shutro-erp 0.3.6 → 0.3.7

package/dist/server/auth/service.js

@@ -594,6 +594,10 @@ export class AuthService {
                 twoFactorEnabled,
                 administrator,
                 administratorNeedsSecondFactor: administrator && !(session.secondFactor && twoFactorEnabled),
+                developer: administrator ||
+                    (await model(env, 'auth.user_group').search({
+                        where: { user: session.user, group: 'base.developer' },
+                    })).length > 0,
                 twoFactorSetupRequired: !twoFactorEnabled && (await this.policy()).twoFactor === 'everyone',
             };
         });
@@ -702,6 +706,21 @@ export class AuthService {
             });
     }
     /** Turns 2FA off (password and a current code required). */
+    /**
+     * A step-up check (RFC 0008 §5.4): the user's current authenticator code, asked again for a dangerous action
+     * (removing an app with its data). Recovery codes do not count. @throws {HttpProblem} 409 when two-factor is off,
+     * 422 when the code does not match
+     */
+    async confirmSecondFactor(user, code) {
+        await this.#system('2fa step-up', async (env) => {
+            const credentials = await model(env, 'auth.credential').search({ where: { user } });
+            const [row] = await fetch(credentials, ['totpSecret', 'totpEnabled']);
+            if (row?.['totpEnabled'] !== true || typeof row['totpSecret'] !== 'string')
+                throw new HttpProblem(409, 'two-factor-off', 'Two-factor authentication is off', 'This needs a code from your authenticator app.', 'Turn on two-factor sign-in in Settings › Your profile first.');
+            if (!verifyTotp(row['totpSecret'], code.trim()))
+                throw new HttpProblem(422, 'invalid-code', 'Invalid code', 'The code does not match.', 'Use the current code of the authenticator app.');
+        });
+    }
     async disableTwoFactor(session, password, code) {
         if ((await this.policy()).twoFactor === 'everyone')
             throw new HttpProblem(409, 'two-factor-required', 'Two-factor sign-in is required', 'This installation requires two-factor sign-in of everyone: it cannot be turned off.');

package/dist/server/events.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Named events of state transitions (RFC 0023 E1, RFC 0006): `emitting(topic, transition)` returns the transition
+ * with an `after` hook that emits `topic` with `{ id }` for each record, once its own `after` ran — in the same
+ * transaction, through the outbox, so notifications, automations and webhooks take it by name. The module declares
+ * the topic in its manifest's `events`.
+ *
+ * ```ts
+ * transitions: {
+ *   validate: emitting('stock.picking.done', { from: ['assigned'], to: 'done', after: … }),
+ * }
+ * ```
+ */
+export declare function emitting<const T extends object>(topic: string, transition: T): T;

package/dist/server/events.js

@@ -0,0 +1,22 @@
+/**
+ * Named events of state transitions (RFC 0023 E1, RFC 0006): `emitting(topic, transition)` returns the transition
+ * with an `after` hook that emits `topic` with `{ id }` for each record, once its own `after` ran — in the same
+ * transaction, through the outbox, so notifications, automations and webhooks take it by name. The module declares
+ * the topic in its manifest's `events`.
+ *
+ * ```ts
+ * transitions: {
+ *   validate: emitting('stock.picking.done', { from: ['assigned'], to: 'done', after: … }),
+ * }
+ * ```
+ */
+export function emitting(topic, transition) {
+    const own = transition.after;
+    const after = async (records) => {
+        await own?.(records);
+        const { env, ids } = records;
+        for (const id of ids)
+            await env.emit(topic, { id });
+    };
+    return { ...transition, after };
+}

package/dist/server/i18n.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Translated metadata (RFC 0023 §3.1): modules ship dictionaries keyed by the English text (`i18n: { bn: () =>
+ * import('./i18n/bn.js') }`, each `export const bn = { 'Customer': 'গ্রাহক', … }`). The server merges every installed
+ * module's dictionaries at start and translates what it serves to the request's language (`Accept-Language`): the
+ * labels, help, descriptions, titles and options of views, menus, actions, apps, model metadata, searches, overviews
+ * and settings, and the message of a problem. English stays the key, so code never changes; a string without a
+ * translation is served in English.
+ */
+import type { FastifyInstance } from 'fastify';
+/** language → English text → translation. */
+export type Dictionaries = ReadonlyMap<string, ReadonlyMap<string, string>>;
+/** Merges the modules' dictionaries (`i18n` loaders) per language; a module's own entries never lose to an empty one. */
+export declare function loadDictionaries(modules: readonly {
+    readonly i18n?: Readonly<Record<string, () => Promise<unknown>>>;
+}[]): Promise<Dictionaries>;
+/** The dictionary of a Shutro language code (`bn_BD`, then `bn`), or none for English. */
+export declare function dictionaryFor(dictionaries: Dictionaries, lang: string | null): ReadonlyMap<string, string> | null;
+/**
+ * A copy of `value` with the people-facing strings translated (and `[value, label]` options' labels). A field's own
+ * label may have a context key, `<model>.<field>` (`res.partner.state` → রাজ্য where "State" is a region), looked up
+ * before the English text: in a served view's `fields` (model → field → description) and a model's metadata.
+ */
+export declare function translateValue(value: unknown, dict: ReadonlyMap<string, string>, key?: string, field?: string): unknown;
+/** A problem's detail with the known messages in it translated (`project.project: A project …`). */
+export declare function translateDetail(detail: string, dict: ReadonlyMap<string, string>): string;
+/** Translates metadata responses and problems to the request's language. */
+export declare function registerTranslation(app: FastifyInstance, dictionaries: Dictionaries): void;

package/dist/server/i18n.js

@@ -0,0 +1,143 @@
+/** The keys whose string values people read (as `pnpm i18n:extract` collects them). */
+const TEXT_KEYS = new Set([
+    'label',
+    'description',
+    'help',
+    'title',
+    'summary',
+    'confirm',
+    'message',
+    'placeholder',
+    'category',
+    'text',
+    'header',
+    'footer',
+    'successMessage',
+    'name',
+]);
+/** Merges the modules' dictionaries (`i18n` loaders) per language; a module's own entries never lose to an empty one. */
+export async function loadDictionaries(modules) {
+    const out = new Map();
+    for (const m of modules)
+        for (const [lang, load] of Object.entries(m.i18n ?? {})) {
+            const loaded = (await load());
+            const dict = (loaded?.[lang] ?? loaded?.['default'] ?? loaded);
+            const target = out.get(lang) ?? new Map();
+            for (const [source, text] of Object.entries(dict ?? {}))
+                if (typeof text === 'string' && text !== '' && !target.has(source))
+                    target.set(source, text);
+            out.set(lang, target);
+        }
+    return out;
+}
+/** The dictionary of a Shutro language code (`bn_BD`, then `bn`), or none for English. */
+export function dictionaryFor(dictionaries, lang) {
+    if (lang === null || lang === '' || lang.startsWith('en'))
+        return null;
+    return dictionaries.get(lang) ?? dictionaries.get(lang.split(/[_-]/)[0] ?? '') ?? null;
+}
+/** A model name (`sale.order`): what keys a served view's `fields` map by. */
+const MODEL = /^[a-z][a-z0-9_]*(\.[a-z0-9_]+)+$/;
+/**
+ * A copy of `value` with the people-facing strings translated (and `[value, label]` options' labels). A field's own
+ * label may have a context key, `<model>.<field>` (`res.partner.state` → রাজ্য where "State" is a region), looked up
+ * before the English text: in a served view's `fields` (model → field → description) and a model's metadata.
+ */
+export function translateValue(value, dict, key, field) {
+    if (typeof value === 'string') {
+        if (key === undefined || !TEXT_KEYS.has(key))
+            return value;
+        return ((key === 'label' && field !== undefined ? dict.get(field) : undefined) ??
+            dict.get(value) ??
+            value);
+    }
+    if (Array.isArray(value)) {
+        // A selection's options: [value, label] pairs.
+        if (key === 'options' &&
+            value.every((o) => Array.isArray(o) && o.length === 2 && typeof o[1] === 'string'))
+            return value.map((o) => [o[0], dict.get(o[1]) ?? o[1]]);
+        return value.map((v) => translateValue(v, dict, key === 'options' ? undefined : key));
+    }
+    if (value !== null && typeof value === 'object') {
+        if (value instanceof Date)
+            return value;
+        const o = value;
+        const out = {};
+        // A model's metadata: `{ name: 'res.partner', fields: [{ key, label, … }] }`.
+        const model = typeof o['name'] === 'string' && MODEL.test(o['name']) ? o['name'] : null;
+        for (const [k, v] of Object.entries(o)) {
+            if (k === 'fields' && v !== null && typeof v === 'object' && !Array.isArray(v)) {
+                // A served view's fields: model → field → description.
+                const byModel = {};
+                for (const [m, fields] of Object.entries(v)) {
+                    if (!MODEL.test(m) || fields === null || typeof fields !== 'object') {
+                        byModel[m] = translateValue(fields, dict, m);
+                        continue;
+                    }
+                    const translated = {};
+                    for (const [f, d] of Object.entries(fields))
+                        translated[f] = translateValue(d, dict, f, `${m}.${f}`);
+                    byModel[m] = translated;
+                }
+                out[k] = byModel;
+            }
+            else if (k === 'fields' && Array.isArray(v) && model !== null)
+                out[k] = v.map((d) => d !== null &&
+                    typeof d === 'object' &&
+                    typeof d['key'] === 'string'
+                    ? translateValue(d, dict, undefined, `${model}.${String(d['key'])}`)
+                    : translateValue(d, dict, k));
+            else
+                out[k] = translateValue(v, dict, k, k === 'label' ? field : undefined);
+        }
+        return out;
+    }
+    return value;
+}
+/** A problem's detail with the known messages in it translated (`project.project: A project …`). */
+export function translateDetail(detail, dict) {
+    let out = detail;
+    for (const [source, text] of dict)
+        if (source.length >= 12 && out.includes(source))
+            out = out.split(source).join(text);
+    return out;
+}
+/** The routes that serve metadata, translated as a whole. */
+const METADATA = [
+    '/api/v1/apps',
+    '/api/v1/menus',
+    '/api/v1/actions/',
+    '/api/v1/views',
+    '/api/v1/search/',
+    '/api/v1/meta/',
+    '/api/v1/reports/overview',
+    '/api/v1/settings/',
+    '/api/v1/models/', // only `/next` (transitions and their messages), below
+];
+/** `bn-BD,bn;q=0.9` → `bn_BD`. */
+function languageOf(request) {
+    const header = request.headers['accept-language'];
+    const first = (Array.isArray(header) ? header[0] : header)?.split(',')[0]?.split(';')[0]?.trim();
+    return first === undefined || first === '' ? null : first.replace('-', '_');
+}
+/** Translates metadata responses and problems to the request's language. */
+export function registerTranslation(app, dictionaries) {
+    if (dictionaries.size === 0)
+        return;
+    app.addHook('preSerialization', async (request, reply, payload) => {
+        const dict = dictionaryFor(dictionaries, languageOf(request));
+        if (dict === null || payload === null || typeof payload !== 'object')
+            return payload;
+        const url = request.url.split('?')[0] ?? '';
+        if (reply.statusCode >= 400) {
+            const p = payload;
+            return typeof p['detail'] === 'string'
+                ? { ...p, detail: translateDetail(p['detail'], dict) }
+                : payload;
+        }
+        const metadata = request.method === 'GET' &&
+            METADATA.some((prefix) => url.startsWith(prefix)) &&
+            (!url.startsWith('/api/v1/models/') || url.endsWith('/next'));
+        return metadata ? translateValue(payload, dict) : payload;
+    });
+}

package/dist/server/index.d.ts

@@ -23,7 +23,9 @@ export { type AuthOptions, AuthService, cookieOf, SESSION_COOKIE, type SecurityP
 export { DEMO_PASSWORD, type DemoResult, installDemo } from './demo.js';
 export { applyEnvironmentNames } from './env-names.js';
 export { HttpProblem, type Problem, problemOf, ServerConfigError } from './errors.js';
+export { emitting } from './events.js';
 export { type AppHost, type AppHostOptions, createAppHost, startAppHost } from './host.js';
+export { type Dictionaries, dictionaryFor, loadDictionaries, translateDetail, translateValue, } from './i18n.js';
 export { type Authenticator, denyAll, isSuperuser, languageOf, type RequestIdentity, type RequestRunOptions, runOptionsOf, } from './identity.js';
 export { imageVersions, registerImageRoutes } from './images.js';
 export { migrate, orm, pg } from './orm.js';

package/dist/server/index.js

@@ -23,7 +23,9 @@ export { AuthService, cookieOf, SESSION_COOKIE, timeOf, } from './auth/service.j
 export { DEMO_PASSWORD, installDemo } from './demo.js';
 export { applyEnvironmentNames } from './env-names.js';
 export { HttpProblem, problemOf, ServerConfigError } from './errors.js';
+export { emitting } from './events.js';
 export { createAppHost, startAppHost } from './host.js';
+export { dictionaryFor, loadDictionaries, translateDetail, translateValue, } from './i18n.js';
 export { denyAll, isSuperuser, languageOf, runOptionsOf, } from './identity.js';
 export { imageVersions, registerImageRoutes } from './images.js';
 export { migrate, orm, pg } from './orm.js';

package/dist/server/server.js

@@ -6,6 +6,7 @@
 import rateLimit from '@fastify/rate-limit';
 import Fastify, {} from 'fastify';
 import { Valkey } from 'iovalkey';
+import { registerExplain } from './api/explain.js';
 import { idempotencyTableStatements } from './api/idempotency.js';
 import { publicApiModels } from './api/metadata.js';
 import { Navigation } from './api/navigation.js';
@@ -19,6 +20,7 @@ import { enforceScopes } from './auth/scopes.js';
 import { AuthService } from './auth/service.js';
 import { applyEnvironmentNames } from './env-names.js';
 import { HttpProblem, problemOf, ServerConfigError } from './errors.js';
+import { loadDictionaries, registerTranslation } from './i18n.js';
 import { denyAll, runOptionsOf } from './identity.js';
 import { registerImageRoutes } from './images.js';
 import { orm, pg } from './orm.js';
@@ -218,6 +220,8 @@ export async function createServer(options) {
             baseUrl: options.oauth?.baseUrl ?? process.env['KOSH_BASE_URL'] ?? 'http://localhost:5173',
         });
     }
+    // Metadata and problems in the request's language, from the modules' dictionaries (RFC 0023 §3.1).
+    registerTranslation(app, await loadDictionaries(registry.loaded.modules));
     // The generated REST API and its OpenAPI document (RFC 0002 §6.3–6.4).
     for (const statement of idempotencyTableStatements())
         await driver.query(statement);
@@ -235,6 +239,8 @@ export async function createServer(options) {
             return openapi;
         },
     });
+    // What models, fields and buttons are, for Developer mode (RFC 0031 §3.1).
+    registerExplain(app, { registry, models });
     new Navigation(registry.loaded, models).register(app);
     views.register(app);
     // Module routes (admin APIs, custom endpoints), in dependency order.

package/dist/settings/company.d.ts

@@ -8,7 +8,9 @@
  * - `PATCH /api/v1/settings/company`     `{ name?, numberGrouping?, accentColor?, details? }` (`accentColor`:
  *                                         `#rrggbb` or null; `details`: `{ field: value }`)
  * - `GET   /api/v1/settings/companies`   every company with its currency and people, the currencies
- * - `POST  /api/v1/settings/companies`   `{ name, currency }`: a new company (administrators)
+ * - `GET   /api/v1/settings/companies`   … and the details a new company may be given (`fields`)
+ * - `POST  /api/v1/settings/companies`   `{ name, currency, numberGrouping?, accentColor?, details? }`: a new company
+ *                                         (administrators), with what each app set up for it (`defaults`)
  */
 import { type ModuleContext } from '../server/index.js';
 /** One of the company's details: a field an installed app adds. */

package/dist/settings/company.js

@@ -8,7 +8,9 @@
  * - `PATCH /api/v1/settings/company`     `{ name?, numberGrouping?, accentColor?, details? }` (`accentColor`:
  *                                         `#rrggbb` or null; `details`: `{ field: value }`)
  * - `GET   /api/v1/settings/companies`   every company with its currency and people, the currencies
- * - `POST  /api/v1/settings/companies`   `{ name, currency }`: a new company (administrators)
+ * - `GET   /api/v1/settings/companies`   … and the details a new company may be given (`fields`)
+ * - `POST  /api/v1/settings/companies`   `{ name, currency, numberGrouping?, accentColor?, details? }`: a new company
+ *                                         (administrators), with what each app set up for it (`defaults`)
  */
 import { audit, HttpProblem, imageVersions, installDefaults, publicApiModels, } from '../server/index.js';
 const model = (env, name) => env.model(name);
@@ -64,9 +66,11 @@ export function registerCompanyRoutes(context) {
     }, 
     // The superuser scope is audited: even a read writes its audit record.
     { write: true });
-    app.get('/api/v1/settings/company', async (request) => guarded(request, (su, company) => read(su, company)));
-    app.patch('/api/v1/settings/company', async (request) => {
-        const body = (request.body ?? {});
+    /**
+     * The company values of a body (`name`, `numberGrouping`, `accentColor`, `details`), checked: the same rules for a
+     * new company and a change.
+     */
+    const companyValues = (body) => {
         const values = {};
         const invalid = (code, title, detail) => new HttpProblem(422, code, title, detail);
         if (body['name'] !== undefined) {
@@ -109,6 +113,12 @@ export function registerCompanyRoutes(context) {
                 values[key] = typeof value === 'string' && value.trim() === '' ? null : value;
             }
         }
+        return values;
+    };
+    app.get('/api/v1/settings/company', async (request) => guarded(request, (su, company) => read(su, company)));
+    app.patch('/api/v1/settings/company', async (request) => {
+        const body = (request.body ?? {});
+        const values = companyValues(body);
         return guarded(request, async (su, company) => {
             if (Object.keys(values).length > 0)
                 await model(su, 'res.company').browse([company]).write(values);
@@ -122,6 +132,16 @@ export function registerCompanyRoutes(context) {
         const currencyName = new Map(currencies.map((c) => [c['id'], String(c['name'])]));
         return {
             canCreate: env.administrator,
+            // What a new company may be given: the details a person changes (not those an app's own flow sets).
+            fields: detailFields()
+                .filter((f) => !f.readonly && !SHOWN_ONLY.has(f.key))
+                .map((f) => ({
+                key: f.key,
+                label: f.label,
+                kind: f.kind,
+                help: f.help,
+                options: f.options?.map((o) => ({ value: String(o[0]), label: String(o[1]) })) ?? null,
+            })),
             companies: (await Promise.all(all.map(async (c) => ({
                 id: c['id'],
                 name: String(c['name']),
@@ -145,6 +165,7 @@ export function registerCompanyRoutes(context) {
         const body = (request.body ?? {});
         const name = String(body['name'] ?? '').trim();
         const currency = Number(body['currency']);
+        const values = companyValues({ ...body, name });
         if (name === '' || name.length > 200)
             throw new HttpProblem(422, 'invalid-name', 'Invalid name', 'The company needs a name.');
         if (!Number.isSafeInteger(currency) || currency <= 0)
@@ -155,7 +176,7 @@ export function registerCompanyRoutes(context) {
             return env.asSuperuser({ reason: 'new company' }, async (su) => {
                 if ((await find(su, 'res.currency', { id: currency }, ['name'])).length === 0)
                     throw new HttpProblem(422, 'invalid-currency', 'Invalid currency', 'Choose its currency.');
-                const company = (await model(su, 'res.company').create([{ name, currency }]))
+                const company = (await model(su, 'res.company').create([{ ...values, name, currency }]))
                     .ids[0];
                 // The administrators and the person who made it can switch to it at once.
                 const admins = [...su.access.administratorGroups()];

package/dist/settings/routes.d.ts

@@ -40,6 +40,16 @@ export interface PlanInfo {
     readonly unchanged: readonly string[];
     readonly statements: readonly string[];
     readonly empty: boolean;
+    /** Apps removed with their data (RFC 0008 §5.4), and what goes: each table or column with its rows. */
+    readonly uninstall: readonly {
+        readonly name: string;
+        readonly cascade: boolean;
+    }[];
+    readonly drops: readonly {
+        readonly table: string;
+        readonly column: string | null;
+        readonly rows: number;
+    }[];
 }
 /** Registers the App manager's routes. */
 export declare function registerAppRoutes(context: ModuleContext): void;

package/dist/settings/routes.js

@@ -17,7 +17,7 @@ const NAME = /^[a-z][a-z0-9_]{0,63}$/;
 function changeOf(body) {
     const b = (body ?? {});
     const out = {};
-    for (const key of ['install', 'enable', 'disable', 'upgrade']) {
+    for (const key of ['install', 'enable', 'disable', 'upgrade', 'uninstall']) {
         const value = b[key];
         if (value === undefined)
             continue;
@@ -30,9 +30,10 @@ function changeOf(body) {
     if ((out.install?.length ?? 0) +
         (out.enable?.length ?? 0) +
         (out.disable?.length ?? 0) +
-        (out.upgrade?.length ?? 0) ===
+        (out.upgrade?.length ?? 0) +
+        (out.uninstall?.length ?? 0) ===
         0)
-        throw new HttpProblem(400, 'invalid-body', 'Invalid request', 'Name at least one app to install, enable, disable or upgrade.');
+        throw new HttpProblem(400, 'invalid-body', 'Invalid request', 'Name at least one app to install, enable, disable, upgrade or uninstall.');
     return out;
 }
 /** Stable for the same change against the same installed set and schema. */
@@ -54,6 +55,8 @@ function planInfo(change, prepared) {
         enable: plan.enable,
         disable: plan.disable,
         upgrade: plan.upgrade,
+        uninstall: plan.uninstall,
+        drops: prepared.drops,
         unchanged: plan.unchanged,
         statements: prepared.migration.statements.map((s) => s.sql),
         empty: prepared.empty,
@@ -135,6 +138,17 @@ export function registerAppRoutes(context) {
             throw new HttpProblem(409, 'plan-changed', 'The plan changed', 'The installed apps or the schema changed since this plan was made.', 'Review the new plan, then apply it.');
         if (prepared.empty)
             return { installed: [], enabled: [], disabled: [], migration: null };
+        // Removing data (RFC 0008 §5.4): the apps' names typed back, and a fresh code from the authenticator app.
+        if ((change.uninstall ?? []).length > 0) {
+            const expected = (change.uninstall ?? []).join(' ');
+            if (typeof body.confirm !== 'string' || body.confirm.trim() !== expected)
+                throw new HttpProblem(422, 'confirm-name', 'Type the app’s name', `Removing data needs the app’s name typed: ${expected}.`);
+            if (typeof body.code !== 'string' || body.code.trim() === '')
+                throw new HttpProblem(422, 'code-required', 'A code is needed', 'Removing data needs a code from your authenticator app.');
+            if (context.auth === undefined)
+                throw new HttpProblem(503, 'auth-unavailable', 'Sign-in unavailable', 'No sign-in here.');
+            await context.auth.confirmSecondFactor(uid, body.code);
+        }
         const result = await applyApps(prepared, {
             driver,
             dir: apps.migrationsDir,
@@ -147,6 +161,8 @@ export function registerAppRoutes(context) {
             installed: result.installed,
             enabled: result.enabled,
             disabled: result.disabled,
+            uninstalled: result.uninstalled,
+            snapshot: result.snapshot,
             migration: result.migration === null
                 ? null
                 : `${result.migration.version}_${result.migration.name}.sql`,

package/dist/settings/web/AppsPage.d.ts

@@ -1,7 +1,8 @@
 /**
  * Settings → Apps (RFC 0008 §5.5): the App manager. A card per app with its icon, state and what it needs; search,
- * category and state filters; Install, Enable and Disable open the server's plan (what comes along, what goes, the
- * database changes and their SQL) and apply it after confirmation. The server decides and checks everything; this
+ * category and state filters; Install, Enable, Disable, Upgrade and Uninstall open the server's plan (what comes
+ * along, what goes, the database changes and their SQL) and apply it after confirmation — an uninstall, which removes
+ * the data, after the app's name is typed back and a code from the authenticator app is given. The server decides and checks everything; this
  * page only shows what it says. After a change every cached query is refreshed: the menus and the launcher follow.
  */
 import { type PageProps } from '../../ui/index.js';

package/dist/settings/web/AppsPage.js

@@ -1,8 +1,9 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 /**
  * Settings → Apps (RFC 0008 §5.5): the App manager. A card per app with its icon, state and what it needs; search,
- * category and state filters; Install, Enable and Disable open the server's plan (what comes along, what goes, the
- * database changes and their SQL) and apply it after confirmation. The server decides and checks everything; this
+ * category and state filters; Install, Enable, Disable, Upgrade and Uninstall open the server's plan (what comes
+ * along, what goes, the database changes and their SQL) and apply it after confirmation — an uninstall, which removes
+ * the data, after the app's name is typed back and a code from the authenticator app is given. The server decides and checks everything; this
  * page only shows what it says. After a change every cached query is refreshed: the menus and the launcher follow.
  */
 import { Alert, ApiError, AppIcon, Badge, Button, Card, Checkbox, Dialog, Input, Select, Spinner, } from '../../ui/index.js';
@@ -42,7 +43,12 @@ export function AppsPage({ api, label }) {
         },
     });
     const apply = useMutation({
-        mutationFn: (p) => api.call('POST', '/api/v1/settings/apps/apply', { change: { [p.kind]: [p.app.name] }, planId: p.plan.planId }),
+        mutationFn: ({ p, confirm, code }) => api.call('POST', '/api/v1/settings/apps/apply', {
+            change: { [p.kind]: [p.app.name] },
+            planId: p.plan.planId,
+            ...(confirm === undefined ? {} : { confirm }),
+            ...(code === undefined ? {} : { code }),
+        }),
         onSuccess: async (result) => {
             const labelOf = (name) => catalogue.data?.apps.find((a) => a.name === name)?.label ?? name;
             const parts = [
@@ -50,6 +56,7 @@ export function AppsPage({ api, label }) {
                 ...result.enabled.map((n) => t('doneEnabled', { name: labelOf(n) })),
                 ...result.disabled.map((n) => t('doneDisabled', { name: labelOf(n) })),
                 ...(result.upgraded ?? []).map((n) => t('doneUpgraded', { name: labelOf(n) })),
+                ...(result.uninstalled ?? []).map((n) => t('doneUninstalled', { name: labelOf(n) })),
             ];
             setPending(null);
             setDone(parts.length === 0 ? t('nothingToDo') : t('done', { list: parts.join(', ') }));
@@ -99,26 +106,35 @@ export function AppsPage({ api, label }) {
                                                         ? ''
                                                         : t('needs', { list: a.depends.map(labelOf).join(', ') }) }), a.installedVersion === null || a.state !== 'installed' ? null : (_jsx(Button, { size: "sm", variant: "primary", busy: plan.isPending &&
                                                 plan.variables?.kind === 'upgrade' &&
-                                                plan.variables.app.name === a.name, "aria-label": `${t('upgrade')} ${a.label}`, onClick: () => plan.mutate({ kind: 'upgrade', app: a }), children: t('upgrade') })), kind === null ? null : (_jsx(Button, { size: "sm", variant: kind === 'disable' ? 'secondary' : 'primary', busy: busy, "aria-label": `${t(kind)} ${a.label}`, onClick: () => plan.mutate({ kind, app: a }), children: t(kind) }))] })] }) }, a.name));
+                                                plan.variables.app.name === a.name, "aria-label": `${t('upgrade')} ${a.label}`, onClick: () => plan.mutate({ kind: 'upgrade', app: a }), children: t('upgrade') })), kind === null ? null : (_jsx(Button, { size: "sm", variant: kind === 'disable' ? 'secondary' : 'primary', busy: busy, "aria-label": `${t(kind)} ${a.label}`, onClick: () => plan.mutate({ kind, app: a }), children: t(kind) })), a.state === 'available' || a.protected ? null : (_jsx(Button, { size: "sm", variant: "ghost", busy: plan.isPending &&
+                                                plan.variables?.kind === 'uninstall' &&
+                                                plan.variables.app.name === a.name, "aria-label": `${t('uninstall')} ${a.label}`, onClick: () => plan.mutate({ kind: 'uninstall', app: a }), children: t('uninstall') }))] })] }) }, a.name));
                 }) })), pending === null ? null : (_jsx(PlanDialog, { pending: pending, labelOf: labelOf, busy: apply.isPending, error: apply.error === null ? null : message(apply.error), onCancel: () => {
                     apply.reset();
                     setPending(null);
-                }, onConfirm: () => apply.mutate(pending) }))] }));
+                }, onConfirm: (confirm, code) => apply.mutate(confirm === undefined ? { p: pending } : { p: pending, confirm, code: code ?? '' }) }))] }));
 }
 function PlanDialog({ pending, labelOf, busy, error, onCancel, onConfirm, }) {
     const { t } = useTranslation('settings');
     const { kind, app, plan } = pending;
+    const formId = useId();
+    const [typed, setTyped] = useState('');
+    const [code, setCode] = useState('');
+    const removing = kind === 'uninstall';
+    const ready = !removing || (typed.trim() === app.name && code.trim() !== '');
     const title = t(kind === 'install'
         ? 'planTitleInstall'
         : kind === 'enable'
             ? 'planTitleEnable'
             : kind === 'upgrade'
                 ? 'planTitleUpgrade'
-                : 'planTitleDisable', { name: app.label });
+                : kind === 'uninstall'
+                    ? 'planTitleUninstall'
+                    : 'planTitleDisable', { name: app.label });
     return (_jsx(Dialog, { open: true, onOpenChange: (open) => {
             if (!open && !busy)
                 onCancel();
-        }, title: title, footer: _jsxs(_Fragment, { children: [_jsx(Button, { variant: "secondary", onClick: onCancel, disabled: busy, children: t('cancel') }), _jsx(Button, { variant: kind === 'disable' ? 'danger' : 'primary', busy: busy, disabled: plan.empty, onClick: onConfirm, children: busy
+        }, title: title, footer: _jsxs(_Fragment, { children: [_jsx(Button, { variant: "secondary", onClick: onCancel, disabled: busy, children: t('cancel') }), _jsx(Button, { variant: kind === 'disable' || removing ? 'danger' : 'primary', busy: busy, disabled: plan.empty || !ready, onClick: () => (removing ? onConfirm(typed.trim(), code.trim()) : onConfirm()), children: busy
                         ? t('applying')
                         : t(kind === 'install'
                             ? 'confirmInstall'
@@ -126,7 +142,9 @@ function PlanDialog({ pending, labelOf, busy, error, onCancel, onConfirm, }) {
                                 ? 'confirmEnable'
                                 : kind === 'upgrade'
                                     ? 'confirmUpgrade'
-                                    : 'confirmDisable') })] }), children: _jsxs("div", { className: "grid gap-3 text-sm", children: [plan.empty ? _jsx("p", { children: t('nothingToDo') }) : null, plan.install.length === 0 ? null : (_jsx(PlanList, { title: t('planInstall'), children: plan.install.map((m) => (_jsxs("li", { children: [labelOf(m.name), m.reason === 'dependency' ? (_jsxs("span", { className: "text-muted-foreground", children: [" \u00B7 ", t('planNeeded')] })) : null] }, m.name))) })), plan.enable.length === 0 ? null : (_jsx(PlanList, { title: t('planEnable'), children: plan.enable.map((name) => (_jsx("li", { children: labelOf(name) }, name))) })), plan.disable.length === 0 ? null : (_jsx(PlanList, { title: t('planDisable'), children: plan.disable.map((m) => (_jsxs("li", { children: [labelOf(m.name), m.cascade ? (_jsxs("span", { className: "text-muted-foreground", children: [" \u00B7 ", t('planCascade')] })) : null] }, m.name))) })), plan.upgrade.length === 0 ? null : (_jsx(PlanList, { title: t('planUpgrade'), children: plan.upgrade.map((u) => (_jsxs("li", { children: [labelOf(u.name), ' ', _jsxs("span", { className: "text-muted-foreground", children: [u.from, " \u2192 ", u.to] })] }, u.name))) })), kind === 'disable' ? _jsx(Alert, { tone: "warning", children: t('planKeepsData') }) : null, kind === 'install' ? _jsx("p", { className: "text-muted-foreground", children: t('planAccess') }) : null, _jsx("p", { className: "text-muted-foreground", children: plan.statements.length === 0
+                                    : removing
+                                        ? 'confirmUninstall'
+                                        : 'confirmDisable') })] }), children: _jsxs("div", { className: "grid gap-3 text-sm", children: [plan.empty ? _jsx("p", { children: t('nothingToDo') }) : null, plan.install.length === 0 ? null : (_jsx(PlanList, { title: t('planInstall'), children: plan.install.map((m) => (_jsxs("li", { children: [labelOf(m.name), m.reason === 'dependency' ? (_jsxs("span", { className: "text-muted-foreground", children: [" \u00B7 ", t('planNeeded')] })) : null] }, m.name))) })), plan.enable.length === 0 ? null : (_jsx(PlanList, { title: t('planEnable'), children: plan.enable.map((name) => (_jsx("li", { children: labelOf(name) }, name))) })), plan.disable.length === 0 ? null : (_jsx(PlanList, { title: t('planDisable'), children: plan.disable.map((m) => (_jsxs("li", { children: [labelOf(m.name), m.cascade ? (_jsxs("span", { className: "text-muted-foreground", children: [" \u00B7 ", t('planCascade')] })) : null] }, m.name))) })), plan.upgrade.length === 0 ? null : (_jsx(PlanList, { title: t('planUpgrade'), children: plan.upgrade.map((u) => (_jsxs("li", { children: [labelOf(u.name), ' ', _jsxs("span", { className: "text-muted-foreground", children: [u.from, " \u2192 ", u.to] })] }, u.name))) })), plan.uninstall.length === 0 ? null : (_jsx(PlanList, { title: t('planUninstall'), children: plan.uninstall.map((m) => (_jsxs("li", { children: [labelOf(m.name), m.cascade ? (_jsxs("span", { className: "text-muted-foreground", children: [" \u00B7 ", t('planCascade')] })) : null] }, m.name))) })), plan.drops.length === 0 ? null : (_jsxs("div", { children: [_jsx("h3", { className: "mb-1 font-medium", children: t('planDrops') }), _jsxs("table", { className: "w-full text-xs", children: [_jsx("thead", { children: _jsxs("tr", { className: "text-muted-foreground", children: [_jsx("th", { className: "text-start font-normal", children: t('planDropWhat') }), _jsx("th", { className: "text-end font-normal", children: t('planDropRows') })] }) }), _jsx("tbody", { children: plan.drops.map((d) => (_jsxs("tr", { children: [_jsx("td", { dir: "ltr", className: "text-start", children: d.column === null ? d.table : `${d.table}.${d.column}` }), _jsx("td", { className: "text-end tabular-nums", children: d.rows })] }, `${d.table}.${d.column ?? ''}`))) })] })] })), removing ? (_jsxs(_Fragment, { children: [_jsx(Alert, { children: t('planRemovesData') }), _jsxs("label", { htmlFor: `${formId}-name`, className: "grid gap-1", children: [_jsx("span", { children: t('typeName', { name: app.name }) }), _jsx(Input, { id: `${formId}-name`, autoComplete: "off", value: typed, onChange: (e) => setTyped(e.target.value) })] }), _jsxs("label", { htmlFor: `${formId}-code`, className: "grid gap-1", children: [_jsx("span", { children: t('authCode') }), _jsx(Input, { id: `${formId}-code`, inputMode: "numeric", autoComplete: "one-time-code", value: code, onChange: (e) => setCode(e.target.value) })] })] })) : null, kind === 'disable' ? _jsx(Alert, { tone: "warning", children: t('planKeepsData') }) : null, kind === 'install' ? _jsx("p", { className: "text-muted-foreground", children: t('planAccess') }) : null, _jsx("p", { className: "text-muted-foreground", children: plan.statements.length === 0
                         ? t('planNoSchema')
                         : t('planSchema', { count: plan.statements.length }) }), plan.statements.length === 0 ? null : (_jsxs("details", { children: [_jsx("summary", { className: "cursor-pointer text-muted-foreground", children: t('planShowSql') }), _jsx("pre", { className: "mt-2 max-h-48 overflow-auto rounded-md bg-muted p-2 text-xs", dir: "ltr", children: plan.statements.map((sql) => `${sql};`).join('\n') })] })), error === null ? null : _jsx(Alert, { children: error })] }) }));
 }