAAC;IAClC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,cAAc,EAAE,eAAe,CAAC;IAChC,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAID,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/backend/routes.oauth.js

@@ -0,0 +1,155 @@
+import { randomBytes } from 'crypto';
+import { SESSION_COOKIE_NAME, ADMIN_SESSION_COOKIE_NAME } from '@endora-commerce/contracts';
+import { currentSalesChannel } from '@endora-commerce/platform/kernel';
+export async function registerMfaOAuthRoutes(app, deps) {
+    for (const surface of ['customer', 'admin']) {
+        registerProviders(app, deps, surface);
+        registerStart(app, deps, surface);
+        registerCallback(app, deps, surface);
+    }
+}
+function frontendBase(deps, surface) {
+    return surface === 'customer' ? deps.storefrontBaseUrl : deps.adminBaseUrl;
+}
+function parseProvider(value) {
+    return value === 'google' || value === 'microsoft' ? value : null;
+}
+function sanitiseNext(input) {
+    if (!input || !input.startsWith('/') || input.startsWith('//'))
+        return '/account';
+    return input;
+}
+function loginRedirect(deps, surface, message) {
+    const base = frontendBase(deps, surface);
+    return `${base}/login?error=${encodeURIComponent(message)}`;
+}
+/**
+ * The providers a login screen may actually offer, for this surface and — for
+ * the customer surface — this sales channel.
+ *
+ * **Pre-auth and public, deliberately.** The login screens are the callers, so
+ * there is no actor to gate on; and the answer is exactly what the buttons
+ * themselves announce, so it reveals nothing a visitor could not read off the
+ * page. It carries no client id, no redirect URI, and nothing per-account —
+ * asking it about a particular user is not possible, which is what keeps it
+ * from becoming a probe for whether an address has a federated identity.
+ *
+ * The body is the same conjunction `registerStart` applies below before it will
+ * redirect anywhere: the operator's setting for this surface and channel, AND
+ * the provider actually being configured. Publishing it stops the frontend from
+ * guessing at a decision this module already makes — it used to render both
+ * buttons unconditionally, which on a default deployment (both settings
+ * `false`) advertised two sign-in routes that could not work (#193).
+ *
+ * `mfa` owns it, so `ctx.routes` gates it like everything else the module owns:
+ * with the module off it answers 503 `MODULE_DISABLED`, and both frontends fail
+ * closed on that — no module, no buttons.
+ */
+function registerProviders(app, deps, surface) {
+    app.get(`/api/v1/auth/${surface}/oauth/providers`, async (_request, reply) => {
+        const salesChannelId = surface === 'customer' ? (currentSalesChannel()?.id ?? null) : null;
+        const policy = await deps.policyResolver.resolve({ subjectType: surface, subjectId: '' }, { salesChannelId });
+        const providers = ['google', 'microsoft'].filter((provider) => {
+            const settingEnabled = provider === 'google' ? policy.googleEnabled : policy.microsoftEnabled;
+            return settingEnabled && deps.oauthProvider.isEnabled(provider);
+        });
+        const body = { providers };
+        return reply.send(body);
+    });
+}
+function registerStart(app, deps, surface) {
+    app.get(`/api/v1/auth/${surface}/oauth/:provider/start`, async (request, reply) => {
+        const provider = parseProvider(request.params.provider);
+        if (!provider)
+            return reply.redirect(loginRedirect(deps, surface, 'Unknown sign-in provider.'));
+        const salesChannelId = surface === 'customer' ? (currentSalesChannel()?.id ?? null) : null;
+        const policy = await deps.policyResolver.resolve({ subjectType: surface, subjectId: '' }, { salesChannelId });
+        const settingEnabled = provider === 'google' ? policy.googleEnabled : policy.microsoftEnabled;
+        if (!settingEnabled || !deps.oauthProvider.isEnabled(provider)) {
+            return reply.redirect(loginRedirect(deps, surface, 'Sign-in with this provider is not available.'));
+        }
+        const next = sanitiseNext(request.query.next);
+        const codeVerifier = randomBytes(32).toString('base64url');
+        const nonce = randomBytes(16).toString('base64url');
+        const state = await deps.challengeStore.issueOAuthTransaction({
+            surface,
+            provider,
+            salesChannelId,
+            pkceVerifier: codeVerifier,
+            nonce,
+            next,
+        });
+        const redirectUri = `${deps.backendBaseUrl}/api/v1/auth/${surface}/oauth/${provider}/callback`;
+        const url = await deps.oauthProvider.buildAuthorizationUrl(provider, {
+            state,
+            codeVerifier,
+            nonce,
+            redirectUri,
+        });
+        return reply.redirect(url);
+    });
+}
+function registerCallback(app, deps, surface) {
+    app.get(`/api/v1/auth/${surface}/oauth/:provider/callback`, async (request, reply) => {
+        const provider = parseProvider(request.params.provider);
+        const { code, state, error } = request.query;
+        if (!provider || error || !code || !state) {
+            return reply.redirect(loginRedirect(deps, surface, 'Sign-in was cancelled or failed.'));
+        }
+        const tx = await deps.challengeStore.getOAuthTransaction(state);
+        if (!tx || tx.surface !== surface || tx.provider !== provider) {
+            return reply.redirect(loginRedirect(deps, surface, 'This sign-in attempt has expired.'));
+        }
+        await deps.challengeStore.consumeOAuthTransaction(state);
+        const redirectUri = `${deps.backendBaseUrl}/api/v1/auth/${surface}/oauth/${provider}/callback`;
+        let identity;
+        try {
+            identity = await deps.oauthProvider.exchangeCode(provider, {
+                code,
+                state,
+                codeVerifier: tx.pkceVerifier,
+                nonce: tx.nonce,
+                redirectUri,
+            });
+        }
+        catch {
+            return reply.redirect(loginRedirect(deps, surface, 'Sign-in failed. Please try again.'));
+        }
+        const result = surface === 'customer'
+            ? await deps.socialIdentityService.signInCustomer(identity)
+            : await deps.socialIdentityService.signInAdmin(identity);
+        if (!result.ok) {
+            const message = result.reason === 'unverified'
+                ? 'Your provider email is not verified.'
+                : result.reason === 'no_account'
+                    ? 'No account matches this provider. Please contact an administrator.'
+                    : 'No account found. Please create an account first.';
+            return reply.redirect(loginRedirect(deps, surface, message));
+        }
+        const session = await deps.sessionService.createSession(surface === 'customer'
+            ? { kind: 'customer', customerAccountId: result.subjectId, ...ipUa(request) }
+            : { kind: 'admin', adminUserId: result.subjectId, ...ipUa(request) });
+        setSessionCookie(reply, surface === 'customer' ? SESSION_COOKIE_NAME : ADMIN_SESSION_COOKIE_NAME, session.cookieValue, session.expiresAt);
+        const dest = surface === 'customer' ? `${deps.storefrontBaseUrl}${sanitiseNext(tx.next)}` : `${deps.adminBaseUrl}/`;
+        return reply.redirect(dest);
+    });
+}
+function ipUa(request) {
+    return {
+        ...(request.ip ? { ipAddress: request.ip } : {}),
+        ...(typeof request.headers['user-agent'] === 'string'
+            ? { userAgent: request.headers['user-agent'] }
+            : {}),
+    };
+}
+function setSessionCookie(reply, cookieName, value, expiresAt) {
+    reply.setCookie(cookieName, value, {
+        path: '/',
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: process.env['NODE_ENV'] === 'production',
+        expires: expiresAt,
+        signed: false,
+    });
+}
+//# sourceMappingURL=routes.oauth.js.map

package/dist/backend/routes.oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.oauth.js","sourceRoot":"","sources":["../../src/backend/routes.oauth.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAE5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AA8BvE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAoB,EACpB,IAAkB;IAElB,KAAK,MAAM,OAAO,IAAI,CAAC,UAAU,EAAE,OAAO,CAAU,EAAE,CAAC;QACrD,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAClC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAkB,EAAE,OAAgB;IACxD,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;AAC7E,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC7C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAkB,EAAE,OAAgB,EAAE,OAAe;IAC1E,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,GAAG,IAAI,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,iBAAiB,CAAC,GAAoB,EAAE,IAAkB,EAAE,OAAgB;IACnF,GAAG,CAAC,GAAG,CAAC,gBAAgB,OAAO,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC3E,MAAM,cAAc,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC9C,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,EACvC,EAAE,cAAc,EAAE,CACnB,CAAC;QACF,MAAM,SAAS,GAAI,CAAC,QAAQ,EAAE,WAAW,CAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;YACvE,MAAM,cAAc,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC9F,OAAO,cAAc,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAmC,EAAE,SAAS,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,GAAoB,EAAE,IAAkB,EAAE,OAAgB;IAC/E,GAAG,CAAC,GAAG,CACL,gBAAgB,OAAO,wBAAwB,EAC/C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC;QAEhG,MAAM,cAAc,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC9C,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,EACvC,EAAE,cAAc,EAAE,CACnB,CAAC;QACF,MAAM,cAAc,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC9F,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,OAAO,KAAK,CAAC,QAAQ,CACnB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,8CAA8C,CAAC,CAC7E,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC;YAC5D,OAAO;YACP,QAAQ;YACR,cAAc;YACd,YAAY,EAAE,YAAY;YAC1B,KAAK;YACL,IAAI;SACL,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,cAAc,gBAAgB,OAAO,UAAU,QAAQ,WAAW,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,QAAQ,EAAE;YACnE,KAAK;YACL,YAAY;YACZ,KAAK;YACL,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAoB,EAAE,IAAkB,EAAE,OAAgB;IAClF,GAAG,CAAC,GAAG,CAGJ,gBAAgB,OAAO,2BAA2B,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9E,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,kCAAkC,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,KAAK,OAAO,IAAI,EAAE,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,mCAAmC,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAEzD,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,cAAc,gBAAgB,OAAO,UAAU,QAAQ,WAAW,CAAC;QAC/F,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACzD,IAAI;gBACJ,KAAK;gBACL,YAAY,EAAE,EAAE,CAAC,YAAY;gBAC7B,KAAK,EAAE,EAAE,CAAC,KAAK;gBACf,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,mCAAmC,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,MAAM,GACV,OAAO,KAAK,UAAU;YACpB,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC3D,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,YAAY;gBAC5B,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY;oBAC9B,CAAC,CAAC,oEAAoE;oBACtE,CAAC,CAAC,mDAAmD,CAAC;YAC5D,OAAO,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACrD,OAAO,KAAK,UAAU;YACpB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;YAC7E,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CACvE,CAAC;QACF,gBAAgB,CACd,KAAK,EACL,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB,EACxE,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,SAAS,CAClB,CAAC;QACF,MAAM,IAAI,GACR,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,GAAG,CAAC;QACzG,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,OAA0D;IAItE,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,QAAQ;YACnD,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAW,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAmB,EACnB,UAAkB,EAClB,KAAa,EACb,SAAe;IAEf,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE;QACjC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QAChD,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/backend/routes.org.d.ts

@@ -0,0 +1,21 @@
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { MfaOrgPolicyService } from './services/mfa-org-policy-service.js';
+/**
+ * Storefront org-admin 2FA enforcement (feature 042, US3, FR-014). An
+ * Organization Administrator (customer role `organization_admin`) can require
+ * 2FA for their own organization's members. The guard + organization id are
+ * resolved by an injected port so the module stays decoupled.
+ */
+export interface MfaOrgRoutesDeps {
+    orgPolicyService: MfaOrgPolicyService;
+    auditLogService: AuditPort;
+    requireCustomer: (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    /** Resolves the caller's org and asserts they are an org admin (throws 403). */
+    resolveOrgAdmin: (req: FastifyRequest) => Promise<{
+        organizationId: string;
+        actor: string;
+    }>;
+}
+export declare function registerMfaOrgRoutes(app: FastifyInstance, deps: MfaOrgRoutesDeps): Promise<void>;
+//# sourceMappingURL=routes.org.d.ts.map

package/dist/backend/routes.org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.org.d.ts","sourceRoot":"","sources":["../../src/backend/routes.org.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,eAAe,EAAE,SAAS,CAAC;IAC3B,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,gFAAgF;IAChF,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9F;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/backend/routes.org.js

@@ -0,0 +1,17 @@
+import { mfaOrgPolicyRequestSchema } from '@endora-commerce/contracts';
+export async function registerMfaOrgRoutes(app, deps) {
+    app.put('/api/v1/account/organization/mfa-policy', { preHandler: deps.requireCustomer, schema: { body: mfaOrgPolicyRequestSchema } }, async (request) => {
+        const body = mfaOrgPolicyRequestSchema.parse(request.body);
+        const { organizationId, actor } = await deps.resolveOrgAdmin(request);
+        const res = await deps.orgPolicyService.setEnforcement(organizationId, body.enforceTotp, actor);
+        await deps.auditLogService.record({
+            action: 'mfa.org_enforced',
+            objectType: 'organization',
+            objectId: organizationId,
+            stateAfter: { enforceTotp: body.enforceTotp },
+            ...(request.ip ? { ipAddress: request.ip } : {}),
+        });
+        return { data: res };
+    });
+}
+//# sourceMappingURL=routes.org.js.map

package/dist/backend/routes.org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.org.js","sourceRoot":"","sources":["../../src/backend/routes.org.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAkBvE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAoB,EACpB,IAAsB;IAEtB,GAAG,CAAC,GAAG,CACL,yCAAyC,EACzC,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,EACjF,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAChG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAChC,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,cAAc;YACxB,UAAU,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC7C,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACvB,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/backend/routes.public.d.ts

@@ -0,0 +1,21 @@
+import type { FastifyInstance } from 'fastify';
+import type { AuthSessionPort } from '@endora-commerce/contracts';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { MfaLoginService } from './services/mfa-login-service.js';
+import type { ChallengeStore } from './services/challenge-store.js';
+import type { MfaEnrolmentService } from './services/mfa-enrolment-service.js';
+/**
+ * Public MFA endpoints (feature 042). Per surface (customer US1 / admin US2):
+ * the second-step verify, and the enforced-but-unenrolled setup-ticket flow
+ * (US3). They differ only in the expected subject surface, session kind, and
+ * cookie name.
+ */
+export interface MfaPublicDeps {
+    loginService: MfaLoginService;
+    sessionService: AuthSessionPort;
+    challengeStore: ChallengeStore;
+    enrolmentService: MfaEnrolmentService;
+    auditLogService: AuditPort;
+}
+export declare function registerMfaPublicRoutes(app: FastifyInstance, deps: MfaPublicDeps): Promise<void>;
+//# sourceMappingURL=routes.public.d.ts.map

package/dist/backend/routes.public.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.d.ts","sourceRoot":"","sources":["../../src/backend/routes.public.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAQ7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,eAAe,CAAC;IAC9B,cAAc,EAAE,eAAe,CAAC;IAChC,cAAc,EAAE,cAAc,CAAC;IAC/B,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,eAAe,EAAE,SAAS,CAAC;CAC5B;AA2BD,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/backend/routes.public.js

@@ -0,0 +1,118 @@
+import { mfaVerifyRequestSchema, mfaSetupTicketBeginSchema, mfaSetupTicketCompleteSchema, SESSION_COOKIE_NAME, ADMIN_SESSION_COOKIE_NAME, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+const SURFACES = [
+    {
+        subjectType: 'customer',
+        cookieName: SESSION_COOKIE_NAME,
+        verifyPath: '/api/v1/auth/customer/mfa/verify',
+        setupBeginPath: '/api/v1/auth/customer/mfa/setup-ticket/begin',
+        setupCompletePath: '/api/v1/auth/customer/mfa/setup-ticket/complete',
+    },
+    {
+        subjectType: 'admin',
+        cookieName: ADMIN_SESSION_COOKIE_NAME,
+        verifyPath: '/api/v1/auth/admin/mfa/verify',
+        setupBeginPath: '/api/v1/auth/admin/mfa/setup-ticket/begin',
+        setupCompletePath: '/api/v1/auth/admin/mfa/setup-ticket/complete',
+    },
+];
+export async function registerMfaPublicRoutes(app, deps) {
+    for (const cfg of SURFACES) {
+        registerVerifyRoute(app, deps, { path: cfg.verifyPath, subjectType: cfg.subjectType, cookieName: cfg.cookieName });
+        registerSetupTicketRoutes(app, deps, cfg);
+    }
+}
+/** Enforced-but-unenrolled flow: enrol using a setup ticket, then get a session. */
+function registerSetupTicketRoutes(app, deps, cfg) {
+    app.post(cfg.setupBeginPath, { schema: { body: mfaSetupTicketBeginSchema } }, async (request) => {
+        const body = mfaSetupTicketBeginSchema.parse(request.body);
+        const ticket = await resolveTicket(deps, body.setupTicket, cfg.subjectType);
+        return {
+            data: await deps.enrolmentService.setup({ subjectType: cfg.subjectType, subjectId: ticket.subjectId }, ticket.subjectId),
+        };
+    });
+    app.post(cfg.setupCompletePath, { schema: { body: mfaSetupTicketCompleteSchema } }, async (request, reply) => {
+        const body = mfaSetupTicketCompleteSchema.parse(request.body);
+        const ticket = await resolveTicket(deps, body.setupTicket, cfg.subjectType);
+        const subject = { subjectType: cfg.subjectType, subjectId: ticket.subjectId };
+        const { recoveryCodes } = await deps.enrolmentService.activate(subject, body.code);
+        await deps.challengeStore.consumeSetupTicket(body.setupTicket);
+        const session = await deps.sessionService.createSession(cfg.subjectType === 'customer'
+            ? { kind: 'customer', customerAccountId: ticket.subjectId, ...ipUa(request) }
+            : { kind: 'admin', adminUserId: ticket.subjectId, ...ipUa(request) });
+        setSessionCookie(reply, cfg.cookieName, session.cookieValue, session.expiresAt);
+        return { data: { status: 'authenticated', recoveryCodes } };
+    });
+}
+async function resolveTicket(deps, setupTicket, subjectType) {
+    const ticket = await deps.challengeStore.getSetupTicket(setupTicket);
+    if (!ticket || ticket.subjectType !== subjectType) {
+        throw new HttpError(400, 'MFA_INVALID_CHALLENGE', 'This setup session has expired. Please sign in again.');
+    }
+    return { subjectId: ticket.subjectId };
+}
+function registerVerifyRoute(app, deps, cfg) {
+    app.post(cfg.path, { schema: { body: mfaVerifyRequestSchema } }, async (request, reply) => {
+        const body = mfaVerifyRequestSchema.parse(request.body);
+        const objectType = cfg.subjectType === 'customer' ? 'customer_account' : 'admin_user';
+        const result = await deps.loginService.verifyChallenge(body.challengeId, body.code);
+        if (!result.ok) {
+            if (result.error === 'invalid_challenge') {
+                throw new HttpError(400, 'MFA_INVALID_CHALLENGE', 'This login attempt has expired. Please sign in again.');
+            }
+            if (result.error === 'locked') {
+                await deps.auditLogService.record({
+                    action: 'mfa.second_step_locked',
+                    objectType,
+                    objectId: result.subject.subjectId,
+                    ...(request.ip ? { ipAddress: request.ip } : {}),
+                });
+                throw new HttpError(429, 'MFA_TOO_MANY_ATTEMPTS', 'Too many incorrect codes. Please sign in again.');
+            }
+            throw new HttpError(401, 'MFA_INVALID_CODE', 'The code is invalid or expired.');
+        }
+        if (result.subject.subjectType !== cfg.subjectType) {
+            throw new HttpError(400, 'MFA_WRONG_SURFACE', 'This challenge is not valid here.');
+        }
+        if (result.factor === 'recovery') {
+            await deps.auditLogService.record({
+                action: 'mfa.recovery_code_used',
+                objectType,
+                objectId: result.subject.subjectId,
+                ...(request.ip ? { ipAddress: request.ip } : {}),
+            });
+        }
+        const session = await deps.sessionService.createSession(cfg.subjectType === 'customer'
+            ? {
+                kind: 'customer',
+                customerAccountId: result.subject.subjectId,
+                ...ipUa(request),
+            }
+            : {
+                kind: 'admin',
+                adminUserId: result.subject.subjectId,
+                ...ipUa(request),
+            });
+        setSessionCookie(reply, cfg.cookieName, session.cookieValue, session.expiresAt);
+        return { data: { status: 'authenticated' } };
+    });
+}
+function ipUa(request) {
+    return {
+        ...(request.ip ? { ipAddress: request.ip } : {}),
+        ...(typeof request.headers['user-agent'] === 'string'
+            ? { userAgent: request.headers['user-agent'] }
+            : {}),
+    };
+}
+function setSessionCookie(reply, cookieName, value, expiresAt) {
+    reply.setCookie(cookieName, value, {
+        path: '/',
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: process.env['NODE_ENV'] === 'production',
+        expires: expiresAt,
+        signed: false,
+    });
+}
+//# sourceMappingURL=routes.public.js.map

package/dist/backend/routes.public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.js","sourceRoot":"","sources":["../../src/backend/routes.public.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AA4B3D,MAAM,QAAQ,GAAiB;IAC7B;QACE,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,mBAAmB;QAC/B,UAAU,EAAE,kCAAkC;QAC9C,cAAc,EAAE,8CAA8C;QAC9D,iBAAiB,EAAE,iDAAiD;KACrE;IACD;QACE,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,yBAAyB;QACrC,UAAU,EAAE,+BAA+B;QAC3C,cAAc,EAAE,2CAA2C;QAC3D,iBAAiB,EAAE,8CAA8C;KAClE;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAoB,EACpB,IAAmB;IAEnB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,mBAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACnH,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,yBAAyB,CAChC,GAAoB,EACpB,IAAmB,EACnB,GAAe;IAEf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9F,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5E,OAAO;YACL,IAAI,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CACrC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAC7D,MAAM,CAAC,SAAS,CACjB;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,GAAG,CAAC,iBAAiB,EACrB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,EAAE,EAClD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAW,CAAC;QACvF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACrD,GAAG,CAAC,WAAW,KAAK,UAAU;YAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;YAC7E,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CACvE,CAAC;QACF,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,CAAC;IAC9D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAmB,EACnB,WAAmB,EACnB,WAAiC;IAEjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,uDAAuD,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAoB,EACpB,IAAmB,EACnB,GAA4E;IAE5E,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACxF,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC;QACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;gBACzC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,uDAAuD,CAAC,CAAC;YAC7G,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;oBAChC,MAAM,EAAE,wBAAwB;oBAChC,UAAU;oBACV,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;oBAClC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjD,CAAC,CAAC;gBACH,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,iDAAiD,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,wBAAwB;gBAChC,UAAU;gBACV,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;gBAClC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACrD,GAAG,CAAC,WAAW,KAAK,UAAU;YAC5B,CAAC,CAAC;gBACE,IAAI,EAAE,UAAU;gBAChB,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;gBAC3C,GAAG,IAAI,CAAC,OAAO,CAAC;aACjB;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;gBACrC,GAAG,IAAI,CAAC,OAAO,CAAC;aACjB,CACN,CAAC;QACF,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,OAGb;IACC,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,QAAQ;YACnD,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAW,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAmB,EACnB,UAAkB,EAClB,KAAa,EACb,SAAe;IAEf,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE;QACjC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QAChD,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/backend/routes.self-service.d.ts

@@ -0,0 +1,34 @@
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { MfaEnrolmentService } from './services/mfa-enrolment-service.js';
+import type { MfaPolicyResolver } from './services/mfa-policy-resolver.js';
+import type { SocialLinkService } from './services/social-link-service.js';
+/**
+ * Surface-agnostic self-service 2FA endpoints (feature 042). Mounted twice by
+ * the plugin: once for storefront customers (`/api/v1/account/mfa/*`, US1) and
+ * once for admin users (`/api/v1/admin/account/mfa/*`, US2). The only
+ * differences are the path prefix, the auth guard, how the subject id is
+ * resolved, and the audit `objectType`.
+ */
+export interface MfaSelfServiceOptions {
+    pathPrefix: string;
+    subjectType: 'customer' | 'admin';
+    auditObjectType: 'customer_account' | 'admin_user';
+    requireGuard: (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    resolveSubjectId: (req: FastifyRequest) => string;
+    resolveOrganizationId?: (req: FastifyRequest) => string | null;
+    enrolmentService: MfaEnrolmentService;
+    policyResolver: MfaPolicyResolver;
+    socialLinkService: SocialLinkService;
+    auditLogService: AuditPort;
+    /**
+     * `specs/110-instance-repository/` T118c — required, both of them. `mfa`
+     * resolves each from its owner's published port rather than taking whatever a
+     * composition root happened to contribute, and while they were optional the
+     * two roots disagreed: production answered both, the test harness neither.
+     */
+    resolveAccountEmail: (subjectType: 'customer' | 'admin', subjectId: string) => Promise<string | null>;
+    verifyAccountPassword: (subjectType: 'customer' | 'admin', subjectId: string, password: string) => Promise<boolean>;
+}
+export declare function registerMfaSelfServiceRoutes(app: FastifyInstance, opts: MfaSelfServiceOptions): Promise<void>;
+//# sourceMappingURL=routes.self-service.d.ts.map

package/dist/backend/routes.self-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.self-service.d.ts","sourceRoot":"","sources":["../../src/backend/routes.self-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAS7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,UAAU,GAAG,OAAO,CAAC;IAClC,eAAe,EAAE,kBAAkB,GAAG,YAAY,CAAC;IACnD,YAAY,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,gBAAgB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC;IAClD,qBAAqB,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,GAAG,IAAI,CAAC;IAC/D,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,cAAc,EAAE,iBAAiB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,eAAe,EAAE,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,mBAAmB,EAAE,CACnB,WAAW,EAAE,UAAU,GAAG,OAAO,EACjC,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5B,qBAAqB,EAAE,CACrB,WAAW,EAAE,UAAU,GAAG,OAAO,EACjC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC,CA6Hf"}