@ketvietlab/ketsuite 0.1.1

package/dist/modules/user/models.js

@@ -0,0 +1,168 @@
+/**
+ * Users, and the companies each may act as.
+ *
+ * A user *has* a party rather than *being* one. Odoo is alone in making the user a
+ * delegated subclass of the partner (`_inherits`), which puts every user in the
+ * address book and leaks the mechanism through archiving, deletion and sudo.
+ * Salesforce keeps `User` a separate object and links a Contact only for external
+ * users; SAP keeps SU01 separate from the business partner. The link is optional
+ * here for the same reason: an operator account is not a person you invoice.
+ *
+ * The password column is the reason D33 had to land first. Every function that
+ * returns a user declares its output, and none of them declares this.
+ */
+export const models = {
+    User: {
+        scope: 'shared',
+        fields: {
+            id: 'id',
+            login: 'text',
+            /** scrypt, parameters encoded in the value. Never in any declared output. */
+            passwordHash: 'text?',
+            /** Optional: an internal operator needs no entry in the address book. */
+            partnerId: 'ref:partner.Partner?',
+            name: 'text',
+            email: 'text?',
+            lang: 'text?',
+            /** IANA timezone used for datetime filters and grouped list buckets. */
+            timezone: 'text?',
+            /** The company a new row is stamped with when this user acts (D32). */
+            defaultCompanyId: 'ref:company.Company?',
+            /** The operational branch a company+branch row is stamped with. */
+            defaultBranchId: 'ref:company.Branch?',
+            /** Backend and website identities share a table, never a cookie realm. */
+            accessKind: 'text',
+            /** Incrementing this invalidates every session and outstanding token. */
+            securityVersion: 'int',
+            lastLoginAt: 'datetime?',
+            /**
+             * Exempt from the permission check entirely.
+             *
+             * Something has to be, or a deployment that turns roles on can never grant
+             * the first one — the functions that manage roles are themselves behind the
+             * check. Odoo solves it with a magic user id and a group; a declared column
+             * is the same escape hatch with its name written on it, and it shows up in
+             * a query rather than in institutional memory.
+             */
+            superuser: 'bool',
+            active: 'bool',
+        },
+        indexes: { login: { fields: ['login'], unique: true } },
+    },
+    /**
+     * A named set of functions.
+     *
+     * Not a set of models with CRUD flags, which is what Odoo's ir.model.access is
+     * and what makes its permissions unanswerable: granting read on a table grants
+     * it in the form, the list, the export, XML-RPC and every search() any module
+     * makes. Here the unit is the action, so a role is exactly the list of actions,
+     * and `ket permissions` can print what any list reaches because there is nothing
+     * to traverse — a function cannot touch a model it did not declare.
+     */
+    Role: {
+        scope: 'shared',
+        fields: {
+            id: 'id',
+            name: 'text',
+            description: 'text?',
+        },
+        indexes: { name: { fields: ['name'], unique: true } },
+    },
+    /** One row per granted function. Additive, like Salesforce permission sets. */
+    Grant: {
+        scope: 'shared',
+        fields: {
+            id: 'id',
+            roleId: 'ref:user.Role',
+            /** A function key, e.g. "partner.listPartners". */
+            fnKey: 'text',
+        },
+        indexes: { role_function: { fields: ['roleId', 'fnKey'], unique: true } },
+    },
+    /** One row per (user, role). A user's permissions are the union of their roles. */
+    Assignment: {
+        scope: 'shared',
+        fields: {
+            id: 'id',
+            userId: 'ref:user.User',
+            roleId: 'ref:user.Role',
+        },
+        indexes: { user_role: { fields: ['userId', 'roleId'], unique: true } },
+    },
+    /**
+     * Which companies a user may read — the set behind `scope.companies`.
+     *
+     * Rows rather than a list column, so granting one company is an insert and
+     * revoking it is a delete, both traceable, neither a read-modify-write of a
+     * field two requests can race on.
+     */
+    Membership: {
+        scope: 'shared',
+        fields: {
+            id: 'id',
+            userId: 'ref:user.User',
+            companyId: 'ref:company.Company',
+        },
+        indexes: { user_company: { fields: ['userId', 'companyId'], unique: true } },
+    },
+    /** Branches are granted explicitly, except the root granted with a company. */
+    BranchMembership: {
+        scope: 'shared',
+        fields: {
+            id: 'id',
+            userId: 'ref:user.User',
+            branchId: 'ref:company.Branch',
+        },
+        indexes: { user_branch: { fields: ['userId', 'branchId'], unique: true } },
+    },
+    /** Invitation/reset secrets are never stored; only this SHA-256 digest is. */
+    AuthToken: {
+        scope: 'shared',
+        fields: {
+            id: 'id',
+            userId: 'ref:user.User',
+            kind: 'text',
+            realm: 'text',
+            digest: 'text',
+            securityVersion: 'int',
+            expiresAt: 'datetime',
+            consumedAt: 'datetime?',
+            createdAt: 'datetime',
+        },
+        indexes: {
+            digest: { fields: ['digest'], unique: true },
+            user_kind: { fields: ['userId', 'kind'], unique: true },
+        },
+    },
+    /** PostgreSQL-backed counters keep cooldowns consistent across every pod. */
+    AuthThrottle: {
+        scope: 'shared',
+        fields: {
+            id: 'id',
+            failures: 'int',
+            blockedUntil: 'datetime?',
+            updatedAt: 'datetime',
+        },
+    },
+    /** Security events are append-only domain rows, never free-form server logs. */
+    SecurityAudit: {
+        scope: 'shared',
+        fields: {
+            id: 'id',
+            userId: 'ref:user.User?',
+            event: 'text',
+            occurredAt: 'datetime',
+            networkFingerprint: 'text?',
+            metadata: 'json?',
+        },
+    },
+    /** A row lock serializes identity invariants that span more than one User row. */
+    SecurityGuard: {
+        scope: 'shared',
+        fields: {
+            id: 'id',
+            updatedAt: 'datetime',
+        },
+    },
+};
+//# sourceMappingURL=models.js.map

package/dist/modules/user/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/user/models.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,MAAM,GAA6B;IAC9C,IAAI,EAAE;QACJ,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,MAAM;YACb,6EAA6E;YAC7E,YAAY,EAAE,OAAO;YACrB,yEAAyE;YACzE,SAAS,EAAE,sBAAsB;YACjC,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,OAAO;YACb,wEAAwE;YACxE,QAAQ,EAAE,OAAO;YACjB,uEAAuE;YACvE,gBAAgB,EAAE,sBAAsB;YACxC,mEAAmE;YACnE,eAAe,EAAE,qBAAqB;YACtC,0EAA0E;YAC1E,UAAU,EAAE,MAAM;YAClB,yEAAyE;YACzE,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,WAAW;YACxB;;;;;;;;eAQG;YACH,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,MAAM;SACf;QACD,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KACxD;IAED;;;;;;;;;OASG;IACH,IAAI,EAAE;QACJ,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,OAAO;SACrB;QACD,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KACtD;IAED,+EAA+E;IAC/E,KAAK,EAAE;QACL,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,eAAe;YACvB,mDAAmD;YACnD,KAAK,EAAE,MAAM;SACd;QACD,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KAC1E;IAED,mFAAmF;IACnF,UAAU,EAAE;QACV,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,eAAe;SACxB;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KACvE;IAED;;;;;;OAMG;IACH,UAAU,EAAE;QACV,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,qBAAqB;SACjC;QACD,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KAC7E;IAED,+EAA+E;IAC/E,gBAAgB,EAAE;QAChB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,oBAAoB;SAC/B;QACD,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KAC3E;IAED,8EAA8E;IAC9E,SAAS,EAAE;QACT,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,MAAM;YACd,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,UAAU;YACrB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,UAAU;SACtB;QACD,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;YAC5C,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;SACxD;KACF;IAED,6EAA6E;IAC7E,YAAY,EAAE;QACZ,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,UAAU;SACtB;KACF;IAED,gFAAgF;IAChF,aAAa,EAAE;QACb,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,UAAU;YACtB,kBAAkB,EAAE,OAAO;YAC3B,QAAQ,EAAE,OAAO;SAClB;KACF;IAED,kFAAkF;IAClF,aAAa,EAAE;QACb,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,UAAU;SACtB;KACF;CACF,CAAA"}

package/dist/modules/user/password.d.ts

@@ -0,0 +1,11 @@
+/** `scrypt$N$r$p$salt$hash`, base64url so it survives any transport unescaped. */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Constant-time where it matters. A wrong password and an unparseable record both
+ * return false rather than throwing: a caller that can tell those apart can tell
+ * whether an account exists.
+ */
+export declare function verifyPassword(password: string, encoded: string): Promise<boolean>;
+/** True when a stored hash was made with parameters we have since moved past. */
+export declare function needsRehash(encoded: string): boolean;
+//# sourceMappingURL=password.d.ts.map

package/dist/modules/user/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/user/password.ts"],"names":[],"mappings":"AAiCA,kFAAkF;AAClF,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKpE;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BxF;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAIpD"}

package/dist/modules/user/password.js

@@ -0,0 +1,74 @@
+// Password hashing, with no dependency.
+//
+// node:crypto ships scrypt, which is memory-hard — the property that makes a GPU
+// farm no cheaper per guess than the machine that set the password. So the one
+// exception the framework grants for a database driver is not needed here.
+//
+// The encoded form carries its own parameters. A hash that does not say how it was
+// made cannot be rehashed later without a migration that reads every row, and
+// parameters that never move are parameters that fall behind the hardware.
+import { randomBytes, scrypt as scryptCb, timingSafeEqual } from 'node:crypto';
+/** N=2^15 costs ~160ms here. Interactive, and expensive per guess. */
+const PARAMS = { N: 2 ** 15, r: 8, p: 1, keylen: 64 };
+const LIMITS = { minN: 2 ** 14, maxN: 2 ** 17, maxR: 16, maxP: 4, salt: 16, keylen: 64 };
+/** Node's default cap is 32MB, which 2^15 exceeds — so it is passed, not assumed. */
+const maxmem = 256 * PARAMS.N * PARAMS.r;
+const scrypt = (password, salt, N, r, p, keylen) => new Promise((resolve, reject) => {
+    scryptCb(password.normalize('NFKC'), salt, keylen, { N, r, p, maxmem: 256 * N * r }, (err, key) => {
+        if (err)
+            reject(err);
+        else
+            resolve(key);
+    });
+});
+/** `scrypt$N$r$p$salt$hash`, base64url so it survives any transport unescaped. */
+export async function hashPassword(password) {
+    const { N, r, p, keylen } = PARAMS;
+    const salt = randomBytes(16);
+    const key = await scrypt(password, salt, N, r, p, keylen);
+    return ['scrypt', N, r, p, salt.toString('base64url'), key.toString('base64url')].join('$');
+}
+/**
+ * Constant-time where it matters. A wrong password and an unparseable record both
+ * return false rather than throwing: a caller that can tell those apart can tell
+ * whether an account exists.
+ */
+export async function verifyPassword(password, encoded) {
+    const parts = encoded.split('$');
+    if (parts.length !== 6 || parts[0] !== 'scrypt')
+        return false;
+    const [, sN, sr, sp, salt64, hash64] = parts;
+    const N = Number(sN), r = Number(sr), p = Number(sp);
+    if (!Number.isInteger(N) ||
+        !Number.isInteger(r) ||
+        !Number.isInteger(p) ||
+        N < LIMITS.minN ||
+        N > LIMITS.maxN ||
+        (N & (N - 1)) !== 0 ||
+        r < 1 ||
+        r > LIMITS.maxR ||
+        p < 1 ||
+        p > LIMITS.maxP)
+        return false;
+    let expected;
+    try {
+        expected = Buffer.from(hash64, 'base64url');
+        const salt = Buffer.from(salt64, 'base64url');
+        if (salt.length !== LIMITS.salt || expected.length !== LIMITS.keylen)
+            return false;
+        const got = await scrypt(password, salt, N, r, p, expected.length);
+        return expected.length === got.length && timingSafeEqual(expected, got);
+    }
+    catch {
+        return false;
+    }
+}
+/** True when a stored hash was made with parameters we have since moved past. */
+export function needsRehash(encoded) {
+    const parts = encoded.split('$');
+    if (parts.length !== 6 || parts[0] !== 'scrypt')
+        return true;
+    return Number(parts[1]) < PARAMS.N;
+}
+void maxmem;
+//# sourceMappingURL=password.js.map

package/dist/modules/user/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/user/password.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,2EAA2E;AAC3E,EAAE;AACF,mFAAmF;AACnF,8EAA8E;AAC9E,2EAA2E;AAE3E,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE9E,sEAAsE;AACtE,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACrD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACxF,qFAAqF;AACrF,MAAM,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAA;AAExC,MAAM,MAAM,GAAG,CACb,QAAgB,EAChB,IAAY,EACZ,CAAS,EACT,CAAS,EACT,CAAS,EACT,MAAc,EACG,EAAE,CACnB,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAChG,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,CAAA;;YACf,OAAO,CAAC,GAAa,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEJ,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAClC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;IAC5B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IACzD,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAe;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAyD,CAAA;IAChG,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,EAClB,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,EACd,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;IAChB,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACpB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACpB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACpB,CAAC,GAAG,MAAM,CAAC,IAAI;QACf,CAAC,GAAG,MAAM,CAAC,IAAI;QACf,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QACnB,CAAC,GAAG,CAAC;QACL,CAAC,GAAG,MAAM,CAAC,IAAI;QACf,CAAC,GAAG,CAAC;QACL,CAAC,GAAG,MAAM,CAAC,IAAI;QAEf,OAAO,KAAK,CAAA;IACd,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAClF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QAClE,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAA;AACpC,CAAC;AAED,KAAK,MAAM,CAAA"}

package/dist/modules/user/relations.d.ts

@@ -0,0 +1,3 @@
+import type { RelationDef } from '@ketvietlab/ketjs';
+export declare const relations: Record<string, Record<string, RelationDef>>;
+//# sourceMappingURL=relations.d.ts.map

package/dist/modules/user/relations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/user/relations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CA6BjE,CAAA"}

package/dist/modules/user/relations.js

@@ -0,0 +1,31 @@
+export const relations = {
+    'user.User': {
+        partner: { belongsTo: 'partner.Partner', by: 'partnerId' },
+        memberships: { hasMany: 'user.Membership', by: 'userId' },
+        branchMemberships: { hasMany: 'user.BranchMembership', by: 'userId' },
+        assignments: { hasMany: 'user.Assignment', by: 'userId' },
+        authTokens: { hasMany: 'user.AuthToken', by: 'userId' },
+    },
+    'user.Membership': {
+        user: { belongsTo: 'user.User', by: 'userId' },
+        company: { belongsTo: 'company.Company', by: 'companyId' },
+    },
+    'user.BranchMembership': {
+        user: { belongsTo: 'user.User', by: 'userId' },
+        branch: { belongsTo: 'company.Branch', by: 'branchId' },
+    },
+    'user.Role': {
+        grants: { hasMany: 'user.Grant', by: 'roleId' },
+    },
+    'user.Grant': {
+        role: { belongsTo: 'user.Role', by: 'roleId' },
+    },
+    'user.Assignment': {
+        user: { belongsTo: 'user.User', by: 'userId' },
+        role: { belongsTo: 'user.Role', by: 'roleId' },
+    },
+    'user.AuthToken': {
+        user: { belongsTo: 'user.User', by: 'userId' },
+    },
+};
+//# sourceMappingURL=relations.js.map

package/dist/modules/user/relations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/user/relations.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,SAAS,GAAgD;IACpE,WAAW,EAAE;QACX,OAAO,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,EAAE,WAAW,EAAE;QAC1D,WAAW,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,QAAQ,EAAE;QACzD,iBAAiB,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,QAAQ,EAAE;QACrE,WAAW,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,QAAQ,EAAE;QACzD,UAAU,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,QAAQ,EAAE;KACxD;IACD,iBAAiB,EAAE;QACjB,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE;QAC9C,OAAO,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,EAAE,WAAW,EAAE;KAC3D;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE;QAC9C,MAAM,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE;KACxD;IACD,WAAW,EAAE;QACX,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE;KAChD;IACD,YAAY,EAAE;QACZ,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE;KAC/C;IACD,iBAAiB,EAAE;QACjB,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE;QAC9C,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE;KAC/C;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE;KAC/C;CACF,CAAA"}

package/dist/modules/user/roles.d.ts

@@ -0,0 +1,12 @@
+import type { Ctx, FnSpec } from '@ketvietlab/ketjs';
+/**
+ * Every function key this user may call, across all their roles.
+ *
+ * Resolved per request rather than cached in the session. A cached list is a
+ * revoked role that keeps working until someone logs out, and "why can they still
+ * do that" is a worse conversation than one extra query. Cache it when a
+ * measurement says to, not before.
+ */
+export declare function permittedFor(ctx: Ctx, userId: string): Promise<string[] | null>;
+export declare const roleFunctions: Record<string, FnSpec>;
+//# sourceMappingURL=roles.d.ts.map

package/dist/modules/user/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/user/roles.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAQpD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAmBrF;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CA2NhD,CAAA"}

package/dist/modules/user/roles.js

@@ -0,0 +1,254 @@
+// Roles: managing them, and resolving what a user may call.
+//
+// A role is a named list of function keys, additive across roles, the way
+// Salesforce permission sets are additive over a minimal profile. It is not a set
+// of models with CRUD flags — that is ir.model.access, and it is what makes Odoo's
+// permissions unanswerable, because granting read on a table grants it everywhere
+// the table is used.
+import { asc, defineFn, deleteFrom, eq, from, inArray } from '@ketvietlab/ketjs';
+const error = (field, code, params) => ({
+    field,
+    code,
+    ...(params ? { params } : {}),
+});
+/**
+ * Every function key this user may call, across all their roles.
+ *
+ * Resolved per request rather than cached in the session. A cached list is a
+ * revoked role that keeps working until someone logs out, and "why can they still
+ * do that" is a worse conversation than one extra query. Cache it when a
+ * measurement says to, not before.
+ */
+export async function permittedFor(ctx, userId) {
+    // Null is "no restriction", and a superuser is the only thing that returns it —
+    // otherwise the functions that grant the first role are themselves behind the
+    // check, and nobody can ever be granted anything.
+    const U = ctx.table('user.User');
+    const who = await ctx.db.one(from(U).select(U.superuser).where(eq(U.id, userId)));
+    if (who?.superuser)
+        return null;
+    const A = ctx.table('user.Assignment');
+    const roleIds = (await ctx.db.all(from(A).select(A.roleId).where(eq(A.userId, userId)))).map((r) => String(r.roleId));
+    if (!roleIds.length)
+        return [];
+    const G = ctx.table('user.Grant');
+    const rows = await ctx.db.all(from(G)
+        .select(G.fnKey)
+        .where(inArray({ model: 'user.Grant', name: 'roleId' }, roleIds)));
+    return [...new Set(rows.map((r) => String(r.fnKey)))].sort();
+}
+export const roleFunctions = {
+    permissionCatalogue: defineFn({
+        input: {},
+        output: { key: 'text', module: 'text', task: 'text' },
+        effects: [],
+        handler: (ctx) => Object.entries(ctx.manifest.functions)
+            .filter(([, fn]) => fn.exposure !== 'internal' && fn.provision !== true && !fn.anonymous)
+            .map(([key]) => {
+            const action = key.split('.').at(-1) ?? key;
+            const task = /^(list|get|count|report|forecast|permitted)/.test(action)
+                ? 'read'
+                : /^(save|create|archive|grant|revoke|assign|unassign|set|issue|apply|manage)/.test(action)
+                    ? 'manage'
+                    : 'operate';
+            return { key, module: key.split('.')[0] ?? '', task };
+        })
+            .sort((a, b) => a.module.localeCompare(b.module) || a.task.localeCompare(b.task) || a.key.localeCompare(b.key)),
+    }),
+    applyPreset: defineFn({
+        input: { module: 'text', level: 'text' },
+        output: { ok: 'bool', roleId: 'id?', granted: 'int?', errors: 'json?' },
+        effects: ['read:user.User', 'read:user.Role', 'write:user.Role', 'read:user.Grant', 'write:user.Grant'],
+        idempotent: true,
+        handler: async (ctx, a) => {
+            if (ctx.actor) {
+                const U = ctx.table('user.User');
+                const actor = await ctx.db.one(from(U).where(eq(U.id, ctx.actor), eq(U.active, true)));
+                if (!actor?.superuser)
+                    return { ok: false, errors: [error('level', 'user.error.superuserRequired')] };
+            }
+            const moduleName = String(a.module);
+            const level = String(a.level);
+            if (!['user', 'manager'].includes(level))
+                return { ok: false, errors: [error('level', 'user.error.presetLevel')] };
+            if (!ctx.manifest.modules[moduleName])
+                return { ok: false, errors: [error('module', 'user.error.moduleMissing')] };
+            const roleId = `preset:${moduleName}:${level}`;
+            await ctx.db.insertIfAbsent('user.Role', {
+                id: roleId,
+                name: `${moduleName} · ${level === 'manager' ? 'Manager' : 'User'}`,
+                description: `preset:${moduleName}:${level}`,
+            });
+            const keys = Object.entries(ctx.manifest.functions)
+                .filter(([key, fn]) => {
+                if (!key.startsWith(`${moduleName}.`) || fn.anonymous)
+                    return false;
+                if (fn.exposure === 'internal')
+                    return level === 'manager' && key === 'user.issueAuthToken';
+                if (level === 'manager')
+                    return true;
+                const action = key.split('.').at(-1) ?? key;
+                // OAuth's public/self-service calls are anonymous-by-contract and already
+                // available to a signed-in user. Provider and foreign identity rows are
+                // administration data, so the ordinary User preset grants none of them.
+                if (moduleName === 'oauth')
+                    return false;
+                return !/^(save|create|archive|grant|revoke|assign|unassign|set|issue|apply|manage)/.test(action);
+            })
+                .map(([key]) => key);
+            let granted = 0;
+            for (const key of keys) {
+                const result = await ctx.db.insertIfAbsent('user.Grant', {
+                    id: `preset:${moduleName}:${level}:${key}`,
+                    roleId,
+                    fnKey: key,
+                });
+                if ('dryRun' in result || result.inserted)
+                    granted++;
+            }
+            return { ok: true, roleId, granted };
+        },
+    }),
+    listRoles: defineFn({
+        input: {},
+        output: { id: 'id', name: 'text', description: 'text?' },
+        effects: ['read:user.Role'],
+        handler: (ctx) => ctx.db.all(from(ctx.table('user.Role')).orderBy(asc(ctx.table('user.Role').name))),
+    }),
+    getRole: defineFn({
+        input: { id: 'id' },
+        output: { id: 'id', name: 'text', description: 'text?', grants: 'json?' },
+        effects: ['read:user.Role', 'read:user.Grant'],
+        handler: async (ctx, a) => {
+            const R = ctx.table('user.Role');
+            return ctx.db.one(from(R).where(eq(R.id, a.id)).preload('grants'));
+        },
+    }),
+    saveRole: defineFn({
+        input: { id: 'id', name: 'text', description: 'text?' },
+        output: { ok: 'bool', id: 'id?', errors: 'json?' },
+        effects: ['read:user.Role', 'write:user.Role'],
+        idempotent: true,
+        handler: async (ctx, a) => {
+            const R = ctx.table('user.Role');
+            const existing = await ctx.db.one(from(R).where(eq(R.id, a.id)));
+            const owner = await ctx.db.one(from(R).where(eq(R.name, String(a.name).trim())));
+            if (owner && owner.id !== a.id)
+                return { ok: false, errors: [error('name', 'user.error.roleNameUnique')] };
+            const cs = ctx.change('user.Role', a, existing).cast(['id', 'name', 'description']).required(['name']);
+            if (!cs.valid)
+                return { ok: false, errors: cs.errors };
+            if (existing) {
+                await ctx.db.commit(cs, { id: a.id });
+                return { ok: true, id: a.id };
+            }
+            const inserted = await ctx.db.insertIfAbsent('user.Role', cs.changes);
+            return 'dryRun' in inserted || inserted.inserted
+                ? { ok: true, id: a.id }
+                : { ok: false, errors: [error('name', 'user.error.roleNameUnique')] };
+        },
+    }),
+    /**
+     * Granting a function that does not exist is refused rather than stored.
+     *
+     * A grant for a removed or misspelt function is a permission nobody can see is
+     * dead: it sits in the table looking like access, and the day the name comes
+     * back it silently becomes access again.
+     */
+    grantFunction: defineFn({
+        input: { id: 'id', roleId: 'id', fnKey: 'text' },
+        output: { ok: 'bool', id: 'id?', errors: 'json?' },
+        effects: ['read:user.Role', 'read:user.Grant', 'write:user.Grant'],
+        idempotent: true,
+        handler: async (ctx, a) => {
+            const key = String(a.fnKey);
+            if (!ctx.manifest.functions[key]) {
+                return {
+                    ok: false,
+                    errors: [error('fnKey', 'user.error.functionMissing', { key })],
+                };
+            }
+            const R = ctx.table('user.Role');
+            if (!(await ctx.db.one(from(R).where(eq(R.id, a.roleId))))) {
+                return { ok: false, errors: [error('roleId', 'user.error.roleMissing')] };
+            }
+            const G = ctx.table('user.Grant');
+            const held = await ctx.db.one(from(G).where(eq(G.roleId, a.roleId), eq(G.fnKey, key)));
+            if (held)
+                return { ok: true, id: String(held.id) };
+            const inserted = await ctx.db.insertIfAbsent('user.Grant', { id: a.id, roleId: a.roleId, fnKey: key });
+            return 'dryRun' in inserted || inserted.inserted
+                ? { ok: true, id: a.id }
+                : {
+                    ok: true,
+                    id: String((await ctx.db.one(from(G).where(eq(G.roleId, a.roleId), eq(G.fnKey, key))))?.id),
+                };
+        },
+    }),
+    revokeFunction: defineFn({
+        input: { roleId: 'id', fnKey: 'text' },
+        output: { ok: 'bool', removed: 'int' },
+        effects: ['read:user.Grant', 'write:user.Grant'],
+        idempotent: true,
+        handler: async (ctx, a) => {
+            const G = ctx.table('user.Grant');
+            const { changes } = await ctx.db.del(deleteFrom(G).where(eq(G.roleId, a.roleId), eq(G.fnKey, a.fnKey)));
+            return { ok: true, removed: changes };
+        },
+    }),
+    assignRole: defineFn({
+        input: { id: 'id', userId: 'id', roleId: 'id' },
+        output: { ok: 'bool', id: 'id?', errors: 'json?' },
+        effects: ['read:user.User', 'read:user.Role', 'read:user.Assignment', 'write:user.Assignment'],
+        idempotent: true,
+        handler: async (ctx, a) => {
+            const U = ctx.table('user.User');
+            const R = ctx.table('user.Role');
+            if (!(await ctx.db.one(from(U).where(eq(U.id, a.userId))))) {
+                return { ok: false, errors: [error('userId', 'user.error.userMissing')] };
+            }
+            if (!(await ctx.db.one(from(R).where(eq(R.id, a.roleId))))) {
+                return { ok: false, errors: [error('roleId', 'user.error.roleMissing')] };
+            }
+            const A = ctx.table('user.Assignment');
+            const held = await ctx.db.one(from(A).where(eq(A.userId, a.userId), eq(A.roleId, a.roleId)));
+            if (held)
+                return { ok: true, id: String(held.id) };
+            const inserted = await ctx.db.insertIfAbsent('user.Assignment', {
+                id: a.id,
+                userId: a.userId,
+                roleId: a.roleId,
+            });
+            return 'dryRun' in inserted || inserted.inserted
+                ? { ok: true, id: a.id }
+                : {
+                    ok: true,
+                    id: String((await ctx.db.one(from(A).where(eq(A.userId, a.userId), eq(A.roleId, a.roleId))))?.id),
+                };
+        },
+    }),
+    unassignRole: defineFn({
+        input: { userId: 'id', roleId: 'id' },
+        output: { ok: 'bool', removed: 'int' },
+        effects: ['read:user.Assignment', 'write:user.Assignment'],
+        idempotent: true,
+        handler: async (ctx, a) => {
+            const A = ctx.table('user.Assignment');
+            const { changes } = await ctx.db.del(deleteFrom(A).where(eq(A.userId, a.userId), eq(A.roleId, a.roleId)));
+            return { ok: true, removed: changes };
+        },
+    }),
+    /** What a given user may call. The same list the server enforces per request. */
+    permitted: defineFn({
+        input: { userId: 'id' },
+        output: { userId: 'id', functions: 'json?', superuser: 'bool' },
+        effects: ['read:user.User', 'read:user.Assignment', 'read:user.Grant'],
+        handler: async (ctx, a) => {
+            const list = await permittedFor(ctx, String(a.userId));
+            return list === null
+                ? { userId: a.userId, superuser: true }
+                : { userId: a.userId, functions: list, superuser: false };
+        },
+    }),
+};
+//# sourceMappingURL=roles.js.map

package/dist/modules/user/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/user/roles.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,0EAA0E;AAC1E,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,qBAAqB;AAErB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAGhF,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,MAAgC,EAAE,EAAE,CAAC,CAAC;IAChF,KAAK;IACL,IAAI;IACJ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC9B,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAQ,EAAE,MAAc;IACzD,gFAAgF;IAChF,8EAA8E;IAC9E,kDAAkD;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAChC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IACjF,IAAI,GAAG,EAAE,SAAS;QAAE,OAAO,IAAI,CAAA;IAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CACjB,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAC3B,IAAI,CAAC,CAAC,CAAC;SACJ,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;SACf,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC,CACpE,CAAA;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,mBAAmB,EAAE,QAAQ,CAAC;QAC5B,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;QACrD,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE,CACpB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;aACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,KAAK,UAAU,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC;aACxF,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;YACb,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAA;YAC3C,MAAM,IAAI,GAAG,6CAA6C,CAAC,IAAI,CAAC,MAAM,CAAC;gBACrE,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,4EAA4E,CAAC,IAAI,CAAC,MAAM,CAAC;oBACzF,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,SAAS,CAAA;YACf,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAA;QACvD,CAAC,CAAC;aACD,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CACjG;KACN,CAAC;IAEF,WAAW,EAAE,QAAQ,CAAC;QACpB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;QACxC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;QACvE,OAAO,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QACvG,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,EAAE,GAAQ,EAAE,CAAC,EAAE,EAAE;YAC7B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACd,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;gBAChC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;gBACtF,IAAI,CAAC,KAAK,EAAE,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC,EAAE,CAAA;YACvG,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;YACnC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YAC7B,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAA;YAC1E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;gBACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,EAAE,CAAA;YAC7E,MAAM,MAAM,GAAG,UAAU,UAAU,IAAI,KAAK,EAAE,CAAA;YAC9C,MAAM,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE;gBACvC,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,GAAG,UAAU,MAAM,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE;gBACnE,WAAW,EAAE,UAAU,UAAU,IAAI,KAAK,EAAE;aAC7C,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;iBAChD,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;gBACpB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS;oBAAE,OAAO,KAAK,CAAA;gBACnE,IAAI,EAAE,CAAC,QAAQ,KAAK,UAAU;oBAAE,OAAO,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,qBAAqB,CAAA;gBAC3F,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAA;gBACpC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAA;gBAC3C,0EAA0E;gBAC1E,wEAAwE;gBACxE,wEAAwE;gBACxE,IAAI,UAAU,KAAK,OAAO;oBAAE,OAAO,KAAK,CAAA;gBACxC,OAAO,CAAC,4EAA4E,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACnG,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,OAAO,GAAG,CAAC,CAAA;YACf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,YAAY,EAAE;oBACvD,EAAE,EAAE,UAAU,UAAU,IAAI,KAAK,IAAI,GAAG,EAAE;oBAC1C,MAAM;oBACN,KAAK,EAAE,GAAG;iBACX,CAAC,CAAA;gBACF,IAAI,QAAQ,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ;oBAAE,OAAO,EAAE,CAAA;YACtD,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;QACtC,CAAC;KACF,CAAC;IAEF,SAAS,EAAE,QAAQ,CAAC;QAClB,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE;QACxD,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;KAC1G,CAAC;IAEF,OAAO,EAAE,QAAQ,CAAC;QAChB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;QACnB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QACzE,OAAO,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,GAAQ,EAAE,CAAC,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;YAChC,OAAO,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;QACpE,CAAC;KACF,CAAC;IAEF,QAAQ,EAAE,QAAQ,CAAC;QACjB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE;QACvD,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QAClD,OAAO,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;QAC9C,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,EAAE,GAAQ,EAAE,CAAC,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAChE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YAChF,IAAI,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE;gBAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,EAAE,CAAA;YAC5E,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YACtG,IAAI,CAAC,EAAE,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAA;YACtD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;gBACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAA;YAC/B,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;YACrE,OAAO,QAAQ,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ;gBAC9C,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;gBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,EAAE,CAAA;QACzE,CAAC;KACF,CAAC;IAEF;;;;;;OAMG;IACH,aAAa,EAAE,QAAQ,CAAC;QACtB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE;QAChD,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QAClD,OAAO,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClE,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,EAAE,GAAQ,EAAE,CAAC,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YAC3B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;iBAChE,CAAA;YACH,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;YAChC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAA;YAC3E,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;YACjC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YACtF,IAAI,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAA;YAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YACtG,OAAO,QAAQ,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ;gBAC9C,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;gBACxB,CAAC,CAAC;oBACE,EAAE,EAAE,IAAI;oBACR,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;iBAC5F,CAAA;QACP,CAAC;KACF,CAAC;IAEF,cAAc,EAAE,QAAQ,CAAC;QACvB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE;QACtC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE;QACtC,OAAO,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QAChD,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,EAAE,GAAQ,EAAE,CAAC,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;YACjC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACvG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;QACvC,CAAC;KACF,CAAC;IAEF,UAAU,EAAE,QAAQ,CAAC;QACnB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QAC/C,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QAClD,OAAO,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,uBAAuB,CAAC;QAC9F,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,EAAE,GAAQ,EAAE,CAAC,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;YAChC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;YAChC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAA;YAC3E,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAA;YAC3E,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;YACtC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAC5F,IAAI,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAA;YAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,iBAAiB,EAAE;gBAC9D,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAA;YACF,OAAO,QAAQ,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ;gBAC9C,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;gBACxB,CAAC,CAAC;oBACE,EAAE,EAAE,IAAI;oBACR,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;iBAClG,CAAA;QACP,CAAC;KACF,CAAC;IAEF,YAAY,EAAE,QAAQ,CAAC;QACrB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QACrC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE;QACtC,OAAO,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;QAC1D,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,EAAE,GAAQ,EAAE,CAAC,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;YACtC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAClC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CACpE,CAAA;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;QACvC,CAAC;KACF,CAAC;IAEF,iFAAiF;IACjF,SAAS,EAAE,QAAQ,CAAC;QAClB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACvB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;QAC/D,OAAO,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,iBAAiB,CAAC;QACtE,OAAO,EAAE,KAAK,EAAE,GAAQ,EAAE,CAAC,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YACtD,OAAO,IAAI,KAAK,IAAI;gBAClB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;gBACvC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAC7D,CAAC;KACF,CAAC;CACH,CAAA"}

package/dist/modules/user/routes.d.ts

@@ -0,0 +1,3 @@
+import type { RouteEntry } from '@ketvietlab/ketjs';
+export declare const routes: Record<string, RouteEntry>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/modules/user/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/user/routes.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAS,UAAU,EAAgB,MAAM,mBAAmB,CAAA;AAsFxE,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAiM7C,CAAA"}