@hilbras/keystone 1.1.0

package/src/services/application/identity.ts

@@ -0,0 +1,56 @@
+import type { IdentityDomainService } from "../domain/identity.js";
+import type { User } from "../../db/schema.js";
+import type { Result } from "../../lib/result.js";
+
+export class IdentityApplicationService {
+  constructor(private readonly domain: IdentityDomainService) {}
+
+  async findUser(id: string): Promise<Result<User>> {
+    return this.domain.findUser(id);
+  }
+
+  async findUserByEmail(email: string): Promise<Result<User>> {
+    return this.domain.findUserByEmail(email);
+  }
+
+  async upsertInvitedUser(input: { email: string; name?: string; username?: string }): Promise<Result<User>> {
+    return this.domain.upsertInvitedUser(input);
+  }
+
+  async updateUserProfile(
+    userId: string,
+    updates: Partial<{ name: string; username: string; role: string; emailVerified: boolean }>
+  ): Promise<Result<User>> {
+    return this.domain.updateUserProfile(userId, updates);
+  }
+
+  async deactivate(userId: string): Promise<Result<void>> {
+    return this.domain.deactivate(userId);
+  }
+
+  async listOrganizationUsers(orgId: string): Promise<User[]> {
+    return this.domain.listOrganizationUsers(orgId);
+  }
+
+  async linkUserIdentity(
+    userId: string,
+    providerId: string,
+    providerType: string,
+    externalSub: string,
+    email?: string
+  ): Promise<Result<void>> {
+    return this.domain.linkUserIdentity(userId, providerId, providerType, externalSub, email);
+  }
+
+  async getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{ url: string }>> {
+    return this.domain.getFederationAuthorizeUrl(provider, state, redirectUri);
+  }
+
+  async completeFederationLogin(
+    provider: string,
+    code: string,
+    redirectUri: string
+  ): Promise<Result<{ user: User; tokens: { accessToken: string; refreshToken: string } }>> {
+    return this.domain.completeFederationLogin(provider, code, redirectUri);
+  }
+}

package/src/services/application/index.ts

@@ -0,0 +1,3 @@
+export { AuthenticationApplicationService } from "./authentication.js";
+export { IdentityApplicationService } from "./identity.js";
+export { OrganizationApplicationService } from "./organization.js";

package/src/services/application/organization.ts

@@ -0,0 +1,77 @@
+import type { OrganizationDomainService } from "../domain/organization.js";
+import type { AuthorizationDomainService, OrgRole } from "../domain/authorization.js";
+import type { IdentityDomainService } from "../domain/identity.js";
+import type { Organization, Application, OrgMembership } from "../../db/schema.js";
+import type { Result } from "../../lib/result.js";
+
+export class OrganizationApplicationService {
+  constructor(
+    private readonly domain: OrganizationDomainService,
+    private readonly authorization: AuthorizationDomainService,
+    private readonly identity: IdentityDomainService
+  ) {}
+
+  async createOrganization(
+    userId: string,
+    input: { name: string; slug?: string; plan?: string }
+  ): Promise<Result<Organization>> {
+    return this.domain.createOrganization(input, userId);
+  }
+
+  async getOrganization(userId: string, orgId: string): Promise<Result<Organization>> {
+    const membership = await this.authorization.isOrgMember(userId, orgId);
+    if (!membership) return { success: false, error: { code: "NOT_MEMBER", message: "Not a member", statusCode: 403 } };
+    return this.domain.getOrganization(orgId);
+  }
+
+  async listUserOrganizations(userId: string): Promise<Organization[]> {
+    return this.domain.listUserOrganizations(userId);
+  }
+
+  async inviteMember(
+    actorId: string,
+    orgId: string,
+    input: { email: string; role: OrgRole }
+  ): Promise<Result<{ user: { id: string }; membership: OrgMembership }>> {
+    const roleCheck = await this.authorization.requireOrgRole(actorId, orgId, ["owner", "admin"]);
+    if (!roleCheck.success) return roleCheck;
+
+    const userResult = await this.identity.upsertInvitedUser({ email: input.email });
+    if (!userResult.success) return userResult;
+
+    const membershipResult = await this.domain.addOrgMembership({ orgId, userId: userResult.data.id, role: input.role });
+    if (!membershipResult.success) return membershipResult;
+
+    return { success: true, data: { user: userResult.data, membership: membershipResult.data } };
+  }
+
+  async createApplication(
+    actorId: string,
+    orgId: string,
+    input: { name: string; redirectUris?: string[]; allowedOrigins?: string[] }
+  ): Promise<Result<Application & { clientSecret: string }>> {
+    const permCheck = await this.authorization.requireOrgRole(actorId, orgId, ["owner", "admin"]);
+    if (!permCheck.success) return permCheck;
+    return this.domain.createApplication({ orgId, ...input });
+  }
+
+  async listOrganizationApplications(
+    actorId: string,
+    orgId: string
+  ): Promise<Result<Application[]>> {
+    const roleCheck = await this.authorization.requireOrgRole(actorId, orgId, ["owner", "admin", "member"]);
+    if (!roleCheck.success) return roleCheck;
+    return { success: true, data: await this.domain.listOrganizationApplications(orgId) };
+  }
+
+  async updateApplication(
+    actorId: string,
+    orgId: string,
+    appId: string,
+    updates: Partial<{ name: string; redirectUris: string[]; allowedOrigins: string[]; allowedIps: string[]; blockedIps: string[]; isActive: boolean }>
+  ): Promise<Result<Application>> {
+    const permCheck = await this.authorization.requireOrgRole(actorId, orgId, ["owner", "admin"]);
+    if (!permCheck.success) return permCheck;
+    return this.domain.updateApplication(appId, orgId, updates);
+  }
+}

package/src/services/applications.ts

@@ -0,0 +1,89 @@
+import crypto from "node:crypto";
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { applications, type Application } from "../db/schema.js";
+import { generateClientSecret, hashClientSecret } from "./secrets.js";
+import { cache } from "./cache.js";
+
+function appCacheKey(clientId: string): string {
+  return `app:clientId:${clientId}`;
+}
+
+export function generateClientId(): string {
+  return `app_${crypto.randomBytes(16).toString("base64url")}`;
+}
+
+// Re-exported for callers that imported these helpers from this module.
+export { generateClientSecret, hashClientSecret };
+
+export async function createApplication(input: {
+  orgId: string;
+  name: string;
+  redirectUris?: string[];
+  allowedOrigins?: string[];
+  clientId?: string;
+  clientSecret?: string;
+}): Promise<Application & { clientSecret: string }> {
+  const clientSecret = input.clientSecret || generateClientSecret();
+  const [app] = await db
+    .insert(applications)
+    .values({
+      orgId: input.orgId,
+      clientId: input.clientId || generateClientId(),
+      clientSecretHash: hashClientSecret(clientSecret),
+      name: input.name,
+      redirectUris: input.redirectUris ?? [],
+      allowedOrigins: input.allowedOrigins ?? [],
+    })
+    .returning();
+  return { ...app, clientSecret };
+}
+
+export async function findApplicationByClientId(
+  clientId: string
+): Promise<Application | undefined> {
+  const cached = await cache.get<Application>(appCacheKey(clientId));
+  if (cached) return cached;
+
+  const [app] = await db
+    .select()
+    .from(applications)
+    .where(eq(applications.clientId, clientId))
+    .limit(1);
+  if (app) await cache.set(appCacheKey(clientId), app, 60);
+  return app;
+}
+
+export async function findApplicationsByOrgId(orgId: string): Promise<Application[]> {
+  return db.select().from(applications).where(eq(applications.orgId, orgId));
+}
+
+export async function updateApplication(
+  appId: string,
+  orgId: string,
+  updates: Partial<{
+    name: string;
+    redirectUris: string[];
+    allowedOrigins: string[];
+    isActive: boolean;
+    branding: Record<string, unknown>;
+  }>
+): Promise<Application | undefined> {
+  const [updated] = await db
+    .update(applications)
+    .set(updates)
+    .where(and(eq(applications.id, appId), eq(applications.orgId, orgId)))
+    .returning();
+  if (updated) await cache.del(appCacheKey(updated.clientId));
+  return updated;
+}
+
+export async function verifyClientSecret(
+  clientId: string,
+  secret: string
+): Promise<Application | undefined> {
+  const app = await findApplicationByClientId(clientId);
+  if (!app || !app.isActive) return undefined;
+  if (app.clientSecretHash !== hashClientSecret(secret)) return undefined;
+  return app;
+}

package/src/services/audit.ts

@@ -0,0 +1,41 @@
+import { eq, and, desc, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { auditLog } from "../db/schema.js";
+import { emit } from "./events/bus.js";
+import type { AuditEventType, EventPayload } from "./events/types.js";
+
+export type AuditEvent = AuditEventType;
+
+export interface AuditInput extends EventPayload {
+  event: AuditEvent;
+}
+
+export async function audit(input: AuditInput): Promise<void> {
+  await emit({ type: input.event, version: 1, payload: input });
+}
+
+export async function listAuditLogs(opts: {
+  orgId?: string;
+  appId?: string;
+  userId?: string;
+  event?: string;
+  limit?: number;
+  offset?: number;
+}): Promise<typeof auditLog.$inferSelect[]> {
+  const limit = opts.limit ?? 50;
+  const offset = opts.offset ?? 0;
+
+  const conditions = [];
+  if (opts.orgId) conditions.push(eq(auditLog.orgId, opts.orgId));
+  if (opts.appId) conditions.push(eq(auditLog.appId, opts.appId));
+  if (opts.userId) conditions.push(eq(auditLog.userId, opts.userId));
+  if (opts.event) conditions.push(eq(auditLog.event, opts.event));
+
+  return db
+    .select()
+    .from(auditLog)
+    .where(conditions.length ? and(...conditions) : sql`true`)
+    .orderBy(desc(auditLog.createdAt))
+    .limit(limit)
+    .offset(offset);
+}

package/src/services/auditExport.ts

@@ -0,0 +1,59 @@
+import { config } from "../config.js";
+import type { AuditEvent } from "./audit.js";
+
+export interface AuditExportRecord {
+  event: AuditEvent;
+  userId?: string;
+  orgId?: string;
+  appId?: string;
+  ip?: string;
+  userAgent?: string;
+  metadata?: Record<string, unknown>;
+  createdAt: Date;
+}
+
+export interface AuditSink {
+  send(record: AuditExportRecord): Promise<void>;
+}
+
+class WebhookSink implements AuditSink {
+  private url: string;
+
+  constructor(url: string) {
+    this.url = url;
+  }
+
+  async send(record: AuditExportRecord): Promise<void> {
+    await fetch(this.url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(record),
+    });
+  }
+}
+
+class ConsoleSink implements AuditSink {
+  async send(record: AuditExportRecord): Promise<void> {
+    console.log("[audit-export]", JSON.stringify(record));
+  }
+}
+
+function createSinks(): AuditSink[] {
+  const sinks: AuditSink[] = [];
+  const webhookUrl = config.AUDIT_WEBHOOK_URL || process.env.AUDIT_WEBHOOK_URL;
+  if (webhookUrl) {
+    sinks.push(new WebhookSink(webhookUrl));
+  }
+  if (config.AUDIT_CONSOLE_EXPORT === "true" || process.env.AUDIT_CONSOLE_EXPORT === "true") {
+    sinks.push(new ConsoleSink());
+  }
+  return sinks;
+}
+
+export const auditSinks = createSinks();
+
+export async function exportAuditRecord(record: AuditExportRecord): Promise<void> {
+  await Promise.all(auditSinks.map((sink) => sink.send(record).catch((err: unknown) => {
+    console.error("[audit-export] sink failed:", err);
+  })));
+}

package/src/services/billing.ts

@@ -0,0 +1,87 @@
+import { eq, and, gte, count } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { organizations, auditLog, orgMemberships, applications } from "../db/schema.js";
+import { getBillingProviderFactory } from "./plugins/registry.js";
+
+const DEFAULT_PLANS = ["free", "starter", "growth", "enterprise"];
+
+export function listPlans(): Array<{ id: string; name: string; description: string }> {
+  return [
+    { id: "free", name: "Free", description: "Core authentication for small projects." },
+    { id: "starter", name: "Starter", description: "Email delivery, workflows, and API keys." },
+    { id: "growth", name: "Growth", description: "SSO, SCIM, and priority queue workers." },
+    { id: "enterprise", name: "Enterprise", description: "Custom SLAs, dedicated support, and advanced audit." },
+  ];
+}
+
+export function isValidPlan(plan: string): boolean {
+  return DEFAULT_PLANS.includes(plan);
+}
+
+export interface BillingSummary {
+  plan: string;
+  provider?: string;
+  subscription?: Record<string, unknown>;
+  usage?: {
+    users: number;
+    applications: number;
+    logins30d: number;
+    signups30d: number;
+  };
+}
+
+export async function getBillingSummary(orgId: string): Promise<BillingSummary> {
+  const [org] = await db.select({ plan: organizations.plan }).from(organizations).where(eq(organizations.id, orgId)).limit(1);
+  if (!org) {
+    throw Object.assign(new Error("Organization not found"), { statusCode: 404 });
+  }
+
+  const since = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+  const [[memberRow], [appRow], [loginRow], [signupRow]] = await Promise.all([
+    db.select({ total: count() }).from(orgMemberships).where(eq(orgMemberships.orgId, orgId)),
+    db.select({ total: count() }).from(applications).where(eq(applications.orgId, orgId)),
+    db
+      .select({ total: count() })
+      .from(auditLog)
+      .where(and(eq(auditLog.orgId, orgId), eq(auditLog.event, "user_login"), gte(auditLog.createdAt, since))),
+    db
+      .select({ total: count() })
+      .from(auditLog)
+      .where(and(eq(auditLog.orgId, orgId), eq(auditLog.event, "user_registered"), gte(auditLog.createdAt, since))),
+  ]);
+
+  const usage = {
+    users: memberRow?.total ?? 0,
+    applications: appRow?.total ?? 0,
+    logins30d: loginRow?.total ?? 0,
+    signups30d: signupRow?.total ?? 0,
+  };
+
+  const factory = getBillingProviderFactory(process.env.KEYSTONE_BILLING_PROVIDER || "none");
+  if (!factory) {
+    return { plan: org.plan, usage };
+  }
+  const provider = factory();
+  const subscription = await provider.getSubscription(orgId).catch(() => null);
+  return { plan: org.plan, provider: provider.name, subscription: subscription ?? undefined, usage };
+}
+
+export async function setOrganizationPlan(orgId: string, plan: string): Promise<{ plan: string }> {
+  if (!isValidPlan(plan)) {
+    throw Object.assign(new Error("Invalid plan"), { statusCode: 400 });
+  }
+  const [org] = await db.update(organizations).set({ plan, updatedAt: new Date() }).where(eq(organizations.id, orgId)).returning();
+  if (!org) {
+    throw Object.assign(new Error("Organization not found"), { statusCode: 404 });
+  }
+  return { plan: org.plan };
+}
+
+export async function provisionBillingCustomer(orgId: string, email: string): Promise<Record<string, unknown>> {
+  const factory = getBillingProviderFactory(process.env.KEYSTONE_BILLING_PROVIDER || "none");
+  if (!factory) {
+    return { ok: false, reason: "No billing provider configured" };
+  }
+  const provider = factory();
+  return provider.createCustomer(orgId, email);
+}

package/src/services/cache.ts

@@ -0,0 +1,131 @@
+import { Redis } from "ioredis";
+import { Counter } from "prom-client";
+import { config } from "../config.js";
+
+const cacheHits = new Counter({ name: "keystone_cache_hits_total", help: "Cache hits", labelNames: ["cache"] });
+const cacheMisses = new Counter({ name: "keystone_cache_misses_total", help: "Cache misses", labelNames: ["cache"] });
+const cacheSets = new Counter({ name: "keystone_cache_sets_total", help: "Cache writes", labelNames: ["cache"] });
+const cacheDeletes = new Counter({ name: "keystone_cache_deletes_total", help: "Cache invalidations", labelNames: ["cache"] });
+
+interface CacheMetrics {
+  hits: number;
+  misses: number;
+  sets: number;
+  deletes: number;
+}
+
+interface CacheEntry<T> {
+  value: T;
+  expiresAt: number;
+}
+
+class CacheProvider {
+  private redis: Redis | null = null;
+  private memory = new Map<string, CacheEntry<unknown>>();
+  private metrics: CacheMetrics = { hits: 0, misses: 0, sets: 0, deletes: 0 };
+  private prefix: string;
+
+  constructor() {
+    this.prefix = config.CACHE_KEY_PREFIX || "keystone:";
+    if (config.REDIS_URL) {
+      this.redis = new Redis(config.REDIS_URL, { maxRetriesPerRequest: 2 });
+      this.redis.on("error", (err) => {
+        console.warn("[cache] redis error, falling back to in-memory:", err.message);
+      });
+    }
+  }
+
+  private key(k: string): string {
+    return `${this.prefix}${k}`;
+  }
+
+  async get<T>(key: string): Promise<T | null> {
+    if (this.redis?.status === "ready") {
+      try {
+        const value = await this.redis.get(this.key(key));
+        if (value !== null) {
+          this.metrics.hits++;
+          cacheHits.inc({ cache: "redis" });
+          return JSON.parse(value) as T;
+        }
+      } catch {
+        // fall through to memory fallback
+      }
+    }
+
+    const entry = this.memory.get(key);
+    if (entry && entry.expiresAt > Date.now()) {
+      this.metrics.hits++;
+      cacheHits.inc({ cache: "memory" });
+      return entry.value as T;
+    }
+    if (entry) this.memory.delete(key);
+    this.metrics.misses++;
+    cacheMisses.inc({ cache: this.redis ? "redis" : "memory" });
+    return null;
+  }
+
+  async set<T>(key: string, value: T, ttlSeconds = 60): Promise<void> {
+    if (this.redis?.status === "ready") {
+      try {
+        await this.redis.setex(this.key(key), ttlSeconds, JSON.stringify(value));
+        this.metrics.sets++;
+        cacheSets.inc({ cache: "redis" });
+        return;
+      } catch {
+        // fall through to memory fallback
+      }
+    }
+    this.memory.set(key, { value, expiresAt: Date.now() + ttlSeconds * 1000 });
+    this.metrics.sets++;
+    cacheSets.inc({ cache: "memory" });
+  }
+
+  async del(key: string): Promise<void> {
+    this.memory.delete(key);
+    if (this.redis?.status === "ready") {
+      try {
+        await this.redis.del(this.key(key));
+      } catch {
+        // ignore
+      }
+    }
+    this.metrics.deletes++;
+    cacheDeletes.inc({ cache: this.redis ? "redis" : "memory" });
+  }
+
+  async invalidate(pattern: string): Promise<void> {
+    const memoryKeys = [...this.memory.keys()].filter((k) => k.includes(pattern));
+    for (const k of memoryKeys) this.memory.delete(k);
+
+    if (this.redis?.status === "ready") {
+      try {
+        let cursor = "0";
+        do {
+          const result = await this.redis.scan(cursor, "MATCH", this.key(`*${pattern}*`), "COUNT", 100);
+          cursor = result[0];
+          const keys = result[1];
+          if (keys.length) await this.redis.del(...keys);
+        } while (cursor !== "0");
+      } catch {
+        // ignore
+      }
+    }
+    this.metrics.deletes += memoryKeys.length;
+    cacheDeletes.inc({ cache: this.redis ? "redis" : "memory" }, memoryKeys.length);
+  }
+
+  getMetrics(): CacheMetrics {
+    return { ...this.metrics };
+  }
+
+  async close(): Promise<void> {
+    this.memory.clear();
+    if (this.redis) {
+      await this.redis.quit();
+      this.redis = null;
+    }
+  }
+}
+
+export const cache = new CacheProvider();

package/src/services/configuration/profiles.ts

@@ -0,0 +1,115 @@
+export interface ConfigurationProfile {
+  name: string;
+  description: string;
+  values: Record<string, string>;
+}
+
+export const CONFIGURATION_PROFILES: Record<string, ConfigurationProfile> = {
+  development: {
+    name: "Development",
+    description: "Local development with debug logging and relaxed security defaults.",
+    values: {
+      NODE_ENV: "development",
+      PORT: "4001",
+      HOST: "0.0.0.0",
+      DATABASE_URL: "postgresql://hilbras:hilbras@localhost:5432/hilbras",
+      REDIS_URL: "redis://localhost:6379",
+      KEYSTONE_QUEUE_PROVIDER: "in-process",
+      KEYSTONE_SECRETS_PROVIDER: "database",
+      EMAIL_PROVIDER: "console",
+      SMS_PROVIDER: "none",
+      AUDIT_CONSOLE_EXPORT: "true",
+      KEYSTONE_FEATURE_FLAGS: "workflows=true,beta_auth=false",
+    },
+  },
+  production: {
+    name: "Production",
+    description: "Production-grade settings with external queue and secrets providers.",
+    values: {
+      NODE_ENV: "production",
+      PORT: "4001",
+      HOST: "0.0.0.0",
+      KEYSTONE_QUEUE_PROVIDER: "bullmq",
+      KEYSTONE_SECRETS_PROVIDER: "database",
+      EMAIL_PROVIDER: "smtp",
+      SMS_PROVIDER: "twilio",
+      AUDIT_CONSOLE_EXPORT: "false",
+      KEYSTONE_FEATURE_FLAGS: "workflows=true",
+    },
+  },
+  docker: {
+    name: "Docker",
+    description: "Single-container deployment using linked Postgres and Redis services.",
+    values: {
+      NODE_ENV: "production",
+      PORT: "4001",
+      HOST: "0.0.0.0",
+      DATABASE_URL: "postgresql://hilbras:hilbras@postgres:5432/hilbras",
+      REDIS_URL: "redis://redis:6379",
+      KEYSTONE_QUEUE_PROVIDER: "bullmq",
+      KEYSTONE_SECRETS_PROVIDER: "database",
+      EMAIL_PROVIDER: "smtp",
+      SMS_PROVIDER: "none",
+      AUDIT_CONSOLE_EXPORT: "false",
+    },
+  },
+  "docker-compose": {
+    name: "Docker Compose",
+    description: "Multi-service deployment via Docker Compose.",
+    values: {
+      NODE_ENV: "production",
+      PORT: "4001",
+      HOST: "0.0.0.0",
+      DATABASE_URL: "postgresql://hilbras:hilbras@postgres:5432/hilbras",
+      REDIS_URL: "redis://redis:6379",
+      KEYSTONE_QUEUE_PROVIDER: "bullmq",
+      KEYSTONE_SECRETS_PROVIDER: "database",
+      EMAIL_PROVIDER: "smtp",
+      SMS_PROVIDER: "none",
+      AUDIT_CONSOLE_EXPORT: "false",
+      KEYSTONE_CONFIG_MODE: "json",
+    },
+  },
+  kubernetes: {
+    name: "Kubernetes",
+    description: "Kubernetes deployment with external secrets and HA queue.",
+    values: {
+      NODE_ENV: "production",
+      PORT: "4001",
+      HOST: "0.0.0.0",
+      KEYSTONE_QUEUE_PROVIDER: "bullmq",
+      KEYSTONE_SECRETS_PROVIDER: "environment",
+      EMAIL_PROVIDER: "smtp",
+      SMS_PROVIDER: "twilio",
+      AUDIT_CONSOLE_EXPORT: "false",
+      KEYSTONE_CONFIG_MODE: "json",
+    },
+  },
+  "high-availability": {
+    name: "High Availability",
+    description: "Scaled deployment with dedicated Redis, Postgres, and external secrets.",
+    values: {
+      NODE_ENV: "production",
+      PORT: "4001",
+      HOST: "0.0.0.0",
+      KEYSTONE_QUEUE_PROVIDER: "bullmq",
+      KEYSTONE_SECRETS_PROVIDER: "environment",
+      EMAIL_PROVIDER: "smtp",
+      SMS_PROVIDER: "twilio",
+      AUDIT_CONSOLE_EXPORT: "false",
+      KEYSTONE_FEATURE_FLAGS: "workflows=true,advanced_audit=true",
+    },
+  },
+};
+
+export function listConfigurationProfiles(): Array<{ id: string; name: string; description: string }> {
+  return Object.entries(CONFIGURATION_PROFILES).map(([id, profile]) => ({
+    id,
+    name: profile.name,
+    description: profile.description,
+  }));
+}
+
+export function getConfigurationProfile(id: string): ConfigurationProfile | undefined {
+  return CONFIGURATION_PROFILES[id];
+}