@isahaq/kosh-server 0.0.0-stage → 0.1.0

package/dist/identity.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Who a request acts as (RFC 0002 §6.2). An {@link Authenticator} turns a request into an identity (sessions and 2FA
+ * come with the auth step); headers may then narrow it: `X-Company` (current company), `X-Companies` (allowed
+ * companies, a subset), `Accept-Language` and `X-Timezone`. Without an identity a route answers 401.
+ */
+import type { FastifyRequest } from 'fastify';
+/** The verified identity of a request. */
+export interface RequestIdentity {
+    readonly user: number;
+    /** Default current company. */
+    readonly company: number;
+    /** Companies the user may work in. */
+    readonly companies: readonly number[];
+    /** Shutro group codes for these companies. */
+    readonly groups: readonly string[];
+    /** Special permissions of the user (Shutro `grants`), e.g. `account.backdate`. */
+    readonly grants?: readonly string[];
+    readonly lang?: string;
+    readonly tz?: string;
+}
+/**
+ * The single explicit bypass (CLAUDE.md "superuser mode", RFC 0003 §5.2): the user holds an administrator role
+ * (Shutro `env.administrator`, acting as themselves) or the code runs in an audited superuser scope (`env.su`).
+ * Permission checks pass; integrity (constraints, company consistency, state guards) still applies.
+ */
+export declare function isSuperuser(env: {
+    readonly administrator: boolean;
+    readonly su: boolean;
+}): boolean;
+/** Resolves a request's identity, or `null` when it is not authenticated. */
+export type Authenticator = (request: FastifyRequest) => Promise<RequestIdentity | null>;
+/** The default: nobody is authenticated (secure by default until an auth method is configured). */
+export declare const denyAll: Authenticator;
+/** The first `ll-CC` of `Accept-Language`, as a Shutro language code (`bn-BD` → `bn_BD`). */
+export declare function languageOf(accept: string | undefined): string | undefined;
+/** What a request runs as in Shutro (`shutro.run` options). */
+export interface RequestRunOptions {
+    readonly user: number;
+    readonly company: number;
+    readonly companies: readonly number[];
+    readonly groups: readonly string[];
+    readonly grants?: readonly string[];
+    readonly lang?: string;
+    readonly tz?: string;
+    readonly readOnly: boolean;
+}
+/** The Shutro run options of a request: the identity narrowed by its headers. @throws {HttpProblem} */
+export declare function runOptionsOf(request: FastifyRequest, identity: RequestIdentity): RequestRunOptions;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE;IAC/B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAEV;AAED,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAEzF,mGAAmG;AACnG,eAAO,MAAM,OAAO,EAAE,aAAgC,CAAC;AAuBvD,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAMzE;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,uGAAuG;AACvG,wBAAgB,YAAY,CAC1B,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,GACxB,iBAAiB,CAkCnB"}

package/dist/identity.js

@@ -0,0 +1,58 @@
+import { HttpProblem } from './errors.js';
+/**
+ * The single explicit bypass (CLAUDE.md "superuser mode", RFC 0003 §5.2): the user holds an administrator role
+ * (Shutro `env.administrator`, acting as themselves) or the code runs in an audited superuser scope (`env.su`).
+ * Permission checks pass; integrity (constraints, company consistency, state guards) still applies.
+ */
+export function isSuperuser(env) {
+    return env.administrator || env.su;
+}
+/** The default: nobody is authenticated (secure by default until an auth method is configured). */
+export const denyAll = async () => null;
+const LANG = /^([a-z]{2,3})[-_]([A-Za-z]{2})$/;
+function header(request, name) {
+    const value = request.headers[name];
+    return typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined;
+}
+function ids(text, what) {
+    return text.split(',').map((part) => {
+        const n = Number(part.trim());
+        if (!Number.isSafeInteger(n) || n <= 0)
+            throw new HttpProblem(400, 'invalid-header', 'Invalid header', `${what} must be company ids, got ${JSON.stringify(text)}.`);
+        return n;
+    });
+}
+/** The first `ll-CC` of `Accept-Language`, as a Shutro language code (`bn-BD` → `bn_BD`). */
+export function languageOf(accept) {
+    for (const part of (accept ?? '').split(',')) {
+        const m = LANG.exec(part.split(';')[0]?.trim() ?? '');
+        if (m !== null)
+            return `${m[1]}_${m[2]?.toUpperCase()}`;
+    }
+    return undefined;
+}
+/** The Shutro run options of a request: the identity narrowed by its headers. @throws {HttpProblem} */
+export function runOptionsOf(request, identity) {
+    const companiesHeader = header(request, 'x-companies');
+    const companyHeader = header(request, 'x-company');
+    const companies = companiesHeader === undefined ? [...identity.companies] : ids(companiesHeader, 'X-Companies');
+    const outside = companies.filter((c) => !identity.companies.includes(c));
+    if (outside.length > 0)
+        throw new HttpProblem(403, 'company-not-allowed', 'Company not allowed', `Company ${outside.join(', ')} is not allowed for this user.`);
+    const company = companyHeader === undefined ? identity.company : ids(companyHeader, 'X-Company')[0];
+    if (!companies.includes(company))
+        throw new HttpProblem(403, 'company-not-allowed', 'Company not allowed', `Company ${company} is not among the selected companies.`);
+    const lang = languageOf(header(request, 'accept-language')) ?? identity.lang;
+    const tz = header(request, 'x-timezone') ?? identity.tz;
+    return {
+        user: identity.user,
+        company,
+        companies,
+        groups: [...identity.groups],
+        ...(identity.grants === undefined ? {} : { grants: [...identity.grants] }),
+        ...(lang === undefined ? {} : { lang }),
+        ...(tz === undefined ? {} : { tz }),
+        readOnly: request.method === 'GET' || request.method === 'HEAD',
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB1C;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAG3B;IACC,OAAO,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,EAAE,CAAC;AACrC,CAAC;AAKD,mGAAmG;AACnG,MAAM,CAAC,MAAM,OAAO,GAAkB,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;AAEvD,MAAM,IAAI,GAAG,iCAAiC,CAAC;AAE/C,SAAS,MAAM,CAAC,OAAuB,EAAE,IAAY;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,IAAY;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACpC,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,gBAAgB,EAChB,gBAAgB,EAChB,GAAG,IAAI,6BAA6B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAC5D,CAAC;QACJ,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAAC,MAA0B;IACnD,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD,uGAAuG;AACvG,MAAM,UAAU,YAAY,CAC1B,OAAuB,EACvB,QAAyB;IAEzB,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,SAAS,GACb,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAC9D,CAAC;IACJ,MAAM,OAAO,GACX,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAY,CAAC;IAClG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC9B,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,OAAO,uCAAuC,CAC1D,CAAC;IACJ,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC;IAC7E,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC;IACxD,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO;QACP,SAAS;QACT,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACnC,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;KAChE,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @packageDocumentation
+ * `@isahaq/kosh-server`: the Fastify server, module loading, the per-request Shutro environment, health checks, rate
+ * limiting, logging and telemetry (RFC 0002). Shutro is reached only through `./orm.ts` (`@isahaq/kosh-server/orm`).
+ */
+export { generateClient, typeOf } from './api/client.js';
+export { IDEMPOTENCY_TABLE, idempotencyTableStatements, type Outcome } from './api/idempotency.js';
+export { type ApiField, type ApiModel, apiModels, defaultFields, publicApiModels, schemaName, } from './api/metadata.js';
+export { type MenuNode, moduleVisible, Navigation } from './api/navigation.js';
+export { fieldSchema, openApiDocument, openApiOf } from './api/openapi.js';
+export { registerRestApi } from './api/rest.js';
+export { type ServedView, type ViewField, ViewRegistry } from './api/views.js';
+export { type AuditInput, audit } from './audit.js';
+export { administrators, isAdministratorUser, keepingAdministrator, LAST_ADMINISTRATOR, } from './auth/admins.js';
+export { base, baseShutro } from './auth/base.js';
+export { digest, hashPassword, newTotpSecret, otpauthUri, randomToken, totp, verifyPassword, verifyTotp, } from './auth/crypto.js';
+export { type InstallBaseOptions, installBase } from './auth/install.js';
+export { registerAuthRoutes } from './auth/routes.js';
+export { type AuthOptions, AuthService, cookieOf, SESSION_COOKIE, type SessionInfo, timeOf, type UserInfo, } from './auth/service.js';
+export { HttpProblem, type Problem, problemOf, ServerConfigError } from './errors.js';
+export { type Authenticator, denyAll, isSuperuser, languageOf, type RequestIdentity, type RequestRunOptions, runOptionsOf, } from './identity.js';
+export { orm, pg } from './orm.js';
+export { buildKoshRegistry, KOSH_VERSION, type KoshRegistry } from './registry.js';
+export { createServer, type KoshServer, type ModuleContext, type ServerOptions, startServer, } from './server.js';
+export { startTelemetry, type Telemetry, tracer } from './telemetry.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,KAAK,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,SAAS,EACT,aAAa,EACb,eAAe,EACf,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,MAAM,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,WAAW,EACX,IAAI,EACJ,cAAc,EACd,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,kBAAkB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,KAAK,WAAW,EAChB,WAAW,EACX,QAAQ,EACR,cAAc,EACd,KAAK,WAAW,EAChB,MAAM,EACN,KAAK,QAAQ,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EACL,KAAK,aAAa,EAClB,OAAO,EACP,WAAW,EACX,UAAU,EACV,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,EACL,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,26 @@
+/**
+ * @packageDocumentation
+ * `@isahaq/kosh-server`: the Fastify server, module loading, the per-request Shutro environment, health checks, rate
+ * limiting, logging and telemetry (RFC 0002). Shutro is reached only through `./orm.ts` (`@isahaq/kosh-server/orm`).
+ */
+export { generateClient, typeOf } from './api/client.js';
+export { IDEMPOTENCY_TABLE, idempotencyTableStatements } from './api/idempotency.js';
+export { apiModels, defaultFields, publicApiModels, schemaName, } from './api/metadata.js';
+export { moduleVisible, Navigation } from './api/navigation.js';
+export { fieldSchema, openApiDocument, openApiOf } from './api/openapi.js';
+export { registerRestApi } from './api/rest.js';
+export { ViewRegistry } from './api/views.js';
+export { audit } from './audit.js';
+export { administrators, isAdministratorUser, keepingAdministrator, LAST_ADMINISTRATOR, } from './auth/admins.js';
+export { base, baseShutro } from './auth/base.js';
+export { digest, hashPassword, newTotpSecret, otpauthUri, randomToken, totp, verifyPassword, verifyTotp, } from './auth/crypto.js';
+export { installBase } from './auth/install.js';
+export { registerAuthRoutes } from './auth/routes.js';
+export { AuthService, cookieOf, SESSION_COOKIE, timeOf, } from './auth/service.js';
+export { HttpProblem, problemOf, ServerConfigError } from './errors.js';
+export { denyAll, isSuperuser, languageOf, runOptionsOf, } from './identity.js';
+export { orm, pg } from './orm.js';
+export { buildKoshRegistry, KOSH_VERSION } from './registry.js';
+export { createServer, startServer, } from './server.js';
+export { startTelemetry, tracer } from './telemetry.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAgB,MAAM,sBAAsB,CAAC;AACnG,OAAO,EAGL,SAAS,EACT,aAAa,EACb,eAAe,EACf,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAiB,aAAa,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAmC,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAmB,KAAK,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,MAAM,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,WAAW,EACX,IAAI,EACJ,cAAc,EACd,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAA2B,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAEL,WAAW,EACX,QAAQ,EACR,cAAc,EAEd,MAAM,GAEP,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAgB,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAEL,OAAO,EACP,WAAW,EACX,UAAU,EAGV,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAqB,MAAM,eAAe,CAAC;AACnF,OAAO,EACL,YAAY,EAIZ,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAkB,MAAM,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/orm.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The ONE place Kosh imports Shutro (CLAUDE.md, Shutro integration; RFC 0002 §6.1). Every other package imports the
+ * ORM from here (`@isahaq/kosh-server/orm`), so the dependency can be renamed or swapped in one file; `pnpm lint` fails if
+ * another file imports `shutro` directly.
+ */
+import * as core from 'shutro';
+import * as driverPg from 'shutro/driver-pg';
+/** The Shutro ORM API as Kosh uses it. */
+export declare const orm: typeof core;
+/** Shutro's PostgreSQL driver (pools, transactions); separate because some error names overlap the core's. */
+export declare const pg: typeof driverPg;
+export type * from 'shutro';
+export type { Driver, DriverOptions } from 'shutro/driver-pg';
+//# sourceMappingURL=orm.d.ts.map

package/dist/orm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm.d.ts","sourceRoot":"","sources":["../src/orm.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,0CAA0C;AAC1C,eAAO,MAAM,GAAG,EAAE,OAAO,IAAW,CAAC;AACrC,8GAA8G;AAC9G,eAAO,MAAM,EAAE,EAAE,OAAO,QAAmB,CAAC;AAE5C,mBAAmB,QAAQ,CAAC;AAC5B,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/orm.js

@@ -0,0 +1,12 @@
+/**
+ * The ONE place Kosh imports Shutro (CLAUDE.md, Shutro integration; RFC 0002 §6.1). Every other package imports the
+ * ORM from here (`@isahaq/kosh-server/orm`), so the dependency can be renamed or swapped in one file; `pnpm lint` fails if
+ * another file imports `shutro` directly.
+ */
+import * as core from 'shutro';
+import * as driverPg from 'shutro/driver-pg';
+/** The Shutro ORM API as Kosh uses it. */
+export const orm = core;
+/** Shutro's PostgreSQL driver (pools, transactions); separate because some error names overlap the core's. */
+export const pg = driverPg;
+//# sourceMappingURL=orm.js.map

package/dist/orm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm.js","sourceRoot":"","sources":["../src/orm.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,0CAA0C;AAC1C,MAAM,CAAC,MAAM,GAAG,GAAgB,IAAI,CAAC;AACrC,8GAA8G;AAC9G,MAAM,CAAC,MAAM,EAAE,GAAoB,QAAQ,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,19 @@
+/**
+ * From Kosh modules to a Shutro registry (RFC 0001 §5, RFC 0002 §6.1): the module loader's checks, then the Shutro
+ * registry of the wrapped Shutro modules, then the checks that need both: every manifest wraps a real Shutro module,
+ * and every Shutro module in the registry has a Kosh manifest (so none escapes declaring access levels).
+ */
+import { type KoshModule, type LoadedModules } from '@isahaq/kosh-modules-sdk';
+import { type Registry, type RegistryOptions } from './orm.js';
+/** The framework version this server implements (checked against each module's `kosh` range). */
+export declare const KOSH_VERSION = "0.1.0";
+/** The loaded modules and their Shutro registry. */
+export interface KoshRegistry {
+    readonly loaded: LoadedModules;
+    readonly registry: Registry;
+}
+/** Loads `modules` (and their dependencies) and builds the Shutro registry. @throws {ServerConfigError} */
+export declare function buildKoshRegistry(modules: readonly KoshModule[], options?: {
+    readonly security?: RegistryOptions<[]>['security'];
+}): KoshRegistry;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAe,MAAM,0BAA0B,CAAC;AAE5F,OAAO,EAAO,KAAK,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAEpE,iGAAiG;AACjG,eAAO,MAAM,YAAY,UAAU,CAAC;AAEpC,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,2GAA2G;AAC3G,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,OAAO,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;CAAO,GACpE,YAAY,CAmBd"}

package/dist/registry.js

@@ -0,0 +1,26 @@
+/**
+ * From Kosh modules to a Shutro registry (RFC 0001 §5, RFC 0002 §6.1): the module loader's checks, then the Shutro
+ * registry of the wrapped Shutro modules, then the checks that need both: every manifest wraps a real Shutro module,
+ * and every Shutro module in the registry has a Kosh manifest (so none escapes declaring access levels).
+ */
+import { loadModules } from '@isahaq/kosh-modules-sdk';
+import { ServerConfigError } from './errors.js';
+import { orm } from './orm.js';
+/** The framework version this server implements (checked against each module's `kosh` range). */
+export const KOSH_VERSION = '0.1.0';
+/** Loads `modules` (and their dependencies) and builds the Shutro registry. @throws {ServerConfigError} */
+export function buildKoshRegistry(modules, options = {}) {
+    const loaded = loadModules(modules, { koshVersion: KOSH_VERSION });
+    for (const m of loaded.modules)
+        if (!orm.isModule(m.shutro))
+            throw new ServerConfigError(`Module '${m.name}' does not wrap a Shutro module.`, 'Pass the value returned by defineModule() from @isahaq/kosh-server/orm as `shutro`.');
+    const registry = orm.buildRegistry({
+        modules: loaded.modules.map((m) => m.shutro),
+        ...(options.security === undefined ? {} : { security: options.security }),
+    });
+    for (const name of registry.loadOrder)
+        if (!loaded.byName.has(name))
+            throw new ServerConfigError(`The Shutro module '${name}' has no Kosh manifest.`, 'Wrap it with defineModule() from @isahaq/kosh-modules-sdk (its access levels are required) and depend on it.');
+    return { loaded, registry };
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAuC,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,GAAG,EAAuC,MAAM,UAAU,CAAC;AAEpE,iGAAiG;AACjG,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AAQpC,2GAA2G;AAC3G,MAAM,UAAU,iBAAiB,CAC/B,OAA8B,EAC9B,OAAO,GAA4D,EAAE;IAErE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAC5B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;YACzB,MAAM,IAAI,iBAAiB,CACzB,WAAW,CAAC,CAAC,IAAI,kCAAkC,EACnD,qFAAqF,CACtF,CAAC;IACN,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,CAAC;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAe,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KAC1E,CAAwB,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,SAAS;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAC1B,MAAM,IAAI,iBAAiB,CACzB,sBAAsB,IAAI,yBAAyB,EACnD,8GAA8G,CAC/G,CAAC;IACN,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,93 @@
+import type { KoshModule } from '@isahaq/kosh-modules-sdk';
+import type { Span } from '@opentelemetry/api';
+import { type FastifyInstance, type FastifyServerOptions } from 'fastify';
+import { type AuthOptions, AuthService } from './auth/service.js';
+import { type Authenticator, type RequestIdentity } from './identity.js';
+import { type Driver, type Env, type Shutro } from './orm.js';
+import { type KoshRegistry } from './registry.js';
+declare module 'fastify' {
+    interface FastifyRequest {
+        /** The verified identity, or `null` on public routes. */
+        identity: RequestIdentity | null;
+        /**
+         * Runs `fn` in this request's Shutro transaction (read-only for GET / HEAD, unless `write`: for reads that open
+         * audited system scopes). @throws {HttpProblem} 401 without identity
+         */
+        env<T>(fn: (env: Env) => Promise<T>, options?: {
+            readonly write?: boolean;
+        }): Promise<T>;
+        /** @internal */
+        span: Span | undefined;
+    }
+    interface FastifyContextConfig {
+        /** No authentication, no rate limit (health checks). */
+        public?: boolean;
+        /** `false`: the route checks the session itself (sign-in, 2FA); still rate limited. */
+        auth?: boolean;
+    }
+}
+/** Options of {@link createServer}. */
+export interface ServerOptions {
+    readonly databaseUrl: string;
+    readonly modules: readonly KoshModule[];
+    /** Valkey for rate limiting (and later caches, pub/sub); without it, limits are per process. */
+    readonly valkeyUrl?: string;
+    /**
+     * Who is calling. Default: Kosh sessions (cookie or Bearer, 2FA) when the `base` module is installed, otherwise
+     * nobody is authenticated.
+     */
+    readonly authenticate?: Authenticator;
+    /** Session settings of the built-in authentication. */
+    readonly auth?: AuthOptions & {
+        /** Sign-in attempts per 15 minutes per IP and login (default 10; 0 turns the limit off). */
+        readonly loginLimit?: number;
+    };
+    /**
+     * Shutro's identity loader checks every request's user (active, companies, groups) against `base`'s data. Default:
+     * on with the built-in authentication; custom authenticators opt in.
+     */
+    readonly verifyIdentities?: boolean;
+    /** Requests per window per user (or IP when anonymous). Default 600 per minute. */
+    readonly rateLimit?: {
+        readonly max: number;
+        readonly timeWindow: string | number;
+    };
+    readonly logger?: FastifyServerOptions['logger'];
+    /** Maximum database connections (default 10). */
+    readonly poolSize?: number;
+    /** Passed to the registry: `{ enforce: false }` only for tests of non-security features. */
+    readonly security?: {
+        readonly enforce?: boolean | 'warn';
+    };
+}
+/** What a module's `routes` hook receives (`defineModule({ routes })`). */
+export interface ModuleContext {
+    readonly app: FastifyInstance;
+    readonly shutro: Shutro;
+    readonly driver: Driver;
+    readonly registry: KoshRegistry;
+    readonly auth: AuthService | undefined;
+}
+/** A created server. */
+export interface KoshServer {
+    readonly app: FastifyInstance;
+    readonly shutro: Shutro;
+    readonly driver: Driver;
+    readonly registry: KoshRegistry;
+    /** The built-in authentication (when `base` is installed). */
+    readonly auth: AuthService | undefined;
+    /** Stops accepting requests, lets in-flight ones finish, then closes the pool and Valkey. Safe to call twice. */
+    close(): Promise<void>;
+}
+/** Creates the server (not listening yet). @throws {ServerConfigError} for modules that cannot load together */
+export declare function createServer(options: ServerOptions): Promise<KoshServer>;
+/**
+ * Listens and shuts down gracefully on SIGTERM / SIGINT (in-flight requests finish, then connections close).
+ */
+export declare function startServer(server: KoshServer, options?: {
+    readonly port?: number;
+    readonly host?: string;
+    readonly onShutdown?: () => Promise<void>;
+}): Promise<string>;
+export type { FastifyInstance };
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,SAAS,CAAC;AASnF,OAAO,EAAE,KAAK,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAE,KAAK,aAAa,EAAW,KAAK,eAAe,EAAgB,MAAM,eAAe,CAAC;AAChG,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,GAAG,EAAW,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAmC,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAGnF,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,yDAAyD;QACzD,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;QACjC;;;WAGG;QACH,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzF,gBAAgB;QAChB,IAAI,EAAE,IAAI,GAAG,SAAS,CAAC;KACxB;IACD,UAAU,oBAAoB;QAC5B,wDAAwD;QACxD,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,uFAAuF;QACvF,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB;CACF;AAED,uCAAuC;AACvC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IACtC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG;QAC5B,4FAA4F;QAC5F,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACjD,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,CAAC;CACxC;AAED,wBAAwB;AACxB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,CAAC;IACvC,iHAAiH;IACjH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AASD,gHAAgH;AAChH,wBAAsB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAqM9E;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE;IACP,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC,GACL,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,YAAY,EAAE,eAAe,EAAE,CAAC"}

package/dist/server.js

@@ -0,0 +1,223 @@
+/**
+ * The Kosh server (RFC 0002, CLAUDE.md robustness): Fastify with Pino logs (request ids, redacted credentials),
+ * authentication through an {@link Authenticator}, one Shutro transaction per request (`request.env`), RFC 9457
+ * errors, rate limiting on Valkey, OpenTelemetry spans, health checks, and graceful shutdown.
+ */
+import rateLimit from '@fastify/rate-limit';
+import Fastify, {} from 'fastify';
+import { Valkey } from 'iovalkey';
+import { idempotencyTableStatements } from './api/idempotency.js';
+import { publicApiModels } from './api/metadata.js';
+import { Navigation } from './api/navigation.js';
+import { openApiDocument } from './api/openapi.js';
+import { registerRestApi } from './api/rest.js';
+import { ViewRegistry } from './api/views.js';
+import { registerAuthRoutes } from './auth/routes.js';
+import { AuthService } from './auth/service.js';
+import { HttpProblem, problemOf } from './errors.js';
+import { denyAll, runOptionsOf } from './identity.js';
+import { orm, pg } from './orm.js';
+import { buildKoshRegistry, KOSH_VERSION } from './registry.js';
+import { endSpan, tracer } from './telemetry.js';
+const REDACT = [
+    'req.headers.authorization',
+    'req.headers.cookie',
+    'req.headers["x-api-key"]',
+    'res.headers["set-cookie"]',
+];
+/** Creates the server (not listening yet). @throws {ServerConfigError} for modules that cannot load together */
+export async function createServer(options) {
+    const registry = buildKoshRegistry(options.modules, {
+        ...(options.security === undefined ? {} : { security: options.security }),
+    });
+    const driver = pg.createDriver({
+        url: options.databaseUrl,
+        max: options.poolSize ?? 10,
+        parseNumeric: orm.toDecimal,
+        applicationName: 'kosh',
+    });
+    const hasBase = registry.registry.models.has('auth.session');
+    let shutro;
+    const auth = hasBase ? new AuthService(() => shutro, options.auth) : undefined;
+    const verify = auth !== undefined && (options.verifyIdentities ?? options.authenticate === undefined);
+    shutro = orm.createShutro({
+        driver,
+        registry: registry.registry,
+        runtimeSecurity: true, // roles, access, rules and field security edited by administrators (RFC 0003)
+        ...(verify ? { identity: (uid) => auth.verify(uid) } : {}),
+    });
+    const authenticate = options.authenticate ??
+        (auth === undefined ? denyAll : (request) => auth.authenticate(request));
+    const valkey = options.valkeyUrl === undefined
+        ? undefined
+        : new Valkey(options.valkeyUrl, { lazyConnect: true, maxRetriesPerRequest: 2 });
+    if (valkey !== undefined)
+        await valkey.connect();
+    const app = Fastify({
+        logger: options.logger ?? { level: process.env['LOG_LEVEL'] ?? 'info', redact: REDACT },
+        genReqId: (req) => {
+            const given = req.headers['x-request-id'];
+            return typeof given === 'string' && /^[\w.-]{1,128}$/.test(given)
+                ? given
+                : crypto.randomUUID();
+        },
+        requestIdHeader: false,
+        return503OnClosing: true,
+    });
+    app.decorateRequest('identity', null);
+    app.decorateRequest('span', undefined);
+    // A generic method: Fastify's decorator typing cannot express it; the augmentation above types callers.
+    app.decorateRequest('env', function env(fn, options = {}) {
+        const request = this;
+        if (request.identity === null)
+            throw new HttpProblem(401, 'unauthenticated', 'Not authenticated', 'This route needs an authenticated user.', 'Sign in first.');
+        const runOptions = {
+            ...runOptionsOf(request, request.identity),
+            ...(options.write === true ? { readOnly: false } : {}),
+        };
+        return tracer.startActiveSpan('shutro.run', async (span) => {
+            try {
+                return await shutro.run(runOptions, fn);
+            }
+            finally {
+                span.end();
+            }
+        });
+    });
+    app.addHook('onRequest', async (request, reply) => {
+        reply.header('x-request-id', request.id);
+        request.span = tracer.startSpan(`HTTP ${request.method}`, {
+            attributes: {
+                'http.request.method': request.method,
+                'url.path': request.url.split('?')[0] ?? '',
+                'kosh.request_id': request.id,
+            },
+        });
+    });
+    // Authentication runs before rate limiting, so limits are per user when there is one.
+    app.addHook('onRequest', async (request) => {
+        const config = request.routeOptions.config;
+        if (config.public === true || config.auth === false)
+            return;
+        request.identity = await authenticate(request);
+    });
+    if (options.rateLimit?.max !== 0)
+        await app.register(rateLimit, {
+            global: true,
+            max: options.rateLimit?.max ?? 600,
+            timeWindow: options.rateLimit?.timeWindow ?? '1 minute',
+            ...(valkey === undefined ? {} : { redis: valkey, nameSpace: 'kosh:ratelimit:' }),
+            keyGenerator: (request) => request.identity === null ? `ip:${request.ip}` : `user:${request.identity.user}`,
+            allowList: (request) => request.routeOptions.config.public === true,
+            errorResponseBuilder: (_request, context) => new HttpProblem(429, 'rate-limited', 'Too many requests', `Limit of ${context.max} requests per ${context.after} reached.`, `Retry after ${context.after}.`),
+        });
+    // While shutting down, responses ask the client to close its connection, so keep-alive sockets that were busy
+    // when the shutdown began do not hold the server open afterwards.
+    let shuttingDown = false;
+    app.addHook('onSend', async (_request, reply) => {
+        if (shuttingDown)
+            reply.header('connection', 'close');
+    });
+    app.addHook('onResponse', async (request, reply) => {
+        if (request.span !== undefined) {
+            request.span.setAttribute('http.route', request.routeOptions.url ?? '');
+            endSpan(request.span, reply.statusCode);
+        }
+    });
+    app.setErrorHandler(async (error, request, reply) => {
+        const problem = problemOf(error);
+        if (problem.status >= 500)
+            request.log.error({ err: error }, 'request failed');
+        else
+            request.log.info({ problem: problem.type, status: problem.status }, 'request refused');
+        request.span?.recordException(error instanceof Error ? error : new Error(String(error)));
+        await reply.status(problem.status).type('application/problem+json').send(problem);
+    });
+    app.setNotFoundHandler(async (request, reply) => {
+        await reply
+            .status(404)
+            .type('application/problem+json')
+            .send({
+            type: 'https://kosh.dev/problems/not-found',
+            title: 'Not found',
+            status: 404,
+            detail: `No route ${request.method} ${request.url.split('?')[0] ?? ''}.`,
+        });
+    });
+    if (auth !== undefined)
+        registerAuthRoutes(app, auth, { loginLimit: options.auth?.loginLimit ?? 10 });
+    // The generated REST API and its OpenAPI document (RFC 0002 §6.3–6.4).
+    for (const statement of idempotencyTableStatements())
+        await driver.query(statement);
+    const models = publicApiModels(registry);
+    const views = new ViewRegistry(registry.loaded.modules, models); // validated at startup
+    let openapi;
+    registerRestApi(app, {
+        models,
+        driver,
+        openapi: () => {
+            openapi ??= openApiDocument(models.values(), { title: 'Kosh API', version: KOSH_VERSION });
+            return openapi;
+        },
+    });
+    new Navigation(registry.loaded).register(app);
+    views.register(app);
+    // Module routes (admin APIs, custom endpoints), in dependency order.
+    const context = { app, shutro, driver, registry, auth };
+    for (const m of registry.loaded.modules)
+        if (m.routes !== undefined)
+            await m.routes(context);
+    // Health checks: public, not rate limited. Liveness: the process answers. Readiness: dependencies answer.
+    app.get('/health/live', { config: { public: true } }, async () => ({ status: 'ok' }));
+    app.get('/health/ready', { config: { public: true } }, async (_request, reply) => {
+        const checks = {};
+        try {
+            await driver.query({ text: 'SELECT 1', params: [] });
+            checks['database'] = 'ok';
+        }
+        catch {
+            checks['database'] = 'down';
+        }
+        if (valkey !== undefined)
+            checks['valkey'] = (await valkey.ping().catch(() => 'down')) === 'PONG' ? 'ok' : 'down';
+        const ready = Object.values(checks).every((c) => c === 'ok');
+        await reply.status(ready ? 200 : 503).send({ status: ready ? 'ok' : 'unavailable', checks });
+    });
+    let closing;
+    return {
+        app,
+        shutro,
+        driver,
+        registry,
+        auth,
+        close() {
+            closing ??= (async () => {
+                shuttingDown = true;
+                await app.close(); // stops accepting; waits for in-flight requests
+                await driver.end({ timeoutSeconds: 10 });
+                await valkey?.quit().catch(() => undefined);
+            })();
+            return closing;
+        },
+    };
+}
+/**
+ * Listens and shuts down gracefully on SIGTERM / SIGINT (in-flight requests finish, then connections close).
+ */
+export async function startServer(server, options = {}) {
+    const address = await server.app.listen({
+        port: options.port ?? 3000,
+        host: options.host ?? '0.0.0.0',
+    });
+    const stop = (signal) => {
+        server.app.log.info({ signal }, 'shutting down');
+        void server
+            .close()
+            .then(() => options.onShutdown?.())
+            .finally(() => process.exit(0));
+    };
+    process.once('SIGTERM', () => stop('SIGTERM'));
+    process.once('SIGINT', () => stop('SIGINT'));
+    return address;
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAG5C,OAAO,OAAO,EAAE,EAAmD,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAoB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAsB,OAAO,EAAwB,YAAY,EAAE,MAAM,eAAe,CAAC;AAChG,OAAO,EAAyB,GAAG,EAAE,EAAE,EAAe,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAqB,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAyEjD,MAAM,MAAM,GAAG;IACb,2BAA2B;IAC3B,oBAAoB;IACpB,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAC;AAEF,gHAAgH;AAChH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAsB;IACvD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE;QAClD,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC;QAC7B,GAAG,EAAE,OAAO,CAAC,WAAW;QACxB,GAAG,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;QAC3B,YAAY,EAAE,GAAG,CAAC,SAAS;QAC3B,eAAe,EAAE,MAAM;KACxB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,cAAuB,CAAC,CAAC;IACtE,IAAI,MAA0B,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC,MAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,MAAM,GACV,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;QACxB,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,eAAe,EAAE,IAAI,EAAE,8EAA8E;QACrG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;IACH,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;QACpB,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GACV,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;IACpF,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IAEjD,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QACvF,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC/D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QACD,eAAe,EAAE,KAAK;QACtB,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,GAAG,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,wGAAwG;IACxG,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,CAErC,EAA4B,EAC5B,OAAO,GAAiC,EAAE;QAE1C,MAAM,OAAO,GAAG,IAEf,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;YAC3B,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,iBAAiB,EACjB,mBAAmB,EACnB,yCAAyC,EACzC,gBAAgB,CACjB,CAAC;QACJ,MAAM,UAAU,GAAG;YACjB,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC1C,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACzD,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC1C,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAU,CAAC,CAAC;IAEZ,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAChD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,OAAO,CAAC,MAAM,EAAE,EAAE;YACxD,UAAU,EAAE;gBACV,qBAAqB,EAAE,OAAO,CAAC,MAAM;gBACrC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBAC3C,iBAAiB,EAAE,OAAO,CAAC,EAAE;aAC9B;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,sFAAsF;IACtF,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO;QAC5D,OAAO,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC;QAC9B,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC5B,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,GAAG;YAClC,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,IAAI,UAAU;YACvD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;YAChF,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CACxB,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE;YAClF,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI;YACnE,oBAAoB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAC1C,IAAI,WAAW,CACb,GAAG,EACH,cAAc,EACd,mBAAmB,EACnB,YAAY,OAAO,CAAC,GAAG,iBAAiB,OAAO,CAAC,KAAK,WAAW,EAChE,eAAe,OAAO,CAAC,KAAK,GAAG,CAChC;SACJ,CAAC,CAAC;IACL,8GAA8G;IAC9G,kEAAkE;IAClE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC9C,IAAI,YAAY;YAAE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YACxE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;;YAC1E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,KAAK;aACR,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,0BAA0B,CAAC;aAChC,IAAI,CAAC;YACJ,IAAI,EAAE,qCAAqC;YAC3C,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,YAAY,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG;SACzE,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,KAAK,SAAS;QACpB,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC;IAEhF,uEAAuE;IACvE,KAAK,MAAM,SAAS,IAAI,0BAA0B,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB;IACxF,IAAI,OAAgB,CAAC;IACrB,eAAe,CAAC,GAAG,EAAE;QACnB,MAAM;QACN,MAAM;QACN,OAAO,EAAE,GAAG,EAAE;YACZ,OAAO,KAAK,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3F,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEpB,qEAAqE;IACrE,MAAM,OAAO,GAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO;QACrC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YACxB,MAAO,CAAC,CAAC,MAAqD,CAAC,OAAO,CAAC,CAAC;IAE5E,0GAA0G;IAC1G,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC/E,MAAM,MAAM,GAAkC,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACrD,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC;QAC9B,CAAC;QACD,IAAI,MAAM,KAAK,SAAS;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,IAAI,OAAkC,CAAC;IACvC,OAAO;QACL,GAAG;QACH,MAAM;QACN,MAAM;QACN,QAAQ;QACR,IAAI;QACJ,KAAK;YACH,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;gBACtB,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,gDAAgD;gBACnE,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;gBACzC,MAAM,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,OAAO,GAIH,EAAE;IAEN,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,SAAS;KAChC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAc,EAAQ,EAAE;QACpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;QACjD,KAAK,MAAM;aACR,KAAK,EAAE;aACP,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;aAClC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC;AACjB,CAAC"}