@ketvietlab/ketsuite 0.1.2 → 0.1.3

package/dist/modules/channel_api/customer.js

@@ -0,0 +1,368 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import { CHANNEL_API_VERSION, bearerOf, channelError, csrfTokenFor, defineChannelRoute, hostOf, registerChannelIdentity, registerChannelRealm, routesOf, sameOrigin, sha256, stableHash, } from './core.js';
+const COOKIE = 'ket_customer_session';
+const schema = (properties, required = []) => ({
+    type: 'object',
+    additionalProperties: false,
+    properties,
+    ...(required.length ? { required } : {}),
+});
+const string = { type: 'string' };
+const authBody = schema({ email: { type: 'string', format: 'email' }, password: string }, [
+    'email',
+    'password',
+]);
+const registerBody = schema({ displayName: string, email: { type: 'string', format: 'email' }, password: string }, ['displayName', 'email', 'password']);
+const envelope = schema({ data: {}, error: {}, meta: { type: 'object' } });
+const hostnameOf = (req) => {
+    try {
+        return new URL(`http://${hostOf(req)}`).hostname.toLowerCase();
+    }
+    catch {
+        return '';
+    }
+};
+const cookieOf = (req) => {
+    for (const part of String(req.headers.cookie ?? '').split(';')) {
+        const [name, ...value] = part.trim().split('=');
+        if (name === COOKIE)
+            return decodeURIComponent(value.join('='));
+    }
+    return null;
+};
+const cookieHeader = (req, token, maxAge) => {
+    const forwarded = String(req.headers['x-forwarded-proto'] ?? '').toLowerCase();
+    const secure = forwarded === 'https' || req.socket.encrypted === true;
+    return [
+        `${COOKIE}=${encodeURIComponent(token)}`,
+        'Path=/api/customer/v1',
+        'HttpOnly',
+        'SameSite=Lax',
+        ...(secure ? ['Secure'] : []),
+        `Max-Age=${Math.max(0, Math.floor(maxAge))}`,
+    ].join('; ');
+};
+const publicAccount = (account) => ({
+    id: account.id,
+    displayName: account.displayName,
+    email: account.email,
+});
+/**
+ * Which realm — and so which site — this request belongs to.
+ *
+ * The host answers for a browser. A native client has no meaningful Host, so it
+ * names the realm outright and the realm's primary site answers instead. Both
+ * paths are needed by every profile route that reads site-scoped data, which is
+ * why this is exported rather than kept for authentication.
+ */
+export const channelRealmContext = async (ctx, url, req) => {
+    const host = hostnameOf(req);
+    if (host) {
+        const site = (await ctx.callUnchecked('website.resolveSite', { host }, url, req));
+        if (site?.id) {
+            const realm = (await ctx.callUnchecked('website.customerRealmForSite', { siteId: site.id }, url, req));
+            if (realm?.id)
+                return { siteId: String(site.id), realmId: String(realm.id), realmKey: String(realm.key ?? realm.id) };
+        }
+    }
+    const key = String(req.headers['x-channel-realm'] ?? '').trim();
+    if (!key)
+        return null;
+    const realm = (await ctx.callUnchecked('website.customerRealmByKey', { key }, url, req));
+    if (!realm?.id)
+        return null;
+    const link = (await ctx.callUnchecked('website.primaryCustomerSiteForRealm', { realmId: realm.id }, url, req));
+    return {
+        siteId: link?.siteId ? String(link.siteId) : null,
+        realmId: String(realm.id),
+        realmKey: String(realm.key ?? key),
+    };
+};
+const startCookieSession = async (ctx, url, req, account) => {
+    const token = randomBytes(32).toString('base64url');
+    const session = (await ctx.callUnchecked('website.startCustomerSession', { id: randomUUID(), accountId: account.id, tokenDigest: sha256(token), networkFingerprint: null }, url, req));
+    if (!session?.absoluteExpiresAt)
+        return null;
+    const maxAge = (new Date(session.absoluteExpiresAt).getTime() - Date.now()) / 1000;
+    return { token, cookie: cookieHeader(req, token, maxAge), csrfToken: csrfTokenFor(token) };
+};
+const issueTokens = async (ctx, url, req, account) => {
+    const accessToken = randomBytes(32).toString('base64url');
+    const refreshToken = randomBytes(48).toString('base64url');
+    const grant = (await ctx.callUnchecked('website.issueCustomerTokenGrant', {
+        id: randomUUID(),
+        accountId: account.id,
+        accessDigest: sha256(accessToken),
+        refreshDigest: sha256(refreshToken),
+    }, url, req));
+    return grant?.accessExpiresAt
+        ? {
+            tokenType: 'Bearer',
+            accessToken,
+            refreshToken,
+            accessExpiresAt: grant.accessExpiresAt,
+            refreshExpiresAt: grant.refreshExpiresAt,
+        }
+        : null;
+};
+export const customerIdentity = async (ctx, url, req) => {
+    const bearer = bearerOf(req);
+    if (bearer) {
+        const grant = (await ctx.callUnchecked('website.resolveCustomerAccessToken', { accessDigest: sha256(bearer) }, url, req));
+        if (!grant?.account || !grant.realmId)
+            return null;
+        const link = (await ctx.callUnchecked('website.primaryCustomerSiteForRealm', { realmId: grant.realmId }, url, req));
+        return {
+            account: grant.account,
+            accountId: grant.account.id,
+            realmId: String(grant.realmId),
+            siteId: link?.siteId ? String(link.siteId) : null,
+            token: bearer,
+            presentation: 'bearer',
+        };
+    }
+    const token = cookieOf(req);
+    const context = await channelRealmContext(ctx, url, req);
+    if (!token || !context?.siteId)
+        return null;
+    const session = (await ctx.callUnchecked('website.resolveCustomerSession', { siteId: context.siteId, tokenDigest: sha256(token) }, url, req));
+    if (!session)
+        return null;
+    return {
+        account: { ...session, id: session.accountId },
+        accountId: session.accountId,
+        realmId: session.realmId,
+        siteId: context.siteId,
+        token,
+        presentation: 'cookie',
+    };
+};
+registerChannelIdentity('customer', customerIdentity);
+registerChannelRealm('customer', async (ctx, url, req) => (await channelRealmContext(ctx, url, req))?.realmId ?? null);
+const authFailure = (ctx, url, req, result, status = 422) => {
+    const errors = Array.isArray(result?.errors)
+        ? (result
+            .errors ?? [])
+        : [];
+    const first = errors[0];
+    const messageKey = first?.message ?? 'website.customer.error.invalidRequest';
+    return {
+        status: messageKey === 'website.customer.error.rateLimit' ? 429 : status,
+        error: channelError(ctx, url, req, messageKey, {
+            messageKey,
+            params: first?.params ?? {},
+            retryable: messageKey === 'website.customer.error.rateLimit',
+            fieldErrors: Object.fromEntries(errors
+                .filter((error) => error.field)
+                .map((error) => [
+                String(error.field),
+                {
+                    code: error.message ?? messageKey,
+                    messageKey: error.message ?? messageKey,
+                    params: error.params ?? {},
+                },
+            ])),
+        }),
+    };
+};
+/**
+ * Registration and sign-in mint the cookie, so there is no session for the facade
+ * to key a CSRF check on yet. The origin check is the one that applies here: it
+ * stops a third-party page from silently logging a visitor into an account it
+ * controls.
+ */
+const authenticate = async (ctx, url, req, body, register, presentation) => {
+    if (presentation === 'cookie' && !sameOrigin(req))
+        return {
+            status: 403,
+            error: channelError(ctx, url, req, 'website.customer.error.originMismatch'),
+        };
+    const context = await channelRealmContext(ctx, url, req);
+    if (!context)
+        return { status: 404, error: channelError(ctx, url, req, 'website.customer.error.realmUnavailable') };
+    const rateKey = sha256(`${req.socket.remoteAddress ?? 'unknown'}\n${String(req.headers['user-agent'] ?? '')}`);
+    const result = (await ctx.callUnchecked(register ? 'website.registerCustomer' : 'website.authenticateCustomer', register
+        ? {
+            realmId: context.realmId,
+            displayName: body.displayName,
+            email: body.email,
+            password: body.password,
+            rateKey,
+        }
+        : { realmId: context.realmId, email: body.email, password: body.password, rateKey }, url, req));
+    if (!result.ok || !result.account)
+        return authFailure(ctx, url, req, result, register ? 422 : 401);
+    if (presentation === 'cookie') {
+        const session = await startCookieSession(ctx, url, req, result.account);
+        if (!session)
+            return authFailure(ctx, url, req, {}, 401);
+        return {
+            status: register ? 201 : 200,
+            data: { customer: publicAccount(result.account), csrfToken: session.csrfToken },
+            headers: { 'set-cookie': session.cookie },
+        };
+    }
+    const tokens = await issueTokens(ctx, url, req, result.account);
+    if (!tokens)
+        return authFailure(ctx, url, req, {}, 401);
+    return { status: register ? 201 : 200, data: { customer: publicAccount(result.account), ...tokens } };
+};
+export const customerRoutes = routesOf(defineChannelRoute({
+    profile: 'customer',
+    method: 'GET',
+    path: 'bootstrap',
+    operationId: 'customer.bootstrap',
+    summary: 'Resolve the customer channel context and live capabilities.',
+    auth: 'optional-customer',
+    responses: { '200': envelope },
+    handler: async (ctx, url, req, _params, request) => {
+        const context = await channelRealmContext(ctx, url, req);
+        const identity = request.identity;
+        /**
+         * What this tenant serves, not what the deployment ships.
+         *
+         * Enumerating the whole manifest and marking the rest blocked told a
+         * shopper which other verticals exist on the box — capability keys for
+         * apps their tenant never installed. A shopper cannot install one, so the
+         * answer was of no use to them and of some use to everyone else.
+         */
+        const live = await ctx.live(req);
+        const grouped = new Map();
+        for (const entry of Object.values(live.routes)) {
+            const contract = entry.contract;
+            if (contract?.profile !== 'customer' || !contract.capability)
+                continue;
+            const actions = grouped.get(contract.capability.key) ?? new Set();
+            actions.add(contract.capability.action);
+            grouped.set(contract.capability.key, actions);
+        }
+        const capabilities = [...grouped.entries()]
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, actions]) => ({ key, mode: 'enabled', actions: [...actions].sort() }));
+        return {
+            data: {
+                contractVersion: CHANNEL_API_VERSION,
+                clientPolicy: null,
+                tenant: {
+                    realmId: context?.realmId ?? identity?.realmId ?? null,
+                    siteId: context?.siteId ?? identity?.siteId ?? null,
+                },
+                customer: identity ? publicAccount(identity.account) : null,
+                capabilities,
+                capabilityRevision: stableHash(capabilities),
+            },
+        };
+    },
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'POST',
+    path: 'auth/session/register',
+    operationId: 'customer.auth.session.register',
+    request: { body: registerBody },
+    responses: { '201': envelope },
+    handler: (ctx, url, req, _params, request) => authenticate(ctx, url, req, request.body, true, 'cookie'),
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'POST',
+    path: 'auth/session/login',
+    operationId: 'customer.auth.session.login',
+    request: { body: authBody },
+    responses: { '200': envelope },
+    handler: (ctx, url, req, _params, request) => authenticate(ctx, url, req, request.body, false, 'cookie'),
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'POST',
+    path: 'auth/token/register',
+    operationId: 'customer.auth.token.register',
+    request: { body: registerBody },
+    responses: { '201': envelope },
+    handler: (ctx, url, req, _params, request) => authenticate(ctx, url, req, request.body, true, 'bearer'),
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'POST',
+    path: 'auth/token',
+    operationId: 'customer.auth.token.issue',
+    request: { body: authBody },
+    responses: { '200': envelope },
+    handler: (ctx, url, req, _params, request) => authenticate(ctx, url, req, request.body, false, 'bearer'),
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'POST',
+    path: 'auth/token/refresh',
+    operationId: 'customer.auth.token.refresh',
+    request: { body: schema({ refreshToken: string }, ['refreshToken']) },
+    responses: { '200': envelope },
+    idempotent: true,
+    rateLimit: { action: 'auth.refresh', limit: 60, windowMs: 15 * 60_000 },
+    handler: async (ctx, url, req, _params, request) => {
+        const key = String(req.headers['idempotency-key'] ?? '').trim();
+        if (!key)
+            return {
+                status: 400,
+                error: channelError(ctx, url, req, 'channel_api.idempotencyRequired', {
+                    messageKey: 'channel_api.error.idempotencyRequired',
+                }),
+            };
+        const refreshToken = String(request.body.refreshToken ?? '');
+        /**
+         * The tokens are minted by the domain, not here.
+         *
+         * They have to be derived rather than random so a client whose response
+         * was lost can retry and be handed the same pair — the server keeps only
+         * digests and cannot look them up again. Deriving them here meant deriving
+         * them from what the caller already had, which made the entire future
+         * chain computable by anyone who obtained one refresh token. The secret
+         * that makes them unguessable lives on the grant, so the derivation lives
+         * there too.
+         */
+        const result = (await ctx.callUnchecked('website.rotateCustomerTokenGrant', { refreshDigest: sha256(refreshToken), requestKey: key }, url, req));
+        // A spent token coming back is how a stolen one announces itself. The grant
+        // is already revoked by the time we are here; the caller is told the same
+        // thing an expired token is told, and learns nothing from the difference.
+        if (!result?.account || !result.accessToken || !result.refreshToken)
+            return {
+                status: 401,
+                error: channelError(ctx, url, req, 'channel_api.invalidRefreshToken', {
+                    messageKey: 'channel_api.error.invalidRefreshToken',
+                }),
+            };
+        return {
+            data: {
+                customer: publicAccount(result.account),
+                tokenType: 'Bearer',
+                accessToken: result.accessToken,
+                refreshToken: result.refreshToken,
+                accessExpiresAt: result.accessExpiresAt,
+                refreshExpiresAt: result.refreshExpiresAt,
+            },
+        };
+    },
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'POST',
+    path: 'auth/logout',
+    operationId: 'customer.auth.logout',
+    auth: 'customer',
+    responses: { '200': envelope },
+    handler: async (ctx, url, req, _params, request) => {
+        const identity = request.identity;
+        if (identity.presentation === 'cookie') {
+            await ctx.callUnchecked('website.revokeCustomerSession', { tokenDigest: sha256(identity.token), reason: 'logout' }, url, req);
+            return { data: { loggedOut: true }, headers: { 'set-cookie': cookieHeader(req, '', 0) } };
+        }
+        await ctx.callUnchecked('website.revokeCustomerTokenGrant', { accessDigest: sha256(identity.token), reason: 'logout' }, url, req);
+        return { data: { loggedOut: true } };
+    },
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'GET',
+    path: 'me',
+    operationId: 'customer.me',
+    auth: 'customer',
+    responses: { '200': envelope },
+    capability: { key: 'channel_api.customer_account', action: 'read' },
+    handler: (_ctx, _url, _req, _params, request) => ({
+        data: { customer: publicAccount(request.identity.account) },
+    }),
+}));
+//# sourceMappingURL=customer.js.map

package/dist/modules/channel_api/customer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/channel_api/customer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAErD,OAAO,EACL,mBAAmB,EACnB,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,MAAM,EACN,uBAAuB,EACvB,oBAAoB,EACpB,QAAQ,EACR,UAAU,EACV,MAAM,EACN,UAAU,GACX,MAAM,WAAW,CAAA;AAOlB,MAAM,MAAM,GAAG,sBAAsB,CAAA;AACrC,MAAM,MAAM,GAAG,CAAC,UAAmC,EAAE,QAAQ,GAAa,EAAE,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,UAAU;IACV,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACzC,CAAC,CAAA;AACF,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;IACxF,OAAO;IACP,UAAU;CACX,CAAC,CAAA;AACF,MAAM,YAAY,GAAG,MAAM,CACzB,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EACrF,CAAC,aAAa,EAAE,OAAO,EAAE,UAAU,CAAC,CACrC,CAAA;AACD,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;AAE1E,MAAM,UAAU,GAAG,CAAC,GAAQ,EAAU,EAAE;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC,CAAA;AACD,MAAM,QAAQ,GAAG,CAAC,GAAQ,EAAiB,EAAE;IAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AACD,MAAM,YAAY,GAAG,CAAC,GAAQ,EAAE,KAAa,EAAE,MAAc,EAAU,EAAE;IACvE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9E,MAAM,MAAM,GAAG,SAAS,KAAK,OAAO,IAAK,GAAG,CAAC,MAAkC,CAAC,SAAS,KAAK,IAAI,CAAA;IAClG,OAAO;QACL,GAAG,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACxC,uBAAuB;QACvB,UAAU;QACV,cAAc;QACd,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE;KAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC,CAAA;AACD,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,CAAC;IAC3C,EAAE,EAAE,OAAO,CAAC,EAAE;IACd,WAAW,EAAE,OAAO,CAAC,WAAW;IAChC,KAAK,EAAE,OAAO,CAAC,KAAK;CACrB,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,GAAiB,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;IACjF,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAExE,CAAA;QACR,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CACpC,8BAA8B,EAC9B,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EACnB,GAAG,EACH,GAAG,CACJ,CAGO,CAAA;YACR,IAAI,KAAK,EAAE,EAAE;gBACX,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,EAAE,CAAA;QAC1G,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAG/E,CAAA;IACR,IAAI,CAAC,KAAK,EAAE,EAAE;QAAE,OAAO,IAAI,CAAA;IAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CACnC,qCAAqC,EACrC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,EACrB,GAAG,EACH,GAAG,CACJ,CAEO,CAAA;IACR,OAAO;QACL,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;QACjD,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC;KACnC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,KAAK,EAAE,GAAiB,EAAE,GAAQ,EAAE,GAAQ,EAAE,OAAgB,EAAE,EAAE;IAC3F,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CACtC,8BAA8B,EAC9B,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,EACjG,GAAG,EACH,GAAG,CACJ,CAA0C,CAAA;IAC3C,IAAI,CAAC,OAAO,EAAE,iBAAiB;QAAE,OAAO,IAAI,CAAA;IAC5C,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAA;IAClF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAA;AAC5F,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,KAAK,EAAE,GAAiB,EAAE,GAAQ,EAAE,GAAQ,EAAE,OAAgB,EAAE,EAAE;IACpF,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACzD,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CACpC,iCAAiC,EACjC;QACE,EAAE,EAAE,UAAU,EAAE;QAChB,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC;KACpC,EACD,GAAG,EACH,GAAG,CACJ,CAAmE,CAAA;IACpE,OAAO,KAAK,EAAE,eAAe;QAC3B,CAAC,CAAC;YACE,SAAS,EAAE,QAAQ;YACnB,WAAW;YACX,YAAY;YACZ,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC;QACH,CAAC,CAAC,IAAI,CAAA;AACV,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAiB,EAAE,GAAQ,EAAE,GAAQ,EAA4B,EAAE;IACxG,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CACpC,oCAAoC,EACpC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAChC,GAAG,EACH,GAAG,CACJ,CAAmD,CAAA;QACpD,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QAClD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CACnC,qCAAqC,EACrC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAC1B,GAAG,EACH,GAAG,CACJ,CAEO,CAAA;QACR,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;YAC3B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YACjD,KAAK,EAAE,MAAM;YACb,YAAY,EAAE,QAAQ;SACvB,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACxD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CACtC,gCAAgC,EAChC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EACtD,GAAG,EACH,GAAG,CACJ,CAA6C,CAAA;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE;QAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK;QACL,YAAY,EAAE,QAAQ;KACvB,CAAA;AACH,CAAC,CAAA;AAED,uBAAuB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;AACrD,oBAAoB,CAClB,UAAU,EACV,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CACrF,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,GAAiB,EAAE,GAAQ,EAAE,GAAQ,EAAE,MAAe,EAAE,MAAM,GAAG,GAAG,EAAE,EAAE;IAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAE,MAA+B,EAAE,MAAM,CAAC;QACpE,CAAC,CAAC,CAAE,MAAoG;aACnG,MAAM,IAAI,EAAE,CAAC;QAClB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACvB,MAAM,UAAU,GAAG,KAAK,EAAE,OAAO,IAAI,uCAAuC,CAAA;IAC5E,OAAO;QACL,MAAM,EAAE,UAAU,KAAK,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;QACxE,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE;YAC7C,UAAU;YACV,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,UAAU,KAAK,kCAAkC;YAC5D,WAAW,EAAE,MAAM,CAAC,WAAW,CAC7B,MAAM;iBACH,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;iBAC9B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;gBACnB;oBACE,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,UAAU;oBACjC,UAAU,EAAE,KAAK,CAAC,OAAO,IAAI,UAAU;oBACvC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;iBAC3B;aACF,CAAC,CACL;SACF,CAAC;KACH,CAAA;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,YAAY,GAAG,KAAK,EACxB,GAAiB,EACjB,GAAQ,EACR,GAAQ,EACR,IAA6B,EAC7B,QAAiB,EACjB,YAAiC,EACjC,EAAE;IACF,IAAI,YAAY,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAC/C,OAAO;YACL,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,uCAAuC,CAAC;SAC5E,CAAA;IACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACxD,IAAI,CAAC,OAAO;QACV,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,yCAAyC,CAAC,EAAE,CAAA;IACvG,MAAM,OAAO,GAAG,MAAM,CACpB,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CACvF,CAAA;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CACrC,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,8BAA8B,EACtE,QAAQ;QACN,CAAC,CAAC;YACE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO;SACR;QACH,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EACrF,GAAG,EACH,GAAG,CACJ,CAA0D,CAAA;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAClG,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACvE,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACxD,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YAC5B,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;YAC/E,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE;SAC1C,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAC/D,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IACvD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,CAAA;AACvG,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CACpC,kBAAkB,CAAC;IACjB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,oBAAoB;IACjC,OAAO,EAAE,6DAA6D;IACtE,IAAI,EAAE,mBAAmB;IACzB,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QACjD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QACjC;;;;;;;WAOG;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAA;QAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YAC/B,IAAI,QAAQ,EAAE,OAAO,KAAK,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU;gBAAE,SAAQ;YACtE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAA;YACzE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACvC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;aACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QACpF,OAAO;YACL,IAAI,EAAE;gBACJ,eAAe,EAAE,mBAAmB;gBACpC,YAAY,EAAE,IAAI;gBAClB,MAAM,EAAE;oBACN,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,IAAI;oBACtD,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,IAAI;iBACpD;gBACD,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC3D,YAAY;gBACZ,kBAAkB,EAAE,UAAU,CAAC,YAAY,CAAC;aAC7C;SACF,CAAA;IACH,CAAC;CACF,CAAC,EACF,kBAAkB,CAAC;IACjB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,gCAAgC;IAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;IAC/B,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;CACxG,CAAC,EACF,kBAAkB,CAAC;IACjB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,6BAA6B;IAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC;CACzG,CAAC,EACF,kBAAkB,CAAC;IACjB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,8BAA8B;IAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;IAC/B,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;CACxG,CAAC,EACF,kBAAkB,CAAC;IACjB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,2BAA2B;IACxC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC;CACzG,CAAC,EACF,kBAAkB,CAAC;IACjB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,6BAA6B;IAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE;IACrE,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9B,UAAU,EAAE,IAAI;IAChB,SAAS,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE;IACvE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QACjD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/D,IAAI,CAAC,GAAG;YACN,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,iCAAiC,EAAE;oBACpE,UAAU,EAAE,uCAAuC;iBACpD,CAAC;aACH,CAAA;QACH,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;QAC5D;;;;;;;;;;WAUG;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CACrC,kCAAkC,EAClC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EACxD,GAAG,EACH,GAAG,CACJ,CAOO,CAAA;QACR,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY;YACjE,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,iCAAiC,EAAE;oBACpE,UAAU,EAAE,uCAAuC;iBACpD,CAAC;aACH,CAAA;QACH,OAAO;YACL,IAAI,EAAE;gBACJ,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;gBACvC,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;aAC1C;SACF,CAAA;IACH,CAAC;CACF,CAAC,EACF,kBAAkB,CAAC;IACjB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,sBAAsB;IACnC,IAAI,EAAE,UAAU;IAChB,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAS,CAAA;QAClC,IAAI,QAAQ,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,GAAG,CAAC,aAAa,CACrB,+BAA+B,EAC/B,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EACzD,GAAG,EACH,GAAG,CACJ,CAAA;YACD,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAA;QAC3F,CAAC;QACD,MAAM,GAAG,CAAC,aAAa,CACrB,kCAAkC,EAClC,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAC1D,GAAG,EACH,GAAG,CACJ,CAAA;QACD,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAA;IACtC,CAAC;CACF,CAAC,EACF,kBAAkB,CAAC;IACjB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,UAAU;IAChB,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9B,UAAU,EAAE,EAAE,GAAG,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,EAAE;IACnE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,QAAS,CAAC,OAAO,CAAC,EAAE;KAC7D,CAAC;CACH,CAAC,CACH,CAAA"}

package/dist/modules/channel_api/index.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("@ketvietlab/ketjs").KetModule;
+export default _default;
+export { CHANNEL_API_VERSION, authorizedChannelCapabilities, channelCredentialFailure, channelCommandId, defineChannelRoute, registerChannelCapabilityAuthorizer, registerChannelIdentity, registerChannelIdentityPresentation, registerChannelRealm, routesOf, } from './core.ts';
+export { openApiDocument } from './openapi.ts';
+export type { ChannelAccount, AuthorizedChannelCapability, ChannelCapability, ChannelCapabilityAuthorizer, ChannelCapabilityAuthorizerRegistration, ChannelCredentialFailure, ChannelIdentities, ChannelIdentityFor, ChannelIdentityPresentation, ChannelIdentityPresentationResolver, CustomerIdentity, PosIdentity, StaffIdentity, ChannelAuth, ChannelIdentity, ChannelIdentityResolver, ChannelProfile, ChannelRequest, ChannelRouteSpec, } from './core.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/channel_api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/channel_api/index.ts"],"names":[],"mappings":";;AAiEA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,mCAAmC,EACnC,uBAAuB,EACvB,mCAAmC,EACnC,oBAAoB,EACpB,QAAQ,GACT,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAC3B,uCAAuC,EACvC,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,mCAAmC,EACnC,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,WAAW,CAAA"}

package/dist/modules/channel_api/index.js

@@ -0,0 +1,66 @@
+import { defineModule } from '@ketvietlab/ketjs';
+import { customerRoutes } from './customer.js';
+import { staffRoutes } from './staff.js';
+export default defineModule({
+    name: 'channel_api',
+    version: '1.0.0',
+    depends: ['website', 'user'],
+    title: 'Channel API',
+    summary: 'Contract API ổn định cho website, mobile, POS và tích hợp.',
+    category: 'Kỹ thuật',
+    reserves: ['/api/customer/v1/', '/api/staff/v1/', '/api/pos/v1/', '/api/integration/v1/', '/internal/v1/'],
+    routes: { ...customerRoutes, ...staffRoutes },
+    messages: {
+        vi: {
+            'app.title': 'Channel API',
+            'app.summary': 'Contract API ổn định cho website, mobile, POS và tích hợp.',
+            'app.category': 'Kỹ thuật',
+            'error.methodNotAllowed': 'Phương thức không hợp lệ; hãy dùng {method}.',
+            'error.internal': 'Không thể xử lý yêu cầu lúc này.',
+            'error.unauthenticated': 'Bạn cần đăng nhập để tiếp tục.',
+            'error.credentialConflict': 'Yêu cầu chứa nhiều thông tin đăng nhập không tương thích.',
+            'error.forbidden': 'Bạn không có quyền thực hiện thao tác này.',
+            'error.idempotencyRequired': 'Yêu cầu cần khóa chống xử lý lặp.',
+            'error.idempotencyConflict': 'Khóa chống xử lý lặp đã được dùng cho một yêu cầu khác.',
+            'error.idempotencyInFlight': 'Yêu cầu trước với khóa này đang được xử lý; hãy thử lại sau giây lát.',
+            'error.invalidRefreshToken': 'Refresh token không hợp lệ hoặc đã hết hạn.',
+            'error.originMismatch': 'Nguồn gửi yêu cầu không được phép.',
+            'error.csrf': 'Yêu cầu bảo mật không hợp lệ. Vui lòng tải lại trang.',
+            'error.rateLimited': 'Bạn thao tác quá nhanh. Vui lòng thử lại sau.',
+            'error.invalidRequest': 'Nội dung yêu cầu không hợp lệ.',
+            'error.fieldRequired': 'Trường bắt buộc chưa có giá trị.',
+            'error.fieldUnknown': 'Trường này không thuộc hợp đồng của yêu cầu.',
+            'error.fieldInvalid': 'Giá trị của trường không hợp lệ.',
+            'unsupportedMediaType.error': 'Nội dung yêu cầu phải dùng application/json.',
+            'payloadTooLarge.error': 'Nội dung yêu cầu vượt quá giới hạn cho phép.',
+            'invalidBody.error': 'Nội dung JSON của yêu cầu không hợp lệ.',
+        },
+        en: {
+            'app.title': 'Channel API',
+            'app.summary': 'Stable contracts for websites, mobile, POS and integrations.',
+            'app.category': 'Technical',
+            'error.methodNotAllowed': 'Method not allowed; use {method}.',
+            'error.internal': 'The request cannot be processed right now.',
+            'error.unauthenticated': 'Sign in to continue.',
+            'error.credentialConflict': 'The request contains conflicting credentials.',
+            'error.forbidden': 'You do not have permission to perform this action.',
+            'error.idempotencyRequired': 'This request requires an idempotency key.',
+            'error.idempotencyConflict': 'The idempotency key was already used for another request.',
+            'error.idempotencyInFlight': 'An earlier request with this key is still running; retry shortly.',
+            'error.invalidRefreshToken': 'The refresh token is invalid or expired.',
+            'error.originMismatch': 'The request origin is not allowed.',
+            'error.csrf': 'The security token is invalid. Reload the page and try again.',
+            'error.rateLimited': 'Too many attempts. Please try again later.',
+            'error.invalidRequest': 'The request body does not match the contract.',
+            'error.fieldRequired': 'This required field is missing.',
+            'error.fieldUnknown': 'This field is not part of the request contract.',
+            'error.fieldInvalid': 'This field has an invalid value.',
+            'unsupportedMediaType.error': 'The request content type must be application/json.',
+            'payloadTooLarge.error': 'The request body exceeds the allowed size.',
+            'invalidBody.error': 'The request body is not valid JSON.',
+        },
+    },
+});
+export { CHANNEL_API_VERSION, authorizedChannelCapabilities, channelCredentialFailure, channelCommandId, defineChannelRoute, registerChannelCapabilityAuthorizer, registerChannelIdentity, registerChannelIdentityPresentation, registerChannelRealm, routesOf, } from './core.js';
+export { openApiDocument } from './openapi.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/channel_api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/channel_api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,aAAa;IACpB,OAAO,EAAE,4DAA4D;IACrE,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,CAAC;IAC1G,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,GAAG,WAAW,EAAE;IAC7C,QAAQ,EAAE;QACR,EAAE,EAAE;YACF,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,4DAA4D;YAC3E,cAAc,EAAE,UAAU;YAC1B,wBAAwB,EAAE,8CAA8C;YACxE,gBAAgB,EAAE,kCAAkC;YACpD,uBAAuB,EAAE,gCAAgC;YACzD,0BAA0B,EAAE,2DAA2D;YACvF,iBAAiB,EAAE,4CAA4C;YAC/D,2BAA2B,EAAE,mCAAmC;YAChE,2BAA2B,EAAE,yDAAyD;YACtF,2BAA2B,EAAE,uEAAuE;YACpG,2BAA2B,EAAE,6CAA6C;YAC1E,sBAAsB,EAAE,oCAAoC;YAC5D,YAAY,EAAE,uDAAuD;YACrE,mBAAmB,EAAE,+CAA+C;YACpE,sBAAsB,EAAE,gCAAgC;YACxD,qBAAqB,EAAE,kCAAkC;YACzD,oBAAoB,EAAE,8CAA8C;YACpE,oBAAoB,EAAE,kCAAkC;YACxD,4BAA4B,EAAE,8CAA8C;YAC5E,uBAAuB,EAAE,8CAA8C;YACvE,mBAAmB,EAAE,yCAAyC;SAC/D;QACD,EAAE,EAAE;YACF,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,8DAA8D;YAC7E,cAAc,EAAE,WAAW;YAC3B,wBAAwB,EAAE,mCAAmC;YAC7D,gBAAgB,EAAE,4CAA4C;YAC9D,uBAAuB,EAAE,sBAAsB;YAC/C,0BAA0B,EAAE,+CAA+C;YAC3E,iBAAiB,EAAE,oDAAoD;YACvE,2BAA2B,EAAE,2CAA2C;YACxE,2BAA2B,EAAE,2DAA2D;YACxF,2BAA2B,EAAE,mEAAmE;YAChG,2BAA2B,EAAE,0CAA0C;YACvE,sBAAsB,EAAE,oCAAoC;YAC5D,YAAY,EAAE,+DAA+D;YAC7E,mBAAmB,EAAE,4CAA4C;YACjE,sBAAsB,EAAE,+CAA+C;YACvE,qBAAqB,EAAE,iCAAiC;YACxD,oBAAoB,EAAE,iDAAiD;YACvE,oBAAoB,EAAE,kCAAkC;YACxD,4BAA4B,EAAE,oDAAoD;YAClF,uBAAuB,EAAE,4CAA4C;YACrE,mBAAmB,EAAE,qCAAqC;SAC3D;KACF;CACF,CAAC,CAAA;AAEF,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,mCAAmC,EACnC,uBAAuB,EACvB,mCAAmC,EACnC,oBAAoB,EACpB,QAAQ,GACT,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA"}

package/dist/modules/channel_api/openapi.d.ts

@@ -0,0 +1,17 @@
+import { type Manifest } from '@ketvietlab/ketjs';
+import { type ChannelProfile } from './core.ts';
+export declare const openApiDocument: (manifest: Manifest, profile: ChannelProfile) => {
+    openapi: string;
+    info: {
+        title: string;
+        version: string;
+    };
+    servers: {
+        url: string;
+    }[];
+    paths: Record<string, Record<string, unknown>>;
+    components: {
+        securitySchemes: Record<string, unknown>;
+    };
+};
+//# sourceMappingURL=openapi.d.ts.map

package/dist/modules/channel_api/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/channel_api/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAkB,MAAM,mBAAmB,CAAA;AACjE,OAAO,EAAoB,KAAK,cAAc,EAAqB,MAAM,WAAW,CAAA;AA2DpF,eAAO,MAAM,eAAe,aAAc,QAAQ,WAAW,cAAc;;;QAoD/D,KAAK;QAA6B,OAAO;;;;;;;QAGnC,eAAe;;CAEhC,CAAA"}

package/dist/modules/channel_api/openapi.js

@@ -0,0 +1,105 @@
+import { SESSION_COOKIE } from '@ketvietlab/ketjs';
+import { demands, resolves } from './core.js';
+/**
+ * Each profile presents its credential differently, and a document naming the
+ * wrong one produces a generated client that cannot authenticate at all. A
+ * customer arrives with a bearer token or the storefront cookie; staff uses the
+ * framework session cookie in browsers and a deployment-resolved opaque Bearer
+ * session in native clients.
+ */
+const SCHEMES = {
+    customer: {
+        bearer: { type: 'http', scheme: 'bearer' },
+        customerCookie: { type: 'apiKey', in: 'cookie', name: 'ket_customer_session' },
+    },
+    staff: {
+        staffBearer: { type: 'http', scheme: 'bearer' },
+        staffCookie: { type: 'apiKey', in: 'cookie', name: SESSION_COOKIE },
+    },
+    pos: {
+        posBearer: { type: 'http', scheme: 'bearer' },
+        operatorBearer: { type: 'http', scheme: 'bearer', bearerFormat: 'JWT' },
+    },
+    integration: {},
+};
+/**
+ * Schemes the facade never offers on its own.
+ *
+ * `operatorBearer` is the upstream identity an enrollment handler verifies for
+ * itself, so it belongs to the routes that name it in `credentials` and to no
+ * other. Naming the exceptions rather than re-listing every profile's schemes
+ * keeps `SCHEMES` the only place a scheme is declared: a new one added there is
+ * offered, instead of being silently dropped from every route's security.
+ */
+const HANDLER_VERIFIED = {
+    customer: [],
+    staff: [],
+    pos: ['operatorBearer'],
+    integration: [],
+};
+const offeredSchemes = (profile) => Object.keys(SCHEMES[profile]).filter((name) => !HANDLER_VERIFIED[profile].includes(name));
+const securityFor = (profile, auth, credentials) => {
+    if (credentials?.length) {
+        for (const name of credentials)
+            if (!(name in SCHEMES[profile]))
+                throw new Error(`channel profile "${profile}" does not define credential scheme "${name}"`);
+        return credentials.map((name) => ({ [name]: [] }));
+    }
+    if (!resolves(auth))
+        return [];
+    const offered = offeredSchemes(profile).map((name) => ({ [name]: [] }));
+    return demands(auth) ? offered : [{}, ...offered];
+};
+const operationPath = (path, profile) => path.slice(`/api/${profile}/v1`.length) || '/';
+export const openApiDocument = (manifest, profile) => {
+    const paths = {};
+    for (const [path, entry] of Object.entries(manifest.routes)) {
+        const contract = entry.contract;
+        if (contract?.profile !== profile)
+            continue;
+        const parameters = [
+            ...Object.entries(contract.request?.params?.properties ?? {}).map(([name, schema]) => ({ name, in: 'path', required: true, schema })),
+            ...Object.entries(contract.request?.query?.properties ?? {}).map(([name, schema]) => ({ name, in: 'query', required: false, schema })),
+            ...Object.entries(contract.request?.headers?.properties ?? {}).map(([name, schema]) => ({
+                name,
+                in: 'header',
+                required: (contract.request?.headers?.required ?? []).includes(name),
+                schema,
+            })),
+        ];
+        paths[operationPath(path, profile)] = {
+            [contract.method.toLowerCase()]: {
+                operationId: contract.operationId,
+                ...(contract.summary ? { summary: contract.summary } : {}),
+                security: securityFor(profile, (contract.auth ?? 'public'), contract.credentials),
+                ...(parameters.length ? { parameters } : {}),
+                ...(contract.request?.body
+                    ? {
+                        requestBody: {
+                            required: true,
+                            content: { 'application/json': { schema: contract.request.body } },
+                        },
+                    }
+                    : {}),
+                responses: Object.fromEntries(Object.entries(contract.responses).map(([status, schema]) => [
+                    status,
+                    {
+                        description: status.startsWith('2') ? 'Success' : 'Error',
+                        content: { 'application/json': { schema } },
+                    },
+                ])),
+                'x-ket-capability': contract.capability ?? null,
+                'x-ket-auth': contract.auth ?? 'public',
+                'x-ket-idempotent': contract.idempotent === true,
+            },
+        };
+    }
+    return {
+        openapi: '3.1.0',
+        info: { title: `KetSuite ${profile} API`, version: '1.0.0' },
+        servers: [{ url: `/api/${profile}/v1` }],
+        paths,
+        components: { securitySchemes: SCHEMES[profile] },
+    };
+};
+//# sourceMappingURL=openapi.js.map

package/dist/modules/channel_api/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/channel_api/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACjE,OAAO,EAAyC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEpF;;;;;;GAMG;AACH,MAAM,OAAO,GAAoD;IAC/D,QAAQ,EAAE;QACR,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC1C,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,EAAE;KAC/E;IACD,KAAK,EAAE;QACL,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC/C,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE;KACpE;IACD,GAAG,EAAE;QACH,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC7C,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE;KACxE;IACD,WAAW,EAAE,EAAE;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAA8C;IAClE,QAAQ,EAAE,EAAE;IACZ,KAAK,EAAE,EAAE;IACT,GAAG,EAAE,CAAC,gBAAgB,CAAC;IACvB,WAAW,EAAE,EAAE;CAChB,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,OAAuB,EAAY,EAAE,CAC3D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;AAE3F,MAAM,WAAW,GAAG,CAAC,OAAuB,EAAE,IAAiB,EAAE,WAAsB,EAAa,EAAE;IACpG,IAAI,WAAW,EAAE,MAAM,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,WAAW;YAC5B,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,wCAAwC,IAAI,GAAG,CAAC,CAAA;QAC/F,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IAC9B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACvE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,OAAuB,EAAU,EAAE,CACtE,IAAI,CAAC,KAAK,CAAC,QAAQ,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;AAEhD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAkB,EAAE,OAAuB,EAAE,EAAE;IAC7E,MAAM,KAAK,GAA4C,EAAE,CAAA;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAC/B,IAAI,QAAQ,EAAE,OAAO,KAAK,OAAO;YAAE,SAAQ;QAC3C,MAAM,UAAU,GAAG;YACjB,GAAG,MAAM,CAAC,OAAO,CACd,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,UAAkD,IAAI,EAAE,CACpF,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACzE,GAAG,MAAM,CAAC,OAAO,CACd,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,UAAkD,IAAI,EAAE,CACnF,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM,CAAC,OAAO,CACd,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,UAAkD,IAAI,EAAE,CACrF,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,IAAI;gBACJ,EAAE,EAAE,QAAQ;gBACZ,QAAQ,EAAE,CAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAiC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9F,MAAM;aACP,CAAC,CAAC;SACJ,CAAA;QACD,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG;YACpC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE;gBAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,QAAQ,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC;gBAChG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI;oBACxB,CAAC,CAAC;wBACE,WAAW,EAAE;4BACX,QAAQ,EAAE,IAAI;4BACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;yBACnE;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,SAAS,EAAE,MAAM,CAAC,WAAW,CAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;oBAC3D,MAAM;oBACN;wBACE,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;wBACzD,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE;qBAC5C;iBACF,CAAC,CACH;gBACD,kBAAkB,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;gBAC/C,YAAY,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ;gBACvC,kBAAkB,EAAE,QAAQ,CAAC,UAAU,KAAK,IAAI;aACjD;SACF,CAAA;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,OAAO,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;QAC5D,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,OAAO,KAAK,EAAE,CAAC;QACxC,KAAK;QACL,UAAU,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;KAClD,CAAA;AACH,CAAC,CAAA"}

package/dist/modules/channel_api/staff.d.ts

@@ -0,0 +1,7 @@
+import { type Route, type ServeContext } from '@ketvietlab/ketjs';
+import type { StaffIdentity } from './core.ts';
+type Req = Parameters<Route>[1];
+export declare const staffIdentity: (ctx: ServeContext, url: URL, req: Req) => Promise<StaffIdentity | null>;
+export declare const staffRoutes: Record<string, import("@ketvietlab/ketjs").RouteEntry>;
+export {};
+//# sourceMappingURL=staff.d.ts.map

package/dist/modules/channel_api/staff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staff.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/channel_api/staff.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,KAAK,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAWjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE9C,KAAK,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAoF/B,eAAO,MAAM,aAAa,QAAe,YAAY,OAAO,GAAG,OAAO,GAAG,KAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAcvG,CAAA;AAYD,eAAO,MAAM,WAAW,wDAiGvB,CAAA"}