@isahaq/kosh-server 0.0.0-stage → 0.1.0

package/dist/auth/base.js

@@ -0,0 +1,192 @@
+/**
+ * The framework's `base` module (CLAUDE.md, Phase 1: users and companies): currencies, companies, users, and the
+ * private authentication models (credentials, sessions, per-company group assignments). Every Kosh application
+ * depends on it. Administrators (`base.admin`) need no grants (RFC 0003 §5.2).
+ */
+import { defineModule as defineKoshModule } from '@isahaq/kosh-modules-sdk';
+import { orm } from '../orm.js';
+import { LAST_ADMINISTRATOR, lastAdministratorRemoved } from './admins.js';
+const { defineGroup, defineModel, defineModule, f } = orm;
+const ResCurrency = defineModel('res.currency', {
+    access: { 'base.user': ['read'] },
+    fields: {
+        name: f.char({ required: true, size: 3, index: 'unique' }),
+        rounding: f.decimal({ scale: 6, required: true, default: '0.01' }),
+        decimalPlaces: f.integer({ default: 2 }),
+    },
+});
+const ResCompany = defineModel('res.company', {
+    access: { 'base.user': ['read'] },
+    fields: {
+        name: f.char({ required: true }),
+        currency: f.many2one('res.currency', { required: true }),
+    },
+});
+const readRows = async (env, model, ids, keys) => env.asSuperuser({ reason: 'check administrators' }, async (su) => {
+    const set = su.model(model).browse(ids);
+    return (await set.load(keys)).read(keys);
+});
+const ResUsers = defineModel('res.users', {
+    archivable: true, // `active`: deactivated users cannot sign in
+    access: { 'base.user': ['read'] },
+    constraints: {
+        // Archiving the last administrator is refused (users are archived, not deleted: see auth.user_group.user).
+        keepAdministrator: {
+            depends: ['active'],
+            check: (records) => lastAdministratorRemoved(records, async (env, ids) => (await readRows(env, 'res.users', ids, ['active'])).map((r) => ({
+                id: r['id'],
+                user: r['id'],
+                removed: r['active'] === false,
+            }))),
+            message: LAST_ADMINISTRATOR,
+        },
+    },
+    fields: {
+        login: f.char({ required: true, index: 'unique' }),
+        name: f.char({ required: true }),
+        email: f.char(),
+        company: f.many2one('res.company'),
+        companies: f.many2many('res.company'),
+        lang: f.char({ default: 'en_US' }),
+        tz: f.char({ default: 'UTC' }),
+    },
+});
+/** Password hash and TOTP state of a user. Private: never served by the generated API. */
+const AuthCredential = defineModel('auth.credential', {
+    fields: {
+        user: f.many2one('res.users', { required: true, ondelete: 'cascade', index: 'unique' }),
+        passwordHash: f.char(),
+        totpSecret: f.char(), // pending or active secret
+        totpEnabled: f.boolean({ default: false }),
+        recoveryCodes: f.json(), // SHA-256 digests of unused codes
+    },
+});
+/** A signed-in session; the token is stored only as a SHA-256 digest. Private. */
+const AuthSession = defineModel('auth.session', {
+    fields: {
+        tokenHash: f.char({ required: true, index: 'unique' }),
+        csrfHash: f.char({ required: true }),
+        user: f.many2one('res.users', { required: true, ondelete: 'cascade' }),
+        twoFactorVerified: f.boolean({ default: false }),
+        /** A second factor was entered in this session (sign-in or enrolment): administrator groups need it. */
+        secondFactor: f.boolean({ default: false }),
+        expiresAt: f.datetime({ required: true }),
+        lastSeenAt: f.datetime({ required: true }),
+        revoked: f.boolean({ default: false }),
+        ip: f.char(),
+        userAgent: f.char(),
+    },
+});
+/**
+ * A group or role a user holds in one company (or every company when `company` is empty). Private. Users holding
+ * any cannot be deleted (`restrict`): they are archived, which the "keep one administrator" guard checks.
+ */
+const AuthUserGroup = defineModel('auth.user_group', {
+    fields: {
+        user: f.many2one('res.users', { required: true, ondelete: 'restrict' }),
+        company: f.many2one('res.company', { ondelete: 'cascade' }),
+        group: f.char({ required: true }),
+    },
+});
+/**
+ * A special permission of one user (Shutro `grants`: a feature permission such as `account.backdate`, or
+ * `model:perm`), in one company or all, optionally until a date. Private: managed by the admin API.
+ */
+const AuthUserGrant = defineModel('auth.user_grant', {
+    fields: {
+        user: f.many2one('res.users', { required: true, ondelete: 'cascade' }),
+        company: f.many2one('res.company', { ondelete: 'cascade' }),
+        grant: f.char({ required: true }),
+        expiresAt: f.datetime(),
+        reason: f.char({ required: true }),
+    },
+});
+/**
+ * The security audit log (CLAUDE.md: logins, permission changes, exports, sensitive actions). Append-only: no one
+ * may change or delete events (administrators included: the REST API never serves it, and the admin API only reads).
+ */
+const AuditEvent = defineModel('audit.event', {
+    access: { 'base.user': ['create'] },
+    order: ['id desc'],
+    fields: {
+        kind: f.char({ required: true, index: true }),
+        actor: f.many2one('res.users', { ondelete: 'set null' }),
+        company: f.many2one('res.company', { ondelete: 'set null' }),
+        targetModel: f.char(),
+        targetId: f.integer(),
+        summary: f.char({ required: true }),
+        details: f.json(),
+        ip: f.char(),
+    },
+});
+/**
+ * Saved searches and favorites (RFC 0004 §5): a search state for a model and view type, private to its owner or
+ * shared with every user who can read the model. Governed by record rules, served by the generated API.
+ */
+const SavedView = defineModel('kosh.saved_view', {
+    access: { 'base.user': ['read', 'write', 'create', 'unlink'] },
+    rules: {
+        visible: {
+            groups: ['base.user'],
+            perms: ['read'],
+            domain: { or: [{ createdBy: { $env: 'uid' } }, { shared: true }] },
+        },
+        own: {
+            groups: ['base.user'],
+            perms: ['write', 'unlink'],
+            domain: { createdBy: { $env: 'uid' } },
+        },
+    },
+    order: ['name asc'],
+    fields: {
+        name: f.char({ required: true }),
+        targetModel: f.char({ required: true, index: true }),
+        viewType: f.char({ required: true, default: 'list' }),
+        /** The `@isahaq/kosh-search` state (facets, filters, group-by, order). */
+        state: f.json({ required: true }),
+        shared: f.boolean({ default: false }),
+        isDefault: f.boolean({ default: false }),
+    },
+});
+/** The Shutro module behind {@link base}. */
+export const baseShutro = defineModule({
+    name: 'base',
+    version: '0.1.0',
+    groups: [
+        defineGroup({ code: 'base.user', label: 'Internal user' }),
+        defineGroup({
+            code: 'base.admin',
+            label: 'Administrator',
+            implies: ['base.user'],
+            administrator: true,
+        }),
+    ],
+    models: [
+        ResCurrency,
+        ResCompany,
+        ResUsers,
+        AuthCredential,
+        AuthSession,
+        AuthUserGroup,
+        AuthUserGrant,
+        AuditEvent,
+        SavedView,
+    ],
+});
+/** The framework's base module: depend on it from every application module. */
+export const base = defineKoshModule({
+    shutro: baseShutro,
+    kosh: '^0.1.0',
+    accessLevels: {
+        user: { label: 'Internal user', groups: ['base.user'] },
+        admin: { label: 'Administrator', groups: ['base.admin'], implies: ['user'] },
+    },
+    privateModels: [
+        'auth.credential',
+        'auth.session',
+        'auth.user_group',
+        'auth.user_grant',
+        'audit.event',
+    ],
+});
+//# sourceMappingURL=base.js.map

package/dist/auth/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/auth/base.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5E,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE3E,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC;AAE1D,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,EAAE;IAC9C,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE;IACjC,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC1D,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAClE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;KACzC;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,EAAE;IAC5C,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE;IACjC,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACzD;CACF,CAAC,CAAC;AAGH,MAAM,QAAQ,GAAG,KAAK,EACpB,GAAQ,EACR,KAAa,EACb,GAAsB,EACtB,IAAc,EACE,EAAE,CAClB,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;IAC/D,MAAM,GAAG,GACP,EAAE,CAAC,KAAK,CAAC,KAAc,CAKxB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEL,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE;IACxC,UAAU,EAAE,IAAI,EAAE,6CAA6C;IAC/D,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE;IACjC,WAAW,EAAE;QACX,2GAA2G;QAC3G,iBAAiB,EAAE;YACjB,OAAO,EAAE,CAAC,QAAQ,CAAC;YACnB,KAAK,EAAE,CAAC,OAAc,EAAE,EAAE,CACxB,wBAAwB,CACtB,OAA+C,EAC/C,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CACjB,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9D,EAAE,EAAE,CAAC,CAAC,IAAI,CAAW;gBACrB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAW;gBACvB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK;aAC/B,CAAC,CAAC,CACN;YACH,OAAO,EAAE,kBAAkB;SAC5B;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE;QACf,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAClC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;KAC/B;CACF,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,cAAc,GAAG,WAAW,CAAC,iBAAiB,EAAE;IACpD,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACvF,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;QACtB,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,2BAA2B;QACjD,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC1C,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;KAC5D;CACF,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,EAAE;IAC9C,MAAM,EAAE;QACN,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACtE,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAChD,wGAAwG;QACxG,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3C,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACzC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACtC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;QACZ,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;KACpB;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,aAAa,GAAG,WAAW,CAAC,iBAAiB,EAAE;IACnD,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QACvE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC3D,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KAClC;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,aAAa,GAAG,WAAW,CAAC,iBAAiB,EAAE;IACnD,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACtE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC3D,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACnC;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,EAAE;IAC5C,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE;IACnC,KAAK,EAAE,CAAC,SAAS,CAAC;IAClB,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC7C,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QACxD,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QAC5D,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE;QACrB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;QACjB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;KACb;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,SAAS,GAAG,WAAW,CAAC,iBAAiB,EAAE;IAC/C,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;IAC9D,KAAK,EAAE;QACL,OAAO,EAAE;YACP,MAAM,EAAE,CAAC,WAAW,CAAC;YACrB,KAAK,EAAE,CAAC,MAAM,CAAC;YACf,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE;SACnE;QACD,GAAG,EAAE;YACH,MAAM,EAAE,CAAC,WAAW,CAAC;YACrB,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC1B,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;SACvC;KACF;IACD,KAAK,EAAE,CAAC,UAAU,CAAC;IACnB,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACpD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACrD,0EAA0E;QAC1E,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;KACzC;CACF,CAAC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,CAAC,MAAM,UAAU,GAAwC,YAAY,CAAC;IAC1E,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE;QACN,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAC1D,WAAW,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,CAAC,WAAW,CAAC;YACtB,aAAa,EAAE,IAAI;SACpB,CAAC;KACH;IACD,MAAM,EAAE;QACN,WAAW;QACX,UAAU;QACV,QAAQ;QACR,cAAc;QACd,WAAW;QACX,aAAa;QACb,aAAa;QACb,UAAU;QACV,SAAS;KACV;CACF,CAAC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,IAAI,GAAwC,gBAAgB,CAAC;IACxE,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,QAAQ;IACd,YAAY,EAAE;QACZ,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;QACvD,KAAK,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;KAC7E;IACD,aAAa,EAAE;QACb,iBAAiB;QACjB,cAAc;QACd,iBAAiB;QACjB,iBAAiB;QACjB,aAAa;KACd;CACF,CAAC,CAAC"}

package/dist/auth/crypto.d.ts

@@ -0,0 +1,20 @@
+/** `scrypt$N$r$p$salt$hash` (base64url); the parameters travel with the hash, so they can be raised later. */
+export declare function hashPassword(password: string): Promise<string>;
+/** Constant-time check of a password against a stored hash (false for malformed hashes). */
+export declare function verifyPassword(password: string, stored: string): Promise<boolean>;
+/** A random token (base64url). */
+export declare function randomToken(bytes?: number): string;
+/** SHA-256 of a token (hex), as stored for sessions and recovery codes. */
+export declare function digest(value: string): string;
+/** RFC 4648 base32 (no padding), as authenticator apps expect secrets. */
+export declare function base32Encode(bytes: Buffer): string;
+export declare function base32Decode(text: string): Buffer;
+/** A new TOTP secret (160 bits, base32). */
+export declare function newTotpSecret(): string;
+/** The TOTP code for `secret` at `time` (6 digits, 30 s steps, HMAC-SHA1: what authenticator apps use). */
+export declare function totp(secret: string, time?: number, digits?: number, stepSeconds?: number): string;
+/** True when `code` matches the current step or one step either side (clock drift). */
+export declare function verifyTotp(secret: string, code: string, time?: number): boolean;
+/** The `otpauth://` URI authenticator apps scan. */
+export declare function otpauthUri(secret: string, account: string, issuer?: string): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/auth/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAiCA,8GAA8G;AAC9G,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpE;AAED,4FAA4F;AAC5F,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAavF;AAED,kCAAkC;AAClC,wBAAgB,WAAW,CAAC,KAAK,SAAK,GAAG,MAAM,CAE9C;AAED,2EAA2E;AAC3E,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;AAMD,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAclD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBjD;AAED,4CAA4C;AAC5C,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,2GAA2G;AAC3G,wBAAgB,IAAI,CAClB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,MAAmB,EACzB,MAAM,SAAI,EACV,WAAW,SAAK,GACf,MAAM,CAQR;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAmB,GAAG,OAAO,CAO3F;AAED,oDAAoD;AACpD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,GAAG,MAAM,CAEnF"}

package/dist/auth/crypto.js

@@ -0,0 +1,100 @@
+/**
+ * Credentials without dependencies (node:crypto): scrypt password hashes, RFC 6238 TOTP for two-factor
+ * authentication, random tokens, and SHA-256 digests for values stored only as hashes (sessions, recovery codes).
+ */
+import { createHash, createHmac, randomBytes, scrypt as scryptCallback, timingSafeEqual, } from 'node:crypto';
+const SCRYPT = { N: 2 ** 15, r: 8, p: 1, keylen: 64, maxmem: 64 * 1024 * 1024 };
+function scrypt(password, salt, n, r, p, keylen) {
+    return new Promise((resolve, reject) => {
+        scryptCallback(password.normalize('NFKC'), salt, keylen, { N: n, r, p, maxmem: SCRYPT.maxmem }, (error, key) => (error === null ? resolve(key) : reject(error)));
+    });
+}
+/** `scrypt$N$r$p$salt$hash` (base64url); the parameters travel with the hash, so they can be raised later. */
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    const key = await scrypt(password, salt, SCRYPT.N, SCRYPT.r, SCRYPT.p, SCRYPT.keylen);
+    return `scrypt$${SCRYPT.N}$${SCRYPT.r}$${SCRYPT.p}$${salt.toString('base64url')}$${key.toString('base64url')}`;
+}
+/** Constant-time check of a password against a stored hash (false for malformed hashes). */
+export async function verifyPassword(password, stored) {
+    const [scheme, n, r, p, salt, hash] = stored.split('$');
+    if (scheme !== 'scrypt' || salt === undefined || hash === undefined)
+        return false;
+    const expected = Buffer.from(hash, 'base64url');
+    const key = await scrypt(password, Buffer.from(salt, 'base64url'), Number(n), Number(r), Number(p), expected.length);
+    return key.length === expected.length && timingSafeEqual(key, expected);
+}
+/** A random token (base64url). */
+export function randomToken(bytes = 32) {
+    return randomBytes(bytes).toString('base64url');
+}
+/** SHA-256 of a token (hex), as stored for sessions and recovery codes. */
+export function digest(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+// ------------------------------------------------------------------------------------------------- TOTP (RFC 6238)
+const BASE32 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+/** RFC 4648 base32 (no padding), as authenticator apps expect secrets. */
+export function base32Encode(bytes) {
+    let bits = 0;
+    let value = 0;
+    let out = '';
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            out += BASE32[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        out += BASE32[(value << (5 - bits)) & 31];
+    return out;
+}
+export function base32Decode(text) {
+    const clean = text.replace(/=+$/, '').toUpperCase();
+    let bits = 0;
+    let value = 0;
+    const out = [];
+    for (const char of clean) {
+        const index = BASE32.indexOf(char);
+        if (index < 0)
+            throw new RangeError('Not a base32 string.');
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            out.push((value >>> (bits - 8)) & 255);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(out);
+}
+/** A new TOTP secret (160 bits, base32). */
+export function newTotpSecret() {
+    return base32Encode(randomBytes(20));
+}
+/** The TOTP code for `secret` at `time` (6 digits, 30 s steps, HMAC-SHA1: what authenticator apps use). */
+export function totp(secret, time = Date.now(), digits = 6, stepSeconds = 30) {
+    const counter = Math.floor(time / 1000 / stepSeconds);
+    const message = Buffer.alloc(8);
+    message.writeBigUInt64BE(BigInt(counter));
+    const mac = createHmac('sha1', base32Decode(secret)).update(message).digest();
+    const offset = mac[mac.length - 1] & 15;
+    const binary = (mac.readUInt32BE(offset) & 0x7fffffff) % 10 ** digits;
+    return String(binary).padStart(digits, '0');
+}
+/** True when `code` matches the current step or one step either side (clock drift). */
+export function verifyTotp(secret, code, time = Date.now()) {
+    if (!/^\d{6}$/.test(code))
+        return false;
+    return [-1, 0, 1].some((drift) => {
+        const expected = Buffer.from(totp(secret, time + drift * 30_000));
+        const given = Buffer.from(code);
+        return expected.length === given.length && timingSafeEqual(expected, given);
+    });
+}
+/** The `otpauth://` URI authenticator apps scan. */
+export function otpauthUri(secret, account, issuer = 'Kosh') {
+    return `otpauth://totp/${encodeURIComponent(`${issuer}:${account}`)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/auth/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,MAAM,IAAI,cAAc,EACxB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAW,CAAC;AAEzF,SAAS,MAAM,CACb,QAAgB,EAChB,IAAY,EACZ,CAAS,EACT,CAAS,EACT,CAAS,EACT,MAAc;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,cAAc,CACZ,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,EAC1B,IAAI,EACJ,MAAM,EACN,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACrC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8GAA8G;AAC9G,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtF,OAAO,UAAU,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACjH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IACnE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,MAAM,CACtB,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAC9B,MAAM,CAAC,CAAC,CAAC,EACT,MAAM,CAAC,CAAC,CAAC,EACT,MAAM,CAAC,CAAC,CAAC,EACT,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,EAAE;IACpC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,oHAAoH;AAEpH,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAElD,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,GAAG,IAAI,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAC5D,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QAC7B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,IAAI,CAClB,MAAc,EACd,IAAI,GAAW,IAAI,CAAC,GAAG,EAAE,EACzB,MAAM,GAAG,CAAC,EACV,WAAW,GAAG,EAAE;IAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,WAAW,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAY,GAAG,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,IAAI,GAAW,IAAI,CAAC,GAAG,EAAE;IAChF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,MAAM,GAAG,MAAM;IACzE,OAAO,kBAAkB,kBAAkB,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,WAAW,MAAM,WAAW,kBAAkB,CAAC,MAAM,CAAC,oCAAoC,CAAC;AAChK,CAAC"}

package/dist/auth/install.d.ts

@@ -0,0 +1,24 @@
+/**
+ * First installation of `base`: a currency, the first company and the first administrator, in one audited system
+ * scope. Run once, after the schema exists.
+ */
+import type { Shutro } from '../orm.js';
+import type { AuthService } from './service.js';
+/** Options of {@link installBase}. */
+export interface InstallBaseOptions {
+    readonly company: {
+        readonly name: string;
+        readonly currency: string;
+    };
+    readonly admin: {
+        readonly login: string;
+        readonly name: string;
+        readonly password: string;
+    };
+}
+/** Creates the first company and administrator; returns their ids. */
+export declare function installBase(shutro: Shutro, auth: AuthService, options: InstallBaseOptions): Promise<{
+    company: number;
+    admin: number;
+}>;
+//# sourceMappingURL=install.d.ts.map

package/dist/auth/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/auth/install.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAO,MAAM,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9F;AAED,sEAAsE;AACtE,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB7C"}

package/dist/auth/install.js

@@ -0,0 +1,18 @@
+/** Creates the first company and administrator; returns their ids. */
+export async function installBase(shutro, auth, options) {
+    const company = await shutro.bootstrap({ reason: 'install base' }, async (env) => {
+        const model = (name) => env.model(name);
+        const [currency] = (await model('res.currency').create([{ name: options.company.currency }]))
+            .ids;
+        const [created] = (await model('res.company').create([{ name: options.company.name, currency }])).ids;
+        return created;
+    });
+    const admin = await auth.createUser({
+        ...options.admin,
+        company,
+        companies: [company],
+        groups: ['base.admin'],
+    });
+    return { company, admin };
+}
+//# sourceMappingURL=install.js.map

package/dist/auth/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/auth/install.ts"],"names":[],"mappings":"AAaA,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,IAAiB,EACjB,OAA2B;IAE3B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,GAAQ,EAAE,EAAE;QACpF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAC7B,GAAG,CAAC,KAAK,CAAC,IAAa,CAEtB,CAAC;QACJ,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;aAC1F,GAAG,CAAC;QACP,MAAM,CAAC,OAAO,CAAC,GAAG,CAChB,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAC9E,CAAC,GAAG,CAAC;QACN,OAAO,OAAiB,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;QAClC,GAAG,OAAO,CAAC,KAAK;QAChB,OAAO;QACP,SAAS,EAAE,CAAC,OAAO,CAAC;QACpB,MAAM,EAAE,CAAC,YAAY,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/dist/auth/routes.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Authentication routes (`/api/v1/auth/*`). Sign-in is public but limited per IP and login (brute force);
+ * everything else needs a session.
+ *
+ * - `POST /api/v1/auth/login`         `{ login, password }` → `{ token, csrfToken, twoFactorRequired }` + cookie
+ * - `POST /api/v1/auth/logout`        revokes the session, clears the cookie
+ * - `GET  /api/v1/auth/me`            the signed-in user
+ * - `POST /api/v1/auth/2fa/setup`     `{ secret, otpauthUri }` (pending until enabled)
+ * - `POST /api/v1/auth/2fa/enable`    `{ code }` → `{ recoveryCodes }`
+ * - `POST /api/v1/auth/2fa/verify`    `{ code }` (TOTP or recovery code) completes a pending sign-in
+ * - `POST /api/v1/auth/2fa/disable`   `{ password, code }`
+ * - `POST /api/v1/auth/password`      `{ current, next }`; other sessions are revoked
+ */
+import type { FastifyInstance } from 'fastify';
+import type { AuthService } from './service.js';
+/** Registers the routes; `loginLimit` attempts per 15 minutes per IP and login (default 10). */
+export declare function registerAuthRoutes(app: FastifyInstance, auth: AuthService, options?: {
+    readonly loginLimit?: number;
+}): void;
+//# sourceMappingURL=routes.d.ts.map

package/dist/auth/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAUhD,gGAAgG;AAChG,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,IAAI,CAyEN"}

package/dist/auth/routes.js

@@ -0,0 +1,56 @@
+import { HttpProblem } from '../errors.js';
+function text(request, key) {
+    const body = request.body;
+    const value = typeof body === 'object' && body !== null ? body[key] : undefined;
+    if (typeof value !== 'string' || value === '' || value.length > 1024)
+        throw new HttpProblem(400, 'invalid-body', 'Invalid body', `'${key}' is required (a string).`);
+    return value;
+}
+/** Registers the routes; `loginLimit` attempts per 15 minutes per IP and login (default 10). */
+export function registerAuthRoutes(app, auth, options = {}) {
+    const limited = options.loginLimit !== 0;
+    app.post('/api/v1/auth/login', {
+        config: {
+            auth: false,
+            ...(limited
+                ? {
+                    rateLimit: {
+                        hook: 'preHandler', // after body parsing: the key includes the login
+                        max: options.loginLimit ?? 10,
+                        timeWindow: '15 minutes',
+                        keyGenerator: (request) => {
+                            const login = request.body?.login;
+                            return `login:${request.ip}:${typeof login === 'string' ? login.toLowerCase() : ''}`;
+                        },
+                    },
+                }
+                : {}),
+        },
+    }, async (request, reply) => {
+        const result = await auth.login(request, text(request, 'login'), text(request, 'password'));
+        reply.header('set-cookie', auth.cookie(result.token));
+        return result;
+    });
+    app.post('/api/v1/auth/logout', { config: { auth: false } }, async (request, reply) => {
+        const session = await auth.requireSession(request, { allowPending: true });
+        await auth.logout(session);
+        reply.header('set-cookie', auth.cookie(null));
+        return { ok: true };
+    });
+    app.get('/api/v1/auth/me', { config: { auth: false } }, async (request) => auth.me(await auth.requireSession(request)));
+    app.post('/api/v1/auth/2fa/setup', { config: { auth: false } }, async (request) => auth.setupTwoFactor(await auth.requireSession(request)));
+    app.post('/api/v1/auth/2fa/enable', { config: { auth: false } }, async (request) => auth.enableTwoFactor(await auth.requireSession(request), text(request, 'code')));
+    app.post('/api/v1/auth/2fa/verify', { config: { auth: false } }, async (request) => {
+        await auth.verifyTwoFactor(await auth.requireSession(request, { allowPending: true }), text(request, 'code'));
+        return { ok: true };
+    });
+    app.post('/api/v1/auth/2fa/disable', { config: { auth: false } }, async (request) => {
+        await auth.disableTwoFactor(await auth.requireSession(request), text(request, 'password'), text(request, 'code'));
+        return { ok: true };
+    });
+    app.post('/api/v1/auth/password', { config: { auth: false } }, async (request) => {
+        await auth.changePassword(await auth.requireSession(request), text(request, 'current'), text(request, 'next'));
+        return { ok: true };
+    });
+}
+//# sourceMappingURL=routes.js.map

package/dist/auth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,SAAS,IAAI,CAAC,OAAuB,EAAE,GAAW;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAkD,CAAC;IACxE,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAClE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,EAAE,IAAI,GAAG,2BAA2B,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAChC,GAAoB,EACpB,IAAiB,EACjB,OAAO,GAAqC,EAAE;IAE9C,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,KAAK,CAAC,CAAC;IACzC,GAAG,CAAC,IAAI,CACN,oBAAoB,EACpB;QACE,MAAM,EAAE;YACN,IAAI,EAAE,KAAK;YACX,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,SAAS,EAAE;wBACT,IAAI,EAAE,YAAqB,EAAE,iDAAiD;wBAC9E,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;wBAC7B,UAAU,EAAE,YAAY;wBACxB,YAAY,EAAE,CAAC,OAAuB,EAAE,EAAE;4BACxC,MAAM,KAAK,GAAI,OAAO,CAAC,IAAwC,EAAE,KAAK,CAAC;4BACvE,OAAO,SAAS,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;wBACvF,CAAC;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;KACF,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5F,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3B,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CACxE,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAC5C,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAChF,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CACxD,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CACjF,IAAI,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAChF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjF,MAAM,IAAI,CAAC,eAAe,CACxB,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAC1D,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CACtB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAClF,MAAM,IAAI,CAAC,gBAAgB,CACzB,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAClC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EACzB,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CACtB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/E,MAAM,IAAI,CAAC,cAAc,CACvB,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAClC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EACxB,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CACtB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/service.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Kosh-native authentication on Shutro (CLAUDE.md, decided 2026-10-18): sessions, TOTP two-factor authentication,
+ * recovery codes, passwords. All reads and writes go through Shutro in audited system scopes (`shutro.bootstrap`), on
+ * the private models of the `base` module.
+ *
+ * Sessions: a random token (cookie `kosh_session`, httpOnly, SameSite=Lax; or `Authorization: Bearer`) stored as a
+ * SHA-256 digest, with an idle timeout and an absolute lifetime. Cookie sessions need `X-CSRF-Token` on unsafe
+ * methods. A session of a user with 2FA enabled is limited to `/auth/2fa/verify` and `/auth/logout` until verified.
+ */
+import type { FastifyRequest } from 'fastify';
+import type { RequestIdentity } from '../identity.js';
+import type { Env, Shutro, VerifiedIdentity } from '../orm.js';
+/** Options of the session layer. */
+export interface AuthOptions {
+    /** `Secure` cookies (default true; turn off only for plain-HTTP development). */
+    readonly secureCookies?: boolean;
+    /** Idle timeout (default 12 h). */
+    readonly idleMs?: number;
+    /** Absolute session lifetime (default 7 days). */
+    readonly lifetimeMs?: number;
+    /** How long a session lookup is cached (default 5 s): bounds how long a revoked session keeps working elsewhere. */
+    readonly cacheMs?: number;
+}
+/** A resolved session. */
+export interface SessionInfo {
+    readonly id: number;
+    readonly user: number;
+    readonly twoFactorRequired: boolean;
+    /** A second factor was entered in this session: administrator groups need it (and 2FA still on). */
+    readonly secondFactor: boolean;
+    readonly via: 'cookie' | 'bearer';
+}
+/** A user's sign-in state as `/auth/me` returns it. */
+export interface UserInfo {
+    readonly id: number;
+    readonly login: string;
+    readonly name: string;
+    readonly company: number | null;
+    readonly companies: readonly number[];
+    readonly twoFactorEnabled: boolean;
+    /** Holds an administrator role (in some company). */
+    readonly administrator: boolean;
+    /** Administrator rights are withheld until this session has a second factor (enable or verify 2FA). */
+    readonly administratorNeedsSecondFactor: boolean;
+}
+export declare const SESSION_COOKIE = "kosh_session";
+/** Milliseconds of a datetime value as Shutro returns it (`Date`, or an ISO text), or `null`. */
+export declare function timeOf(value: unknown): number | null;
+/** Reads `name` from the Cookie header. */
+export declare function cookieOf(request: FastifyRequest, name: string): string | undefined;
+/** The authentication service of one server. */
+export declare class AuthService {
+    #private;
+    constructor(shutro: () => Shutro, options?: AuthOptions);
+    /** The `Set-Cookie` value for a session token (empty token: clears it). */
+    cookie(token: string | null): string;
+    /** Hashes and sets a user's password. @throws {HttpProblem} 422 for a too-short password */
+    setPassword(env: Env, user: number, password: string): Promise<void>;
+    /** Creates a user with a password and group assignments (installation, tests, admin tools). */
+    createUser(input: {
+        readonly login: string;
+        readonly name: string;
+        readonly password: string;
+        readonly company?: number;
+        readonly companies?: readonly number[];
+        /** Group codes, all companies (`company` omitted) or per company. */
+        readonly groups?: readonly (string | {
+            readonly group: string;
+            readonly company: number;
+        })[];
+    }): Promise<number>;
+    /** Signs in: a new session (pending second factor when 2FA is on). @throws {HttpProblem} 401 */
+    login(request: FastifyRequest, login: string, password: string): Promise<{
+        token: string;
+        csrfToken: string;
+        twoFactorRequired: boolean;
+    }>;
+    /** The request's session, or `null`. Cookie sessions need the CSRF header on unsafe methods. */
+    session(request: FastifyRequest): Promise<SessionInfo | null>;
+    /** The verified session of a request. @throws {HttpProblem} 401 without one, or before the second factor */
+    requireSession(request: FastifyRequest, options?: {
+        readonly allowPending?: boolean;
+    }): Promise<SessionInfo>;
+    /** Authenticator for the server (RFC 0002 §6.2): the session's user, company from `X-Company`, groups for it. */
+    authenticate(request: FastifyRequest): Promise<RequestIdentity | null>;
+    /** Identity loader for Shutro (`createShutro({ identity })`): the user is active; companies and groups from the database. */
+    verify(uid: number): Promise<VerifiedIdentity | null>;
+    /** The signed-in user's state. */
+    me(session: SessionInfo): Promise<UserInfo>;
+    /** Revokes a session. */
+    logout(session: SessionInfo): Promise<void>;
+    /** Starts 2FA enrolment: a new secret, not active until confirmed with a code. */
+    setupTwoFactor(session: SessionInfo): Promise<{
+        secret: string;
+        otpauthUri: string;
+    }>;
+    /** Confirms enrolment with a code; returns ten recovery codes (shown once, stored as digests). */
+    enableTwoFactor(session: SessionInfo, code: string): Promise<{
+        recoveryCodes: string[];
+    }>;
+    /** Completes a pending sign-in with a TOTP or recovery code (a recovery code works once). */
+    verifyTwoFactor(session: SessionInfo, code: string): Promise<void>;
+    /** Turns 2FA off (password and a current code required). */
+    disableTwoFactor(session: SessionInfo, password: string, code: string): Promise<void>;
+    /** Changes the password; every other session of the user is revoked. */
+    changePassword(session: SessionInfo, current: string, next: string): Promise<void>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/auth/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAY/D,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,mCAAmC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oHAAoH;IACpH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0BAA0B;AAC1B,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,oGAAoG;IACpG,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACnC;AAED,uDAAuD;AACvD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,qDAAqD;IACrD,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,uGAAuG;IACvG,QAAQ,CAAC,8BAA8B,EAAE,OAAO,CAAC;CAClD;AAED,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAiB7C,iGAAiG;AACjG,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIpD;AAeD,2CAA2C;AAC3C,wBAAgB,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMlF;AAID,gDAAgD;AAChD,qBAAa,WAAW;;IAMtB,YAAY,MAAM,EAAE,MAAM,MAAM,EAAE,OAAO,GAAE,WAAgB,EAQ1D;IAMD,2EAA2E;IAC3E,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAUnC;IAED,4FAA4F;IACtF,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAazE;IAED,+FAA+F;IACzF,UAAU,CAAC,KAAK,EAAE;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,qEAAqE;QACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,EAAE,CAAC;KAC9F,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB;IAED,gGAAgG;IAC1F,KAAK,CACT,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC,CA+D3E;IAED,gGAAgG;IAC1F,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAmElE;IAED,4GAA4G;IACtG,cAAc,CAClB,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE;QAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GAChD,OAAO,CAAC,WAAW,CAAC,CAetB;IAED,iHAAiH;IAC3G,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAgD3E;IAED,6HAA6H;IACvH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAa1D;IA8DD,kCAAkC;IAC5B,EAAE,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyBhD;IAED,yBAAyB;IACnB,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhD;IAWD,kFAAkF;IAC5E,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAuB1F;IAED,kGAAkG;IAC5F,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAiC9F;IAED,6FAA6F;IACvF,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCvE;IAqBD,4DAA4D;IACtD,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B1F;IAED,wEAAwE;IAClE,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BvF;CACF"}