@endora-commerce/mod-organizations 0.100.0

package/dist/backend/services/personal-organization-service.js

@@ -0,0 +1,207 @@
+import { ERROR_CODES, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { Organization } from '../entities/organization.entity.js';
+/**
+ * The name a scrubbed personal organisation is renamed to. It matches the one
+ * `customer_accounts` writes over the member's own first and last name,
+ * because a personal organisation's name *is* that person's name.
+ */
+export const ANONYMIZED_ORGANIZATION_NAME = 'Deleted customer';
+/**
+ * Feature 051 — provisions and guards single-member Personal Organizations for
+ * B2C (individual) customers. One provisioning rule, reused by live registration
+ * and the backfill migration's mental model (the migration duplicates the SQL).
+ */
+export class PersonalOrganizationService {
+    emFactory;
+    accounts;
+    auditLog;
+    constructor(emFactory, 
+    /**
+     * Required since `customers`' Phase-C cut: the `ensureFor` overload that
+     * needed neither port — it took the caller's managed `CustomerAccount` and
+     * its `EntityManager` — went with that cut, and every method left reads
+     * this module's neighbour through its ports.
+     */
+    accounts, 
+    /**
+     * Feature 075 — `anonymizeIfOrphaned` records the scrub. It used to be
+     * written by `customers`' deletion sweep, on a row that module does not
+     * own; the write and its one audit row moved here together.
+     */
+    auditLog) {
+        this.emFactory = emFactory;
+        this.accounts = accounts;
+        this.auditLog = auditLog;
+    }
+    /** Name an individual's organization from their profile, falling back to the email local-part. */
+    static personalName(account) {
+        const full = `${account.firstName ?? ''} ${account.lastName ?? ''}`.trim();
+        return full.length > 0 ? full : account.email.split('@')[0];
+    }
+    /**
+     * The provisioning itself — find-or-create the personal organisation for an
+     * account, on the `EntityManager` the caller hands in.
+     *
+     * D-178 made this the one place the row is written, and gave it a caller that
+     * has no account row yet: `customer_accounts` inserts the account and its
+     * organisation in one transaction, so it passes the id it is *about* to write
+     * and the name components it already holds. Nothing here reads
+     * `customer_accounts` and nothing here writes it.
+     *
+     * Idempotent by `taxId`, which is derived from the account id — a retry after
+     * a rolled-back attempt re-finds the row rather than creating a second one.
+     *
+     * command-coverage-ignore: idempotent auto-provisioning of a customer's
+     * personal (B2C) organization — a system invariant the constitution mandates
+     * (Principle XI), not an operator-initiated write. Its caller's own write is
+     * the audited event.
+     */
+    async provisionFor(em, input) {
+        const taxId = personalTaxId(input.customerAccountId);
+        const existingByTaxId = await em.findOne(Organization, { taxId });
+        if (existingByTaxId)
+            return existingByTaxId;
+        const org = em.create(Organization, {
+            name: PersonalOrganizationService.personalName({
+                firstName: input.firstName ?? '',
+                lastName: input.lastName ?? '',
+                email: input.email,
+            }),
+            taxId,
+            status: 'active',
+            vatStatus: 'vat_exempt',
+            isPersonal: true,
+            registeredAddress: { street: '-', city: '-', postalCode: '-', country: 'PL' },
+        });
+        // Flushed here rather than left pending, because the caller's next statement
+        // inserts a row whose `organization_id` foreign key points at this one. It
+        // is the caller's `EntityManager` and therefore the caller's transaction, so
+        // a rollback takes this row with it.
+        await em.persistAndFlush(org);
+        return org;
+    }
+    /**
+     * Return the customer's organization, provisioning a personal one iff none is
+     * linked. Idempotent by customer — a customer that already has an organization
+     * is returned as-is (never a second personal org).
+     *
+     * **Since D-178 this repairs rather than provisions.** Every write path now
+     * creates the account and its organisation in one transaction, so a live
+     * account always has one and this method's provisioning arm is reached only by
+     * a caller holding an account written before that ruling. It is kept because
+     * it is idempotent and because `ensureForCustomerAccount` is a published port.
+     */
+    async ensureForCustomerAccountId(customerAccountId) {
+        const accounts = this.#accounts();
+        const em = this.emFactory();
+        const account = await accounts.read.findById(customerAccountId);
+        if (!account) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, `Customer account ${customerAccountId} not found.`);
+        }
+        if (account.organizationId) {
+            const existing = await em.findOne(Organization, { id: account.organizationId });
+            if (existing)
+                return existing;
+        }
+        const org = await this.provisionFor(em, { ...account, customerAccountId: account.id });
+        await accounts.write.attachToOrganization(account.id, org.id);
+        return org;
+    }
+    /**
+     * D-178 — the account's **own** personal organisation, whatever it currently
+     * belongs to, provisioned if it has never existed.
+     *
+     * `unassign` on the admin customer screen is what wants it: an operator
+     * detaching a member from a company used to write `organization_id = NULL`,
+     * and the account it produced could never transact. The operation is now the
+     * move it always meant, and this is the destination. The **binding** is not
+     * written here — `customers` writes it through
+     * `CustomerAccountLifecycleWritePort.detachToPersonalOrganization` once its
+     * own authority and org-administrator-depletion guards have passed.
+     */
+    async provisionPersonalOrganizationFor(customerAccountId) {
+        const account = await this.#accounts().read.findById(customerAccountId);
+        if (!account) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, `Customer account ${customerAccountId} not found.`);
+        }
+        return this.provisionFor(this.emFactory(), { ...account, customerAccountId: account.id });
+    }
+    /**
+     * Feature 051, the other end of the same rule — the retention sweep's
+     * cascade, moved here with `customers`' Phase-C cut.
+     *
+     * That module ran it by loading this module's `Organization`, renaming it,
+     * blanking its registered address and stamping `deletedAt` — three writes on
+     * a row it does not own, plus the audit entry describing them. The decision
+     * is this module's: a personal organisation whose single member has been
+     * anonymised has nobody in it and carries that person's name.
+     *
+     * Writes nothing and answers `null` whenever the cascade does not apply, so a
+     * caller cannot get it wrong by asking too often.
+     */
+    async anonymizeIfOrphaned(customerAccountId) {
+        const account = await this.#accounts().read.findById(customerAccountId);
+        if (!account?.organizationId)
+            return null;
+        const em = this.emFactory();
+        const org = await em.findOne(Organization, { id: account.organizationId });
+        if (!org || !org.isPersonal || org.deletedAt)
+            return null;
+        // Any surviving (non-deleted) member keeps the organisation alive. For a
+        // personal one this is empty once its single member has been soft-deleted.
+        const members = await this.#accounts().read.listByOrganization(org.id, { activeOnly: true });
+        if (members.length > 0)
+            return null;
+        // command-coverage-ignore: the retention sweep's cascade over a
+        // member-less personal organization — a system-initiated scrub on a timer,
+        // audited below with the null actor that fact deserves, not an
+        // operator-initiated write with an actor to attribute it to.
+        const before = { name: org.name };
+        org.name = ANONYMIZED_ORGANIZATION_NAME;
+        org.registeredAddress = {
+            street: '-',
+            city: '-',
+            postalCode: '-',
+            country: org.registeredAddress.country,
+        };
+        org.deletedAt = new Date();
+        await em.flush();
+        await this.auditLog?.record({
+            actorAdminUserId: null,
+            action: 'organization.anonymized',
+            objectType: 'organization',
+            objectId: org.id,
+            stateBefore: before,
+            stateAfter: { anonymizedAt: org.deletedAt.toISOString(), isPersonal: true },
+        });
+        return org;
+    }
+    /**
+     * Guard: a personal organization is single-member and MUST never gain a second
+     * customer. Call before attaching a customer to an organization.
+     */
+    async assertMembershipAllowed(organizationId, em = this.emFactory()) {
+        const org = await em.findOne(Organization, { id: organizationId });
+        if (!org?.isPersonal)
+            return; // company orgs are multi-member
+        const members = await this.#accounts().read.listByOrganization(organizationId, {
+            activeOnly: true,
+        });
+        if (members.length > 0) {
+            throw new HttpError(409, ERROR_CODES.VERSION_CONFLICT, 'A personal organization is single-member and cannot take another customer.');
+        }
+    }
+    #accounts() {
+        return this.accounts;
+    }
+}
+/**
+ * `tax_id` is globally unique (varchar(32)); an individual has no company tax
+ * id, so the account's UUID without dashes is used — 32 hex chars, unique, and
+ * derived, which is what makes the provisioning re-runnable.
+ */
+function personalTaxId(customerAccountId) {
+    return customerAccountId.replace(/-/g, '');
+}
+//# sourceMappingURL=personal-organization-service.js.map

package/dist/backend/services/personal-organization-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personal-organization-service.js","sourceRoot":"","sources":["../../../src/backend/services/personal-organization-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,GAIZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAgBlE;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,OAAO,2BAA2B;IAEnB;IAOA;IAMA;IAdnB,YACmB,SAA8B;IAC/C;;;;;OAKG;IACc,QAA0C;IAC3D;;;;OAIG;IACc,QAAoB;QAbpB,cAAS,GAAT,SAAS,CAAqB;QAO9B,aAAQ,GAAR,QAAQ,CAAkC;QAM1C,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,kGAAkG;IAClG,MAAM,CAAC,YAAY,CACjB,OAAwE;QAExE,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,YAAY,CAChB,EAAiB,EACjB,KAKC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;QAC5C,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE;YAClC,IAAI,EAAE,2BAA2B,CAAC,YAAY,CAAC;gBAC7C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;gBAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;gBAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC;YACF,KAAK;YACL,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;SAC9E,CAAC,CAAC;QACH,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,qCAAqC;QACrC,MAAM,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,0BAA0B,CAAC,iBAAyB;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,SAAS,EACrB,oBAAoB,iBAAiB,aAAa,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YAChF,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,MAAM,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,gCAAgC,CAAC,iBAAyB;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,SAAS,EACrB,oBAAoB,iBAAiB,aAAa,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,mBAAmB,CAAC,iBAAyB;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,EAAE,cAAc;YAAE,OAAO,IAAI,CAAC;QAE1C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE1D,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,gEAAgE;QAChE,2EAA2E;QAC3E,+DAA+D;QAC/D,6DAA6D;QAC7D,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACxC,GAAG,CAAC,iBAAiB,GAAG;YACtB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,GAAG;YACT,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,GAAG,CAAC,iBAAiB,CAAC,OAAO;SACvC,CAAC;QACF,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,yBAAyB;YACjC,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;SAC5E,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,cAAsB,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE;QACzE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,EAAE,UAAU;YAAE,OAAO,CAAC,gCAAgC;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE;YAC7E,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,gBAAgB,EAC5B,4EAA4E,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,iBAAyB;IAC9C,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC"}

package/dist/backend/services/registration-service.d.ts

@@ -0,0 +1,80 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type CustomerAccountMemberWritePort, type CustomerAccountReadPort, type CustomerAccountRecord, type DictionaryValidator, type RegisterOrganizationRequest } from '@endora-commerce/contracts';
+import type { EventBase, EventBus } from '@endora-commerce/platform/events';
+import { Organization } from '../entities/organization.entity.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+/**
+ * Registration flow (T117, FR-040).
+ *
+ * - Creates the Organization in `pending_verification`.
+ * - Creates the first CustomerAccount with `role='organization_admin'`, email
+ *   unverified, argon2-hashed password.
+ * - Issues an EmailVerificationToken; the raw token is returned so callers
+ *   can dispatch the email. Only its sha256 hash is stored.
+ * - Emits `organization.registered.v1`.
+ *
+ * Uniqueness conflicts raise:
+ *   409 ORGANIZATION_TAX_ID_EXISTS if the taxId is taken.
+ *   409 EMAIL_ALREADY_REGISTERED if the email is taken by another account.
+ */
+export interface OrganizationEvents extends Record<string, EventBase> {
+    'organization.registered.v1': EventBase & {
+        organizationId: string;
+    };
+    'organization.verified.v1': EventBase & {
+        organizationId: string;
+        customerAccountId: string;
+    };
+    'organization.status_changed.v1': EventBase & {
+        organizationId: string;
+        newStatus: string;
+    };
+    /**
+     * A CustomerAccount belonging to an Organization was created (self-service
+     * registration, admin direct-create, or invitation accept). Consumed by the
+     * shopping_lists module to provision the customer's default list eagerly.
+     */
+    'customer_account.created.v1': EventBase & {
+        customerAccountId: string;
+        organizationId: string;
+    };
+}
+export type OrganizationEventBus = EventBus<OrganizationEvents>;
+/**
+ * Emit `customer_account.created.v1` for a newly-created org-attached customer.
+ * Shared by every creation chokepoint so provisioning side effects (e.g. the
+ * default shopping list) happen consistently regardless of entry path.
+ */
+export declare function emitCustomerAccountCreated(events: OrganizationEventBus, customerAccountId: string, organizationId: string): void;
+export interface RegistrationResult {
+    organization: Organization;
+    customerAccount: CustomerAccountRecord;
+    /** Raw token to include in the verification email — shown once. */
+    verificationToken: string;
+}
+export interface RegistrationAccountPorts {
+    /**
+     * `customer_accounts`' published read and write (feature 075, Phase C). The
+     * first user of a new Organization is a row in *that* module's table, and
+     * this service used to create it with `em.create(CustomerAccount, …)` and a
+     * `hashPassword` imported from `auth`. Both are on the owner's side of the
+     * port now, which is also why the plain password crosses and no hash does.
+     *
+     * With `customer_accounts` off registration fails closed. That is right: an
+     * Organization whose administrator could not be created is not a
+     * registration, and the module is in any case non-deactivatable.
+     */
+    read: CustomerAccountReadPort;
+    write: CustomerAccountMemberWritePort;
+}
+export declare class RegistrationService {
+    private readonly emFactory;
+    private readonly events;
+    private readonly accounts;
+    private readonly dictionaryValidator?;
+    private readonly auditLog?;
+    constructor(emFactory: () => EntityManager, events: OrganizationEventBus, accounts: RegistrationAccountPorts, dictionaryValidator?: DictionaryValidator | undefined, auditLog?: AuditPort | undefined);
+    registerOrganization(req: RegisterOrganizationRequest): Promise<RegistrationResult>;
+    private validateCountry;
+}
+//# sourceMappingURL=registration-service.d.ts.map

package/dist/backend/services/registration-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/registration-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,EAGL,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAGlE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,kBAAmB,SAAQ,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;IACnE,4BAA4B,EAAE,SAAS,GAAG;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,0BAA0B,EAAE,SAAS,GAAG;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9F,gCAAgC,EAAE,SAAS,GAAG;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5F;;;;OAIG;IACH,6BAA6B,EAAE,SAAS,GAAG;QACzC,iBAAiB,EAAE,MAAM,CAAC;QAC1B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AACD,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,oBAAoB,EAC5B,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,GACrB,IAAI,CAON;AAID,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,YAAY,CAAC;IAC3B,eAAe,EAAE,qBAAqB,CAAC;IACvC,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;;;;;;;OAUG;IACH,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,8BAA8B,CAAC;CACvC;AAED,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAJT,SAAS,EAAE,MAAM,aAAa,EAC9B,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,wBAAwB,EAClC,mBAAmB,CAAC,EAAE,mBAAmB,YAAA,EACzC,QAAQ,CAAC,EAAE,SAAS,YAAA;IAGjC,oBAAoB,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA0F3E,eAAe;CAkB9B"}

package/dist/backend/services/registration-service.js

@@ -0,0 +1,126 @@
+import { createHash, randomBytes } from 'crypto';
+import { UniqueConstraintViolationException } from '@mikro-orm/core';
+import { DictionaryReferenceError, ERROR_CODES, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { Organization } from '../entities/organization.entity.js';
+import { EmailVerificationToken } from '../entities/email-verification-token.entity.js';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+/**
+ * Emit `customer_account.created.v1` for a newly-created org-attached customer.
+ * Shared by every creation chokepoint so provisioning side effects (e.g. the
+ * default shopping list) happen consistently regardless of entry path.
+ */
+export function emitCustomerAccountCreated(events, customerAccountId, organizationId) {
+    events.emit('customer_account.created.v1', {
+        eventId: crypto.randomUUID(),
+        occurredAt: new Date().toISOString(),
+        customerAccountId,
+        organizationId,
+    });
+}
+const TOKEN_TTL_HOURS = 48;
+export class RegistrationService {
+    emFactory;
+    events;
+    accounts;
+    dictionaryValidator;
+    auditLog;
+    constructor(emFactory, events, accounts, dictionaryValidator, auditLog) {
+        this.emFactory = emFactory;
+        this.events = events;
+        this.accounts = accounts;
+        this.dictionaryValidator = dictionaryValidator;
+        this.auditLog = auditLog;
+    }
+    async registerOrganization(req) {
+        const em = this.emFactory();
+        await this.validateCountry(req.organization.registeredAddress.country);
+        // Pre-check the easy cases so we can return the right error code before
+        // hashing the password (avoids a wasted ~50 ms of argon2 work — the hash
+        // is computed inside `create` below, after both checks have passed).
+        const existingByTaxId = await em.findOne(Organization, { taxId: req.organization.taxId });
+        if (existingByTaxId) {
+            throw new HttpError(409, ERROR_CODES.ORGANIZATION_TAX_ID_EXISTS, 'An organization with this taxId already exists.');
+        }
+        const existingByEmail = await this.accounts.read.findByEmail(req.firstUser.email);
+        if (existingByEmail) {
+            throw new HttpError(409, ERROR_CODES.EMAIL_ALREADY_REGISTERED, 'An account with this email already exists.');
+        }
+        const organization = em.create(Organization, {
+            name: req.organization.name,
+            taxId: req.organization.taxId,
+            status: 'pending_verification',
+            vatStatus: req.organization.vatStatus ?? 'vat_payer',
+            registeredAddress: {
+                street: req.organization.registeredAddress.street,
+                city: req.organization.registeredAddress.city,
+                postalCode: req.organization.registeredAddress.postalCode,
+                country: req.organization.registeredAddress.country,
+            },
+        });
+        try {
+            await em.persistAndFlush(organization);
+        }
+        catch (err) {
+            if (err instanceof UniqueConstraintViolationException) {
+                throw new HttpError(409, ERROR_CODES.ORGANIZATION_TAX_ID_EXISTS, 'An organization with this taxId already exists.');
+            }
+            throw err;
+        }
+        // `create` raises the same 409 `EMAIL_ALREADY_REGISTERED` on the unique
+        // index that the `catch` here used to, so the translation moved with the
+        // write rather than being dropped.
+        const customerAccount = await this.accounts.write.create({
+            organizationId: organization.id,
+            email: req.firstUser.email,
+            password: req.firstUser.password,
+            firstName: req.firstUser.firstName,
+            lastName: req.firstUser.lastName,
+            role: 'organization_admin',
+        });
+        const rawToken = randomBytes(32).toString('base64url');
+        const token = em.create(EmailVerificationToken, {
+            customerAccountId: customerAccount.id,
+            tokenHash: sha256Hex(rawToken),
+            expiresAt: new Date(Date.now() + TOKEN_TTL_HOURS * 60 * 60 * 1_000),
+        });
+        if (this.auditLog) {
+            // Self-registration is pre-auth (no ambient actor) — the entry records the
+            // organization creation with a null actor.
+            recordAuditFromContext(this.auditLog, em, {
+                action: 'organization.register',
+                objectType: 'organization',
+                objectId: organization.id,
+                stateBefore: null,
+                stateAfter: { name: organization.name, taxId: organization.taxId, status: organization.status },
+            });
+        }
+        await em.persistAndFlush(token);
+        this.events.emit('organization.registered.v1', {
+            eventId: crypto.randomUUID(),
+            occurredAt: new Date().toISOString(),
+            organizationId: organization.id,
+        });
+        emitCustomerAccountCreated(this.events, customerAccount.id, organization.id);
+        return { organization, customerAccount, verificationToken: rawToken };
+    }
+    async validateCountry(country) {
+        if (!this.dictionaryValidator)
+            return;
+        try {
+            await this.dictionaryValidator.validateCountryCode(country, 'create-or-change');
+        }
+        catch (err) {
+            if (err instanceof DictionaryReferenceError) {
+                throw new HttpError(409, err.code, err.code === 'DICTIONARY_ENTRY_INACTIVE'
+                    ? `Country code ${err.entryCode} is no longer available for organization registration.`
+                    : `Country code ${err.entryCode} is not recognised.`, [{ path: 'organization.registeredAddress.country', issue: err.code }]);
+            }
+            throw err;
+        }
+    }
+}
+function sha256Hex(input) {
+    return createHash('sha256').update(input, 'utf8').digest('hex');
+}
+//# sourceMappingURL=registration-service.js.map

package/dist/backend/services/registration-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-service.js","sourceRoot":"","sources":["../../../src/backend/services/registration-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,EAAE,kCAAkC,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,wBAAwB,EACxB,WAAW,GAMZ,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAkC5E;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA4B,EAC5B,iBAAyB,EACzB,cAAsB;IAEtB,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;QACzC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,iBAAiB;QACjB,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,eAAe,GAAG,EAAE,CAAC;AAyB3B,MAAM,OAAO,mBAAmB;IAEX;IACA;IACA;IACA;IACA;IALnB,YACmB,SAA8B,EAC9B,MAA4B,EAC5B,QAAkC,EAClC,mBAAyC,EACzC,QAAoB;QAJpB,cAAS,GAAT,SAAS,CAAqB;QAC9B,WAAM,GAAN,MAAM,CAAsB;QAC5B,aAAQ,GAAR,QAAQ,CAA0B;QAClC,wBAAmB,GAAnB,mBAAmB,CAAsB;QACzC,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,KAAK,CAAC,oBAAoB,CAAC,GAAgC;QACzD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEvE,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1F,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,0BAA0B,EACtC,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClF,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE;YAC3C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI;YAC3B,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK;YAC7B,MAAM,EAAE,sBAAsB;YAC9B,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,WAAW;YACpD,iBAAiB,EAAE;gBACjB,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM;gBACjD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI;gBAC7C,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,iBAAiB,CAAC,UAAU;gBACzD,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO;aACpD;SACF,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kCAAkC,EAAE,CAAC;gBACtD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,0BAA0B,EACtC,iDAAiD,CAClD,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YACvD,cAAc,EAAE,YAAY,CAAC,EAAE;YAC/B,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK;YAC1B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ;YAChC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS;YAClC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ;YAChC,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE;YAC9C,iBAAiB,EAAE,eAAe,CAAC,EAAE;YACrC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;SACpE,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,2EAA2E;YAC3E,2CAA2C;YAC3C,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;gBACxC,MAAM,EAAE,uBAAuB;gBAC/B,UAAU,EAAE,cAAc;gBAC1B,QAAQ,EAAE,YAAY,CAAC,EAAE;gBACzB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;aAChG,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;YAC7C,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;YAC5B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,cAAc,EAAE,YAAY,CAAC,EAAE;SAChC,CAAC,CAAC;QACH,0BAA0B,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;QAE7E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;IACxE,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,OAAe;QAC3C,IAAI,CAAC,IAAI,CAAC,mBAAmB;YAAE,OAAO;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,IAAI,KAAK,2BAA2B;oBACtC,CAAC,CAAC,gBAAgB,GAAG,CAAC,SAAS,wDAAwD;oBACvF,CAAC,CAAC,gBAAgB,GAAG,CAAC,SAAS,qBAAqB,EACtD,CAAC,EAAE,IAAI,EAAE,wCAAwC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CACtE,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}

package/dist/backend/services/sales-rep-assignment-service.d.ts

@@ -0,0 +1,89 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { OrganizationSalesRepAssignment } from '../entities/organization-sales-rep-assignment.entity.js';
+import type { SalesRepAssignmentPort, SalesRepAssignmentRow } from '@endora-commerce/contracts';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { OrganizationTreeService } from './organization-tree-service.js';
+/**
+ * Feature 056 US2 — optional roll-up wiring. When present, a sales-rep whose
+ * actor holds the `organizations:rollup` capability has their assignment scope
+ * expanded to the subtree of each assigned node (with per-descendant override,
+ * FR-011). Absent (flat deployments / no capability), behavior is byte-for-byte
+ * the pre-feature flat set.
+ */
+export interface SalesRepSubtreeDeps {
+    readonly treeService: OrganizationTreeService;
+    readonly hasRollupCapability: (adminUserId: string) => Promise<boolean>;
+}
+/**
+ * The sales-rep assignment relation as **other modules** see it:
+ * `organizations`' `organizationSalesRepScopePort` (T143a, widened for issue
+ * #108).
+ *
+ * One implementation, five questions. Before this port existed, every consumer
+ * built its own `SalesRepAssignmentService`, and each build was free to omit the
+ * optional third constructor argument — which `customers` did, so
+ * `CustomerAuthorityService` applied the flat pre-056 rule and the roll-up was
+ * skipped for every block / unblock / delete / org-assign decision. `tsc` cannot
+ * see an omitted optional argument; a single port removes the chance to omit it.
+ *
+ * Structural rather than the entity type on purpose: a consumer wants the reps,
+ * not `organizations`' ORM rows.
+ *
+ * Both declarations moved to `@endora-commerce/contracts` in feature 075's Phase P, so the
+ * two consuming modules can name a package rather than this file. Re-exported
+ * here for the length of Phase P, which cuts no consumer.
+ */
+export type { SalesRepAssignmentPort, SalesRepAssignmentRow };
+/**
+ * Centralised visibility predicate for the sales-rep ↔ organization
+ * relation. Every endpoint that lists or operates on Quote Requests
+ * (and any future module that wants the same scoping) MUST go through
+ * this service so the rule is implemented exactly once.
+ *
+ * Rules (research §R2):
+ *   - A platform admin sees every organization (decided by the caller —
+ *     we only check assignment, not platform-admin role).
+ *   - An admin user with an explicit assignment row sees that org.
+ *   - An organization with ZERO assignment rows is in
+ *     "unassigned-org fallback" mode and is visible to every sales rep.
+ */
+export declare class SalesRepAssignmentService implements SalesRepAssignmentPort {
+    #private;
+    private readonly emFactory;
+    private readonly auditLog?;
+    private readonly subtree?;
+    constructor(emFactory: () => EntityManager, auditLog?: AuditPort | undefined, subtree?: SalesRepSubtreeDeps | undefined);
+    /**
+     * Returns true when the admin user is allowed to see the
+     * organization's RFQs based on the assignment table.
+     *
+     * Feature 056 — when the actor holds the roll-up capability, the rule is
+     * "nearest assignment on the ancestor-or-self chain wins" (FR-011): the org
+     * is visible iff the nearest ancestor-or-self carrying any assignment row
+     * assigns it to this rep. An org whose entire chain has zero assignments is
+     * visible to any rep (unassigned-org fallback, preserved). Without the
+     * capability, the legacy exact-assignment + fallback rule applies.
+     */
+    canSeeOrganization(adminUserId: string, organizationId: string): Promise<boolean>;
+    /**
+     * Returns the list of organization IDs the admin user can act on.
+     *
+     * Feature 056 — when the actor holds the roll-up capability, each assigned
+     * node expands to its subtree MINUS any descendant subtree governed by its
+     * own (nearer) assignment (FR-011). Without the capability, returns the flat
+     * assigned rows (pre-feature behavior).
+     */
+    listAssignedOrganizationIds(adminUserId: string): Promise<string[]>;
+    /** Inserts an assignment if not already present. Returns the row. */
+    assign(input: {
+        organizationId: string;
+        adminUserId: string;
+        assignedByAdminUserId?: string | null;
+    }): Promise<OrganizationSalesRepAssignment>;
+    unassign(input: {
+        organizationId: string;
+        adminUserId: string;
+    }): Promise<boolean>;
+    listForOrganization(organizationId: string): Promise<OrganizationSalesRepAssignment[]>;
+}
+//# sourceMappingURL=sales-rep-assignment-service.d.ts.map

package/dist/backend/services/sales-rep-assignment-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sales-rep-assignment-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/sales-rep-assignment-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,yDAAyD,CAAC;AAIzG,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEhG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC;IAC9C,QAAQ,CAAC,mBAAmB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,qBAAa,yBAA0B,YAAW,sBAAsB;;IAEpE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAFR,SAAS,EAAE,MAAM,aAAa,EAC9B,QAAQ,CAAC,EAAE,SAAS,YAAA,EACpB,OAAO,CAAC,EAAE,mBAAmB,YAAA;IAGhD;;;;;;;;;;OAUG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BvF;;;;;;;OAOG;IACG,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA8CzE,qEAAqE;IAC/D,MAAM,CAAC,KAAK,EAAE;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACvC,GAAG,OAAO,CAAC,8BAA8B,CAAC;IAoCrC,QAAQ,CAAC,KAAK,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBlF,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,EAAE,CAAC;CAI7F"}