@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/org-billing-doc.js

@@ -0,0 +1,238 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * Where the commercial keys live now that they are off the org doc (AGL-1028).
+ *
+ * `orgs/{orgId}` has to stay readable by any member — it carries `plan` and
+ * `entitlements`, which every console surface gates features on, so denying it
+ * locks a site collaborator out of the site they were invited to. Firestore has
+ * no field-level reads, so the only way to narrow "readable" is to move the
+ * fields somewhere with its own rule. This subcollection is that somewhere, and
+ * it is gated on `canManageOrg()`.
+ *
+ * What did NOT move, and why. AGL-1028 originally listed `seatAddons` and all
+ * of `subscription` as movers; measuring the readers changed that:
+ *
+ * - `plan` / `entitlements` — the whole reason the org doc stays readable.
+ * - `seatAddons` — NOT a commercial secret, an ENTITLEMENT INPUT.
+ *   `resolveOrgEntitlements` stacks it on top of the plan: `seatAddons.hosts`
+ *   raises `hostLimit`, `posRegisters` raises `posRegisters`, `eventCalendar`
+ *   switches a feature on. It resolves at 29 call sites including the tenant
+ *   runtime and non-manager console components — none of which can read a
+ *   manager-gated doc. Moving it would silently drop every paying org to base
+ *   plan limits for exactly the users the org doc stays readable for.
+ * - `subscription.status`, as the derived `billingStatus` mirror — same reason.
+ *   `resolveEffectivePlan` downgrades a paid plan to free on a dead
+ *   subscription, and `resolvePurchasedAddons` stops counting add-ons on one.
+ *   Entitlement resolution therefore needs the status word, so the status word
+ *   cannot be manager-gated. The rest of `subscription` — price ids, amounts,
+ *   interval, period end, custom enterprise pricing — moves.
+ * - `suspendedAt` / `suspendedReason` — the tenant runtime reads suspension on
+ *   EVERY published page render, off an org doc it already fetches for plan and
+ *   branding. Moving it would add a Firestore read to the hot path AGL-1152 is
+ *   trying to shrink, and would hide nothing: the org doc stays member-readable
+ *   regardless. "Your sites are offline" is also something every member needs
+ *   to see, unlike a Stripe customer id.
+ *
+ * So what a scoped collaborator can still see is their plan, their capacity and
+ * a status word — the things they need — and what they lose is the Stripe
+ * customer id, price ids, amounts, billing interval, renewal date and any
+ * negotiated enterprise rate.
+ */ export const ORG_BILLING_SUBCOLLECTION = 'billing';
+/**
+ * Single document id, not one doc per concern. The reads are always "all of
+ * it" (the billing page, the webhook, the staff MRR roll-up), so splitting it
+ * would only buy extra round trips.
+ */ export const ORG_BILLING_DOC_ID = 'stripe';
+/**
+ * Reverse index `stripeCustomers/{stripeCustomerId} -> { orgId }`, written by
+ * the webhook alongside the billing doc.
+ *
+ * It exists because the webhook has to answer "which org is this Stripe
+ * customer?" on `invoice.payment_failed`, and it did that with
+ * `.where('stripeCustomerId', '==', …)` on the orgs collection. Once the field
+ * moves into a subcollection that query cannot work: the alternative is a
+ * collection-group query, which needs a collection-group index that the
+ * emulator will never ask for and production will (AGL-1028). A mapping doc is
+ * an O(1) `get`, needs no index, and stops the webhook scanning `orgs` at all.
+ *
+ * Admin-SDK only — nothing client-side has any business reading it.
+ */ export const STRIPE_CUSTOMER_INDEX_COLLECTION = 'stripeCustomers';
+/**
+ * The keys that moved off `orgs/{orgId}` and into the billing doc.
+ *
+ * `seatAddons` is deliberately NOT here — see the note above; it is an
+ * entitlement input, not a commercial secret.
+ */ export const ORG_BILLING_MOVED_KEYS = [
+    'stripeCustomerId',
+    'subscription'
+];
+/**
+ * The TEST-mode Stripe customer id, stored beside the live one (AGL-2486).
+ *
+ * `stripeCustomerId` held ONE id with no notion of Stripe livemode, so an org
+ * that had been through live checkout could never be exercised in test mode
+ * and vice versa: every billing call answered
+ *
+ *   No such customer: 'cus_…'; a similar object exists in live mode, but a
+ *   test mode key was used to make this request.
+ *
+ * — a raw 502 out of `/api/billing/checkout`, `/invoices` and `/addons`. For a
+ * team running both modes against ONE Firestore that is permanent, and it made
+ * the test-mode path we need before September 1 unusable on any real org.
+ *
+ * Worse than the 502, and the reason this is a stored-shape change rather than
+ * a better error message: a test-mode run that COMPLETED would write its test
+ * customer into the single slot and destroy the live linkage — silently, with
+ * every subsequent live invoice scattering onto a customer the Billing page no
+ * longer queries.
+ *
+ * ## Why a second field and not a mode-keyed map
+ *
+ * The live id stays at `stripeCustomerId`, untouched. That makes the migration
+ * EMPTY — every value production holds today was written by a `sk_live_`
+ * deployment and is already in the right slot — and it makes the change a
+ * NO-OP in live mode by construction: the live path reads the same field name
+ * it always read. Only test mode, which is 100% broken today, behaves
+ * differently. A `{live,test}` map would have required rewriting every
+ * existing document to gain nothing.
+ *
+ * The `stripeCustomers` reverse index needs NO equivalent treatment: it is
+ * keyed BY the customer id, and Stripe customer ids are unique across modes, so
+ * a test and a live entry are simply two documents that both resolve to the
+ * same org. That is why this fix is contained.
+ *
+ * Physical field names are an implementation detail of `org-billing.ts` — read
+ * and write through `readOrgBilling`/`writeOrgBilling`, which project the
+ * deployment's mode onto the logical `stripeCustomerId` key. Nothing else
+ * should name this constant.
+ */ export const STRIPE_CUSTOMER_ID_TEST_FIELD = 'stripeCustomerIdTest';
+/**
+ * Picks the moved keys off an org-shaped object, dropping `undefined` so a
+ * partial update never writes holes over good data.
+ *
+ * `null` is preserved deliberately — the webhook uses it to mean "Stripe says
+ * this is gone", which is a real value and not an absence.
+ */ export function pickOrgBillingFields(source) {
+    const out = {};
+    if (!source) return out;
+    for (const key of ORG_BILLING_MOVED_KEYS){
+        if (source[key] !== undefined) out[key] = source[key];
+    }
+    return out;
+}
+/**
+ * The status string to mirror onto the org doc for the dunning banner.
+ *
+ * Returns `null` when there is no subscription at all, which the banner treats
+ * the same as a healthy one — a pre-billing workspace is not in dunning.
+ */ export function orgBillingStatusFrom(billing) {
+    var _billing_subscription;
+    const status = billing == null ? void 0 : (_billing_subscription = billing.subscription) == null ? void 0 : _billing_subscription.status;
+    return typeof status === 'string' && status ? status : null;
+}
+/**
+ * Subscription statuses that mean "this org is already subscribed" (AGL-1715).
+ *
+ * A STATUS test rather than a "has a subscription record" test, and that is the
+ * part worth preserving: the record — and the `stripeCustomerId` beside it —
+ * both survive cancellation, so the naive form would lock every churned
+ * workspace out of ever paying us again. `incomplete`, `incomplete_expired` and
+ * `unpaid` are out from the other side: there is no live subscription to
+ * protect and a new one is the buyer's only way forward.
+ *
+ * `past_due` IS live. A second subscription does not settle the first one's
+ * unpaid invoice; it adds a charge beside it. Dunning is paid through the
+ * invoices and portal routes.
+ *
+ * THE list, not A list. `live-subscription-status-single-source.spec.ts` fails
+ * the build if this triple is spelled out anywhere else in the repo without an
+ * `AGL-1715-EXEMPT:` line saying why that copy answers a different question.
+ */ const LIVE_SUBSCRIPTION_STATUSES = [
+    'active',
+    'trialing',
+    'past_due'
+];
+/**
+ * True when a subscription STATUS word means the subscription is live.
+ *
+ * The status-string half of the predicate, for the call sites that hold a
+ * Stripe subscription object rather than an org billing document — the
+ * `subscriptions?customer=…&status=all` list responses in
+ * `/api/billing/subscription`, `/api/billing/addons` and
+ * `/api/admin/org-discount`, and the webhook status word that
+ * `metered-backfill` decides on. Those cannot be typed as an `OrgBillingDoc`
+ * without lying, and wrapping them in one just to unwrap it again is a cast
+ * that hides the shape. Same list, one entry point per shape.
+ */ export function isLiveSubscriptionStatus(status) {
+    return typeof status === 'string' && LIVE_SUBSCRIPTION_STATUSES.includes(status);
+}
+/**
+ * True when this org already has a live subscription and must not be sold or
+ * provisioned a second one (AGL-1697, AGL-1714).
+ *
+ * Lives here rather than at the call site because the failure mode of the
+ * copies is asymmetric in the expensive direction: if one call site's list ever
+ * narrows relative to another's, a subscribed org gets sold a second
+ * subscription and both bill. AGL-1715 repointed the older inline copies at
+ * this predicate (or at `isLiveSubscriptionStatus` where the value in hand is
+ * a Stripe object): the Billing page, `/api/billing/checkout`,
+ * `/api/billing/subscription`, `/api/billing/addons`,
+ * `/api/admin/org-discount` and `utils/server/metered-backfill`.
+ */ export function isOrgSubscriptionLive(billing) {
+    return isLiveSubscriptionStatus(orgBillingStatusFrom(billing));
+}
+/**
+ * True when an org record still carries the moved keys inline — i.e. it has not
+ * been through the backfill yet. Used by the read path to decide whether the
+ * org doc is a trustworthy fallback, and by the backfill to skip work it has
+ * already done.
+ */ export function hasInlineOrgBilling(source) {
+    if (!source) return false;
+    return ORG_BILLING_MOVED_KEYS.some((key)=>source[key] !== undefined);
+}
+/**
+ * Merge the manager-gated billing doc over an org doc WITHOUT letting the
+ * billing doc's identity win (AGL-1991).
+ *
+ * The billing page merges `orgs/{orgId}/billing/stripe` over `orgs/{orgId}` so
+ * that every `org.subscription…` reference keeps working after AGL-1028 moved
+ * those keys. The trap: the console's `useConfirmedDoc` stamps the DOCUMENT ID
+ * into the payload it hands back (`{ $id: id, ...payload }`), so the billing
+ * doc arrives carrying `$id === ORG_BILLING_DOC_ID` — the literal string
+ * `'stripe'`. A plain spread puts that second, so the merged object's `$id`
+ * silently became `'stripe'` and every child deriving its org id from it read
+ * `orgs/stripe/…`, which is not an org and is denied by the rules.
+ *
+ * That is why this is a helper and not an inline `$id:` re-assert at the call
+ * site: `useConfirmedDoc` stamping `$id` makes ANY merge of two documents
+ * identity-swapping, so the safe merge belongs somewhere it can be reused and
+ * named rather than re-derived correctly each time.
+ *
+ * The org doc's `$id` wins unconditionally — including when it is absent, in
+ * which case the result carries no `$id` at all rather than inheriting the
+ * billing doc's. A missing org id must read as "unknown", never as a
+ * confidently wrong path.
+ */ export function mergeOrgBillingOverOrg(orgDoc, orgBilling) {
+    const merged = _extends({}, orgDoc != null ? orgDoc : {}, orgBilling != null ? orgBilling : {});
+    // Restore the org document's identity, whatever the billing doc claimed.
+    if (orgDoc && '$id' in orgDoc) merged['$id'] = orgDoc['$id'];
+    else delete merged['$id'];
+    return merged;
+}
+
+//# sourceMappingURL=org-billing-doc.js.map

package/src/lib/app-utils/org-billing-doc.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/org-billing-doc.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { OrgSeatAddons, OrgSubscription } from '../foundation/definitions/org-billing.types'\n\n/**\n * Where the commercial keys live now that they are off the org doc (AGL-1028).\n *\n * `orgs/{orgId}` has to stay readable by any member — it carries `plan` and\n * `entitlements`, which every console surface gates features on, so denying it\n * locks a site collaborator out of the site they were invited to. Firestore has\n * no field-level reads, so the only way to narrow \"readable\" is to move the\n * fields somewhere with its own rule. This subcollection is that somewhere, and\n * it is gated on `canManageOrg()`.\n *\n * What did NOT move, and why. AGL-1028 originally listed `seatAddons` and all\n * of `subscription` as movers; measuring the readers changed that:\n *\n * - `plan` / `entitlements` — the whole reason the org doc stays readable.\n * - `seatAddons` — NOT a commercial secret, an ENTITLEMENT INPUT.\n *   `resolveOrgEntitlements` stacks it on top of the plan: `seatAddons.hosts`\n *   raises `hostLimit`, `posRegisters` raises `posRegisters`, `eventCalendar`\n *   switches a feature on. It resolves at 29 call sites including the tenant\n *   runtime and non-manager console components — none of which can read a\n *   manager-gated doc. Moving it would silently drop every paying org to base\n *   plan limits for exactly the users the org doc stays readable for.\n * - `subscription.status`, as the derived `billingStatus` mirror — same reason.\n *   `resolveEffectivePlan` downgrades a paid plan to free on a dead\n *   subscription, and `resolvePurchasedAddons` stops counting add-ons on one.\n *   Entitlement resolution therefore needs the status word, so the status word\n *   cannot be manager-gated. The rest of `subscription` — price ids, amounts,\n *   interval, period end, custom enterprise pricing — moves.\n * - `suspendedAt` / `suspendedReason` — the tenant runtime reads suspension on\n *   EVERY published page render, off an org doc it already fetches for plan and\n *   branding. Moving it would add a Firestore read to the hot path AGL-1152 is\n *   trying to shrink, and would hide nothing: the org doc stays member-readable\n *   regardless. \"Your sites are offline\" is also something every member needs\n *   to see, unlike a Stripe customer id.\n *\n * So what a scoped collaborator can still see is their plan, their capacity and\n * a status word — the things they need — and what they lose is the Stripe\n * customer id, price ids, amounts, billing interval, renewal date and any\n * negotiated enterprise rate.\n */\nexport const ORG_BILLING_SUBCOLLECTION = 'billing'\n\n/**\n * Single document id, not one doc per concern. The reads are always \"all of\n * it\" (the billing page, the webhook, the staff MRR roll-up), so splitting it\n * would only buy extra round trips.\n */\nexport const ORG_BILLING_DOC_ID = 'stripe'\n\n/**\n * Reverse index `stripeCustomers/{stripeCustomerId} -> { orgId }`, written by\n * the webhook alongside the billing doc.\n *\n * It exists because the webhook has to answer \"which org is this Stripe\n * customer?\" on `invoice.payment_failed`, and it did that with\n * `.where('stripeCustomerId', '==', …)` on the orgs collection. Once the field\n * moves into a subcollection that query cannot work: the alternative is a\n * collection-group query, which needs a collection-group index that the\n * emulator will never ask for and production will (AGL-1028). A mapping doc is\n * an O(1) `get`, needs no index, and stops the webhook scanning `orgs` at all.\n *\n * Admin-SDK only — nothing client-side has any business reading it.\n */\nexport const STRIPE_CUSTOMER_INDEX_COLLECTION = 'stripeCustomers'\n\n/**\n * The keys that moved off `orgs/{orgId}` and into the billing doc.\n *\n * `seatAddons` is deliberately NOT here — see the note above; it is an\n * entitlement input, not a commercial secret.\n */\nexport const ORG_BILLING_MOVED_KEYS = [\n  'stripeCustomerId',\n  'subscription',\n] as const\n\nexport type OrgBillingMovedKey = (typeof ORG_BILLING_MOVED_KEYS)[number]\n\n/**\n * The TEST-mode Stripe customer id, stored beside the live one (AGL-2486).\n *\n * `stripeCustomerId` held ONE id with no notion of Stripe livemode, so an org\n * that had been through live checkout could never be exercised in test mode\n * and vice versa: every billing call answered\n *\n *   No such customer: 'cus_…'; a similar object exists in live mode, but a\n *   test mode key was used to make this request.\n *\n * — a raw 502 out of `/api/billing/checkout`, `/invoices` and `/addons`. For a\n * team running both modes against ONE Firestore that is permanent, and it made\n * the test-mode path we need before September 1 unusable on any real org.\n *\n * Worse than the 502, and the reason this is a stored-shape change rather than\n * a better error message: a test-mode run that COMPLETED would write its test\n * customer into the single slot and destroy the live linkage — silently, with\n * every subsequent live invoice scattering onto a customer the Billing page no\n * longer queries.\n *\n * ## Why a second field and not a mode-keyed map\n *\n * The live id stays at `stripeCustomerId`, untouched. That makes the migration\n * EMPTY — every value production holds today was written by a `sk_live_`\n * deployment and is already in the right slot — and it makes the change a\n * NO-OP in live mode by construction: the live path reads the same field name\n * it always read. Only test mode, which is 100% broken today, behaves\n * differently. A `{live,test}` map would have required rewriting every\n * existing document to gain nothing.\n *\n * The `stripeCustomers` reverse index needs NO equivalent treatment: it is\n * keyed BY the customer id, and Stripe customer ids are unique across modes, so\n * a test and a live entry are simply two documents that both resolve to the\n * same org. That is why this fix is contained.\n *\n * Physical field names are an implementation detail of `org-billing.ts` — read\n * and write through `readOrgBilling`/`writeOrgBilling`, which project the\n * deployment's mode onto the logical `stripeCustomerId` key. Nothing else\n * should name this constant.\n */\nexport const STRIPE_CUSTOMER_ID_TEST_FIELD = 'stripeCustomerIdTest'\n\n/** The manager-gated document's shape. */\nexport interface OrgBillingDoc {\n  stripeCustomerId?: string | null\n  /**\n   * The test-mode twin. Present on the stored document only; the accessors\n   * collapse the pair to `stripeCustomerId` for every reader.\n   */\n  stripeCustomerIdTest?: string | null\n  subscription?: OrgSubscription | null\n}\n\n/**\n * `seatAddons` stays on the org doc, so this is the shape of what the org doc\n * still carries commercially. Named for clarity at the call sites that have to\n * keep the two apart.\n */\nexport interface OrgInlineBilling {\n  seatAddons?: OrgSeatAddons | null\n  billingStatus?: string | null\n}\n\n/**\n * The non-sensitive mirror that STAYS on the org doc.\n *\n * The AGL-275 dunning banner keys on `subscription.status === 'past_due'` and\n * is shown to every member on purpose — a contractor who cannot see the invoice\n * still benefits from knowing the workspace is about to lapse. Putting\n * `subscription` behind `canManageOrg()` would have silently switched that\n * banner off for non-managers, so the webhook mirrors the status string (and\n * nothing else: no amounts, no price ids, no customer id) back onto the org doc\n * for the banner to read.\n */\nexport type OrgBillingStatus = string\n\n/**\n * Picks the moved keys off an org-shaped object, dropping `undefined` so a\n * partial update never writes holes over good data.\n *\n * `null` is preserved deliberately — the webhook uses it to mean \"Stripe says\n * this is gone\", which is a real value and not an absence.\n */\nexport function pickOrgBillingFields(\n  source: Partial<Record<OrgBillingMovedKey, unknown>> | null | undefined,\n): Partial<OrgBillingDoc> {\n  const out: Record<string, unknown> = {}\n  if (!source) return out\n  for (const key of ORG_BILLING_MOVED_KEYS) {\n    if (source[key] !== undefined) out[key] = source[key]\n  }\n  return out as Partial<OrgBillingDoc>\n}\n\n/**\n * The status string to mirror onto the org doc for the dunning banner.\n *\n * Returns `null` when there is no subscription at all, which the banner treats\n * the same as a healthy one — a pre-billing workspace is not in dunning.\n */\nexport function orgBillingStatusFrom(\n  billing: Partial<OrgBillingDoc> | null | undefined,\n): OrgBillingStatus | null {\n  const status = (billing?.subscription as { status?: unknown } | null | undefined)?.status\n  return typeof status === 'string' && status ? status : null\n}\n\n/**\n * Subscription statuses that mean \"this org is already subscribed\" (AGL-1715).\n *\n * A STATUS test rather than a \"has a subscription record\" test, and that is the\n * part worth preserving: the record — and the `stripeCustomerId` beside it —\n * both survive cancellation, so the naive form would lock every churned\n * workspace out of ever paying us again. `incomplete`, `incomplete_expired` and\n * `unpaid` are out from the other side: there is no live subscription to\n * protect and a new one is the buyer's only way forward.\n *\n * `past_due` IS live. A second subscription does not settle the first one's\n * unpaid invoice; it adds a charge beside it. Dunning is paid through the\n * invoices and portal routes.\n *\n * THE list, not A list. `live-subscription-status-single-source.spec.ts` fails\n * the build if this triple is spelled out anywhere else in the repo without an\n * `AGL-1715-EXEMPT:` line saying why that copy answers a different question.\n */\nconst LIVE_SUBSCRIPTION_STATUSES = ['active', 'trialing', 'past_due']\n\n/**\n * True when a subscription STATUS word means the subscription is live.\n *\n * The status-string half of the predicate, for the call sites that hold a\n * Stripe subscription object rather than an org billing document — the\n * `subscriptions?customer=…&status=all` list responses in\n * `/api/billing/subscription`, `/api/billing/addons` and\n * `/api/admin/org-discount`, and the webhook status word that\n * `metered-backfill` decides on. Those cannot be typed as an `OrgBillingDoc`\n * without lying, and wrapping them in one just to unwrap it again is a cast\n * that hides the shape. Same list, one entry point per shape.\n */\nexport function isLiveSubscriptionStatus(status: unknown): boolean {\n  return (\n    typeof status === 'string' && LIVE_SUBSCRIPTION_STATUSES.includes(status)\n  )\n}\n\n/**\n * True when this org already has a live subscription and must not be sold or\n * provisioned a second one (AGL-1697, AGL-1714).\n *\n * Lives here rather than at the call site because the failure mode of the\n * copies is asymmetric in the expensive direction: if one call site's list ever\n * narrows relative to another's, a subscribed org gets sold a second\n * subscription and both bill. AGL-1715 repointed the older inline copies at\n * this predicate (or at `isLiveSubscriptionStatus` where the value in hand is\n * a Stripe object): the Billing page, `/api/billing/checkout`,\n * `/api/billing/subscription`, `/api/billing/addons`,\n * `/api/admin/org-discount` and `utils/server/metered-backfill`.\n */\nexport function isOrgSubscriptionLive(\n  billing: Partial<OrgBillingDoc> | null | undefined,\n): boolean {\n  return isLiveSubscriptionStatus(orgBillingStatusFrom(billing))\n}\n\n/**\n * True when an org record still carries the moved keys inline — i.e. it has not\n * been through the backfill yet. Used by the read path to decide whether the\n * org doc is a trustworthy fallback, and by the backfill to skip work it has\n * already done.\n */\nexport function hasInlineOrgBilling(\n  source: Partial<Record<OrgBillingMovedKey, unknown>> | null | undefined,\n): boolean {\n  if (!source) return false\n  return ORG_BILLING_MOVED_KEYS.some((key) => source[key] !== undefined)\n}\n\n/**\n * Merge the manager-gated billing doc over an org doc WITHOUT letting the\n * billing doc's identity win (AGL-1991).\n *\n * The billing page merges `orgs/{orgId}/billing/stripe` over `orgs/{orgId}` so\n * that every `org.subscription…` reference keeps working after AGL-1028 moved\n * those keys. The trap: the console's `useConfirmedDoc` stamps the DOCUMENT ID\n * into the payload it hands back (`{ $id: id, ...payload }`), so the billing\n * doc arrives carrying `$id === ORG_BILLING_DOC_ID` — the literal string\n * `'stripe'`. A plain spread puts that second, so the merged object's `$id`\n * silently became `'stripe'` and every child deriving its org id from it read\n * `orgs/stripe/…`, which is not an org and is denied by the rules.\n *\n * That is why this is a helper and not an inline `$id:` re-assert at the call\n * site: `useConfirmedDoc` stamping `$id` makes ANY merge of two documents\n * identity-swapping, so the safe merge belongs somewhere it can be reused and\n * named rather than re-derived correctly each time.\n *\n * The org doc's `$id` wins unconditionally — including when it is absent, in\n * which case the result carries no `$id` at all rather than inheriting the\n * billing doc's. A missing org id must read as \"unknown\", never as a\n * confidently wrong path.\n */\nexport function mergeOrgBillingOverOrg<\n  TOrg extends Record<string, unknown>,\n  TBilling extends Record<string, unknown>,\n>(\n  orgDoc: TOrg | null | undefined,\n  orgBilling: TBilling | null | undefined,\n): TOrg & Partial<TBilling> {\n  const merged = { ...(orgDoc ?? {}), ...(orgBilling ?? {}) } as Record<\n    string,\n    unknown\n  >\n  // Restore the org document's identity, whatever the billing doc claimed.\n  if (orgDoc && '$id' in orgDoc) merged['$id'] = (orgDoc as Record<string, unknown>)['$id']\n  else delete merged['$id']\n  return merged as TOrg & Partial<TBilling>\n}\n"],"names":["ORG_BILLING_SUBCOLLECTION","ORG_BILLING_DOC_ID","STRIPE_CUSTOMER_INDEX_COLLECTION","ORG_BILLING_MOVED_KEYS","STRIPE_CUSTOMER_ID_TEST_FIELD","pickOrgBillingFields","source","out","key","undefined","orgBillingStatusFrom","billing","status","subscription","LIVE_SUBSCRIPTION_STATUSES","isLiveSubscriptionStatus","includes","isOrgSubscriptionLive","hasInlineOrgBilling","some","mergeOrgBillingOverOrg","orgDoc","orgBilling","merged"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCC,GACD,OAAO,MAAMA,4BAA4B,UAAS;AAElD;;;;CAIC,GACD,OAAO,MAAMC,qBAAqB,SAAQ;AAE1C;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,mCAAmC,kBAAiB;AAEjE;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB;IACpC;IACA;CACD,CAAS;AAIV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCC,GACD,OAAO,MAAMC,gCAAgC,uBAAsB;AAoCnE;;;;;;CAMC,GACD,OAAO,SAASC,qBACdC,MAAuE;IAEvE,MAAMC,MAA+B,CAAC;IACtC,IAAI,CAACD,QAAQ,OAAOC;IACpB,KAAK,MAAMC,OAAOL,uBAAwB;QACxC,IAAIG,MAAM,CAACE,IAAI,KAAKC,WAAWF,GAAG,CAACC,IAAI,GAAGF,MAAM,CAACE,IAAI;IACvD;IACA,OAAOD;AACT;AAEA;;;;;CAKC,GACD,OAAO,SAASG,qBACdC,OAAkD;QAElCA;IAAhB,MAAMC,SAAUD,4BAAAA,wBAAAA,QAASE,YAAY,qBAAtB,AAACF,sBAAmEC,MAAM;IACzF,OAAO,OAAOA,WAAW,YAAYA,SAASA,SAAS;AACzD;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAME,6BAA6B;IAAC;IAAU;IAAY;CAAW;AAErE;;;;;;;;;;;CAWC,GACD,OAAO,SAASC,yBAAyBH,MAAe;IACtD,OACE,OAAOA,WAAW,YAAYE,2BAA2BE,QAAQ,CAACJ;AAEtE;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASK,sBACdN,OAAkD;IAElD,OAAOI,yBAAyBL,qBAAqBC;AACvD;AAEA;;;;;CAKC,GACD,OAAO,SAASO,oBACdZ,MAAuE;IAEvE,IAAI,CAACA,QAAQ,OAAO;IACpB,OAAOH,uBAAuBgB,IAAI,CAAC,CAACX,MAAQF,MAAM,CAACE,IAAI,KAAKC;AAC9D;AAEA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,SAASW,uBAIdC,MAA+B,EAC/BC,UAAuC;IAEvC,MAAMC,SAAS,aAAMF,iBAAAA,SAAU,CAAC,GAAQC,qBAAAA,aAAc,CAAC;IAIvD,yEAAyE;IACzE,IAAID,UAAU,SAASA,QAAQE,MAAM,CAAC,MAAM,GAAG,AAACF,MAAkC,CAAC,MAAM;SACpF,OAAOE,MAAM,CAAC,MAAM;IACzB,OAAOA;AACT"}

package/src/lib/app-utils/org-override-reason.d.ts

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * WHY a staff org override was made (AGL-1652).
+ *
+ * The override dialog changes what an organization is ENTITLED to and BILLED
+ * against — since AGL-1635 it can also set `transactionFeePhysicalPct`,
+ * `transactionFeeDigitalPct` and `marketplaceFeePct`, and force an
+ * unreleased feature on for one paying customer. Its `adminAudit` row
+ * recorded the actor, the target and a full before/after, and nothing at all
+ * about why. `before`/`after` shows that a fee changed; only a reason can
+ * show it was the negotiated rate rather than a slip, and that question is
+ * asked months later during a billing dispute, when the row can no longer be
+ * back-filled.
+ *
+ * ## The field family is AGL-1501's, deliberately
+ *
+ * `reason` (a code from a fixed set) + `note` (free text, staff-only) is the
+ * shape lockdown and media quarantine already use, so an operator reading an
+ * audit row is reading the same two fields whichever staff action wrote it.
+ * What is NOT borrowed is the vocabulary: lockdown's
+ * security/billing/maintenance/manual describes an INCIDENT, and an override
+ * is not one. A negotiated enterprise rate recorded as "billing" is a record
+ * that cannot answer the only question anyone ever asks of it.
+ *
+ * The AGL-1512 `message` field is absent for the same kind of reason: a
+ * quarantine notice is shown to the customer, and an override reason is
+ * not — nothing here reaches a tenant surface.
+ *
+ * ## Required, and why a code rather than free text
+ *
+ * A required free-text box is defeated by typing "x", and a box that can be
+ * defeated that cheaply buys a false sense of a record. A fixed set cannot
+ * be: every value is one somebody has to stand behind, and the set is small
+ * enough to read as a distribution across a quarter.
+ *
+ * `other` is the escape hatch that keeps the set honest — without one, staff
+ * pick the nearest wrong code and the whole vocabulary rots. It is the one
+ * code that says nothing by itself, so it is the one code that REQUIRES the
+ * note: see {@link orgOverrideReasonNeedsNote}. Every other code may carry a
+ * note and does not need one.
+ */
+export type OrgOverrideReasonCode = 'enterprise' | 'support' | 'beta' | 'correction' | 'trial' | 'other';
+export declare const ORG_OVERRIDE_REASON_CODES: OrgOverrideReasonCode[];
+export declare function isOrgOverrideReasonCode(value: unknown): value is OrgOverrideReasonCode;
+/** Staff-surface labels; the key stays the wire/audit identity. */
+export declare const ORG_OVERRIDE_REASON_LABELS: Record<OrgOverrideReasonCode, string>;
+/** Internal staff rationale — never shown to the customer. */
+export declare const ORG_OVERRIDE_NOTE_MAX = 1000;
+/**
+ * Does this code mean nothing without the note? Only `other` does. Keeping
+ * this a predicate rather than an inline `=== 'other'` is what lets the
+ * dialog's Save gate and any later server-side gate agree by construction.
+ */
+export declare function orgOverrideReasonNeedsNote(code: OrgOverrideReasonCode): boolean;
+/** The two fields an `org.override` audit row carries beside before/after. */
+export interface OrgOverrideReason {
+    reason: OrgOverrideReasonCode;
+    /**
+     * Explicit `null` when absent, never `undefined` — this value goes
+     * straight into a Firestore write, and Firestore rejects `undefined`.
+     */
+    note: string | null;
+}
+/**
+ * The ONE predicate for "is this a reason worth writing down".
+ *
+ * Returns `null` — never a defaulted value — when the code is unrecognised,
+ * or when `other` arrives without a note. A defaulted reason would be worse
+ * than none: it would put a code somebody never chose next to a fee change
+ * they did make.
+ *
+ * Whitespace-only notes are treated as absent, which is what makes the
+ * `other` gate real rather than a space-bar away from being satisfied.
+ */
+export declare function normalizeOrgOverrideReason(code: unknown, note?: unknown): OrgOverrideReason | null;
+/**
+ * How an override reason reads on a staff surface: the label, plus the note
+ * when there is one. Shared so the audit log and the org detail page cannot
+ * drift into describing the same row two different ways.
+ *
+ * A row written before AGL-1652 has no reason at all, and says so — the gap
+ * is a fact about the record, and rendering it as blank would let a
+ * pre-AGL-1652 override pass for one nobody had to explain.
+ */
+export declare function orgOverrideReasonSummary(reason: unknown, note?: unknown): string | null;

package/src/lib/app-utils/org-override-reason.js

@@ -0,0 +1,116 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * WHY a staff org override was made (AGL-1652).
+ *
+ * The override dialog changes what an organization is ENTITLED to and BILLED
+ * against — since AGL-1635 it can also set `transactionFeePhysicalPct`,
+ * `transactionFeeDigitalPct` and `marketplaceFeePct`, and force an
+ * unreleased feature on for one paying customer. Its `adminAudit` row
+ * recorded the actor, the target and a full before/after, and nothing at all
+ * about why. `before`/`after` shows that a fee changed; only a reason can
+ * show it was the negotiated rate rather than a slip, and that question is
+ * asked months later during a billing dispute, when the row can no longer be
+ * back-filled.
+ *
+ * ## The field family is AGL-1501's, deliberately
+ *
+ * `reason` (a code from a fixed set) + `note` (free text, staff-only) is the
+ * shape lockdown and media quarantine already use, so an operator reading an
+ * audit row is reading the same two fields whichever staff action wrote it.
+ * What is NOT borrowed is the vocabulary: lockdown's
+ * security/billing/maintenance/manual describes an INCIDENT, and an override
+ * is not one. A negotiated enterprise rate recorded as "billing" is a record
+ * that cannot answer the only question anyone ever asks of it.
+ *
+ * The AGL-1512 `message` field is absent for the same kind of reason: a
+ * quarantine notice is shown to the customer, and an override reason is
+ * not — nothing here reaches a tenant surface.
+ *
+ * ## Required, and why a code rather than free text
+ *
+ * A required free-text box is defeated by typing "x", and a box that can be
+ * defeated that cheaply buys a false sense of a record. A fixed set cannot
+ * be: every value is one somebody has to stand behind, and the set is small
+ * enough to read as a distribution across a quarter.
+ *
+ * `other` is the escape hatch that keeps the set honest — without one, staff
+ * pick the nearest wrong code and the whole vocabulary rots. It is the one
+ * code that says nothing by itself, so it is the one code that REQUIRES the
+ * note: see {@link orgOverrideReasonNeedsNote}. Every other code may carry a
+ * note and does not need one.
+ */ const ORG_OVERRIDE_REASON_KEYS = {
+    enterprise: true,
+    support: true,
+    beta: true,
+    correction: true,
+    trial: true,
+    other: true
+};
+export const ORG_OVERRIDE_REASON_CODES = Object.keys(ORG_OVERRIDE_REASON_KEYS);
+export function isOrgOverrideReasonCode(value) {
+    return typeof value === 'string' && value in ORG_OVERRIDE_REASON_KEYS;
+}
+/** Staff-surface labels; the key stays the wire/audit identity. */ export const ORG_OVERRIDE_REASON_LABELS = {
+    enterprise: 'Negotiated enterprise or custom contract',
+    support: 'Support remediation or goodwill',
+    beta: 'Early access to an unreleased feature',
+    correction: 'Correcting an earlier mistake',
+    trial: 'Sales trial or proof of concept',
+    other: 'Other — say what, below'
+};
+/** Internal staff rationale — never shown to the customer. */ export const ORG_OVERRIDE_NOTE_MAX = 1000;
+/**
+ * Does this code mean nothing without the note? Only `other` does. Keeping
+ * this a predicate rather than an inline `=== 'other'` is what lets the
+ * dialog's Save gate and any later server-side gate agree by construction.
+ */ export function orgOverrideReasonNeedsNote(code) {
+    return code === 'other';
+}
+/**
+ * The ONE predicate for "is this a reason worth writing down".
+ *
+ * Returns `null` — never a defaulted value — when the code is unrecognised,
+ * or when `other` arrives without a note. A defaulted reason would be worse
+ * than none: it would put a code somebody never chose next to a fee change
+ * they did make.
+ *
+ * Whitespace-only notes are treated as absent, which is what makes the
+ * `other` gate real rather than a space-bar away from being satisfied.
+ */ export function normalizeOrgOverrideReason(code, note) {
+    if (!isOrgOverrideReasonCode(code)) return null;
+    const trimmed = typeof note === 'string' && note.trim() ? note.trim().slice(0, ORG_OVERRIDE_NOTE_MAX) : null;
+    if (orgOverrideReasonNeedsNote(code) && !trimmed) return null;
+    return {
+        reason: code,
+        note: trimmed
+    };
+}
+/**
+ * How an override reason reads on a staff surface: the label, plus the note
+ * when there is one. Shared so the audit log and the org detail page cannot
+ * drift into describing the same row two different ways.
+ *
+ * A row written before AGL-1652 has no reason at all, and says so — the gap
+ * is a fact about the record, and rendering it as blank would let a
+ * pre-AGL-1652 override pass for one nobody had to explain.
+ */ export function orgOverrideReasonSummary(reason, note) {
+    if (!isOrgOverrideReasonCode(reason)) return null;
+    const label = ORG_OVERRIDE_REASON_LABELS[reason];
+    return typeof note === 'string' && note.trim() ? `${label} — ${note.trim()}` : label;
+}
+
+//# sourceMappingURL=org-override-reason.js.map

package/src/lib/app-utils/org-override-reason.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/org-override-reason.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * WHY a staff org override was made (AGL-1652).\n *\n * The override dialog changes what an organization is ENTITLED to and BILLED\n * against — since AGL-1635 it can also set `transactionFeePhysicalPct`,\n * `transactionFeeDigitalPct` and `marketplaceFeePct`, and force an\n * unreleased feature on for one paying customer. Its `adminAudit` row\n * recorded the actor, the target and a full before/after, and nothing at all\n * about why. `before`/`after` shows that a fee changed; only a reason can\n * show it was the negotiated rate rather than a slip, and that question is\n * asked months later during a billing dispute, when the row can no longer be\n * back-filled.\n *\n * ## The field family is AGL-1501's, deliberately\n *\n * `reason` (a code from a fixed set) + `note` (free text, staff-only) is the\n * shape lockdown and media quarantine already use, so an operator reading an\n * audit row is reading the same two fields whichever staff action wrote it.\n * What is NOT borrowed is the vocabulary: lockdown's\n * security/billing/maintenance/manual describes an INCIDENT, and an override\n * is not one. A negotiated enterprise rate recorded as \"billing\" is a record\n * that cannot answer the only question anyone ever asks of it.\n *\n * The AGL-1512 `message` field is absent for the same kind of reason: a\n * quarantine notice is shown to the customer, and an override reason is\n * not — nothing here reaches a tenant surface.\n *\n * ## Required, and why a code rather than free text\n *\n * A required free-text box is defeated by typing \"x\", and a box that can be\n * defeated that cheaply buys a false sense of a record. A fixed set cannot\n * be: every value is one somebody has to stand behind, and the set is small\n * enough to read as a distribution across a quarter.\n *\n * `other` is the escape hatch that keeps the set honest — without one, staff\n * pick the nearest wrong code and the whole vocabulary rots. It is the one\n * code that says nothing by itself, so it is the one code that REQUIRES the\n * note: see {@link orgOverrideReasonNeedsNote}. Every other code may carry a\n * note and does not need one.\n */\nexport type OrgOverrideReasonCode =\n  | 'enterprise'\n  | 'support'\n  | 'beta'\n  | 'correction'\n  | 'trial'\n  | 'other'\n\nconst ORG_OVERRIDE_REASON_KEYS: Record<OrgOverrideReasonCode, true> = {\n  enterprise: true,\n  support: true,\n  beta: true,\n  correction: true,\n  trial: true,\n  other: true,\n}\n\nexport const ORG_OVERRIDE_REASON_CODES = Object.keys(\n  ORG_OVERRIDE_REASON_KEYS,\n) as OrgOverrideReasonCode[]\n\nexport function isOrgOverrideReasonCode(\n  value: unknown,\n): value is OrgOverrideReasonCode {\n  return typeof value === 'string' && value in ORG_OVERRIDE_REASON_KEYS\n}\n\n/** Staff-surface labels; the key stays the wire/audit identity. */\nexport const ORG_OVERRIDE_REASON_LABELS: Record<\n  OrgOverrideReasonCode,\n  string\n> = {\n  enterprise: 'Negotiated enterprise or custom contract',\n  support: 'Support remediation or goodwill',\n  beta: 'Early access to an unreleased feature',\n  correction: 'Correcting an earlier mistake',\n  trial: 'Sales trial or proof of concept',\n  other: 'Other — say what, below',\n}\n\n/** Internal staff rationale — never shown to the customer. */\nexport const ORG_OVERRIDE_NOTE_MAX = 1000\n\n/**\n * Does this code mean nothing without the note? Only `other` does. Keeping\n * this a predicate rather than an inline `=== 'other'` is what lets the\n * dialog's Save gate and any later server-side gate agree by construction.\n */\nexport function orgOverrideReasonNeedsNote(\n  code: OrgOverrideReasonCode,\n): boolean {\n  return code === 'other'\n}\n\n/** The two fields an `org.override` audit row carries beside before/after. */\nexport interface OrgOverrideReason {\n  reason: OrgOverrideReasonCode\n  /**\n   * Explicit `null` when absent, never `undefined` — this value goes\n   * straight into a Firestore write, and Firestore rejects `undefined`.\n   */\n  note: string | null\n}\n\n/**\n * The ONE predicate for \"is this a reason worth writing down\".\n *\n * Returns `null` — never a defaulted value — when the code is unrecognised,\n * or when `other` arrives without a note. A defaulted reason would be worse\n * than none: it would put a code somebody never chose next to a fee change\n * they did make.\n *\n * Whitespace-only notes are treated as absent, which is what makes the\n * `other` gate real rather than a space-bar away from being satisfied.\n */\nexport function normalizeOrgOverrideReason(\n  code: unknown,\n  note?: unknown,\n): OrgOverrideReason | null {\n  if (!isOrgOverrideReasonCode(code)) return null\n  const trimmed =\n    typeof note === 'string' && note.trim()\n      ? note.trim().slice(0, ORG_OVERRIDE_NOTE_MAX)\n      : null\n  if (orgOverrideReasonNeedsNote(code) && !trimmed) return null\n  return { reason: code, note: trimmed }\n}\n\n/**\n * How an override reason reads on a staff surface: the label, plus the note\n * when there is one. Shared so the audit log and the org detail page cannot\n * drift into describing the same row two different ways.\n *\n * A row written before AGL-1652 has no reason at all, and says so — the gap\n * is a fact about the record, and rendering it as blank would let a\n * pre-AGL-1652 override pass for one nobody had to explain.\n */\nexport function orgOverrideReasonSummary(\n  reason: unknown,\n  note?: unknown,\n): string | null {\n  if (!isOrgOverrideReasonCode(reason)) return null\n  const label = ORG_OVERRIDE_REASON_LABELS[reason]\n  return typeof note === 'string' && note.trim()\n    ? `${label} — ${note.trim()}`\n    : label\n}\n"],"names":["ORG_OVERRIDE_REASON_KEYS","enterprise","support","beta","correction","trial","other","ORG_OVERRIDE_REASON_CODES","Object","keys","isOrgOverrideReasonCode","value","ORG_OVERRIDE_REASON_LABELS","ORG_OVERRIDE_NOTE_MAX","orgOverrideReasonNeedsNote","code","normalizeOrgOverrideReason","note","trimmed","trim","slice","reason","orgOverrideReasonSummary","label"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCC,GASD,MAAMA,2BAAgE;IACpEC,YAAY;IACZC,SAAS;IACTC,MAAM;IACNC,YAAY;IACZC,OAAO;IACPC,OAAO;AACT;AAEA,OAAO,MAAMC,4BAA4BC,OAAOC,IAAI,CAClDT,0BAC0B;AAE5B,OAAO,SAASU,wBACdC,KAAc;IAEd,OAAO,OAAOA,UAAU,YAAYA,SAASX;AAC/C;AAEA,iEAAiE,GACjE,OAAO,MAAMY,6BAGT;IACFX,YAAY;IACZC,SAAS;IACTC,MAAM;IACNC,YAAY;IACZC,OAAO;IACPC,OAAO;AACT,EAAC;AAED,4DAA4D,GAC5D,OAAO,MAAMO,wBAAwB,KAAI;AAEzC;;;;CAIC,GACD,OAAO,SAASC,2BACdC,IAA2B;IAE3B,OAAOA,SAAS;AAClB;AAYA;;;;;;;;;;CAUC,GACD,OAAO,SAASC,2BACdD,IAAa,EACbE,IAAc;IAEd,IAAI,CAACP,wBAAwBK,OAAO,OAAO;IAC3C,MAAMG,UACJ,OAAOD,SAAS,YAAYA,KAAKE,IAAI,KACjCF,KAAKE,IAAI,GAAGC,KAAK,CAAC,GAAGP,yBACrB;IACN,IAAIC,2BAA2BC,SAAS,CAACG,SAAS,OAAO;IACzD,OAAO;QAAEG,QAAQN;QAAME,MAAMC;IAAQ;AACvC;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASI,yBACdD,MAAe,EACfJ,IAAc;IAEd,IAAI,CAACP,wBAAwBW,SAAS,OAAO;IAC7C,MAAME,QAAQX,0BAA0B,CAACS,OAAO;IAChD,OAAO,OAAOJ,SAAS,YAAYA,KAAKE,IAAI,KACxC,GAAGI,MAAM,GAAG,EAAEN,KAAKE,IAAI,IAAI,GAC3BI;AACN"}