@endora-commerce/platform 0.100.0

package/dist/tenancy/filters.d.ts

@@ -0,0 +1,87 @@
+/**
+ * MikroORM global-filter definitions for the tenant guard (feature 050).
+ *
+ * The `cond` functions read the ambient `TenantContext` DIRECTLY from
+ * AsyncLocalStorage at query time (not from `setFilterParams`). This makes the
+ * filter fork-independent: it applies correctly on the request-scoped EM, on
+ * `em.transactional` sub-forks, and on any other fork — because the store is
+ * read when the query runs, inside the caller's async context. A query executed
+ * with no ambient context throws `MissingTenantContextError` (fail-closed).
+ *
+ * The filters are attached (default-on, `args: false`) by the classification
+ * decorators in `org-scoped.decorator.ts`.
+ */
+export declare const ORG_FILTER = "org";
+export declare const CUSTOMER_FILTER = "customerAccount";
+/** The tenant key every `@CustomerScoped` entity carries, by definition. */
+export declare const CUSTOMER_TENANT_KEY = "customerAccountId";
+/**
+ * The organization column a `@CustomerScoped` entity carries **when it has
+ * one**. `Cart` does; the other fifteen do not yet (feature 087, FR-003).
+ */
+export declare const CUSTOMER_ORGANIZATION_KEY = "organizationId";
+/**
+ * Whether the filtered entity carries {@link CUSTOMER_ORGANIZATION_KEY}.
+ *
+ * Derived per entity by the decorator from the ORM's own discovered metadata —
+ * never written down — so an entity that gains the column starts being filtered
+ * on it in the same run, and one that loses it stops. See
+ * `org-scoped.decorator.ts`.
+ */
+export type CustomerOrganizationColumn = 'present' | 'absent';
+/** `where` fragment applied to `@OrgScoped` entities on their `organizationId`. */
+export declare function orgFilterCond(): Record<string, unknown>;
+/**
+ * `where` fragment applied to `@CustomerScoped` entities on their
+ * `customerAccountId` — and, for the `allowed-set` mode, on their own
+ * organization column when they carry one (feature 087, FR-001/FR-002).
+ *
+ * ## The `allowed-set` arm, and why it used to be empty
+ *
+ * It returned `{}`. An `allowed-set` context is what a `sales_representative`
+ * resolves to, so for that actor every one of the sixteen `@CustomerScoped`
+ * classes behaved exactly as if it were `@GlobalEntity`, and the tenant
+ * boundary on any admin surface over one was whatever that surface remembered
+ * to do for itself. That is a guard whose green means *not looking*: the code
+ * runs, returns successfully, and enforces nothing. Two surfaces did the work
+ * by hand (`carts`, `customers`); every other one disclosed another
+ * organization's rows, reads and writes alike.
+ *
+ * The arm now answers in one of two ways and never in a third:
+ *
+ *  - **the entity carries `organizationId`** — the column compare the owner
+ *    ruled for (exit (a′), 2026-08-24): `{ organizationId: { $in: allowed } }`,
+ *    on a column of the filtered row's own table, no join and no subquery
+ *    (FR-002). `Cart` is the one class in this state today.
+ *  - **it does not** — the predicate matches **nothing**. That is not a
+ *    placeholder, it is FR-011 applied to the state those tables are in: they
+ *    carry no organization at all, so no row in them is inside a scoped
+ *    actor's authority, and a row is never visible because a predicate was
+ *    absent. When feature 087's Group A and Group B land the column, the same
+ *    arm starts matching without another edit here.
+ *
+ * `{ customerAccountId: { $in: [] } }` is the match-nothing spelling because
+ * `customerAccountId` is the one column every `@CustomerScoped` entity carries
+ * by classification, so FR-002 holds for the refusal exactly as it does for the
+ * grant. An empty `allowed-set` therefore matches nothing on `@OrgScoped` and
+ * on `@CustomerScoped` alike (FR-007) — the two used to give the same actor
+ * opposite answers, and the `@CustomerScoped` one was "everything".
+ *
+ * **The refusal says so** (feature 087, owner decision of 2026-08-29). An empty
+ * list and "nothing exists" are the same three bytes to every layer above this
+ * one, so the refusing arm records itself on the ambient context's observation
+ * sink (`TenantScopeNotices`) and the host puts a code on the response
+ * envelope. That is derived rather than declared: no route sets a flag, no
+ * screen is remembered, and the day a table gains its column the same arm
+ * starts granting and the notice stops being emitted, in one edit that is this
+ * file's `organizationColumn` answer changing.
+ *
+ * **A surface that has already established the caller's authority may still
+ * read across this**, through the one sanctioned crossing (`withSystemScope`,
+ * feature 050 FR-005) and never through a bare `catch`. `customers`'
+ * `CustomerAddressService` is the worked example: it proves the caller may
+ * reach the account through `customer_accounts`' `@OrgScoped` read model first,
+ * and the widening covers only the rows of the account it just authorised.
+ */
+export declare function customerFilterCond(organizationColumn: CustomerOrganizationColumn): Record<string, unknown>;
+//# sourceMappingURL=filters.d.ts.map

package/dist/tenancy/filters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filters.d.ts","sourceRoot":"","sources":["../../src/tenancy/filters.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,UAAU,QAAQ,CAAC;AAChC,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAEjD,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,MAAM,0BAA0B,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE9D,mFAAmF;AACnF,wBAAgB,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoBvD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAgB,kBAAkB,CAChC,kBAAkB,EAAE,0BAA0B,GAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBzB"}

package/dist/tenancy/filters.js

@@ -0,0 +1,126 @@
+import { getTenantContext, MissingTenantContextError, noteOrganizationAttributionRefusal, } from './tenant-context.js';
+/**
+ * MikroORM global-filter definitions for the tenant guard (feature 050).
+ *
+ * The `cond` functions read the ambient `TenantContext` DIRECTLY from
+ * AsyncLocalStorage at query time (not from `setFilterParams`). This makes the
+ * filter fork-independent: it applies correctly on the request-scoped EM, on
+ * `em.transactional` sub-forks, and on any other fork — because the store is
+ * read when the query runs, inside the caller's async context. A query executed
+ * with no ambient context throws `MissingTenantContextError` (fail-closed).
+ *
+ * The filters are attached (default-on, `args: false`) by the classification
+ * decorators in `org-scoped.decorator.ts`.
+ */
+export const ORG_FILTER = 'org';
+export const CUSTOMER_FILTER = 'customerAccount';
+/** The tenant key every `@CustomerScoped` entity carries, by definition. */
+export const CUSTOMER_TENANT_KEY = 'customerAccountId';
+/**
+ * The organization column a `@CustomerScoped` entity carries **when it has
+ * one**. `Cart` does; the other fifteen do not yet (feature 087, FR-003).
+ */
+export const CUSTOMER_ORGANIZATION_KEY = 'organizationId';
+/** `where` fragment applied to `@OrgScoped` entities on their `organizationId`. */
+export function orgFilterCond() {
+    const ctx = getTenantContext();
+    if (!ctx)
+        throw new MissingTenantContextError(`filter '${ORG_FILTER}'`);
+    switch (ctx.mode) {
+        case 'all':
+        case 'system':
+            return {};
+        case 'single-org':
+            // The `?? null` is belt-and-braces and **matches nothing** since D-178.
+            // A `single-org` context with a null organisation was producible by
+            // exactly one thing — a signed-in customer whose `customer_accounts` row
+            // had `organization_id IS NULL` — and that column is `NOT NULL` now.
+            // Until it was, this line put every such customer into one shared tenant
+            // bucket: two of them resolved the same predicate and saw each other's
+            // `@OrgScoped` rows. The type keeps the coalesce (`TenantContext`'s field
+            // is optional); the platform no longer has a caller for it.
+            return { organizationId: ctx.organizationId ?? null };
+        case 'allowed-set':
+            return { organizationId: { $in: [...(ctx.allowedOrganizationIds ?? [])] } };
+    }
+}
+/**
+ * `where` fragment applied to `@CustomerScoped` entities on their
+ * `customerAccountId` — and, for the `allowed-set` mode, on their own
+ * organization column when they carry one (feature 087, FR-001/FR-002).
+ *
+ * ## The `allowed-set` arm, and why it used to be empty
+ *
+ * It returned `{}`. An `allowed-set` context is what a `sales_representative`
+ * resolves to, so for that actor every one of the sixteen `@CustomerScoped`
+ * classes behaved exactly as if it were `@GlobalEntity`, and the tenant
+ * boundary on any admin surface over one was whatever that surface remembered
+ * to do for itself. That is a guard whose green means *not looking*: the code
+ * runs, returns successfully, and enforces nothing. Two surfaces did the work
+ * by hand (`carts`, `customers`); every other one disclosed another
+ * organization's rows, reads and writes alike.
+ *
+ * The arm now answers in one of two ways and never in a third:
+ *
+ *  - **the entity carries `organizationId`** — the column compare the owner
+ *    ruled for (exit (a′), 2026-08-24): `{ organizationId: { $in: allowed } }`,
+ *    on a column of the filtered row's own table, no join and no subquery
+ *    (FR-002). `Cart` is the one class in this state today.
+ *  - **it does not** — the predicate matches **nothing**. That is not a
+ *    placeholder, it is FR-011 applied to the state those tables are in: they
+ *    carry no organization at all, so no row in them is inside a scoped
+ *    actor's authority, and a row is never visible because a predicate was
+ *    absent. When feature 087's Group A and Group B land the column, the same
+ *    arm starts matching without another edit here.
+ *
+ * `{ customerAccountId: { $in: [] } }` is the match-nothing spelling because
+ * `customerAccountId` is the one column every `@CustomerScoped` entity carries
+ * by classification, so FR-002 holds for the refusal exactly as it does for the
+ * grant. An empty `allowed-set` therefore matches nothing on `@OrgScoped` and
+ * on `@CustomerScoped` alike (FR-007) — the two used to give the same actor
+ * opposite answers, and the `@CustomerScoped` one was "everything".
+ *
+ * **The refusal says so** (feature 087, owner decision of 2026-08-29). An empty
+ * list and "nothing exists" are the same three bytes to every layer above this
+ * one, so the refusing arm records itself on the ambient context's observation
+ * sink (`TenantScopeNotices`) and the host puts a code on the response
+ * envelope. That is derived rather than declared: no route sets a flag, no
+ * screen is remembered, and the day a table gains its column the same arm
+ * starts granting and the notice stops being emitted, in one edit that is this
+ * file's `organizationColumn` answer changing.
+ *
+ * **A surface that has already established the caller's authority may still
+ * read across this**, through the one sanctioned crossing (`withSystemScope`,
+ * feature 050 FR-005) and never through a bare `catch`. `customers`'
+ * `CustomerAddressService` is the worked example: it proves the caller may
+ * reach the account through `customer_accounts`' `@OrgScoped` read model first,
+ * and the widening covers only the rows of the account it just authorised.
+ */
+export function customerFilterCond(organizationColumn) {
+    const ctx = getTenantContext();
+    if (!ctx)
+        throw new MissingTenantContextError(`filter '${CUSTOMER_FILTER}'`);
+    switch (ctx.mode) {
+        case 'all':
+        case 'system':
+            return {};
+        case 'single-org':
+            return { [CUSTOMER_TENANT_KEY]: ctx.customerAccountId ?? null };
+        case 'allowed-set': {
+            const allowed = [...(ctx.allowedOrganizationIds ?? [])];
+            if (organizationColumn === 'present') {
+                return { [CUSTOMER_ORGANIZATION_KEY]: { $in: allowed } };
+            }
+            // The predicate is unchanged; the line above it is a *record* that this
+            // execution was refused a whole table, which the host discloses on the
+            // response envelope (feature 087, owner decision of 2026-08-29). It is
+            // written here because this is the only place that knows the difference
+            // between "your reach excludes all of these" and "there are none", and
+            // both answers look like `[]` from every layer above. Nothing in the
+            // guard reads it back: it is an observation, not an input.
+            noteOrganizationAttributionRefusal(ctx);
+            return { [CUSTOMER_TENANT_KEY]: { $in: [] } };
+        }
+    }
+}
+//# sourceMappingURL=filters.js.map

package/dist/tenancy/filters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filters.js","sourceRoot":"","sources":["../../src/tenancy/filters.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AAChC,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAY1D,mFAAmF;AACnF,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,yBAAyB,CAAC,WAAW,UAAU,GAAG,CAAC,CAAC;IACxE,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,YAAY;YACf,wEAAwE;YACxE,oEAAoE;YACpE,yEAAyE;YACzE,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,0EAA0E;YAC1E,4DAA4D;YAC5D,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;QACxD,KAAK,aAAa;YAChB,OAAO,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,kBAAkB,CAChC,kBAA8C;IAE9C,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,yBAAyB,CAAC,WAAW,eAAe,GAAG,CAAC,CAAC;IAC7E,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,YAAY;YACf,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAClE,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC;YACxD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;YAC3D,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,2DAA2D;YAC3D,kCAAkC,CAAC,GAAG,CAAC,CAAC;YACxC,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/tenancy/index.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Tenant guard core layer (feature 050 — Systemic Organization Tenant Scoping).
+ * Peer of `events/`, `http/`, `kernel/`, `commands/`; becomes the `./tenancy`
+ * subpath of `@endora-commerce/platform` (feature 080, D-160.1/D-160.7), and
+ * that subpath is the boundary a future `@endora-commerce/tenancy` would take
+ * (D-160.6). See specs/050-org-tenant-scoping/.
+ *
+ * **This barrel is a package boundary in waiting, so it carries this
+ * directory's symbols and nothing else.** Re-exporting a kernel or commands
+ * symbol here to save a consumer one import line spends the split option for a
+ * convenience.
+ *
+ * **What is on it is decided by `contracts/host-package.md` §1.3, not by what
+ * happens to be here** (T042f, applying T042c's rule to this directory for the
+ * first time). Until T042f the barrel was an accumulation of 38 names over
+ * seven files, of which modules took **two** through the barrel itself —
+ * `getTenantContext` and `withSystemScope`, in four files — while the same
+ * directory was reached 237 times by relative path, for ten distinct names.
+ * Every one of those relative reaches becomes a bare specifier when its module
+ * moves, so the surface is decided by §1.3's symbol column and not by what
+ * happened to be re-exported here.
+ *
+ * So the rule is the kernel barrel's: a symbol is here when §1.3 records a
+ * module taking it from a file it marks **P** (rows 2, 21, 28, 30 and 45 — every
+ * file of this directory a module reaches is **P**), or when it is the argument,
+ * return or thrown shape of one of those. Everything else is reachable by
+ * relative path, which the composition roots and the tests have and a packaged
+ * module does not. `test/unit/kernel/published-surface.test.ts` is the two-way
+ * ratchet and carries the reason each removed name is not published.
+ *
+ * Two groups deserve naming here because a future author will look for them:
+ *
+ *  - **the request pipeline** — `resolveTenantContext`, `systemTenantContext`,
+ *    `orgPinnedTenantContext` and the four actor-input shapes, plus
+ *    `runWithTenantContext` / `runInTenantContext` / `enterTenantContext` /
+ *    `runWithoutTenantContext` and `forkScopedEm`. A context is derived
+ *    server-side from the authenticated actor and established by the host; a
+ *    module *reads* it (`getTenantContext`) or widens it explicitly
+ *    (`withSystemScope`), and §1.3 gives none of those files a row because no
+ *    module reaches one. `enterSystemScope` (kernel, row 13) is the
+ *    module-facing entry for an execution that starts outside a request.
+ *  - **the runtime classification registry** — `tenantClassifications`,
+ *    `ClassificationMeta`, `ScopeClass` and the two filter names. The
+ *    decorators write into the registry and attach the MikroORM filters; the
+ *    host and `check-entity-tenant-classification` read them. A module applies
+ *    a decorator and never names what it wrote.
+ */
+export { 
+/** Row 45 — `getTenantContext`'s return shape, and the parameter of every derived-scope helper. */
+type TenantContext, 
+/**
+ * The fail-closed guarantee: a tenant-scoped query with no ambient context
+ * raises it, as does every derived-scope helper. A caller that cannot name it
+ * cannot handle the refusal.
+ */
+MissingTenantContextError, getTenantContext, } from './tenant-context.js';
+/** Row 2 — 219 reaches from 59 modules, the largest single reach in the contract. */
+export { OrgScoped, CustomerScoped, GlobalEntity, TransitivelyScoped, RuleScoped, } from './org-scoped.decorator.js';
+/** Row 21 — the sanctioned cross-organization widening (FR-005/FR-013). */
+export { withSystemScope } from './escape-hatch.js';
+/** Row 28, plus `orgConstraintFor`'s return shape. */
+export { orgConstraintFor, isOrgInScope, ruleVisibleForScope, type OrgConstraint, } from './derived-scope.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/tenancy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tenancy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO;AACL,mGAAmG;AACnG,KAAK,aAAa;AAClB;;;;GAIG;AACH,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,qFAAqF;AACrF,OAAO,EACL,SAAS,EACT,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,UAAU,GACX,MAAM,2BAA2B,CAAC;AACnC,2EAA2E;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,sDAAsD;AACtD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC"}

package/dist/tenancy/index.js

@@ -0,0 +1,61 @@
+/**
+ * Tenant guard core layer (feature 050 — Systemic Organization Tenant Scoping).
+ * Peer of `events/`, `http/`, `kernel/`, `commands/`; becomes the `./tenancy`
+ * subpath of `@endora-commerce/platform` (feature 080, D-160.1/D-160.7), and
+ * that subpath is the boundary a future `@endora-commerce/tenancy` would take
+ * (D-160.6). See specs/050-org-tenant-scoping/.
+ *
+ * **This barrel is a package boundary in waiting, so it carries this
+ * directory's symbols and nothing else.** Re-exporting a kernel or commands
+ * symbol here to save a consumer one import line spends the split option for a
+ * convenience.
+ *
+ * **What is on it is decided by `contracts/host-package.md` §1.3, not by what
+ * happens to be here** (T042f, applying T042c's rule to this directory for the
+ * first time). Until T042f the barrel was an accumulation of 38 names over
+ * seven files, of which modules took **two** through the barrel itself —
+ * `getTenantContext` and `withSystemScope`, in four files — while the same
+ * directory was reached 237 times by relative path, for ten distinct names.
+ * Every one of those relative reaches becomes a bare specifier when its module
+ * moves, so the surface is decided by §1.3's symbol column and not by what
+ * happened to be re-exported here.
+ *
+ * So the rule is the kernel barrel's: a symbol is here when §1.3 records a
+ * module taking it from a file it marks **P** (rows 2, 21, 28, 30 and 45 — every
+ * file of this directory a module reaches is **P**), or when it is the argument,
+ * return or thrown shape of one of those. Everything else is reachable by
+ * relative path, which the composition roots and the tests have and a packaged
+ * module does not. `test/unit/kernel/published-surface.test.ts` is the two-way
+ * ratchet and carries the reason each removed name is not published.
+ *
+ * Two groups deserve naming here because a future author will look for them:
+ *
+ *  - **the request pipeline** — `resolveTenantContext`, `systemTenantContext`,
+ *    `orgPinnedTenantContext` and the four actor-input shapes, plus
+ *    `runWithTenantContext` / `runInTenantContext` / `enterTenantContext` /
+ *    `runWithoutTenantContext` and `forkScopedEm`. A context is derived
+ *    server-side from the authenticated actor and established by the host; a
+ *    module *reads* it (`getTenantContext`) or widens it explicitly
+ *    (`withSystemScope`), and §1.3 gives none of those files a row because no
+ *    module reaches one. `enterSystemScope` (kernel, row 13) is the
+ *    module-facing entry for an execution that starts outside a request.
+ *  - **the runtime classification registry** — `tenantClassifications`,
+ *    `ClassificationMeta`, `ScopeClass` and the two filter names. The
+ *    decorators write into the registry and attach the MikroORM filters; the
+ *    host and `check-entity-tenant-classification` read them. A module applies
+ *    a decorator and never names what it wrote.
+ */
+export { 
+/**
+ * The fail-closed guarantee: a tenant-scoped query with no ambient context
+ * raises it, as does every derived-scope helper. A caller that cannot name it
+ * cannot handle the refusal.
+ */
+MissingTenantContextError, getTenantContext, } from './tenant-context.js';
+/** Row 2 — 219 reaches from 59 modules, the largest single reach in the contract. */
+export { OrgScoped, CustomerScoped, GlobalEntity, TransitivelyScoped, RuleScoped, } from './org-scoped.decorator.js';
+/** Row 21 — the sanctioned cross-organization widening (FR-005/FR-013). */
+export { withSystemScope } from './escape-hatch.js';
+/** Row 28, plus `orgConstraintFor`'s return shape. */
+export { orgConstraintFor, isOrgInScope, ruleVisibleForScope, } from './derived-scope.js';
+//# sourceMappingURL=index.js.map

package/dist/tenancy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tenancy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO;AAGL;;;;GAIG;AACH,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,qFAAqF;AACrF,OAAO,EACL,SAAS,EACT,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,UAAU,GACX,MAAM,2BAA2B,CAAC;AACnC,2EAA2E;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,sDAAsD;AACtD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,GAEpB,MAAM,oBAAoB,CAAC"}

package/dist/tenancy/org-scoped.decorator.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Per-entity tenant-scope classification (feature 050, FR-006).
+ *
+ * Exactly one decorator MUST be applied to every persisted entity. `@OrgScoped`
+ * and `@CustomerScoped` also attach a default-on MikroORM global filter, so the
+ * data-layer guard applies automatically. The other three record classification
+ * only (enforcement is via `derived-scope.ts` or, for globals, none).
+ *
+ * The `check-entity-tenant-classification.ts` CI check reads the source to prove
+ * the classification is total; the runtime registry here supports introspection
+ * and tests.
+ */
+export type ScopeClass = 'org' | 'customer' | 'global' | 'transitive' | 'rule';
+type EntityClass = new (...args: never[]) => object;
+export interface ClassificationMeta {
+    readonly target: EntityClass;
+    readonly className: string;
+    readonly scope: ScopeClass;
+    /** Tenant-key column for `org` / `customer`. */
+    readonly key?: string;
+    /**
+     * Parent-aggregate class name + FK for `transitive` — see
+     * {@link TransitivelyScoped} for why the parent is a name and not a class.
+     */
+    readonly parentClassName?: string;
+    readonly fk?: string;
+}
+/** All classified entities registered at import time. */
+export declare function tenantClassifications(): readonly ClassificationMeta[];
+/** Direct `organizationId` column. Filtered by the `org` global filter. */
+export declare function OrgScoped(): (target: EntityClass) => void;
+/**
+ * Direct `customerAccountId` column. Filtered by the `customerAccount` filter.
+ *
+ * The filter's `allowed-set` arm also needs to know whether *this* entity
+ * carries an organization column of its own, so the `cond` forwards the ORM's
+ * `em` and `entityName` to {@link customerOrganizationColumn}. See
+ * `customerFilterCond` for what each answer means.
+ */
+export declare function CustomerScoped(): (target: EntityClass) => void;
+/** Platform-global, exempt from all tenant filters. */
+export declare function GlobalEntity(): (target: EntityClass) => void;
+/**
+ * Scoped through a parent aggregate's org (e.g. Invoice → Order). No own column.
+ *
+ * **The parent is named by its class name, not by the class** (feature 080,
+ * T049; ruling D-169). Both of this platform's transitive chains cross a module
+ * boundary — `Invoice` → `Order` and `KsefSubmission` → `Invoice` — and D-168
+ * says a module that has become a package publishes an `entities` array and no
+ * named entity class, so the symbol the old `() => Order` thunk closed over is
+ * one the child cannot import. Those two lines were the whole reason `invoices`
+ * and `ksef` could not be packaged. Nothing else in the tree took the thunk
+ * form, so there is one form and not two (Constitution IV).
+ *
+ * **Why the class name and not the table name.** {@link ClassificationMeta}
+ * already keys every row by `className`, so the lookup needs no second index
+ * and no per-module token registry; MikroORM refuses two entities sharing a
+ * class name at discovery (`MetadataValidator`), so the name is a
+ * platform-wide unique key the ORM already enforces rather than an assumption
+ * written down here; and no reader of this registry — `filters.ts`,
+ * `derived-scope.ts`, `kernel/scope.ts`, `check-entity-tenant-classification`
+ * — asks for a table. Resolving a table name would mean re-deriving it through
+ * the naming strategy or reading `MetadataStorage`, which is only populated
+ * after ORM discovery, i.e. later than the moment this has to answer.
+ *
+ * The name is resolved lazily by {@link resolveTransitiveParent}: entity
+ * classes register in import order and a child is routinely imported before its
+ * parent, so resolving here would refuse a chain that is perfectly good.
+ */
+export declare function TransitivelyScoped(parentClassName: string, fk: string): (target: EntityClass) => void;
+/**
+ * A `@TransitivelyScoped` chain from which no tenant can be read.
+ *
+ * It is an error and never a fallback. A transitively scoped entity carries no
+ * tenant column of its own, so an unresolved parent leaves it reachable with no
+ * tenant predicate at all — Principle XI (non-negotiable) defeated by a silence,
+ * which is exactly the failure mode a name-addressed parent would otherwise
+ * introduce. Resolution therefore has two outcomes and no third: the one
+ * classified entity carrying that name, or this.
+ *
+ * **It is also the error for a chain that resolves at every step and grounds
+ * nowhere** (D-170): a `global` or `rule` terminus, a cycle, and a run of
+ * transitives reaching no keyed classification. **One error class, deliberately.**
+ * A caller can do nothing different about "your parent does not exist" and "your
+ * parent has no tenant to give you" — both are boot failures with the same
+ * remedy, a decorator to open — and a second class would invite a `catch` that
+ * distinguishes them, which is the beginning of a degraded mode. The degraded
+ * mode is an untenanted read.
+ */
+export declare class UnresolvableTenantParentError extends Error {
+    constructor(detail: string);
+}
+/**
+ * The classification of `child`'s parent aggregate, resolved by class name.
+ *
+ * Lazy and order-independent by construction: it reads the registry when it is
+ * called, never when the decorator ran. Throws {@link UnresolvableTenantParentError}
+ * — see that class for why there is no other outcome.
+ */
+export declare function resolveTransitiveParent(child: ClassificationMeta): ClassificationMeta;
+/** Where the reconciliation's `info` lines go; a `PlatformLogger` satisfies it. */
+export interface TenancyChainReporter {
+    info(obj: object, msg: string): void;
+}
+/**
+ * Reconcile every transitive chain in the registry, and refuse if any is broken.
+ *
+ * **This is where the refusal lives, and the placement is the decision.** The
+ * decorator cannot refuse — a child is routinely decorated before its parent is
+ * imported, so an eager check would reject working chains. The *first
+ * resolution* cannot be the only refusal either: nothing in this repository
+ * resolves a parent on a request path today, so a chain that stopped resolving
+ * would sit there unmeasured, which is the silence this exists to remove. So
+ * the host reconciles the whole registry once, at the moment it enumerates the
+ * entity classes it is about to configure the ORM with
+ * (`backend/src/db/configured-entities.ts`) — the first instant at which every
+ * classification decorator has run, core and installed package alike, and still
+ * before a single query can be issued.
+ *
+ * It reports **every** broken chain, not the first: an author who renamed an
+ * entity wants the whole list in one boot, not one per restart.
+ *
+ * ## Three outcomes (D-170)
+ *
+ * Silent for an `org` terminus. **Refused** for `global`, `rule`, a cycle or a
+ * run of transitives that grounds nowhere — see {@link walkTenancyChain}.
+ * **Accepted with one `info` line** for a `customer` terminus, which is legal
+ * because it grounds (a real column, a default-on filter, and `CustomerAccount`
+ * is itself `@OrgScoped`, so the customer axis narrows the org axis rather than
+ * competing with it) and reported because of a measured circularity:
+ * `customerFilterCond()` returns `{ customerAccountId: … }` in `single-org`
+ * mode and **`{}` — no predicate at all — in `allowed-set`**, where that file's
+ * own comment says an org-scoped admin "cannot be expressed as a
+ * customer-account predicate… such rows are reached **via transitive scoping**
+ * where needed". A chain terminating there is therefore unfiltered for an
+ * org-scoped admin, and the recorded remedy for that is the very mechanism doing
+ * the terminating. Worth a line; not worth a throw, since refusing would police
+ * a defect the terminus did not cause — the `{}` applies to all customer-scoped
+ * entities either way — and would forbid a shape with nowhere else to go, a
+ * customer-scoped parent having no `organizationId` column to continue through.
+ *
+ * The notices are emitted before the refusal rather than instead of it: each
+ * chain is judged on its own, and suppressing a true report about one because
+ * another is broken would make the line come and go for unrelated reasons.
+ */
+export declare function assertTransitiveParentsResolve(report?: TenancyChainReporter): void;
+/** Org targeting lives in a rule (e.g. price_lists `applicationRule`), not a column. */
+export declare function RuleScoped(): (target: EntityClass) => void;
+export {};
+//# sourceMappingURL=org-scoped.decorator.d.ts.map

package/dist/tenancy/org-scoped.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-scoped.decorator.d.ts","sourceRoot":"","sources":["../../src/tenancy/org-scoped.decorator.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;AAG/E,KAAK,WAAW,GAAG,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,MAAM,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAID,yDAAyD;AACzD,wBAAgB,qBAAqB,IAAI,SAAS,kBAAkB,EAAE,CAErE;AAsDD,2EAA2E;AAC3E,wBAAgB,SAAS,IAAI,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAKzD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAO9D;AAED,uDAAuD;AACvD,wBAAgB,YAAY,IAAI,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAI5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,EAAE,MAAM,EACvB,EAAE,EAAE,MAAM,GACT,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAI/B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,MAAM,EAAE,MAAM;CAI3B;AAmCD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,kBAAkB,GAAG,kBAAkB,CAIrF;AAmGD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,GAAE,oBAAsC,GAC7C,IAAI,CAwBN;AAED,wFAAwF;AACxF,wBAAgB,UAAU,IAAI,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAI1D"}