@kernhq/module-inventory 0.2.0 → 0.3.0

package/dist/server/services/audience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience.d.ts","sourceRoot":"","sources":["../../../src/server/services/audience.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAuC5C;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,EAAE,CAAC,CAoBnB"}

package/dist/server/services/audience.js

@@ -0,0 +1,64 @@
+/**
+ * Who to tell when the thing that happened belongs to the workspace rather than to a person.
+ *
+ * Custody notifications have an obvious recipient — the person the item was handed to. A warranty
+ * running out on a spare in a cupboard, or a repair nobody has chased, does not: it belongs to
+ * whoever looks after the register. There is no "the office manager" field, and inventing one would
+ * be a setting somebody has to fill in before the feature works at all, so the question is asked of
+ * the permission system instead: **who may actually do the thing this message is asking for.**
+ *
+ * A warranty notice asks somebody to renew or replace, which is `inventory.asset.manage`. An overdue
+ * repair asks somebody to chase the vendor, which is `inventory.repair.manage`. Somebody leaving
+ * with a laptop asks somebody to take it back, which is `inventory.custody.manage`. Each message
+ * names the key it needs rather than settling for "the admins", because a workspace that gave its
+ * office manager a custom role did that on purpose.
+ */
+/** Most senior first, so the cap below keeps the people most likely to act. */
+const ROLE_RANK = { owner: 3, admin: 2, member: 1, guest: 0 };
+/**
+ * How many people one workspace-level notification may reach.
+ *
+ * A message sent to five thousand people is not a notification, it is a mailing list nobody reads —
+ * and on a large instance every member holds `inventory.asset.manage` by default, so an uncapped
+ * audience would be exactly that. Twenty is well past any real "who looks after the register" group
+ * and small enough that the check below stays a handful of calls rather than one per seat.
+ *
+ * The cap is applied **after** sorting by role, so the people it keeps are the senior ones rather
+ * than whichever rows the database happened to return first.
+ */
+const RECIPIENT_CAP = 20;
+/**
+ * The members of a workspace who genuinely hold a permission.
+ *
+ * Genuinely, not "hold the role it defaults to": `kernel.authz.can` reads custom roles and scope
+ * bindings as well as the built-in defaults, so a workspace that took `inventory.repair.manage` away
+ * from `member` and gave it to one custom role is answered correctly. Guessing from the role would
+ * have been one local call instead of a handful, and would have quietly told the wrong people.
+ *
+ * Every failure here is swallowed: this decides an audience for a best-effort notification, and a
+ * member whose principal core cannot produce right now is one fewer recipient, not a reason for a
+ * nightly sweep to stop half-way through a workspace.
+ */
+export async function membersWithPermission(kernel, workspaceId, permission) {
+    const members = await kernel
+        .call('core.workspaces.members', { workspaceId })
+        .catch(() => []);
+    const ordered = [...members].sort((a, b) => (ROLE_RANK[b.role] ?? 0) - (ROLE_RANK[a.role] ?? 0));
+    const allowed = [];
+    for (const member of ordered) {
+        if (allowed.length >= RECIPIENT_CAP)
+            break;
+        const principal = await kernel
+            .call('core.users.principal', { userId: member.userId })
+            .catch(() => null);
+        if (!principal)
+            continue;
+        const can = await kernel.authz
+            .can(principal, permission, { kind: 'workspace', workspaceId })
+            .catch(() => false);
+        if (can)
+            allowed.push(member.userId);
+    }
+    return allowed;
+}
+//# sourceMappingURL=audience.js.map

package/dist/server/services/audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience.js","sourceRoot":"","sources":["../../../src/server/services/audience.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AAEH,+EAA+E;AAC/E,MAAM,SAAS,GAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;AAE1F;;;;;;;;;;GAUG;AACH,MAAM,aAAa,GAAG,EAAE,CAAA;AAOxB;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,WAAmB,EACnB,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,MAAM;SACzB,IAAI,CAAW,yBAAyB,EAAE,EAAE,WAAW,EAAE,CAAC;SAC1D,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAA;IAE9B,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAEhG,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,IAAI,aAAa;YAAE,MAAK;QAC1C,MAAM,SAAS,GAAG,MAAM,MAAM;aAC3B,IAAI,CAAmB,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aACzE,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACpB,IAAI,CAAC,SAAS;YAAE,SAAQ;QACxB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK;aAC3B,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;aAC9D,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;QACrB,IAAI,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/server/services/categories.d.ts

@@ -0,0 +1,57 @@
+import { type Tx } from '@kernhq/kernel';
+import type { Category as CategoryModel } from '../../contract/models.js';
+import { categories } from '../schema.js';
+type Row = typeof categories.$inferSelect;
+/** The wire shape: drizzle gives Date objects for timestamps, the contract promises ISO strings. */
+export declare function toCategory(row: Row): CategoryModel;
+/**
+ * How a workspace groups what it owns.
+ *
+ * Small on purpose. A category is a name and a position in a list; everything interesting about an
+ * asset belongs to the asset. The one thing here worth reading twice is that nothing deletes — see
+ * `archive` below.
+ */
+export declare class CategoryService {
+    /**
+     * Ordered by `order` and then by name, which is what makes a workspace that never touches the
+     * order field still get an alphabetical picker rather than an arbitrary one — every row has
+     * `order` 0, so the tiebreak is doing all the work and has to be a name rather than an id.
+     */
+    list(tx: Tx, workspaceId: string, includeArchived: boolean): Promise<CategoryModel[]>;
+    get(tx: Tx, workspaceId: string, categoryId: string): Promise<Row>;
+    /**
+     * A duplicate name is a `CONFLICT` with the name in it, never a 500.
+     *
+     * The unique index is what actually decides — checking first and inserting after is a race that
+     * two people adding "Laptops" at once will find — so the check is the insert, and the driver's
+     * 23505 is translated into a sentence rather than shown as "Failed query: insert into
+     * mod_inventory.categories …".
+     */
+    create(tx: Tx, workspaceId: string, name: string, order: number): Promise<Row>;
+    update(tx: Tx, workspaceId: string, categoryId: string, patch: {
+        name?: string;
+        order?: number;
+    }): Promise<Row>;
+    /**
+     * Archive and restore, which are one procedure because they are one column.
+     *
+     * **Nothing here deletes, and that is the decision this file exists to record.**
+     * `assets.category_id` carries no foreign key — a module keeps its ids plain — so a delete would
+     * leave every asset filed under this category pointing at a row that is not there: a blank column
+     * on the row, a picker that cannot explain what the asset used to be, and an `asset_history`
+     * entry saying "category changed to <nothing>". None of it recoverable, all of it caused by a
+     * settings screen. An archived category disappears from every picker and every filter and leaves
+     * each asset able to say what it is.
+     */
+    archive(tx: Tx, workspaceId: string, categoryId: string, archived: boolean): Promise<Row>;
+    /**
+     * The unique index refused it, or something else did and must not be disguised.
+     *
+     * Rethrowing the original for anything that is not this constraint matters: turning every failed
+     * insert into "that name is taken" would hide a real fault behind a sentence a person would act
+     * on by renaming something, for ever.
+     */
+    private static nameTaken;
+}
+export {};
+//# sourceMappingURL=categories.d.ts.map

package/dist/server/services/categories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"categories.d.ts","sourceRoot":"","sources":["../../../src/server/services/categories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,EAAE,EAAU,MAAM,gBAAgB,CAAA;AAE3D,OAAO,KAAK,EAAE,QAAQ,IAAI,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAGzC,KAAK,GAAG,GAAG,OAAO,UAAU,CAAC,YAAY,CAAA;AAKzC,oGAAoG;AACpG,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,aAAa,CAUlD;AAED;;;;;;GAMG;AACH,qBAAa,eAAe;IAC1B;;;;OAIG;IACG,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAWrF,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IASxE;;;;;;;OAOG;IACG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAS9E,MAAM,CACV,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,GAAG,CAAC;IAqBf;;;;;;;;;;OAUG;IACG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAU/F;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;CAOzB"}

package/dist/server/services/categories.js

@@ -0,0 +1,124 @@
+import { KernError, uuidv7 } from '@kernhq/kernel';
+import { and, asc, eq, isNull } from 'drizzle-orm';
+import { categories } from '../schema.js';
+import { violated } from './db-errors.js';
+/** The unique index `0000_init.sql` put on (workspace_id, name). */
+const NAME_TAKEN = 'inventory_categories_ws_name_uq';
+/** The wire shape: drizzle gives Date objects for timestamps, the contract promises ISO strings. */
+export function toCategory(row) {
+    return {
+        id: row.id,
+        workspaceId: row.workspaceId,
+        name: row.name,
+        order: row.order,
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString(),
+        archivedAt: row.archivedAt?.toISOString() ?? null,
+    };
+}
+/**
+ * How a workspace groups what it owns.
+ *
+ * Small on purpose. A category is a name and a position in a list; everything interesting about an
+ * asset belongs to the asset. The one thing here worth reading twice is that nothing deletes — see
+ * `archive` below.
+ */
+export class CategoryService {
+    /**
+     * Ordered by `order` and then by name, which is what makes a workspace that never touches the
+     * order field still get an alphabetical picker rather than an arbitrary one — every row has
+     * `order` 0, so the tiebreak is doing all the work and has to be a name rather than an id.
+     */
+    async list(tx, workspaceId, includeArchived) {
+        const filters = [eq(categories.workspaceId, workspaceId)];
+        if (!includeArchived)
+            filters.push(isNull(categories.archivedAt));
+        const rows = await tx
+            .select()
+            .from(categories)
+            .where(and(...filters))
+            .orderBy(asc(categories.order), asc(categories.name));
+        return rows.map(toCategory);
+    }
+    async get(tx, workspaceId, categoryId) {
+        const [row] = await tx
+            .select()
+            .from(categories)
+            .where(and(eq(categories.workspaceId, workspaceId), eq(categories.id, categoryId)));
+        if (!row)
+            throw KernError.notFound('Category');
+        return row;
+    }
+    /**
+     * A duplicate name is a `CONFLICT` with the name in it, never a 500.
+     *
+     * The unique index is what actually decides — checking first and inserting after is a race that
+     * two people adding "Laptops" at once will find — so the check is the insert, and the driver's
+     * 23505 is translated into a sentence rather than shown as "Failed query: insert into
+     * mod_inventory.categories …".
+     */
+    async create(tx, workspaceId, name, order) {
+        try {
+            const [row] = await tx.insert(categories).values({ id: uuidv7(), workspaceId, name, order }).returning();
+            return row;
+        }
+        catch (err) {
+            throw CategoryService.nameTaken(err, name);
+        }
+    }
+    async update(tx, workspaceId, categoryId, patch) {
+        const previous = await this.get(tx, workspaceId, categoryId);
+        // `undefined` means "not mentioned". Neither field is nullable, so there is no "clear it" here
+        // and no reason for the `null`-versus-`undefined` care `assets.update` needs.
+        const values = {
+            name: patch.name ?? previous.name,
+            order: patch.order ?? previous.order,
+            updatedAt: new Date(),
+        };
+        try {
+            const [row] = await tx
+                .update(categories)
+                .set(values)
+                .where(and(eq(categories.workspaceId, workspaceId), eq(categories.id, categoryId)))
+                .returning();
+            return row;
+        }
+        catch (err) {
+            throw CategoryService.nameTaken(err, values.name);
+        }
+    }
+    /**
+     * Archive and restore, which are one procedure because they are one column.
+     *
+     * **Nothing here deletes, and that is the decision this file exists to record.**
+     * `assets.category_id` carries no foreign key — a module keeps its ids plain — so a delete would
+     * leave every asset filed under this category pointing at a row that is not there: a blank column
+     * on the row, a picker that cannot explain what the asset used to be, and an `asset_history`
+     * entry saying "category changed to <nothing>". None of it recoverable, all of it caused by a
+     * settings screen. An archived category disappears from every picker and every filter and leaves
+     * each asset able to say what it is.
+     */
+    async archive(tx, workspaceId, categoryId, archived) {
+        const [row] = await tx
+            .update(categories)
+            .set({ archivedAt: archived ? new Date() : null, updatedAt: new Date() })
+            .where(and(eq(categories.workspaceId, workspaceId), eq(categories.id, categoryId)))
+            .returning();
+        if (!row)
+            throw KernError.notFound('Category');
+        return row;
+    }
+    /**
+     * The unique index refused it, or something else did and must not be disguised.
+     *
+     * Rethrowing the original for anything that is not this constraint matters: turning every failed
+     * insert into "that name is taken" would hide a real fault behind a sentence a person would act
+     * on by renaming something, for ever.
+     */
+    static nameTaken(err, name) {
+        if (!violated(err, NAME_TAKEN))
+            return err;
+        return KernError.conflict(`This workspace already has a category called “${name}”.`, 'inventory.category.name_taken');
+    }
+}
+//# sourceMappingURL=categories.js.map

package/dist/server/services/categories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"categories.js","sourceRoot":"","sources":["../../../src/server/services/categories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAW,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAIzC,oEAAoE;AACpE,MAAM,UAAU,GAAG,iCAAiC,CAAA;AAEpD,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,GAAQ;IACjC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,WAA2C;QAC5D,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;KAClD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IAC1B;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,WAAmB,EAAE,eAAwB;QAC9D,MAAM,OAAO,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,eAAe;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QACjE,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;aACtB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAM,EAAE,WAAmB,EAAE,UAAkB;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;QACrF,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAC9C,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,EAAM,EAAE,WAAmB,EAAE,IAAY,EAAE,KAAa;QACnE,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAA;YACxG,OAAO,GAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,eAAe,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,EAAM,EACN,WAAmB,EACnB,UAAkB,EAClB,KAAwC;QAExC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;QAC5D,+FAA+F;QAC/F,8EAA8E;QAC9E,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;YACpC,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,MAAM,CAAC;iBACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;iBAClF,SAAS,EAAE,CAAA;YACd,OAAO,GAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,eAAe,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,WAAmB,EAAE,UAAkB,EAAE,QAAiB;QAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACxE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;aAClF,SAAS,EAAE,CAAA;QACd,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAC9C,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,GAAY,EAAE,IAAY;QACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;YAAE,OAAO,GAAG,CAAA;QAC1C,OAAO,SAAS,CAAC,QAAQ,CACvB,iDAAiD,IAAI,IAAI,EACzD,+BAA+B,CAChC,CAAA;IACH,CAAC;CACF"}

package/dist/server/services/cursor.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The one page boundary this module issues, for every list it pages.
+ *
+ * **The bookmarked row's id, and the sort it was issued under.** Nothing else — in particular not
+ * the sort key itself, which is what it used to carry. That earlier shape (`{k: <sort key>, i:
+ * <id>}`) was wrong three separate ways, each of them reachable by anyone who could type into the
+ * address bar:
+ *
+ *   - **It could not be trusted.** `decode` checked only that `i` was a *string*, and `i` is
+ *     interpolated into `(col, id) < ($1, $2::uuid)`. `{"k":"x","i":"not-a-uuid"}` therefore
+ *     reached Postgres as a 22P02 nobody caught — an unhandled 500 and an error-level log line per
+ *     request, at the 600-a-minute the rate limiter allows.
+ *   - **It was not bound to its sort.** A cursor issued under `sort=recent` replayed under
+ *     `sort=code` compared a uuid against a code, so page two came back equal to page one and
+ *     "Load more" never ended.
+ *   - **It was unbounded.** `sort=name` on a 200-character Persian name encoded to 602 characters,
+ *     and `Cursor` in `@kernhq/contracts` is `max(512)` — so a long enough name broke "Load more"
+ *     with a validation error, in exactly the locales least likely to be tested.
+ *
+ * Carrying the id alone and reading the sort key back from that row in SQL answers all three: the
+ * cursor is a fixed ~60 characters whatever the name, a value that is not a uuid is refused before
+ * it is anywhere near the database, and a cursor whose sort disagrees with the request is refused
+ * rather than quietly misread. Base64 so nothing in the product is tempted to read it — it is a
+ * bookmark, not an offset, and its shape is this file's business.
+ *
+ * It lives here rather than in `assets.ts` because the repair list pages too, and a second bookmark
+ * format would be a second set of those three bugs. `src/client/mock.ts` mirrors this byte for
+ * byte; read them as one pair and change them as one pair.
+ *
+ * The asset timeline is the one list that does **not** use this one: it is ordered by a sequence
+ * rather than by a row id, so its bookmark is `SeqBookmark` below.
+ */
+export interface Bookmark<S extends string> {
+    i: string;
+    s: S;
+}
+export declare const encodeMark: <S extends string>(mark: Bookmark<S>) => string;
+export declare function decodeMark<S extends string>(cursor: string, sort: S): Bookmark<S>;
+/**
+ * The other page boundary: a row's **sequence number**, and the sort it was issued under.
+ *
+ * The asset timeline is ordered by `asset_history.seq` rather than by the row id, because a uuidv7
+ * is only ordered to the millisecond and two entries written inside one — an attach and a detach, a
+ * create and its first entry — sort by ten random bytes. `schema.ts` argues that at the column. A
+ * bookmark into that ordering has to name the sequence value, so it is a number rather than a uuid
+ * and needs its own codec: handing `decodeMark` a number would have it refused as "not a uuid", and
+ * relaxing `decodeMark` to accept either is how one of the two shapes ends up unvalidated.
+ *
+ * It keeps all three properties the uuid bookmark has, and for the same reasons:
+ *
+ *   - **bounded** — a base64url of `{"n":<integer>,"s":"recent"}` is around forty characters
+ *     whatever the row, well inside `Cursor`'s `max(512)` in `@kernhq/contracts`;
+ *   - **checked before it reaches SQL** — anything that is not a safe positive integer is refused
+ *     here rather than interpolated into a `bigint` comparison for Postgres to reject as a 22P02;
+ *   - **bound to its sort** — a bookmark issued under one ordering is meaningless under another,
+ *     and reading it anyway is what made "Load more" loop for ever.
+ *
+ * `Number.isSafeInteger` is the upper bound as well as the type check: the column is a `bigint` and
+ * the sequence would have to hand out nine quadrillion history rows to reach it, but a cursor
+ * arrives from outside and `JSON.parse` will happily produce `1e400`.
+ */
+export interface SeqBookmark<S extends string> {
+    n: number;
+    s: S;
+}
+export declare const encodeSeqMark: <S extends string>(mark: SeqBookmark<S>) => string;
+export declare function decodeSeqMark<S extends string>(cursor: string, sort: S): SeqBookmark<S>;
+//# sourceMappingURL=cursor.d.ts.map

package/dist/server/services/cursor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../../src/server/services/cursor.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,QAAQ,CAAC,CAAC,SAAS,MAAM;IACxC,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,CAAC,CAAA;CACL;AAED,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAG,MACA,CAAA;AAKjE,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAcjF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,MAAM;IAC3C,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,CAAC,CAAA;CACL;AAED,eAAO,MAAM,aAAa,GAAI,CAAC,SAAS,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,KAAG,MACN,CAAA;AAEjE,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAWvF"}

package/dist/server/services/cursor.js

@@ -0,0 +1,39 @@
+import { KernError } from '@kernhq/kernel';
+export const encodeMark = (mark) => Buffer.from(JSON.stringify(mark), 'utf8').toString('base64url');
+/** Cheap and total, and it runs before the value can reach a `::uuid` cast. */
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function decodeMark(cursor, sort) {
+    const refuse = () => KernError.badRequest('That page marker is not one this list issued');
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw refuse();
+    }
+    if (typeof parsed?.i !== 'string' || !UUID.test(parsed.i))
+        throw refuse();
+    // One comparison covers both a sort this list never issues and a sort it issued under a
+    // *different* request. Either way the bookmark cannot be read against the ordering asked for,
+    // and pretending otherwise is what made "Load more" loop for ever.
+    if (parsed.s !== sort)
+        throw refuse();
+    return { i: parsed.i, s: sort };
+}
+export const encodeSeqMark = (mark) => Buffer.from(JSON.stringify(mark), 'utf8').toString('base64url');
+export function decodeSeqMark(cursor, sort) {
+    const refuse = () => KernError.badRequest('That page marker is not one this list issued');
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw refuse();
+    }
+    if (typeof parsed?.n !== 'number' || !Number.isSafeInteger(parsed.n) || parsed.n < 1)
+        throw refuse();
+    if (parsed.s !== sort)
+        throw refuse();
+    return { n: parsed.n, s: sort };
+}
+//# sourceMappingURL=cursor.js.map

package/dist/server/services/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../../src/server/services/cursor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAuC1C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAmB,IAAiB,EAAU,EAAE,CACxE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEjE,+EAA+E;AAC/E,MAAM,IAAI,GAAG,iEAAiE,CAAA;AAE9E,MAAM,UAAU,UAAU,CAAmB,MAAc,EAAE,IAAO;IAClE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,8CAA8C,CAAC,CAAA;IACzF,IAAI,MAAmC,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgC,CAAA;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,MAAM,EAAE,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,MAAM,EAAE,CAAA;IACzE,wFAAwF;IACxF,8FAA8F;IAC9F,mEAAmE;IACnE,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,MAAM,EAAE,CAAA;IACrC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;AACjC,CAAC;AA8BD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAmB,IAAoB,EAAU,EAAE,CAC9E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEjE,MAAM,UAAU,aAAa,CAAmB,MAAc,EAAE,IAAO;IACrE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,8CAA8C,CAAC,CAAA;IACzF,IAAI,MAAsC,CAAA;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAmC,CAAA;IAC1G,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,MAAM,EAAE,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,MAAM,EAAE,CAAA;IACpG,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,MAAM,EAAE,CAAA;IACrC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;AACjC,CAAC"}

package/dist/server/services/custody.d.ts

@@ -0,0 +1,175 @@
+import { type Tx } from '@kernhq/kernel';
+import type { CustodyPeriod as CustodyPeriodModel } from '../../contract/models.js';
+import { assets, custodyPeriods } from '../schema.js';
+import type { HistoryInput, NotifyService } from './notify.js';
+type AssetRow = typeof assets.$inferSelect;
+type PeriodRow = typeof custodyPeriods.$inferSelect;
+/** The wire shape: drizzle gives Date objects for timestamps, the contract promises ISO strings. */
+export declare function toCustodyPeriod(row: PeriodRow): CustodyPeriodModel;
+/**
+ * What one custody change wrote, and what may only leave the module once it has committed.
+ *
+ * `previousUserId` and `userId` are what `inventory.custody.changed` carries, and between them they
+ * say which of the three verbs happened without a fourth field claiming to: out from stock has no
+ * previous, back to stock has no next, a hand-on has both.
+ */
+export interface CustodyWritten {
+    asset: AssetRow;
+    /** The period this call opened. Null on a return: something closed, nothing opened. */
+    period: PeriodRow | null;
+    userId: string | null;
+    previousUserId: string | null;
+    activity: HistoryInput;
+    /** Who to tell, which is the recipient and never the person doing the handing. */
+    notifyUserId: string | null;
+}
+/**
+ * Who is holding what, over time.
+ *
+ * Effective-dated the way HR keeps employments: **nothing is ever updated in place**. A change
+ * closes the open row and inserts a new one, so the answer to "who had this laptop in March" is a
+ * row that still exists rather than a value that was overwritten.
+ *
+ * Three things happen in one transaction on every change, and the whole point of the class is that
+ * they cannot come apart: the period rows move, `assets.custodian_user_id`/`custody_since`/`status`
+ * are brought into step with them, and an `asset_history` entry records it. The denormalised
+ * columns on `assets` are what the list filters and the widget read; they are correct because they
+ * are written here, in the same transaction, and never by a job afterwards.
+ *
+ * **A repair never refuses a handover.** An item at the repairer is still somebody's
+ * responsibility, so none of the three verbs looks at repair state to decide whether it may run —
+ * refusing `assign` would mean refusing `return` as well, and somebody leaving the company while
+ * their laptop is in the workshop has to be able to hand it back. What repair state *does* affect
+ * is the status these three write, which is `deriveStatus`'s job and is argued in `status.ts`.
+ *
+ * **The database is the arbiter of who won, not this file.** There is deliberately no `select … for
+ * update` before the period is inserted. `inventory_custody_no_overlap` — a GiST exclusion
+ * constraint on `(asset_id =, tstzrange(effective_from, effective_to, '[)') &&)` — is what makes two
+ * open periods impossible, so two people pressing *Hand over* on the same laptop in the same instant
+ * both read "nobody has it", both insert, and Postgres refuses exactly one of them. Locking the
+ * asset first would serialise them into two successful handovers, which is a worse answer wearing
+ * the clothes of a safer one. What this file owes the loser is a sentence they can act on rather
+ * than drizzle's "Failed query: insert into mod_inventory.custody_periods …", and that is `refuse()`
+ * below.
+ *
+ * **The asset row *is* locked afterwards, and that is a different job.** `stamp` takes it before it
+ * reads the repair state, because `status` is derived from two facts two services write and the
+ * winner of the race still has to write an answer nobody can overwrite from a stale snapshot. The
+ * distinction is argued at `lockAsset` in `status.ts`: the constraint decides the contest, the lock
+ * orders the bookkeeping that follows it.
+ */
+export declare class CustodyService {
+    private readonly notify;
+    constructor(notify: NotifyService);
+    /**
+     * The one error a lost race produces, in every place a race can be lost.
+     *
+     * Actionable rather than apologetic: the reader's screen is now out of date, and the only thing
+     * they can do about it is look again. `reason` is stable so a client could eventually say it in
+     * the reader's own language; the message is the honest fallback until one does.
+     */
+    private static refuse;
+    private asset;
+    /** The period that has not been closed, if there is one. At most one exists, by construction. */
+    open(tx: Tx, workspaceId: string, assetId: string): Promise<PeriodRow | undefined>;
+    /**
+     * Every period for one asset, newest first.
+     *
+     * Capped rather than paged: the rows are bounded by how many times one item changed hands, which
+     * is tens over its life. Ordered by `effective_from` and then by id, because a hand-on closes one
+     * row and opens another at the same instant and the two would otherwise have no order between
+     * them — the panel would show the handover before the return it replaced, at random.
+     */
+    history(tx: Tx, workspaceId: string, assetId: string, limit: number): Promise<PeriodRow[]>;
+    /**
+     * Close the open period at `at`, or refuse.
+     *
+     * `and effective_to is null` in the predicate is the optimistic guard: under READ COMMITTED a
+     * concurrent close blocks this statement, and when it resumes the row no longer matches, so zero
+     * rows come back rather than a second close silently overwriting the first one's timestamp.
+     */
+    private close;
+    private openPeriod;
+    /**
+     * The three denormalised columns, brought into step inside the same transaction.
+     *
+     * **`status` is not `userId ? 'assigned' : 'in_stock'`, and that line is what this comment is
+     * about.** An item can be at a repairer *and* assigned to somebody — the repair does not release
+     * whoever is answerable for it — so a handover that wrote `assigned` unconditionally would
+     * announce a laptop as back in the office while it was still in the workshop. Both facts are read
+     * and `deriveStatus` decides; the rule is argued in full in `status.ts`.
+     *
+     * **The asset row is locked before the repair state is read, and the order is the point.** Without
+     * it a repair completing in another transaction is invisible here and this handover's status is
+     * derived from a snapshot that has already stopped being true — the two writes then interleave
+     * into a status matching neither. See `lockAsset`.
+     *
+     * The lock is also what makes `assets.archive`'s refusal real rather than advisory. Archiving
+     * reads "nobody is holding it" under the same lock, so a handover racing an archive is ordered
+     * against it: whichever gets the lock second sees what the first committed, and the re-check below
+     * is what turns that into a refusal instead of an archived asset with an open custody period.
+     *
+     * @param repairsOn whether the workspace records repairs, read before the transaction opened.
+     * A workspace that has switched the capability off has no `under_repair`, because the procedure
+     * that would end one answers 404 — `deriveStatus` argues it in full, and this is one of the two
+     * write paths that lets an asset out of a status nothing else could move it out of.
+     */
+    private stamp;
+    /**
+     * The latest instant this asset's custody trail already reaches.
+     *
+     * The end of the most recent closed period, or the start of the open one. One row answers it
+     * because the periods for an asset cannot overlap — that is what `inventory_custody_no_overlap`
+     * enforces — so the row that starts last also ends last.
+     */
+    private boundary;
+    /**
+     * The instant this change happens, for both halves of it.
+     *
+     * One value, so the period that closes and the period that opens abut exactly: `'[)'` ranges
+     * `[…, at)` and `[at, …)` do not overlap, where two `now()` calls a microsecond apart would leave
+     * a gap during which the asset was held by nobody.
+     *
+     * **It is a millisecond past the trail's own end, not `now()`, and both halves of that are a
+     * defect this replaced.**
+     *
+     * - `max(now, open.effectiveFrom)` produced a **zero-length period** whenever the two were equal,
+     *   which two handovers inside one millisecond make them — a JS `Date` resolves no finer. `[t, t)`
+     *   is empty, an empty range overlaps nothing, so the exclusion constraint waves it through and
+     *   the trail permanently records somebody holding the item for no time at all. Anybody reading
+     *   "who had this in March" gets a name that was never true. Strictly after the boundary, there
+     *   is no such row to write.
+     * - `assign` used plain `now()`, which a clock that steps backwards puts *before* the end of the
+     *   last closed period — so the new period overlapped a finished one, Postgres refused it with
+     *   `23P01`, and the person was told "somebody changed who is holding this a moment before you
+     *   did. Reload." Nobody had; reloading changes nothing; the handover is refused again every time.
+     *   Reading the trail's own end rather than the clock makes that unreachable instead of merely
+     *   better explained: the next period always starts after the last one ended, whatever the clock
+     *   says.
+     *
+     * `now` still wins whenever it is ahead, which is every ordinary case — this only ever moves the
+     * instant forward, never back, so it cannot manufacture a period that starts before its asset was
+     * bought.
+     */
+    private instant;
+    /**
+     * Hand a free item to a member.
+     *
+     * Refuses when somebody already has it, rather than quietly taking it off them: `transfer` is the
+     * procedure that means "hand it on", and collapsing the two would make a mistyped assignment
+     * indistinguishable from a deliberate handover in the timeline everyone reads afterwards.
+     */
+    assign(tx: Tx, workspaceId: string, actorId: string | null, assetId: string, userId: string, note: string | null, repairsOn: boolean): Promise<CustodyWritten>;
+    /**
+     * Hand it straight on. One transaction, not a return followed by an assign.
+     *
+     * Two calls would leave the asset `in_stock` with no custodian in between — visible to anybody
+     * reading the list at that moment, and permanently visible in the timeline as a return nobody
+     * performed and a stock period nobody spent.
+     */
+    transfer(tx: Tx, workspaceId: string, actorId: string | null, assetId: string, userId: string, note: string | null, repairsOn: boolean): Promise<CustodyWritten>;
+    /** Take it back. Closes the open period and puts the item back in stock. */
+    return(tx: Tx, workspaceId: string, actorId: string | null, assetId: string, note: string | null, repairsOn: boolean): Promise<CustodyWritten>;
+}
+export {};
+//# sourceMappingURL=custody.d.ts.map

package/dist/server/services/custody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custody.d.ts","sourceRoot":"","sources":["../../../src/server/services/custody.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,EAAE,EAAU,MAAM,gBAAgB,CAAA;AAE3D,OAAO,KAAK,EAAE,aAAa,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACnF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAG9D,KAAK,QAAQ,GAAG,OAAO,MAAM,CAAC,YAAY,CAAA;AAC1C,KAAK,SAAS,GAAG,OAAO,cAAc,CAAC,YAAY,CAAA;AAYnD,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,kBAAkB,CAYlE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,QAAQ,CAAA;IACf,uFAAuF;IACvF,MAAM,EAAE,SAAS,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,EAAE,YAAY,CAAA;IACtB,kFAAkF;IAClF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,aAAa;IAElD;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,MAAM;YAOP,KAAK;IAiBnB,iGAAiG;IAC3F,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAexF;;;;;;;OAOG;IACG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAShG;;;;;;OAMG;YACW,KAAK;YAgBL,UAAU;IA+BxB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,KAAK;IA6CnB;;;;;;OAMG;YACW,QAAQ;IAUtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;YACW,OAAO;IAKrB;;;;;;OAMG;IACG,MAAM,CACV,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC,cAAc,CAAC;IAqC1B;;;;;;OAMG;IACG,QAAQ,CACZ,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC,cAAc,CAAC;IAkC1B,4EAA4E;IACtE,MAAM,CACV,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC,cAAc,CAAC;CAgC3B"}