@kernhq/module-hr 0.13.2 → 0.14.0

package/dist/server/services/access.d.ts

@@ -0,0 +1,176 @@
+import type { Principal } from '@kernhq/contracts';
+import type { Kernel, Tx } from '@kernhq/kernel';
+/**
+ * Who a viewer may read, and how much of them.
+ *
+ * The module has always declared four widths of "other people" and enforced one. `hr.person.view`
+ * defaults to `member`, so every colleague read every colleague's whole row — personal email, phone
+ * number, hire date, termination date — and `view_team`, `view_office` and `view_all` sat in the
+ * role editor gating nothing. This is the thing that reads them.
+ *
+ * **The split is by field, not by row, and that is a product decision.** A staff directory every
+ * colleague can open is what a company wants; hiding half the workforce from an engineer looking up
+ * who runs Payroll would be a worse product, not a safer one. So `hr.person.view` still returns
+ * every person — as a **card**: name, employee number, work email, photo, status, timezone, office.
+ * The four fields in `PERSONNEL_FIELDS` are the *personnel record* behind that card, and the three
+ * widening keys decide whose card fills out into one:
+ *
+ * - nobody's but your own, with `hr.person.view` alone;
+ * - `hr.person.view_team` — the org-unit subtree you head, plus your direct reports;
+ * - `hr.person.view_office` — everybody assigned to an office you head, primary or not, because a
+ *   non-primary assignment is exactly what "visible to that office's local HR" means;
+ * - `hr.person.view_all` — the workspace, and the only one that answers `null`.
+ *
+ * None of the three implies another, so a country HR manager does not silently become a global one.
+ * You always see your own record: identity, never a grant. `hr.person.manage` reads what it writes —
+ * see `grantsFor`.
+ *
+ * **Why this is a computed set of ids and not `.use(requires('hr.person.view_team'))`.**
+ * `Authz.can` falls through to the workspace-level effective set whenever there is no object-scope
+ * binding for the id it was handed, so an object-scoped `requires` passes for anybody holding the
+ * key at workspace level and scopes *nothing*. It would look like it worked. The scope has to be
+ * derived from the org chart — `org_units.head_person_id` over the ltree subtree, `offices.head_
+ * person_id`, `employments.manager_person_id` — which is what these columns are for and what the
+ * GiST index on `org_units.path` was built to answer.
+ *
+ * **What is not resolved yet:** an object-scope *binding* of `view_team`/`view_office` to a unit or
+ * office id, which `permissions.ts` describes. `Authz` exposes no way to ask "is this bound *at*
+ * this object" — `can(object, id)` answers true for anybody holding the key at workspace level too
+ * — so honouring it would mean one `can` call per office in the workspace on every directory read.
+ * Headship is what the columns can answer today; the binding needs either `PermissionScopeKind` to
+ * grow `org_unit`/`office` or `Authz` to expose its bindings, both changes to the kernel.
+ */
+export declare class HrAccessService {
+    private readonly kernel;
+    /** Everything, however it was arrived at. Frozen so no caller can narrow the shared answer. */
+    private static readonly UNBOUNDED;
+    constructor(kernel: Kernel);
+    /**
+     * Which of the three widening keys this viewer holds, at workspace level.
+     *
+     * Workspace scope on purpose. The keys are declared `scope: 'object'` so an administrator *can*
+     * bind them to a unit or an office, but the question here is only "do you hold this key at all";
+     * *which* team or office it covers comes from the org chart below, never from the check.
+     *
+     * `view_all` is asked through `can`, so an owner and an instance admin pass the way they pass
+     * everything else and the two narrower reads are skipped. Below them one `effective()` answers
+     * every remaining key, rather than three `can` calls resolving the same set three times.
+     *
+     * **`hr.person.manage` reads everything it can write.** The edit form is populated from the
+     * record it is about to save back, so a writer who saw a redacted card would blank the very
+     * fields they could not see — silent data loss on an ordinary edit. Managing is workspace-wide
+     * already and has no narrow variant to lose, so this takes nothing away from anybody: it only
+     * closes the hole a custom role opens by granting `manage` without `view_all`.
+     */
+    grantsFor(principal: Principal, workspaceId: string): Promise<HrAccessGrants>;
+    /**
+     * The people whose full personnel record this viewer may read. `null` means every person.
+     *
+     * `null` rather than a list of every id in the workspace: an HR administrator in a company of
+     * five thousand should not pay for a five-thousand-element set on every directory page, and
+     * "unbounded" is a different fact from "happens to cover everybody today".
+     *
+     * The viewer's own person id is resolved here rather than passed in, because the answer for an
+     * unbounded viewer must not cost a lookup at all — and because every caller would otherwise
+     * repeat the same two lines before asking.
+     */
+    visiblePersonIds(tx: Tx, workspaceId: string, principal: Principal): Promise<string[] | null>;
+    /** The viewer's own HR record, if they have one. Null for a member who was never made a person. */
+    personIdOf(tx: Tx, workspaceId: string, principal: Principal): Promise<string | null>;
+    /**
+     * `view_team`: everybody in the org-unit subtree this person heads, plus their direct reports.
+     *
+     * Two questions rather than one, because they answer different shapes of manager. A department
+     * head is named on `org_units.head_person_id` and needs the whole subtree under it — one GiST
+     * lookup on `path <@`, not a recursive walk. A team lead who heads no unit at all is named on
+     * their reports' `employments.manager_person_id`, which has its own index.
+     *
+     * Headship of an *archived* unit grants nothing: a department that has been dissolved should not
+     * keep handing out records. Units inside the subtree are not filtered the same way — the people
+     * in them are still employed, and losing them because a sub-department was tidied up would be a
+     * hole rather than a narrowing.
+     */
+    /**
+     * Scope is asked as of **today**, through `inForceOn`, not "the row with no end date".
+     *
+     * The two disagree exactly where this module dates rows, and it dates them routinely, in both
+     * directions:
+     *
+     * - `people.offboard` writes `effective_to` = the last working day, which is normally in the
+     *   *future*. Keying on a null end date drops somebody the moment their leaving is recorded, so
+     *   their manager loses the record for the whole notice period — including `terminatedOn`, the
+     *   one field that says when they actually go. That is the failure nobody reports, because a
+     *   record that vanishes reads as "HR took it away".
+     * - `changeEmployment` closes the open row at `effective_from - 1` and opens the new one, so a
+     *   transfer dated 1 October and recorded in August would hand the record to the receiving
+     *   manager five weeks early and take it from the current one just as early. A future joiner is
+     *   the same shape: created `onboarding` with a future `hired_on`.
+     *
+     * Every other resolver here answers "who is this today" the same way — `approvals.ts`,
+     * `resolve.ts` and the office roster all use `inForceOn`. Visibility must not be the one that
+     * disagrees — and the roster was itself changed to this predicate in the same commit, because it
+     * had been on the null-end-date test and would otherwise have listed a different set of people
+     * from the one whose records this service lets you read, in the same response.
+     */
+    private teamOf;
+    /**
+     * `view_office`: everybody assigned to an office this person heads, as of today.
+     *
+     * Every open assignment, not only the primary one. The primary decides holidays, timezone and
+     * policy; the others grant presence — appearing in that office's directory, being visible to its
+     * local HR — and that second half is precisely this permission.
+     *
+     * An office's `parent_office_id` is not walked. A campus is geography, not authority, and there
+     * is no materialised path to walk it with; heading the campus and heading its buildings are two
+     * grants until somebody asks for the third.
+     */
+    private officeOf;
+}
+/** Which of the three widening keys a viewer holds. `all` implies the other two. */
+export interface HrAccessGrants {
+    /** `hr.person.view_all` — every record in the workspace. */
+    all: boolean;
+    /** `hr.person.view_team` — the org-unit subtree you head, plus your direct reports. */
+    team: boolean;
+    /** `hr.person.view_office` — everybody assigned to an office you head. */
+    office: boolean;
+}
+/**
+ * The fields a directory card does not carry.
+ *
+ * Personal email and phone are contact details somebody gave their employer, not their colleagues.
+ * Hire and termination dates are employment facts: the first is somebody's seniority and the second
+ * is the date they were let go, which is not a thing to publish to the whole company on the day it
+ * happens.
+ *
+ * Everything else on `Person` stays: name, employee number, work email, photo, status, timezone,
+ * office, and `custom`. A directory that cannot tell you somebody's work email is not a directory.
+ *
+ * Nulled rather than omitted, because all four are `.nullable()` in the contract — so a card parses
+ * as a `Person` and no client has to learn a second shape.
+ */
+export declare const PERSONNEL_FIELDS: readonly ["personalEmail", "phone", "hiredOn", "terminatedOn"];
+/** The shape `forViewer` narrows. Structural, so it fits a row with extra columns joined onto it. */
+export interface PersonnelFields {
+    personalEmail: string | null;
+    phone: string | null;
+    hiredOn: string | null;
+    terminatedOn: string | null;
+    personnelHidden: boolean;
+}
+/** What `visiblePersonIds` answered, ready to be asked about one person at a time. */
+export type VisiblePeople = ReadonlySet<string> | null;
+/** Build the lookup once per page rather than scanning an array per row. */
+export declare const visibleSet: (ids: string[] | null) => VisiblePeople;
+/** Does this viewer read the record behind the card, or only the card? */
+export declare const seesRecordOf: (visible: VisiblePeople, personId: string) => boolean;
+/**
+ * A person as this viewer may read them: the whole record, or the directory card.
+ *
+ * Returns the object it was given when nothing is hidden, so the common path — an HR administrator
+ * with `view_all` — allocates nothing.
+ */
+export declare function forViewer<T extends PersonnelFields & {
+    id: string;
+}>(person: T, visible: VisiblePeople): T;
+//# sourceMappingURL=access.d.ts.map

package/dist/server/services/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/server/services/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAMhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,qBAAa,eAAe;IAQd,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAI/B;gBAE2B,MAAM,EAAE,MAAM;IAE3C;;;;;;;;;;;;;;;;OAgBG;IACG,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAgBnF;;;;;;;;;;OAUG;IACG,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAkBnG,mGAAmG;IAC7F,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU3F;;;;;;;;;;;;OAYG;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,MAAM;IAoDpB;;;;;;;;;;OAUG;YACW,QAAQ;CAmCvB;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,GAAG,EAAE,OAAO,CAAA;IACZ,uFAAuF;IACvF,IAAI,EAAE,OAAO,CAAA;IACb,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,gEAAiE,CAAA;AAE9F,qGAAqG;AACrG,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,OAAO,CAAA;CACzB;AAED,sFAAsF;AACtF,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;AAEtD,4EAA4E;AAC5E,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,EAAE,GAAG,IAAI,KAAG,aAAqD,CAAA;AAEvG,0EAA0E;AAC1E,eAAO,MAAM,YAAY,GAAI,SAAS,aAAa,EAAE,UAAU,MAAM,KAAG,OAC7B,CAAA;AAE3C;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,GAAG,CAAC,CAa1G"}

package/dist/server/services/access.js

@@ -0,0 +1,260 @@
+import { and, eq, inArray, isNull, or, sql } from 'drizzle-orm';
+import { HR_PERMISSIONS } from '../../contract/index.js';
+import { employments, officeAssignments, offices, orgUnits, people } from '../schema.js';
+import { inForceOn, todayIso } from './db.js';
+/**
+ * Who a viewer may read, and how much of them.
+ *
+ * The module has always declared four widths of "other people" and enforced one. `hr.person.view`
+ * defaults to `member`, so every colleague read every colleague's whole row — personal email, phone
+ * number, hire date, termination date — and `view_team`, `view_office` and `view_all` sat in the
+ * role editor gating nothing. This is the thing that reads them.
+ *
+ * **The split is by field, not by row, and that is a product decision.** A staff directory every
+ * colleague can open is what a company wants; hiding half the workforce from an engineer looking up
+ * who runs Payroll would be a worse product, not a safer one. So `hr.person.view` still returns
+ * every person — as a **card**: name, employee number, work email, photo, status, timezone, office.
+ * The four fields in `PERSONNEL_FIELDS` are the *personnel record* behind that card, and the three
+ * widening keys decide whose card fills out into one:
+ *
+ * - nobody's but your own, with `hr.person.view` alone;
+ * - `hr.person.view_team` — the org-unit subtree you head, plus your direct reports;
+ * - `hr.person.view_office` — everybody assigned to an office you head, primary or not, because a
+ *   non-primary assignment is exactly what "visible to that office's local HR" means;
+ * - `hr.person.view_all` — the workspace, and the only one that answers `null`.
+ *
+ * None of the three implies another, so a country HR manager does not silently become a global one.
+ * You always see your own record: identity, never a grant. `hr.person.manage` reads what it writes —
+ * see `grantsFor`.
+ *
+ * **Why this is a computed set of ids and not `.use(requires('hr.person.view_team'))`.**
+ * `Authz.can` falls through to the workspace-level effective set whenever there is no object-scope
+ * binding for the id it was handed, so an object-scoped `requires` passes for anybody holding the
+ * key at workspace level and scopes *nothing*. It would look like it worked. The scope has to be
+ * derived from the org chart — `org_units.head_person_id` over the ltree subtree, `offices.head_
+ * person_id`, `employments.manager_person_id` — which is what these columns are for and what the
+ * GiST index on `org_units.path` was built to answer.
+ *
+ * **What is not resolved yet:** an object-scope *binding* of `view_team`/`view_office` to a unit or
+ * office id, which `permissions.ts` describes. `Authz` exposes no way to ask "is this bound *at*
+ * this object" — `can(object, id)` answers true for anybody holding the key at workspace level too
+ * — so honouring it would mean one `can` call per office in the workspace on every directory read.
+ * Headship is what the columns can answer today; the binding needs either `PermissionScopeKind` to
+ * grow `org_unit`/`office` or `Authz` to expose its bindings, both changes to the kernel.
+ */
+export class HrAccessService {
+    kernel;
+    /** Everything, however it was arrived at. Frozen so no caller can narrow the shared answer. */
+    static UNBOUNDED = Object.freeze({
+        all: true,
+        team: true,
+        office: true,
+    });
+    constructor(kernel) {
+        this.kernel = kernel;
+    }
+    /**
+     * Which of the three widening keys this viewer holds, at workspace level.
+     *
+     * Workspace scope on purpose. The keys are declared `scope: 'object'` so an administrator *can*
+     * bind them to a unit or an office, but the question here is only "do you hold this key at all";
+     * *which* team or office it covers comes from the org chart below, never from the check.
+     *
+     * `view_all` is asked through `can`, so an owner and an instance admin pass the way they pass
+     * everything else and the two narrower reads are skipped. Below them one `effective()` answers
+     * every remaining key, rather than three `can` calls resolving the same set three times.
+     *
+     * **`hr.person.manage` reads everything it can write.** The edit form is populated from the
+     * record it is about to save back, so a writer who saw a redacted card would blank the very
+     * fields they could not see — silent data loss on an ordinary edit. Managing is workspace-wide
+     * already and has no narrow variant to lose, so this takes nothing away from anybody: it only
+     * closes the hole a custom role opens by granting `manage` without `view_all`.
+     */
+    async grantsFor(principal, workspaceId) {
+        const all = await this.kernel.authz.can(principal, HR_PERMISSIONS.personViewAll, {
+            kind: 'workspace',
+            id: workspaceId,
+            workspaceId,
+        });
+        if (all)
+            return HrAccessService.UNBOUNDED;
+        const held = await this.kernel.authz.effective(principal, workspaceId);
+        if (held.has(HR_PERMISSIONS.personManage))
+            return HrAccessService.UNBOUNDED;
+        return {
+            all: false,
+            team: held.has(HR_PERMISSIONS.personViewTeam),
+            office: held.has(HR_PERMISSIONS.personViewOffice),
+        };
+    }
+    /**
+     * The people whose full personnel record this viewer may read. `null` means every person.
+     *
+     * `null` rather than a list of every id in the workspace: an HR administrator in a company of
+     * five thousand should not pay for a five-thousand-element set on every directory page, and
+     * "unbounded" is a different fact from "happens to cover everybody today".
+     *
+     * The viewer's own person id is resolved here rather than passed in, because the answer for an
+     * unbounded viewer must not cost a lookup at all — and because every caller would otherwise
+     * repeat the same two lines before asking.
+     */
+    async visiblePersonIds(tx, workspaceId, principal) {
+        const grants = await this.grantsFor(principal, workspaceId);
+        if (grants.all)
+            return null;
+        const viewer = await this.personIdOf(tx, workspaceId, principal);
+        // Plenty of members are not employees. They see the directory and no record but — since they
+        // have none — nobody's.
+        if (!viewer)
+            return [];
+        const ids = new Set([viewer]);
+        // One date for both resolvers, so a request that straddles midnight cannot answer the team from
+        // one day and the office from the next.
+        const today = todayIso();
+        if (grants.team)
+            for (const id of await this.teamOf(tx, workspaceId, viewer, today))
+                ids.add(id);
+        if (grants.office)
+            for (const id of await this.officeOf(tx, workspaceId, viewer, today))
+                ids.add(id);
+        return [...ids];
+    }
+    /** The viewer's own HR record, if they have one. Null for a member who was never made a person. */
+    async personIdOf(tx, workspaceId, principal) {
+        if (!principal.userId)
+            return null;
+        const [row] = await tx
+            .select({ id: people.id })
+            .from(people)
+            .where(and(eq(people.workspaceId, workspaceId), eq(people.userId, principal.userId)))
+            .limit(1);
+        return row?.id ?? null;
+    }
+    /**
+     * `view_team`: everybody in the org-unit subtree this person heads, plus their direct reports.
+     *
+     * Two questions rather than one, because they answer different shapes of manager. A department
+     * head is named on `org_units.head_person_id` and needs the whole subtree under it — one GiST
+     * lookup on `path <@`, not a recursive walk. A team lead who heads no unit at all is named on
+     * their reports' `employments.manager_person_id`, which has its own index.
+     *
+     * Headship of an *archived* unit grants nothing: a department that has been dissolved should not
+     * keep handing out records. Units inside the subtree are not filtered the same way — the people
+     * in them are still employed, and losing them because a sub-department was tidied up would be a
+     * hole rather than a narrowing.
+     */
+    /**
+     * Scope is asked as of **today**, through `inForceOn`, not "the row with no end date".
+     *
+     * The two disagree exactly where this module dates rows, and it dates them routinely, in both
+     * directions:
+     *
+     * - `people.offboard` writes `effective_to` = the last working day, which is normally in the
+     *   *future*. Keying on a null end date drops somebody the moment their leaving is recorded, so
+     *   their manager loses the record for the whole notice period — including `terminatedOn`, the
+     *   one field that says when they actually go. That is the failure nobody reports, because a
+     *   record that vanishes reads as "HR took it away".
+     * - `changeEmployment` closes the open row at `effective_from - 1` and opens the new one, so a
+     *   transfer dated 1 October and recorded in August would hand the record to the receiving
+     *   manager five weeks early and take it from the current one just as early. A future joiner is
+     *   the same shape: created `onboarding` with a future `hired_on`.
+     *
+     * Every other resolver here answers "who is this today" the same way — `approvals.ts`,
+     * `resolve.ts` and the office roster all use `inForceOn`. Visibility must not be the one that
+     * disagrees — and the roster was itself changed to this predicate in the same commit, because it
+     * had been on the null-end-date test and would otherwise have listed a different set of people
+     * from the one whose records this service lets you read, in the same response.
+     */
+    async teamOf(tx, workspaceId, viewerPersonId, today) {
+        const ids = new Set();
+        const headed = await tx
+            .select({ path: orgUnits.path })
+            .from(orgUnits)
+            .where(and(eq(orgUnits.workspaceId, workspaceId), eq(orgUnits.headPersonId, viewerPersonId), isNull(orgUnits.archivedAt)));
+        if (headed.length) {
+            const subtree = or(...headed.map((u) => sql `${orgUnits.path} <@ ${u.path}::ltree`));
+            const rows = await tx
+                .select({ personId: employments.personId })
+                .from(employments)
+                .innerJoin(orgUnits, and(eq(orgUnits.id, employments.orgUnitId), eq(orgUnits.workspaceId, employments.workspaceId)))
+                .where(and(eq(employments.workspaceId, workspaceId), inForceOn(employments.effectiveFrom, employments.effectiveTo, today), subtree));
+            for (const r of rows)
+                ids.add(r.personId);
+        }
+        const reports = await tx
+            .select({ personId: employments.personId })
+            .from(employments)
+            .where(and(eq(employments.workspaceId, workspaceId), eq(employments.managerPersonId, viewerPersonId), inForceOn(employments.effectiveFrom, employments.effectiveTo, today)));
+        for (const r of reports)
+            ids.add(r.personId);
+        return [...ids];
+    }
+    /**
+     * `view_office`: everybody assigned to an office this person heads, as of today.
+     *
+     * Every open assignment, not only the primary one. The primary decides holidays, timezone and
+     * policy; the others grant presence — appearing in that office's directory, being visible to its
+     * local HR — and that second half is precisely this permission.
+     *
+     * An office's `parent_office_id` is not walked. A campus is geography, not authority, and there
+     * is no materialised path to walk it with; heading the campus and heading its buildings are two
+     * grants until somebody asks for the third.
+     */
+    async officeOf(tx, workspaceId, viewerPersonId, today) {
+        const headed = await tx
+            .select({ id: offices.id })
+            .from(offices)
+            .where(and(eq(offices.workspaceId, workspaceId), eq(offices.headPersonId, viewerPersonId), isNull(offices.archivedAt)));
+        if (!headed.length)
+            return [];
+        const rows = await tx
+            .select({ personId: officeAssignments.personId })
+            .from(officeAssignments)
+            .where(and(eq(officeAssignments.workspaceId, workspaceId), inArray(officeAssignments.officeId, headed.map((o) => o.id)), 
+        // As of today, for the reason spelled out on `teamOf`: an office move is dated, so a null
+        // end date is neither "here now" nor "here on the day we are asking about".
+        inForceOn(officeAssignments.effectiveFrom, officeAssignments.effectiveTo, today)));
+        return [...new Set(rows.map((r) => r.personId))];
+    }
+}
+/**
+ * The fields a directory card does not carry.
+ *
+ * Personal email and phone are contact details somebody gave their employer, not their colleagues.
+ * Hire and termination dates are employment facts: the first is somebody's seniority and the second
+ * is the date they were let go, which is not a thing to publish to the whole company on the day it
+ * happens.
+ *
+ * Everything else on `Person` stays: name, employee number, work email, photo, status, timezone,
+ * office, and `custom`. A directory that cannot tell you somebody's work email is not a directory.
+ *
+ * Nulled rather than omitted, because all four are `.nullable()` in the contract — so a card parses
+ * as a `Person` and no client has to learn a second shape.
+ */
+export const PERSONNEL_FIELDS = ['personalEmail', 'phone', 'hiredOn', 'terminatedOn'];
+/** Build the lookup once per page rather than scanning an array per row. */
+export const visibleSet = (ids) => (ids === null ? null : new Set(ids));
+/** Does this viewer read the record behind the card, or only the card? */
+export const seesRecordOf = (visible, personId) => visible === null || visible.has(personId);
+/**
+ * A person as this viewer may read them: the whole record, or the directory card.
+ *
+ * Returns the object it was given when nothing is hidden, so the common path — an HR administrator
+ * with `view_all` — allocates nothing.
+ */
+export function forViewer(person, visible) {
+    if (seesRecordOf(visible, person.id))
+        return person;
+    // `personnelHidden` is what lets a screen tell "withheld" from "empty". This is the only place
+    // that nulls these fields, so it is the only place that can honestly say so — a client trying to
+    // infer it would be re-deriving the org chart from data it never fetched.
+    return {
+        ...person,
+        personalEmail: null,
+        phone: null,
+        hiredOn: null,
+        terminatedOn: null,
+        personnelHidden: true,
+    };
+}
+//# sourceMappingURL=access.js.map

package/dist/server/services/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../../src/server/services/access.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACxF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,OAAO,eAAe;IAQG;IAP7B,+FAA+F;IACvF,MAAM,CAAU,SAAS,GAAmB,MAAM,CAAC,MAAM,CAAC;QAChE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;KACb,CAAC,CAAA;IAEF,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,SAAS,CAAC,SAAoB,EAAE,WAAmB;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,aAAa,EAAE;YAC/E,IAAI,EAAE,WAAW;YACjB,EAAE,EAAE,WAAW;YACf,WAAW;SACZ,CAAC,CAAA;QACF,IAAI,GAAG;YAAE,OAAO,eAAe,CAAC,SAAS,CAAA;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;QACtE,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC;YAAE,OAAO,eAAe,CAAC,SAAS,CAAA;QAC3E,OAAO;YACL,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC;YAC7C,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,gBAAgB,CAAC;SAClD,CAAA;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAM,EAAE,WAAmB,EAAE,SAAoB;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;QAC3D,IAAI,MAAM,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;QAChE,6FAA6F;QAC7F,wBAAwB;QACxB,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QAEtB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QACrC,gGAAgG;QAChG,wCAAwC;QACxC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAA;QACxB,IAAI,MAAM,CAAC,IAAI;YAAE,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChG,IAAI,MAAM,CAAC,MAAM;YAAE,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;IACjB,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,UAAU,CAAC,EAAM,EAAE,WAAmB,EAAE,SAAoB;QAChE,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aACzB,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;aACpF,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,CAAA;IACxB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,MAAM,CAClB,EAAM,EACN,WAAmB,EACnB,cAAsB,EACtB,KAAa;QAEb,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;QAE7B,MAAM,MAAM,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;aAC/B,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,EACrC,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC,EACzC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC5B,CACF,CAAA;QACH,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAA;YACnF,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;iBAC1C,IAAI,CAAC,WAAW,CAAC;iBACjB,SAAS,CACR,QAAQ,EACR,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAC/F;iBACA,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EACxC,SAAS,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,EACpE,OAAO,CACR,CACF,CAAA;YACH,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;aAC1C,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EACxC,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,cAAc,CAAC,EAC/C,SAAS,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CACrE,CACF,CAAA;QACH,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QAE5C,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,QAAQ,CACpB,EAAM,EACN,WAAmB,EACnB,cAAsB,EACtB,KAAa;QAEb,MAAM,MAAM,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;aAC1B,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EACpC,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,EACxC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAC3B,CACF,CAAA;QACH,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QAE7B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC;aAChD,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC9C,OAAO,CACL,iBAAiB,CAAC,QAAQ,EAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxB;QACD,0FAA0F;QAC1F,4EAA4E;QAC5E,SAAS,CAAC,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,CACjF,CACF,CAAA;QACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;;AAaH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAU,CAAA;AAc9F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAiB,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AAEvG,0EAA0E;AAC1E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAsB,EAAE,QAAgB,EAAW,EAAE,CAChF,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;AAE3C;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAA6C,MAAS,EAAE,OAAsB;IACrG,IAAI,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,MAAM,CAAA;IACnD,+FAA+F;IAC/F,iGAAiG;IACjG,0EAA0E;IAC1E,OAAO;QACL,GAAG,MAAM;QACT,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,IAAI;KACtB,CAAA;AACH,CAAC"}

package/dist/server/services/people.d.ts

@@ -19,6 +19,7 @@ export declare class PeopleService {
     static toPerson(row: PersonRow): {
         status: PersonStatus;
         custom: Record<string, unknown>;
+        personnelHidden: boolean;
         createdAt: string;
         updatedAt: string;
         id: string;

package/dist/server/services/people.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"people.d.ts","sourceRoot":"","sources":["../../../src/server/services/people.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,MAAM,EAAE,KAAK,EAAE,EAAU,MAAM,gBAAgB,CAAA;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACvF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAiB,MAAM,cAAc,CAAA;AAGpF,yDAAyD;AACzD,MAAM,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,YAAY,CAAA;AAClD,MAAM,MAAM,aAAa,GAAG,OAAO,WAAW,CAAC,YAAY,CAAA;AAE3D;;;;;;;GAOG;AACH,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,sGAAsG;IACtG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS;gBAMJ,YAAY;;;;;;;;;;;;;;;;;IAOtC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa;wBAGI,cAAc;;;;;;;;;;;;;;;;IAOlD,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAUvE,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAS3F;;;;;;;OAOG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUvF,2EAA2E;IACrE,MAAM,CACV,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,EAC7D,MAAM,SAAQ;IAiBhB;;;;;;OAMG;IACG,gBAAgB,CACpB,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC,CAAC,GACnF,OAAO,CAAC,aAAa,CAAC;IAkDzB;;;;;;OAMG;IACG,YAAY,CAChB,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,GAAG,IAAI;;;;;;;;;;;IAkDvB,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,iBAAiB,CAAC,YAAY;;;;;;;;;;;IAI9D,KAAK,eAAW;CACjB"}
+{"version":3,"file":"people.d.ts","sourceRoot":"","sources":["../../../src/server/services/people.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,MAAM,EAAE,KAAK,EAAE,EAAU,MAAM,gBAAgB,CAAA;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACvF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAiB,MAAM,cAAc,CAAA;AAGpF,yDAAyD;AACzD,MAAM,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,YAAY,CAAA;AAClD,MAAM,MAAM,aAAa,GAAG,OAAO,WAAW,CAAC,YAAY,CAAA;AAE3D;;;;;;;GAOG;AACH,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,sGAAsG;IACtG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS;gBAMJ,YAAY;;;;;;;;;;;;;;;;;;IAUtC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa;wBAGI,cAAc;;;;;;;;;;;;;;;;IAOlD,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAUvE,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAS3F;;;;;;;OAOG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUvF,2EAA2E;IACrE,MAAM,CACV,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,EAC7D,MAAM,SAAQ;IAiBhB;;;;;;OAMG;IACG,gBAAgB,CACpB,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC,CAAC,GACnF,OAAO,CAAC,aAAa,CAAC;IAkDzB;;;;;;OAMG;IACG,YAAY,CAChB,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,GAAG,IAAI;;;;;;;;;;;IAkDvB,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,iBAAiB,CAAC,YAAY;;;;;;;;;;;IAI9D,KAAK,eAAW;CACjB"}

package/dist/server/services/people.js

@@ -24,6 +24,9 @@ export class PeopleService {
             // consumer; the column is only ever written from the same union.
             status: row.status,
             custom: row.custom ?? {},
+            // False here and set true by `forViewer` alone, which is the only thing that withholds these
+            // fields. A record that never passed through it was never redacted.
+            personnelHidden: false,
             createdAt: row.createdAt.toISOString(),
             updatedAt: row.updatedAt.toISOString(),
         };

package/dist/server/services/people.js.map

@@ -1 +1 @@
-{"version":3,"file":"people.js","sourceRoot":"","sources":["../../../src/server/services/people.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAwB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACpF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAM1C;;;;;;;GAOG;AACH,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,sGAAsG;IACtG,MAAM,CAAC,QAAQ,CAAC,GAAc;QAC5B,OAAO;YACL,GAAG,GAAG;YACN,6FAA6F;YAC7F,uFAAuF;YACvF,iEAAiE;YACjE,MAAM,EAAE,GAAG,CAAC,MAAsB;YAClC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;YACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;SACvC,CAAA;IACH,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,GAAkB;QACpC,OAAO;YACL,GAAG,GAAG;YACN,cAAc,EAAE,GAAG,CAAC,cAAgC;YACpD,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YACtC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACnG,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;SACvC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,WAAmB,EAAE,QAAgB;QACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;aACxE,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC5C,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAM,EAAE,WAAmB,EAAE,MAAc;QACxD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1E,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,QAAoB;QAC5D,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,QAAQ,CAAC,kBAAkB,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACnF,MAAM,IAAI,GAAG,QAAQ,CAAC,kBAAkB,CAAA;QACxC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE;YACtD,GAAG,QAAQ;YACX,kBAAkB,EAAE,IAAI,GAAG,CAAC;SAC7B,CAAC,CAAA;QACF,OAAO,GAAG,QAAQ,CAAC,oBAAoB,GAAG,IAAI,EAAE,CAAA;IAClD,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,MAAM,CACV,EAAM,EACN,WAAmB,EACnB,QAAgB,EAChB,OAAsB,EACtB,OAA6D,EAC7D,MAAM,GAAG,KAAK;QAEd,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAM;QAC3B,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CACnC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClB,EAAE,EAAE,MAAM,EAAE;YACZ,WAAW;YACX,QAAQ;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAU;YAC/B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAU;YAC3B,OAAO;YACP,MAAM;SACP,CAAC,CAAC,CACJ,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CACpB,EAAM,EACN,WAAmB,EACnB,QAAgB,EAChB,aAAqB,EACrB,KAAoF;QAEpF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EACxC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAClC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAChC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAA;QAEX,IAAI,IAAI,IAAI,aAAa,GAAG,IAAI,CAAC,aAAa;YAC5C,MAAM,SAAS,CAAC,UAAU,CACxB,0CAA0C,IAAI,CAAC,aAAa,uCAAuC,CACpG,CAAA;QAEH,IAAI,IAAI,EAAE,CAAC;YACT,8FAA8F;YAC9F,6FAA6F;YAC7F,gCAAgC;YAChC,MAAM,EAAE;iBACL,MAAM,CAAC,WAAW,CAAC;iBACnB,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAA,GAAG,aAAa,YAAY,EAAE,CAAC;iBACrD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,WAAW,CAAC;aACnB,MAAM,CAAC;YACN,EAAE,EAAE,MAAM,EAAE;YACZ,WAAW;YACX,QAAQ;YACR,aAAa;YACb,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,SAAS,IAAI,IAAI;YACrD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,UAAU,IAAI,IAAI;YACxD,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,EAAE,aAAa,IAAI,IAAI;YACjE,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI;YAC9D,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI,EAAE,eAAe,IAAI,IAAI;YACvE,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,EAAE,cAAc,IAAI,WAAW;YAC3E,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,OAAO;YACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAAE,iBAAiB,IAAI,IAAI;YAC7E,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;SAC7B,CAAC;aACD,SAAS,EAAE,CAAA;QACd,OAAO,GAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,EAAM,EACN,WAAmB,EACnB,QAAgB,EAChB,QAAgB,EAChB,SAAkB,EAClB,aAAqB,EACrB,MAAqB;QAErB,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC9C,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACxC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CACtC,CACF,CAAA;QAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9B,2FAA2F;gBAC3F,wCAAwC;gBACxC,MAAM,EAAE;qBACL,MAAM,CAAC,iBAAiB,CAAC;qBACzB,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAA,GAAG,aAAa,YAAY,EAAE,CAAC;qBACrD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC5C,CAAC;iBAAM,IAAI,SAAS,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBACtC,yFAAyF;gBACzF,sFAAsF;gBACtF,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YACtG,CAAC;QACH,CAAC;QAED,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;YACxC,EAAE,EAAE,MAAM,EAAE;YACZ,WAAW;YACX,QAAQ;YACR,QAAQ;YACR,SAAS;YACT,aAAa;YACb,MAAM;SACP,CAAC,CAAA;QAEF,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC9C,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACxC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CACtC,CACF,CAAA;IACL,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,GAA0C;QAC5D,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAA;IAC3D,CAAC;IAED,KAAK,GAAG,QAAQ,CAAA;CACjB"}
+{"version":3,"file":"people.js","sourceRoot":"","sources":["../../../src/server/services/people.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAwB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACpF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAM1C;;;;;;;GAOG;AACH,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,sGAAsG;IACtG,MAAM,CAAC,QAAQ,CAAC,GAAc;QAC5B,OAAO;YACL,GAAG,GAAG;YACN,6FAA6F;YAC7F,uFAAuF;YACvF,iEAAiE;YACjE,MAAM,EAAE,GAAG,CAAC,MAAsB;YAClC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;YACxB,6FAA6F;YAC7F,oEAAoE;YACpE,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;YACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;SACvC,CAAA;IACH,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,GAAkB;QACpC,OAAO;YACL,GAAG,GAAG;YACN,cAAc,EAAE,GAAG,CAAC,cAAgC;YACpD,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YACtC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACnG,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;SACvC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,WAAmB,EAAE,QAAgB;QACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;aACxE,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC5C,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAM,EAAE,WAAmB,EAAE,MAAc;QACxD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1E,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,QAAoB;QAC5D,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,QAAQ,CAAC,kBAAkB,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACnF,MAAM,IAAI,GAAG,QAAQ,CAAC,kBAAkB,CAAA;QACxC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE;YACtD,GAAG,QAAQ;YACX,kBAAkB,EAAE,IAAI,GAAG,CAAC;SAC7B,CAAC,CAAA;QACF,OAAO,GAAG,QAAQ,CAAC,oBAAoB,GAAG,IAAI,EAAE,CAAA;IAClD,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,MAAM,CACV,EAAM,EACN,WAAmB,EACnB,QAAgB,EAChB,OAAsB,EACtB,OAA6D,EAC7D,MAAM,GAAG,KAAK;QAEd,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAM;QAC3B,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CACnC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClB,EAAE,EAAE,MAAM,EAAE;YACZ,WAAW;YACX,QAAQ;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAU;YAC/B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAU;YAC3B,OAAO;YACP,MAAM;SACP,CAAC,CAAC,CACJ,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CACpB,EAAM,EACN,WAAmB,EACnB,QAAgB,EAChB,aAAqB,EACrB,KAAoF;QAEpF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EACxC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAClC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAChC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAA;QAEX,IAAI,IAAI,IAAI,aAAa,GAAG,IAAI,CAAC,aAAa;YAC5C,MAAM,SAAS,CAAC,UAAU,CACxB,0CAA0C,IAAI,CAAC,aAAa,uCAAuC,CACpG,CAAA;QAEH,IAAI,IAAI,EAAE,CAAC;YACT,8FAA8F;YAC9F,6FAA6F;YAC7F,gCAAgC;YAChC,MAAM,EAAE;iBACL,MAAM,CAAC,WAAW,CAAC;iBACnB,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAA,GAAG,aAAa,YAAY,EAAE,CAAC;iBACrD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,WAAW,CAAC;aACnB,MAAM,CAAC;YACN,EAAE,EAAE,MAAM,EAAE;YACZ,WAAW;YACX,QAAQ;YACR,aAAa;YACb,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,SAAS,IAAI,IAAI;YACrD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,UAAU,IAAI,IAAI;YACxD,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,EAAE,aAAa,IAAI,IAAI;YACjE,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI;YAC9D,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI,EAAE,eAAe,IAAI,IAAI;YACvE,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,EAAE,cAAc,IAAI,WAAW;YAC3E,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,OAAO;YACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAAE,iBAAiB,IAAI,IAAI;YAC7E,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;SAC7B,CAAC;aACD,SAAS,EAAE,CAAA;QACd,OAAO,GAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,EAAM,EACN,WAAmB,EACnB,QAAgB,EAChB,QAAgB,EAChB,SAAkB,EAClB,aAAqB,EACrB,MAAqB;QAErB,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC9C,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACxC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CACtC,CACF,CAAA;QAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9B,2FAA2F;gBAC3F,wCAAwC;gBACxC,MAAM,EAAE;qBACL,MAAM,CAAC,iBAAiB,CAAC;qBACzB,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAA,GAAG,aAAa,YAAY,EAAE,CAAC;qBACrD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC5C,CAAC;iBAAM,IAAI,SAAS,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBACtC,yFAAyF;gBACzF,sFAAsF;gBACtF,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YACtG,CAAC;QACH,CAAC;QAED,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;YACxC,EAAE,EAAE,MAAM,EAAE;YACZ,WAAW;YACX,QAAQ;YACR,QAAQ;YACR,SAAS;YACT,aAAa;YACb,MAAM;SACP,CAAC,CAAA;QAEF,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC9C,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACxC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CACtC,CACF,CAAA;IACL,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,GAA0C;QAC5D,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAA;IAC3D,CAAC;IAED,KAAK,GAAG,QAAQ,CAAA;CACjB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kernhq/module-hr",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "description": "Kern HR module: people, offices, org chart, calendars",
   "license": "AGPL-3.0-only",
   "type": "module",

package/src/client/components/DayDetail.svelte

@@ -109,20 +109,38 @@ const directionLabel = (direction: string) =>
         ? t('att_punch_break_start')
         : t('att_punch_break_end')
 
-const methodLabel = (method: string) =>
-  method === 'web'
-    ? t('att_method_web')
-    : method === 'mobile'
-      ? t('att_method_mobile')
-      : method === 'kiosk'
-        ? t('att_method_kiosk')
-        : method === 'qr'
-          ? t('att_method_qr')
-          : method === 'device'
-            ? t('att_method_device')
-            : method === 'import'
-              ? t('att_method_import')
-              : t('att_method_manual')
+/**
+ * What recorded the punch, in words.
+ *
+ * Keyed by the method the contract names, and `auto` is the machine's own — the job that closes a
+ * shift nobody clocked out of. Every method used to be a rung on a ternary ending in
+ * `att_method_manual`, so `auto`, and anything else the contract might add, landed on **"Entered by
+ * hand"**: the one badge on this panel that names a culprit, telling somebody arguing about their
+ * own timesheet that a person had typed a punch no person touched.
+ *
+ * So the fallback no longer claims anything. A method with no string here is a build behind the
+ * server, and it renders the raw code — the same bargain `anomalyLabel` below makes, and the same
+ * reasoning: a code somebody can quote in a question beats a confident wrong sentence about who
+ * touched their record.
+ */
+const METHOD_KEYS: Record<string, string> = {
+  web: 'hr.att_method_web',
+  mobile: 'hr.att_method_mobile',
+  kiosk: 'hr.att_method_kiosk',
+  qr: 'hr.att_method_qr',
+  device: 'hr.att_method_device',
+  import: 'hr.att_method_import',
+  manual: 'hr.att_method_manual',
+  auto: 'hr.att_method_auto',
+}
+const methodLabel = (method: string): string => {
+  // Namespaced keys, because `t()` answers a miss with the key it was **given**: a bare
+  // `att_method_auto` comes back as `hr.att_method_auto`, which never equals what was passed, so a
+  // missing string would test as present and render the key at somebody.
+  const key = METHOD_KEYS[method]
+  const text = key ? t(key) : undefined
+  return text && text !== key ? text : method
+}
 
 /**
  * The time, with the date added only when it is not this day's.