kempo 4.6.2 → 4.8.0

package/server/utils/settings/ensureEncryptionKey.js

@@ -0,0 +1,132 @@
+import { readFile, writeFile, chmod } from 'fs/promises';
+import { join } from 'path';
+import crypto from 'crypto';
+import { and, eq, isNotNull, ne, sql } from 'drizzle-orm';
+import db from '../../db/index.js';
+import { setting } from '../../db/schema.js';
+
+/*
+  Makes sure SETTINGS_ENCRYPTION_KEY exists before anything needs it, so a site never has to set one up by
+  hand. In order:
+
+    1. the environment, when it has one (a secret manager, docker compose, the host). It always wins
+    2. the site's `.env` file, for a key written after the process started
+    3. a new random key, but only when nothing is encrypted yet. Written to `.env` (owner-only, and a
+       .gitignore that names it is kept honest), then set for this process, so there is no restart
+
+  A key is never generated while the database already holds encrypted settings: a new one would make every
+  one of them unreadable. That case is an error that says so. A key is also never kept only in memory:
+  when `.env` cannot be written the answer is an error, because a key that vanishes on the next restart
+  is worse than none.
+
+  Anyone with shell access to the server can read the key in `.env`. Back it up with the database: losing
+  it makes the stored credentials unrecoverable (they can be typed in again, nothing else is lost).
+*/
+
+const NAME = 'SETTINGS_ENCRYPTION_KEY';
+const VALID = /^[0-9a-fA-F]{64}$/;
+const LINE = new RegExp(`^[ \\t]*(?:export[ \\t]+)?${NAME}[ \\t]*=[ \\t]*(.*?)[ \\t]*$`, 'm');
+const COMMENT = '# Encrypts the API credentials saved in the admin. Back this up with your database: if it is lost they cannot be recovered.';
+
+const unquote = value => value.replace(/^(['"])(.*)\1$/, '$2');
+
+const readText = async path => {
+  try {
+    return await readFile(path, 'utf8');
+  } catch(error) {
+    if(error.code === 'ENOENT') return null;
+    throw error;
+  }
+};
+
+/* How many settings are stored encrypted. A site that has not created its tables yet has none. */
+const storedSecrets = async () => {
+  try {
+    const [{ total }] = await db.select({ total: sql`count(*)::int` }).from(setting)
+      .where(and(eq(setting.type, 'secret'), isNotNull(setting.value), ne(setting.value, '')));
+    return [null, total];
+  } catch(error) {
+    if((error?.code || error?.cause?.code) === '42P01') return [null, 0];
+    return [{ code: 500, msg: 'Could not check whether this site already has encrypted settings, so no encryption key was created' }, null];
+  }
+};
+
+/* Puts the key in `.env`: replaces an empty `SETTINGS_ENCRYPTION_KEY=` line, or adds one. */
+const saveKey = async (path, key, text) => {
+  const line = `${NAME}=${key}`;
+  let next;
+  if(text === null) next = `${COMMENT}\n${line}\n`;
+  else if(LINE.test(text)) next = text.replace(LINE, line);
+  else next = `${text}${text === '' || text.endsWith('\n') ? '' : '\n'}\n${COMMENT}\n${line}\n`;
+  await writeFile(path, next, { mode: 0o600 });
+  await chmod(path, 0o600).catch(() => {});
+};
+
+/* A .gitignore that exists but does not name `.env` would let the key be committed. */
+const keepOutOfGit = async dir => {
+  const path = join(dir, '.gitignore');
+  try {
+    const text = await readText(path);
+    if(text === null || /^\/?\.env\s*$/m.test(text)) return;
+    await writeFile(path, `${text}${text.endsWith('\n') ? '' : '\n'}.env\n`);
+  } catch {
+    /* Not being able to tidy .gitignore is not worth refusing a key over. */
+  }
+};
+
+const resolve = async ({ cwd }) => {
+  const fromEnvironment = process.env[NAME];
+  if(fromEnvironment){
+    return VALID.test(fromEnvironment)
+      ? [null, { source: 'environment' }]
+      : [{ code: 500, msg: `${NAME} must be a 64-character hex string (32 bytes). Remove it to have one generated, or replace it with the key this site was created with` }, null];
+  }
+
+  const path = join(cwd, '.env');
+  let text;
+  try {
+    text = await readText(path);
+  } catch(error) {
+    return [{ code: 500, msg: `Could not read ${path} (${error.code ?? error.message}), so no encryption key was created` }, null];
+  }
+
+  const inFile = text === null ? '' : unquote(LINE.exec(text)?.[1] ?? '');
+  if(inFile){
+    if(!VALID.test(inFile)) return [{ code: 500, msg: `${NAME} in ${path} must be a 64-character hex string (32 bytes)` }, null];
+    process.env[NAME] = inFile;
+    return [null, { source: 'file', path }];
+  }
+
+  const [countError, count] = await storedSecrets();
+  if(countError) return [countError, null];
+  if(count > 0){
+    return [{ code: 500, msg: `This site has ${count} encrypted setting${count === 1 ? '' : 's'} but ${NAME} is not set. Restore the key it was created with (your .env backup, or the host's environment). A new key would make them unreadable` }, null];
+  }
+
+  const key = crypto.randomBytes(32).toString('hex');
+  try {
+    await saveKey(path, key, text);
+  } catch(error) {
+    return [{ code: 500, msg: `Could not save a new ${NAME} to ${path} (${error.code ?? error.message}). Set ${NAME} in the server's environment instead` }, null];
+  }
+  await keepOutOfGit(cwd);
+  process.env[NAME] = key;
+  console.warn(`[kempo] ${NAME} was not set, so one was generated and saved to ${path}. Back it up with your database: if it is lost, stored credentials (Stripe keys and the like) cannot be recovered and must be entered again.`);
+  return [null, { source: 'generated', path }];
+};
+
+/* One answer per process: concurrent callers share the work, and a failure can be tried again. */
+let pending = null;
+
+export const ensureEncryptionKey = ({ cwd = process.cwd() } = {}) => {
+  pending ??= resolve({ cwd }).then(result => {
+    if(result[0]) pending = null;
+    return result;
+  });
+  return pending;
+};
+
+/* For tests: forget the answer so the next call decides again. */
+export const resetEncryptionKey = () => {
+  pending = null;
+};

package/server/utils/settings/listSettings.js

@@ -1,23 +1,28 @@
 import db from '../../db/index.js';
 import { setting } from '../../db/schema.js';
-import { like, not, and, sql } from 'drizzle-orm';
+import { like, not, and, asc, sql } from 'drizzle-orm';
 import { SECRET_MASK } from './secretCrypto.js';
 
+/*
+  The settings of one owner, by name. `owner` is 'system', 'custom', 'extension' (every setting that is neither, whoever owns it),
+  or the name of one extension (`kempo-commerce`), which lists just its own. The owner is matched as a plain prefix, never as a
+  pattern, so a name with `_` or `%` in it cannot reach another owner's settings.
+*/
 export default async ({ owner, limit = 50, offset = 0 } = {}) => {
   try {
     let where;
-    if(owner === 'system' || owner === 'custom'){
-      where = like(setting.name, `${owner}:%`);
-    } else if(owner === 'extension'){
+    if(owner === 'extension'){
       where = and(
         not(like(setting.name, 'system:%')),
         not(like(setting.name, 'custom:%'))
       );
+    } else if(owner){
+      where = sql`left(${setting.name}, ${owner.length + 1}) = ${`${owner}:`}`;
     }
     const q = db.select().from(setting);
     const cq = db.select({ count: sql`count(*)` }).from(setting);
     if(where){ q.where(where); cq.where(where); }
-    const results = await q.limit(limit).offset(offset);
+    const results = await q.orderBy(asc(setting.name)).limit(limit).offset(offset);
     const [{ count }] = await cq;
 
     // Never send secret ciphertext to the admin UI, not even encrypted.

package/server/utils/settings/secretCrypto.js

@@ -37,5 +37,9 @@ export const decryptSecret = encoded => {
   const ciphertext = data.subarray(28);
   const decipher = crypto.createDecipheriv('aes-256-gcm', getKey(), iv);
   decipher.setAuthTag(authTag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+  try {
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+  } catch {
+    throw new Error('A stored secret could not be decrypted: SETTINGS_ENCRYPTION_KEY is not the key it was saved with. Restore the original key, or enter the credential again');
+  }
 };

package/server/utils/settings/setSetting.js

@@ -3,12 +3,16 @@ import { setting } from '../../db/schema.js';
 import { eq } from 'drizzle-orm';
 import { serializeValue } from './helpers.js';
 import { SECRET_MASK } from './secretCrypto.js';
+import settingRule from './settingRules.js';
 
 export default async (owner, name, value, type = null, isPublic = false, description = null) => {
   if(!owner || !name){
     return [{ code: 400, msg: 'Both owner and name are required' }, null];
   }
 
+  const ruleError = settingRule(owner, name, value);
+  if(ruleError) return [ruleError, null];
+
   try {
     const fullName = `${owner}:${name}`;
     const detectedType = type || (typeof value === 'object' ? 'json' : typeof value);

package/server/utils/settings/settingRules.js

@@ -0,0 +1,21 @@
+import isValidSender from '../email/isValidSender.js';
+
+/*
+  Rules for particular settings, checked whenever one is saved (the admin screen, the API and the SDK alike), because a bad value of
+  these breaks something site-wide. Resolves to an `{ code, msg }` error, or null when the value is fine.
+*/
+const whole = (value, min, max) => Number.isInteger(Number(value)) && value !== '' && value !== null && Number(value) >= min && Number(value) <= max;
+
+const RULES = {
+  'system:email_max_retries': value => (whole(value, 0, 10) ? null : { code: 400, msg: 'Retries must be a whole number from 0 to 10' }),
+  'system:email_retention_days': value => (whole(value, 0, 3650) ? null : { code: 400, msg: 'Retention must be a whole number of days from 0 to 3650' }),
+  'system:email_retention_by_type': value => (value && typeof value === 'object' && !Array.isArray(value) && Object.values(value).every(days => whole(days, 0, 3650))
+    ? null
+    : { code: 400, msg: 'Give each kind of email a whole number of days from 0 to 3650, like { "verify-email": 7 }' }),
+  'system:email_from': value => (value === '' || isValidSender(value) ? null : { code: 400, msg: 'The sender must look like name@example.com or Shop Name <name@example.com>' }),
+};
+
+export default (owner, name, value) => {
+  const rule = Object.hasOwn(RULES, `${owner}:${name}`) ? RULES[`${owner}:${name}`] : null;
+  return rule ? rule(value) : null;
+};

package/server/utils/settings/systemSettings.js

@@ -0,0 +1,40 @@
+import db from '../../db/index.js';
+import { setting } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import setSetting from './setSetting.js';
+
+/*
+  The settings kempo itself owns, with their defaults. A new site gets them when it is set up (seedDatabase), and `ensureSystemSettings`
+  adds any that an older site is missing when the server starts, so a setting added in a later version shows on the settings screen
+  and can be edited like the rest. It only ever adds: a setting that exists is never touched, so nothing an admin chose is overwritten.
+*/
+export const SYSTEM_SETTINGS = [
+  { owner: 'system', name: 'site_name', value: 'Kempo Site', type: 'string', isPublic: true, description: 'The name of the website' },
+  { owner: 'system', name: 'session_duration_days', value: 7, type: 'number', isPublic: false, description: 'Session duration in days' },
+  { owner: 'system', name: 'allow_registration', value: true, type: 'boolean', isPublic: true, description: 'Allow new users to register' },
+  { owner: 'system', name: 'require_email_verification', value: false, type: 'boolean', isPublic: false, description: 'Require email verification before account access' },
+  { owner: 'system', name: 'verification_url', value: 'http://localhost:3000/verify-email/{{token}}', type: 'string', isPublic: false, description: 'Email verification URL template' },
+  { owner: 'system', name: 'notification_retention_days', value: 90, type: 'number', isPublic: false, description: 'Days to keep notifications before they are deleted (0 keeps them forever)' },
+  { owner: 'system', name: 'password_reset_url', value: 'http://localhost:3000/reset-password/{{token}}', type: 'string', isPublic: false, description: 'Password reset URL template' },
+  { owner: 'system', name: 'email_max_retries', value: 1, type: 'number', isPublic: false, description: 'How many times kempo tries again to send an email that could not be sent, after the first try (0 never retries)' },
+  { owner: 'system', name: 'email_retention_days', value: 30, type: 'number', isPublic: false, description: 'Days to keep the log of sent emails before it is deleted (0 keeps it forever)' },
+  { owner: 'system', name: 'email_retention_by_type', value: {}, type: 'json', isPublic: false, description: 'Days to keep a particular kind of email, instead of the number above, as { "verify-email": 7, "kempo-commerce/order-processing": 365 } (0 keeps that kind forever)' },
+  { owner: 'system', name: 'email_from', value: '', type: 'string', isPublic: false, description: 'The address emails are sent from, as name@example.com or Shop Name <name@example.com>. It must be on a domain verified with the email provider. Empty uses EMAIL_FROM from the server environment' },
+];
+
+/* Resolves to [error, { added: [names] }]. */
+export const ensureSystemSettings = async () => {
+  try {
+    const added = [];
+    for(const entry of SYSTEM_SETTINGS){
+      const [existing] = await db.select({ name: setting.name }).from(setting).where(eq(setting.name, `${entry.owner}:${entry.name}`)).limit(1);
+      if(existing) continue;
+      const [error] = await setSetting(entry.owner, entry.name, entry.value, entry.type, entry.isPublic, entry.description);
+      if(error) return [error, null];
+      added.push(entry.name);
+    }
+    return [null, { added }];
+  } catch {
+    return [{ code: 500, msg: 'The system settings could not be checked' }, null];
+  }
+};

package/server/utils/setup/seedDatabase.js

@@ -2,54 +2,7 @@ import crypto from 'crypto';
 import db from '../../db/index.js';
 import { permission, group, groupPermission, setting, createSettingProtectionTrigger, createGroupProtectionTrigger, createPermissionProtectionTrigger } from '../../db/schema.js';
 import { eq, and, sql } from 'drizzle-orm';
-
-const DEFAULT_PERMISSIONS = [
-  { name: 'system:user:create', description: 'Create new users' },
-  { name: 'system:user:read', description: 'View users' },
-  { name: 'system:user:update', description: 'Edit users' },
-  { name: 'system:user:delete', description: 'Delete users' },
-  
-  { name: 'system:group:create', description: 'Create new groups' },
-  { name: 'system:group:read', description: 'View groups' },
-  { name: 'system:group:update', description: 'Edit groups and manage membership' },
-  { name: 'system:group:delete', description: 'Delete groups' },
-  
-  { name: 'system:permissions:read', description: 'View permissions for all users' },
-  { name: 'system:permissions:manage', description: 'Add or remove permissions' },
-  
-  { name: 'system:settings:read', description: 'View private settings' },
-  { name: 'system:settings:update', description: 'Update settings' },
-  { name: 'system:custom-settings:manage', description: 'Create and delete custom settings' },
-  
-  { name: 'system:pages:read', description: 'View pages in admin' },
-  { name: 'system:pages:create', description: 'Create new pages' },
-  { name: 'system:pages:update', description: 'Edit pages' },
-  { name: 'system:pages:delete', description: 'Delete pages' },
-  
-  { name: 'system:menus:create', description: 'Create new menus' },
-  { name: 'system:menus:read', description: 'View menus in admin' },
-  { name: 'system:menus:update', description: 'Edit menus and menu items' },
-  { name: 'system:menus:delete', description: 'Delete menus' },
-  
-  { name: 'system:fragments:read', description: 'View fragments in admin' },
-  { name: 'system:fragments:create', description: 'Create new fragments' },
-  { name: 'system:fragments:update', description: 'Edit fragments' },
-  { name: 'system:fragments:delete', description: 'Delete fragments' },
-  
-  { name: 'system:globals:read', description: 'View global content in admin' },
-  { name: 'system:globals:create', description: 'Create new global content' },
-  { name: 'system:globals:update', description: 'Edit global content' },
-  { name: 'system:globals:delete', description: 'Delete global content' },
-
-  { name: 'system:extensions:read', description: 'View installed extensions' },
-  { name: 'system:extensions:install', description: 'Install extensions' },
-  { name: 'system:extensions:uninstall', description: 'Uninstall extensions' },
-  { name: 'system:extensions:manage', description: 'Enable and disable extensions' },
-
-  { name: 'system:realtime:read', description: 'View realtime connections and channels' },
-
-  { name: 'system:admin:access', description: 'Access admin panel' },
-];
+import { SYSTEM_PERMISSIONS } from './systemPermissions.js';
 
 const DEFAULT_GROUPS = {
   'system:Users': {
@@ -69,7 +22,7 @@ const DEFAULT_GROUPS = {
       'system:fragments:read', 'system:fragments:create', 'system:fragments:update', 'system:fragments:delete',
       'system:globals:read', 'system:globals:create', 'system:globals:update', 'system:globals:delete',
       'system:extensions:read', 'system:extensions:install', 'system:extensions:uninstall', 'system:extensions:manage',
-      'system:realtime:read'
+      'system:realtime:read', 'system:emails:read', 'system:emails:manage'
     ]
   }
 };
@@ -88,7 +41,7 @@ const runScript = text => db.$client?.exec ? db.$client.exec(text) : db.execute(
 export default async ({ log = console.log } = {}) => {
   log('=== Seeding Permissions ===\n');
 
-  for(const perm of DEFAULT_PERMISSIONS) {
+  for(const perm of SYSTEM_PERMISSIONS) {
     const existing = await db.select()
       .from(permission)
       .where(eq(permission.name, perm.name))
@@ -167,18 +120,10 @@ export default async ({ log = console.log } = {}) => {
 
   log('\n=== Creating Default Settings ===\n');
 
-  const DEFAULT_SETTINGS = [
-    { owner: 'system', name: 'site_name', value: 'Kempo Site', type: 'string', isPublic: true, description: 'The name of the website' },
-    { owner: 'system', name: 'session_duration_days', value: 7, type: 'number', isPublic: false, description: 'Session duration in days' },
-    { owner: 'system', name: 'allow_registration', value: true, type: 'boolean', isPublic: true, description: 'Allow new users to register' },
-    { owner: 'system', name: 'require_email_verification', value: false, type: 'boolean', isPublic: false, description: 'Require email verification before account access' },
-    { owner: 'system', name: 'verification_url', value: 'http://localhost:3000/verify-email/{{token}}', type: 'string', isPublic: false, description: 'Email verification URL template' },
-    { owner: 'system', name: 'notification_retention_days', value: 90, type: 'number', isPublic: false, description: 'Days to keep notifications before they are deleted (0 keeps them forever)' },
-    { owner: 'system', name: 'password_reset_url', value: 'http://localhost:3000/reset-password/{{token}}', type: 'string', isPublic: false, description: 'Password reset URL template' },
-  ];
+  const { SYSTEM_SETTINGS } = await import('../settings/systemSettings.js');
 
   const { default: setSetting } = await import('../settings/setSetting.js');
-  for(const s of DEFAULT_SETTINGS){
+  for(const s of SYSTEM_SETTINGS){
     await setSetting(s.owner, s.name, s.value, s.type, s.isPublic, s.description);
     log(`✓ Created setting: ${s.owner}:${s.name} = ${s.value}`);
   }

package/server/utils/setup/systemPermissions.js

@@ -0,0 +1,75 @@
+import db from '../../db/index.js';
+import { permission } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+/*
+  The permissions kempo itself defines. A new site gets them when it is set up (seedDatabase), and `ensureSystemPermissions` adds any
+  that an older site is missing when the server starts, so a permission added in a later version exists there too. It only adds: one
+  that exists is never touched. The Administrators group has every permission without being given each one.
+*/
+export const SYSTEM_PERMISSIONS = [
+  { name: 'system:user:create', description: 'Create new users' },
+  { name: 'system:user:read', description: 'View users' },
+  { name: 'system:user:update', description: 'Edit users' },
+  { name: 'system:user:delete', description: 'Delete users' },
+  
+  { name: 'system:group:create', description: 'Create new groups' },
+  { name: 'system:group:read', description: 'View groups' },
+  { name: 'system:group:update', description: 'Edit groups and manage membership' },
+  { name: 'system:group:delete', description: 'Delete groups' },
+  
+  { name: 'system:permissions:read', description: 'View permissions for all users' },
+  { name: 'system:permissions:manage', description: 'Add or remove permissions' },
+  
+  { name: 'system:settings:read', description: 'View private settings' },
+  { name: 'system:settings:update', description: 'Update settings' },
+  { name: 'system:custom-settings:manage', description: 'Create and delete custom settings' },
+  
+  { name: 'system:pages:read', description: 'View pages in admin' },
+  { name: 'system:pages:create', description: 'Create new pages' },
+  { name: 'system:pages:update', description: 'Edit pages' },
+  { name: 'system:pages:delete', description: 'Delete pages' },
+  
+  { name: 'system:menus:create', description: 'Create new menus' },
+  { name: 'system:menus:read', description: 'View menus in admin' },
+  { name: 'system:menus:update', description: 'Edit menus and menu items' },
+  { name: 'system:menus:delete', description: 'Delete menus' },
+  
+  { name: 'system:fragments:read', description: 'View fragments in admin' },
+  { name: 'system:fragments:create', description: 'Create new fragments' },
+  { name: 'system:fragments:update', description: 'Edit fragments' },
+  { name: 'system:fragments:delete', description: 'Delete fragments' },
+  
+  { name: 'system:globals:read', description: 'View global content in admin' },
+  { name: 'system:globals:create', description: 'Create new global content' },
+  { name: 'system:globals:update', description: 'Edit global content' },
+  { name: 'system:globals:delete', description: 'Delete global content' },
+
+  { name: 'system:extensions:read', description: 'View installed extensions' },
+  { name: 'system:extensions:install', description: 'Install extensions' },
+  { name: 'system:extensions:uninstall', description: 'Uninstall extensions' },
+  { name: 'system:extensions:manage', description: 'Enable and disable extensions' },
+
+  { name: 'system:realtime:read', description: 'View realtime connections and channels' },
+
+  { name: 'system:emails:read', description: 'View the log of emails, including what they said' },
+  { name: 'system:emails:manage', description: 'Send a test email and try failed emails again' },
+
+  { name: 'system:admin:access', description: 'Access admin panel' },
+];
+
+/* Resolves to [error, { added: [names] }]. */
+export const ensureSystemPermissions = async () => {
+  try {
+    const added = [];
+    for(const perm of SYSTEM_PERMISSIONS){
+      const [existing] = await db.select({ name: permission.name }).from(permission).where(eq(permission.name, perm.name)).limit(1);
+      if(existing) continue;
+      await db.insert(permission).values({ name: perm.name, description: perm.description, owner: 'system', createdAt: new Date() });
+      added.push(perm.name);
+    }
+    return [null, { added }];
+  } catch {
+    return [{ code: 500, msg: 'The system permissions could not be checked' }, null];
+  }
+};

package/dist/kempo/icons/create_new_folder.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M560-320h80v-80h80v-80h-80v-80h-80v80h-80v80h80v80ZM160-160q-33 0-56.5-23.5T80-240v-480q0-33 23.5-56.5T160-800h240l80 80h320q33 0 56.5 23.5T880-640v400q0 33-23.5 56.5T800-160H160Zm0-80h640v-400H447l-80-80H160v480Zm0 0v-480 480Z"/></svg>

package/dist/kempo/icons/credit_card.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M880-720v480q0 33-23.5 56.5T800-160H160q-33 0-56.5-23.5T80-240v-480q0-33 23.5-56.5T160-800h640q33 0 56.5 23.5T880-720ZM160-640h640v-80H160v80Zm0 160v240h640v-240H160Zm0 240v-480 480Z"/></svg>

package/dist/kempo/icons/login.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M480-120v-80h280v-560H480v-80h280q33 0 56.5 23.5T840-760v560q0 33-23.5 56.5T760-120H480Zm-80-160-55-58 102-102H120v-80h327L345-622l55-58 200 200-200 200Z"/></svg>

package/dist/kempo/icons/payments.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M560-440q-50 0-85-35t-35-85q0-50 35-85t85-35q50 0 85 35t35 85q0 50-35 85t-85 35ZM280-320q-33 0-56.5-23.5T200-400v-320q0-33 23.5-56.5T280-800h560q33 0 56.5 23.5T920-720v320q0 33-23.5 56.5T840-320H280Zm80-80h400q0-33 23.5-56.5T840-480v-160q-33 0-56.5-23.5T760-720H360q0 33-23.5 56.5T280-640v160q33 0 56.5 23.5T360-400Zm440 240H120q-33 0-56.5-23.5T40-240v-440h80v440h680v80ZM280-400v-320 320Z"/></svg>

package/dist/kempo/icons/toll.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M373-253q-93-93-93-227t93-227q93-93 227-93t227 93q93 93 93 227t-93 227q-93 93-227 93t-227-93Zm-93 83q-106-28-173-114T40-480q0-110 67-196t173-114v84q-72 25-116 87t-44 139q0 77 44 139t116 87v84Zm320-310Zm170 170q70-70 70-170t-70-170q-70-70-170-70t-170 70q-70 70-70 170t70 170q70 70 170 70t170-70Z"/></svg>

package/dist/kempo/icons/wallet.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M200-120q-33 0-56.5-23.5T120-200v-560q0-33 23.5-56.5T200-840h560q33 0 56.5 23.5T840-760v80h-80v-80H200v560h560v-80h80v80q0 33-23.5 56.5T760-120H200Zm320-160q-33 0-56.5-23.5T440-360v-240q0-33 23.5-56.5T520-680h280q33 0 56.5 23.5T880-600v240q0 33-23.5 56.5T800-280H520Zm280-80v-240H520v240h280Zm-160-60q25 0 42.5-17.5T700-480q0-25-17.5-42.5T640-540q-25 0-42.5 17.5T580-480q0 25 17.5 42.5T640-420Z"/></svg>