@endora-commerce/platform 0.100.0

package/dist/tenancy/org-scoped.decorator.js

@@ -0,0 +1,339 @@
+import { Filter } from '@mikro-orm/core';
+import { ORG_FILTER, CUSTOMER_FILTER, CUSTOMER_ORGANIZATION_KEY, orgFilterCond, customerFilterCond, } from './filters.js';
+const registry = [];
+/** All classified entities registered at import time. */
+export function tenantClassifications() {
+    return registry;
+}
+function applyMikroFilter(target, name, cond) {
+    // MikroORM's `Filter` is a class decorator; apply it programmatically.
+    // `args: false` — the cond reads the ambient context from AsyncLocalStorage at
+    // query time, so no per-fork `setFilterParams` is needed (fork-independent).
+    Filter({ name, cond, default: true, args: false })(target);
+}
+/**
+ * Whether the entity being filtered carries {@link CUSTOMER_ORGANIZATION_KEY},
+ * read out of the ORM's **own discovered metadata** — the same source the query
+ * being filtered is built from.
+ *
+ * It is derived rather than declared for the reason a derived fact is never
+ * written down twice: a list of "the customer-scoped classes that have an
+ * organization column" would be right on the day it was written and wrong the
+ * next time one of feature 087's fifteen migrations lands, and being wrong in
+ * the *permissive* direction is a disclosure. Deriving it means the column and
+ * the predicate arrive together, in one merge request, with no third artefact
+ * to keep in step.
+ *
+ * **It answers `'absent'` for anything it cannot read**, which is the
+ * restrictive answer: an unreadable metadata store must not be the reason a
+ * scoped administrator sees every organization's rows.
+ */
+function customerOrganizationColumn(em, entityName) {
+    const metadataOf = em?.getMetadata;
+    if (typeof metadataOf !== 'function')
+        return 'absent';
+    const storage = metadataOf.call(em);
+    if (typeof storage?.find !== 'function')
+        return 'absent';
+    const meta = storage.find(entityName);
+    const properties = meta?.properties;
+    if (!properties)
+        return 'absent';
+    return Object.prototype.hasOwnProperty.call(properties, CUSTOMER_ORGANIZATION_KEY)
+        ? 'present'
+        : 'absent';
+}
+/** Direct `organizationId` column. Filtered by the `org` global filter. */
+export function OrgScoped() {
+    return (target) => {
+        registry.push({ target, className: target.name, scope: 'org', key: 'organizationId' });
+        applyMikroFilter(target, ORG_FILTER, () => orgFilterCond());
+    };
+}
+/**
+ * Direct `customerAccountId` column. Filtered by the `customerAccount` filter.
+ *
+ * The filter's `allowed-set` arm also needs to know whether *this* entity
+ * carries an organization column of its own, so the `cond` forwards the ORM's
+ * `em` and `entityName` to {@link customerOrganizationColumn}. See
+ * `customerFilterCond` for what each answer means.
+ */
+export function CustomerScoped() {
+    return (target) => {
+        registry.push({ target, className: target.name, scope: 'customer', key: 'customerAccountId' });
+        applyMikroFilter(target, CUSTOMER_FILTER, (_args, _type, em, _options, entityName) => customerFilterCond(customerOrganizationColumn(em, entityName ?? target)));
+    };
+}
+/** Platform-global, exempt from all tenant filters. */
+export function GlobalEntity() {
+    return (target) => {
+        registry.push({ target, className: target.name, scope: 'global' });
+    };
+}
+/**
+ * Scoped through a parent aggregate's org (e.g. Invoice → Order). No own column.
+ *
+ * **The parent is named by its class name, not by the class** (feature 080,
+ * T049; ruling D-169). Both of this platform's transitive chains cross a module
+ * boundary — `Invoice` → `Order` and `KsefSubmission` → `Invoice` — and D-168
+ * says a module that has become a package publishes an `entities` array and no
+ * named entity class, so the symbol the old `() => Order` thunk closed over is
+ * one the child cannot import. Those two lines were the whole reason `invoices`
+ * and `ksef` could not be packaged. Nothing else in the tree took the thunk
+ * form, so there is one form and not two (Constitution IV).
+ *
+ * **Why the class name and not the table name.** {@link ClassificationMeta}
+ * already keys every row by `className`, so the lookup needs no second index
+ * and no per-module token registry; MikroORM refuses two entities sharing a
+ * class name at discovery (`MetadataValidator`), so the name is a
+ * platform-wide unique key the ORM already enforces rather than an assumption
+ * written down here; and no reader of this registry — `filters.ts`,
+ * `derived-scope.ts`, `kernel/scope.ts`, `check-entity-tenant-classification`
+ * — asks for a table. Resolving a table name would mean re-deriving it through
+ * the naming strategy or reading `MetadataStorage`, which is only populated
+ * after ORM discovery, i.e. later than the moment this has to answer.
+ *
+ * The name is resolved lazily by {@link resolveTransitiveParent}: entity
+ * classes register in import order and a child is routinely imported before its
+ * parent, so resolving here would refuse a chain that is perfectly good.
+ */
+export function TransitivelyScoped(parentClassName, fk) {
+    return (target) => {
+        registry.push({ target, className: target.name, scope: 'transitive', parentClassName, fk });
+    };
+}
+/**
+ * A `@TransitivelyScoped` chain from which no tenant can be read.
+ *
+ * It is an error and never a fallback. A transitively scoped entity carries no
+ * tenant column of its own, so an unresolved parent leaves it reachable with no
+ * tenant predicate at all — Principle XI (non-negotiable) defeated by a silence,
+ * which is exactly the failure mode a name-addressed parent would otherwise
+ * introduce. Resolution therefore has two outcomes and no third: the one
+ * classified entity carrying that name, or this.
+ *
+ * **It is also the error for a chain that resolves at every step and grounds
+ * nowhere** (D-170): a `global` or `rule` terminus, a cycle, and a run of
+ * transitives reaching no keyed classification. **One error class, deliberately.**
+ * A caller can do nothing different about "your parent does not exist" and "your
+ * parent has no tenant to give you" — both are boot failures with the same
+ * remedy, a decorator to open — and a second class would invite a `catch` that
+ * distinguishes them, which is the beginning of a degraded mode. The degraded
+ * mode is an untenanted read.
+ */
+export class UnresolvableTenantParentError extends Error {
+    constructor(detail) {
+        super(`Unresolvable @TransitivelyScoped parent — ${detail}`);
+        this.name = 'UnresolvableTenantParentError';
+    }
+}
+/**
+ * Why `child`'s parent does not resolve, or `null` when it does.
+ *
+ * Shared by the single resolution and the whole-registry reconciliation so the
+ * two cannot come to disagree about what "resolves" means — and so neither has
+ * to `catch` the other's throw.
+ */
+function describeChild(child) {
+    return `${child.className} (fk '${child.fk ?? '?'}')`;
+}
+function transitiveParentIssue(child) {
+    const where = describeChild(child);
+    if (child.scope !== 'transitive' || child.parentClassName === undefined) {
+        return `${where} is classified '${child.scope}' and names no transitive parent`;
+    }
+    const matches = registry.filter((meta) => meta.className === child.parentClassName);
+    if (matches.length === 1)
+        return null;
+    if (matches.length === 0) {
+        return (`${where} is scoped through '${child.parentClassName}', and no classified entity of ` +
+            'that name is registered in this platform. Either the parent entity is not part of ' +
+            'this composition — check the owning module is installed and that this module ' +
+            'declares it in its manifest `dependencies` — or the name in the decorator is wrong.');
+    }
+    return (`${where} is scoped through '${child.parentClassName}', and ${matches.length} classified ` +
+        'entities carry that class name. A class name is the platform-wide key here, so an ' +
+        'ambiguous one is refused rather than resolved to whichever registered first.');
+}
+/**
+ * The classification of `child`'s parent aggregate, resolved by class name.
+ *
+ * Lazy and order-independent by construction: it reads the registry when it is
+ * called, never when the decorator ran. Throws {@link UnresolvableTenantParentError}
+ * — see that class for why there is no other outcome.
+ */
+export function resolveTransitiveParent(child) {
+    const issue = transitiveParentIssue(child);
+    if (issue !== null)
+        throw new UnresolvableTenantParentError(issue);
+    return registry.find((meta) => meta.className === child.parentClassName);
+}
+/** `A -> B -> C`, the shape every message below spells a chain in. */
+function pathText(path) {
+    return path.join(' -> ');
+}
+/**
+ * Walk `child`'s chain of parents to a classification that carries a tenant key.
+ *
+ * **The rule is `parent.key !== undefined`** (D-170), true for exactly `org` and
+ * `customer` — {@link ClassificationMeta} already encodes it, so nothing new is
+ * stored and the two cannot come to disagree.
+ *
+ * Checking the *immediate* parent, which is what this used to do, leaves three
+ * silences that are all the same failure with a different number of steps: a
+ * `global` terminus, a cycle (`A -> B -> A` resolves at every step and grounds
+ * nowhere), and a run of transitives reaching no keyed classification. In each
+ * of them the entity is reachable with no tenant predicate anywhere on the path.
+ *
+ * **No depth limit.** The repeated-name guard is what terminates the walk — a
+ * chain with no cycle is finite because the registry is — and a legitimate deep
+ * chain is not wrong for being deep.
+ */
+function walkTenancyChain(child) {
+    const path = [child.className];
+    const seen = new Set([child.className]);
+    let current = child;
+    for (;;) {
+        const issue = transitiveParentIssue(current);
+        if (issue !== null) {
+            // Beyond the first hop the broken decorator is somebody else's — and that
+            // entity is transitive too, so it reports the same issue under its own
+            // name. This one has to say which chain of its own brought it there.
+            return {
+                path,
+                issue: current === child
+                    ? issue
+                    : `${describeChild(child)} is scoped through ${pathText(path)}, and that chain breaks: ${issue}`,
+            };
+        }
+        const parent = registry.find((meta) => meta.className === current.parentClassName);
+        path.push(parent.className);
+        if (seen.has(parent.className)) {
+            return {
+                path,
+                issue: `${describeChild(child)} is scoped through ${pathText(path)}, which is a cycle. ` +
+                    'It resolves at every step and grounds nowhere, so no tenant predicate is ' +
+                    'reachable from it. One of the entities in the cycle owns the tenant and should ' +
+                    "carry a column for it — '@OrgScoped' or '@CustomerScoped' — rather than pointing " +
+                    'at the next.',
+            };
+        }
+        seen.add(parent.className);
+        if (parent.scope === 'transitive') {
+            current = parent;
+            continue;
+        }
+        if (parent.key !== undefined)
+            return { path, terminus: parent, issue: null };
+        if (parent.scope === 'rule') {
+            return {
+                path,
+                issue: `${describeChild(child)} is scoped through ${pathText(path)}, which terminates at ` +
+                    `'${parent.className}' — classified 'rule', so it carries no tenant key. A transitive ` +
+                    'chain gives the child a foreign key and a foreign key cannot evaluate a rule: a ' +
+                    "rule-scoped entity's org targeting lives in a JSONB rule that 'derived-scope.ts' " +
+                    'makes the *query* intersect. This refusal retires the day a rule-scoped entity ' +
+                    "gains a resolved-org projection — that projection is '@OrgScoped', and a chain may " +
+                    'terminate there.',
+            };
+        }
+        return {
+            path,
+            issue: `${describeChild(child)} is scoped through ${pathText(path)}, which terminates at ` +
+                `'${parent.className}' — classified '${parent.scope}', so it carries no tenant key. A ` +
+                'transitively scoped entity has no tenant column and no filter of its own, and a ' +
+                'global parent has none either, so the chain delivers no tenant predicate anywhere ' +
+                'on the path and no reader can recover one (Principle XI). If this entity genuinely ' +
+                "has no tenant, classify it '@GlobalEntity' itself.",
+        };
+    }
+}
+/**
+ * The default destination, for a caller that passes none.
+ *
+ * A real write and never a no-op, for the reason `kernel/logging.ts` gives its
+ * own fallback: this runs before `buildServer`, so stdout is what a boot line
+ * has. It is duplicated rather than imported because `kernel/logging.ts` reaches
+ * `kernel/scope.ts`, which imports this directory — and this file is loaded by
+ * every persisted entity class at decoration time, which is no place to drag
+ * the container in behind an import cycle.
+ *
+ * (The ORM's entity decorator is deliberately not spelled out above: the
+ * composer generator collects entity classes by a text match over these
+ * sources, so writing it here would make this file one.)
+ */
+const consoleReporter = {
+    // eslint-disable-next-line no-console -- the pre-`buildServer` destination; see above.
+    info: (obj, msg) => console.info(obj, msg),
+};
+/**
+ * Reconcile every transitive chain in the registry, and refuse if any is broken.
+ *
+ * **This is where the refusal lives, and the placement is the decision.** The
+ * decorator cannot refuse — a child is routinely decorated before its parent is
+ * imported, so an eager check would reject working chains. The *first
+ * resolution* cannot be the only refusal either: nothing in this repository
+ * resolves a parent on a request path today, so a chain that stopped resolving
+ * would sit there unmeasured, which is the silence this exists to remove. So
+ * the host reconciles the whole registry once, at the moment it enumerates the
+ * entity classes it is about to configure the ORM with
+ * (`backend/src/db/configured-entities.ts`) — the first instant at which every
+ * classification decorator has run, core and installed package alike, and still
+ * before a single query can be issued.
+ *
+ * It reports **every** broken chain, not the first: an author who renamed an
+ * entity wants the whole list in one boot, not one per restart.
+ *
+ * ## Three outcomes (D-170)
+ *
+ * Silent for an `org` terminus. **Refused** for `global`, `rule`, a cycle or a
+ * run of transitives that grounds nowhere — see {@link walkTenancyChain}.
+ * **Accepted with one `info` line** for a `customer` terminus, which is legal
+ * because it grounds (a real column, a default-on filter, and `CustomerAccount`
+ * is itself `@OrgScoped`, so the customer axis narrows the org axis rather than
+ * competing with it) and reported because of a measured circularity:
+ * `customerFilterCond()` returns `{ customerAccountId: … }` in `single-org`
+ * mode and **`{}` — no predicate at all — in `allowed-set`**, where that file's
+ * own comment says an org-scoped admin "cannot be expressed as a
+ * customer-account predicate… such rows are reached **via transitive scoping**
+ * where needed". A chain terminating there is therefore unfiltered for an
+ * org-scoped admin, and the recorded remedy for that is the very mechanism doing
+ * the terminating. Worth a line; not worth a throw, since refusing would police
+ * a defect the terminus did not cause — the `{}` applies to all customer-scoped
+ * entities either way — and would forbid a shape with nowhere else to go, a
+ * customer-scoped parent having no `organizationId` column to continue through.
+ *
+ * The notices are emitted before the refusal rather than instead of it: each
+ * chain is judged on its own, and suppressing a true report about one because
+ * another is broken would make the line come and go for unrelated reasons.
+ */
+export function assertTransitiveParentsResolve(report = consoleReporter) {
+    const failures = [];
+    const notices = [];
+    for (const child of registry.filter((meta) => meta.scope === 'transitive')) {
+        const walk = walkTenancyChain(child);
+        if (walk.issue !== null)
+            failures.push(walk.issue);
+        else if (walk.terminus?.scope === 'customer')
+            notices.push(walk);
+    }
+    for (const walk of notices) {
+        report.info({
+            chain: pathText(walk.path),
+            terminus: walk.terminus?.className,
+            terminusScope: walk.terminus?.scope,
+        }, 'tenancy chain terminates at a customer-scoped entity: filtered in `single-org` mode, ' +
+            'unfiltered in `allowed-set`, where `customerFilterCond()` returns no predicate for an ' +
+            'org-scoped admin');
+    }
+    if (failures.length === 0)
+        return;
+    throw new UnresolvableTenantParentError(`${failures.length} tenancy chain(s) do not reach a tenant:\n  - ${failures.join('\n  - ')}`);
+}
+/** Org targeting lives in a rule (e.g. price_lists `applicationRule`), not a column. */
+export function RuleScoped() {
+    return (target) => {
+        registry.push({ target, className: target.name, scope: 'rule' });
+    };
+}
+//# sourceMappingURL=org-scoped.decorator.js.map

package/dist/tenancy/org-scoped.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-scoped.decorator.js","sourceRoot":"","sources":["../../src/tenancy/org-scoped.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EACL,UAAU,EACV,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AAkCtB,MAAM,QAAQ,GAAyB,EAAE,CAAC;AAE1C,yDAAyD;AACzD,MAAM,UAAU,qBAAqB;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAeD,SAAS,gBAAgB,CAAC,MAAmB,EAAE,IAAY,EAAE,IAAgB;IAC3E,uEAAuE;IACvE,+EAA+E;IAC/E,6EAA6E;IAC5E,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAA8B,CAAC,MAAM,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,0BAA0B,CAAC,EAAW,EAAE,UAAmB;IAClE,MAAM,UAAU,GAAI,EAAkD,EAAE,WAAW,CAAC;IACpF,IAAI,OAAO,UAAU,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAErB,CAAC;IACd,IAAI,OAAO,OAAO,EAAE,IAAI,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,CAAC;IACpC,IAAI,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAC;IACjC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,yBAAyB,CAAC;QAChF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS;IACvB,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACvF,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/F,gBAAgB,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CACnF,kBAAkB,CAAC,0BAA0B,CAAC,EAAE,EAAE,UAAU,IAAI,MAAM,CAAC,CAAC,CACzE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,kBAAkB,CAChC,eAAuB,EACvB,EAAU;IAEV,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9F,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,MAAc;QACxB,KAAK,CAAC,6CAA6C,MAAM,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAyB;IAC9C,OAAO,GAAG,KAAK,CAAC,SAAS,SAAS,KAAK,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;AACxD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB;IACtD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,GAAG,KAAK,mBAAmB,KAAK,CAAC,KAAK,kCAAkC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CACL,GAAG,KAAK,uBAAuB,KAAK,CAAC,eAAe,iCAAiC;YACrF,oFAAoF;YACpF,+EAA+E;YAC/E,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,CACL,GAAG,KAAK,uBAAuB,KAAK,CAAC,eAAe,UAAU,OAAO,CAAC,MAAM,cAAc;QAC1F,oFAAoF;QACpF,8EAA8E,CAC/E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,eAAe,CAAuB,CAAC;AACjG,CAAC;AAYD,sEAAsE;AACtE,SAAS,QAAQ,CAAC,IAAuB;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,gBAAgB,CAAC,KAAyB;IACjD,MAAM,IAAI,GAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAChD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,0EAA0E;YAC1E,uEAAuE;YACvE,qEAAqE;YACrE,OAAO;gBACL,IAAI;gBACJ,KAAK,EACH,OAAO,KAAK,KAAK;oBACf,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,sBAAsB,QAAQ,CAAC,IAAI,CAAC,4BAA4B,KAAK,EAAE;aACrG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,eAAe,CAC/B,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,IAAI;gBACJ,KAAK,EACH,GAAG,aAAa,CAAC,KAAK,CAAC,sBAAsB,QAAQ,CAAC,IAAI,CAAC,sBAAsB;oBACjF,2EAA2E;oBAC3E,iFAAiF;oBACjF,mFAAmF;oBACnF,cAAc;aACjB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClC,OAAO,GAAG,MAAM,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC7E,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO;gBACL,IAAI;gBACJ,KAAK,EACH,GAAG,aAAa,CAAC,KAAK,CAAC,sBAAsB,QAAQ,CAAC,IAAI,CAAC,wBAAwB;oBACnF,IAAI,MAAM,CAAC,SAAS,mEAAmE;oBACvF,kFAAkF;oBAClF,mFAAmF;oBACnF,iFAAiF;oBACjF,qFAAqF;oBACrF,kBAAkB;aACrB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI;YACJ,KAAK,EACH,GAAG,aAAa,CAAC,KAAK,CAAC,sBAAsB,QAAQ,CAAC,IAAI,CAAC,wBAAwB;gBACnF,IAAI,MAAM,CAAC,SAAS,mBAAmB,MAAM,CAAC,KAAK,oCAAoC;gBACvF,kFAAkF;gBAClF,oFAAoF;gBACpF,qFAAqF;gBACrF,oDAAoD;SACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAOD;;;;;;;;;;;;;GAaG;AACH,MAAM,eAAe,GAAyB;IAC5C,uFAAuF;IACvF,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAA+B,eAAe;IAE9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC9C,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,KAAK,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT;YACE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS;YAClC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK;SACpC,EACD,uFAAuF;YACrF,wFAAwF;YACxF,kBAAkB,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,IAAI,6BAA6B,CACrC,GAAG,QAAQ,CAAC,MAAM,iDAAiD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAC7F,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,UAAU;IACxB,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC;AACJ,CAAC"}

package/dist/tenancy/org-write-guard.d.ts

@@ -0,0 +1,106 @@
+import type { EntityName, EventArgs, EventSubscriber } from '@mikro-orm/core';
+/**
+ * The tenant guard on the **write** side (D-260/A, feature 050 FR-003).
+ *
+ * `@OrgScoped()` attaches a MikroORM global filter and nothing else, and
+ * MikroORM applies a filter to `SELECT` / `UPDATE` / `DELETE` and **not to
+ * `INSERT`** (`specs/087-tenant-scope-enforcement/r1-spike.md` §4: *"A
+ * tenant-scoped INSERT with no ambient context succeeds… The fail-closed
+ * guarantee in `tenant-context.ts`'s header is a **read** guarantee."*). So a
+ * classification bought a narrowed read and bought nothing on the write side,
+ * and the two halves compose into an escalation wherever a handler diffs a
+ * narrowed read against a caller-supplied set: an id the actor cannot see reads
+ * as *absent* and is then inserted. Measured on
+ * `PUT /api/v1/admin/stripe/methods/:id`, where a `sales_representative`
+ * assigned to org A submitted `[orgA, orgB]`, was answered **200**, and created
+ * org B's deny row.
+ *
+ * This subscriber closes that at the flush boundary, for every `scope === 'org'`
+ * class at once, out of the registry the classification decorators already
+ * write. There is no new declaration for a module to make and no per-route
+ * discipline to remember — which is the whole reason it is here and not in five
+ * payment-gateway packages that leave this repository in feature 134 wave 2.
+ *
+ * ## Why the flush boundary and not the Command Bus
+ *
+ * The bus is not on the path (D-260/A, *Alternatives rejected*): `mfa`'s org
+ * policy, `webhooks`' create and `organizations`' sales-rep assignment all write
+ * without one, so a command-level assertion would cover exactly the writes that
+ * are already the most disciplined. And a refusal here is inside
+ * `em.transactional`, so the bus's single transaction rolls back **whole** — no
+ * orphan row, no audit row, no event. That is 087 §2.2's *"silent-and-complete
+ * became loud-and-partial"* answered the other way round: loud **and** complete.
+ *
+ * ## Three deliberate limits, each with its reason
+ *
+ *  1. **`scope === 'org'` only, for v1** (D-260/A, step A3).
+ *     `@TransitivelyScoped` children carry no organization column at all, so
+ *     asserting one would mean loading the parent aggregate at flush time — a
+ *     query inside a unit-of-work event, which is a different decision with a
+ *     different cost. `@CustomerScoped` classes that *do* carry
+ *     `organizationId` (`Cart` is the only one — `filters.ts:84-87`) are the
+ *     second decision, and they need their own evidence: the customer axis is
+ *     the primary key there and the organization column arrived later.
+ *  2. **A null or absent `organizationId` is not refused.** D-260/A's subject is
+ *     *"a write that **carries** a foreign organization"*; a row with no
+ *     organization carries none, so there is nothing for this predicate to
+ *     compare. Two classified classes are in that state — `ReturnCase` and
+ *     `AnalyticsEvent`, both `organizationId?: string | null` — and what a null
+ *     tenant key *means* is D-259's open question and the owner's, not this
+ *     subscriber's to answer by refusing. It is worth being explicit that this
+ *     is the permissive arm: a row written with a null organization is invisible
+ *     to every scoped reader (`orgFilterCond`'s `$in` and `=` both exclude
+ *     null), so the leak it would permit is a row nobody can read, not a row
+ *     another tenant can.
+ *  3. **`beforeCreate` and `beforeUpdate` only.** `beforeDelete` is not needed —
+ *     a `DELETE` *is* filtered, so `em.remove` reaches only rows the narrowed
+ *     read loaded. `beforeUpsert` is unsubscribed because nothing in this
+ *     repository calls `em.upsert`, and `em.nativeUpdate` fires no event at all;
+ *     both are recorded gaps rather than oversights, and both are reachable only
+ *     by code that would have to *set* an organization id by hand.
+ *
+ * ## What "no ambient context" does
+ *
+ * `isOrgInScope` delegates to `orgConstraintFor`, which raises
+ * `MissingTenantContextError` when no context is established — the same answer a
+ * *read* of the same class gets today (`filters.ts`). A write with no scope
+ * therefore fails closed for the same reason and with the same error, rather
+ * than through a second arm here that would have to decide how much of the
+ * fail-closed guarantee to keep.
+ */
+export declare class OrgWriteGuardSubscriber implements EventSubscriber<object> {
+    /**
+     * Which class names are `scope === 'org'`, recomputed when the registry grows.
+     *
+     * The registry is written by decorators at entity-import time, so its contents
+     * depend on which modules a composition loaded. Caching on its **length**
+     * keeps the lookup O(1) per write event without freezing an answer taken
+     * before the last module's entities were imported — a real risk here, because
+     * this subscriber is constructed while the ORM configuration is being built.
+     */
+    private cache;
+    private orgScopedClassNames;
+    /**
+     * The subscribed set, as classes out of the classification registry.
+     *
+     * MikroORM reads this **once**, when the `EventManager` registers the
+     * subscriber (`EventManager.registerSubscriber`), which is after the host has
+     * handed `mikroOrmConfigFrom` its entity list and therefore after every
+     * classification decorator has run.
+     *
+     * It is a narrowing for cost only, and never the guard's boundary: an empty
+     * array is how MikroORM spells *"every entity"* (`entities.size === 0` in
+     * `dispatchEvent`), so a registry this read too early would silently widen the
+     * subscription to `@GlobalEntity` classes that happen to carry an
+     * `organization_id` column — `Webhook`, `Promotion`, `MfaOrganizationPolicy`,
+     * `OrganizationSalesRepAssignment`, every one of them D-260/**B**'s territory
+     * and correctly classified. `assertInScope` therefore re-checks the class
+     * against the registry on each event, so the wide subscription is at worst
+     * wasted work and never a behaviour change.
+     */
+    getSubscribedEntities(): EntityName<object>[];
+    beforeCreate(args: EventArgs<object>): void;
+    beforeUpdate(args: EventArgs<object>): void;
+    private assertInScope;
+}
+//# sourceMappingURL=org-write-guard.d.ts.map

package/dist/tenancy/org-write-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-write-guard.d.ts","sourceRoot":"","sources":["../../src/tenancy/org-write-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAK9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,qBAAa,uBAAwB,YAAW,eAAe,CAAC,MAAM,CAAC;IACrE;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,CAA6E;IAE1F,OAAO,CAAC,mBAAmB;IAW3B;;;;;;;;;;;;;;;;;OAiBG;IACH,qBAAqB,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE;IAO7C,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI;IAI3C,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI;IAQ3C,OAAO,CAAC,aAAa;CAStB"}

package/dist/tenancy/org-write-guard.js

@@ -0,0 +1,141 @@
+import { tenantClassifications } from './org-scoped.decorator.js';
+import { isOrgInScope } from './derived-scope.js';
+import { OrgWriteOutOfScopeError } from './tenant-context.js';
+/**
+ * The tenant guard on the **write** side (D-260/A, feature 050 FR-003).
+ *
+ * `@OrgScoped()` attaches a MikroORM global filter and nothing else, and
+ * MikroORM applies a filter to `SELECT` / `UPDATE` / `DELETE` and **not to
+ * `INSERT`** (`specs/087-tenant-scope-enforcement/r1-spike.md` §4: *"A
+ * tenant-scoped INSERT with no ambient context succeeds… The fail-closed
+ * guarantee in `tenant-context.ts`'s header is a **read** guarantee."*). So a
+ * classification bought a narrowed read and bought nothing on the write side,
+ * and the two halves compose into an escalation wherever a handler diffs a
+ * narrowed read against a caller-supplied set: an id the actor cannot see reads
+ * as *absent* and is then inserted. Measured on
+ * `PUT /api/v1/admin/stripe/methods/:id`, where a `sales_representative`
+ * assigned to org A submitted `[orgA, orgB]`, was answered **200**, and created
+ * org B's deny row.
+ *
+ * This subscriber closes that at the flush boundary, for every `scope === 'org'`
+ * class at once, out of the registry the classification decorators already
+ * write. There is no new declaration for a module to make and no per-route
+ * discipline to remember — which is the whole reason it is here and not in five
+ * payment-gateway packages that leave this repository in feature 134 wave 2.
+ *
+ * ## Why the flush boundary and not the Command Bus
+ *
+ * The bus is not on the path (D-260/A, *Alternatives rejected*): `mfa`'s org
+ * policy, `webhooks`' create and `organizations`' sales-rep assignment all write
+ * without one, so a command-level assertion would cover exactly the writes that
+ * are already the most disciplined. And a refusal here is inside
+ * `em.transactional`, so the bus's single transaction rolls back **whole** — no
+ * orphan row, no audit row, no event. That is 087 §2.2's *"silent-and-complete
+ * became loud-and-partial"* answered the other way round: loud **and** complete.
+ *
+ * ## Three deliberate limits, each with its reason
+ *
+ *  1. **`scope === 'org'` only, for v1** (D-260/A, step A3).
+ *     `@TransitivelyScoped` children carry no organization column at all, so
+ *     asserting one would mean loading the parent aggregate at flush time — a
+ *     query inside a unit-of-work event, which is a different decision with a
+ *     different cost. `@CustomerScoped` classes that *do* carry
+ *     `organizationId` (`Cart` is the only one — `filters.ts:84-87`) are the
+ *     second decision, and they need their own evidence: the customer axis is
+ *     the primary key there and the organization column arrived later.
+ *  2. **A null or absent `organizationId` is not refused.** D-260/A's subject is
+ *     *"a write that **carries** a foreign organization"*; a row with no
+ *     organization carries none, so there is nothing for this predicate to
+ *     compare. Two classified classes are in that state — `ReturnCase` and
+ *     `AnalyticsEvent`, both `organizationId?: string | null` — and what a null
+ *     tenant key *means* is D-259's open question and the owner's, not this
+ *     subscriber's to answer by refusing. It is worth being explicit that this
+ *     is the permissive arm: a row written with a null organization is invisible
+ *     to every scoped reader (`orgFilterCond`'s `$in` and `=` both exclude
+ *     null), so the leak it would permit is a row nobody can read, not a row
+ *     another tenant can.
+ *  3. **`beforeCreate` and `beforeUpdate` only.** `beforeDelete` is not needed —
+ *     a `DELETE` *is* filtered, so `em.remove` reaches only rows the narrowed
+ *     read loaded. `beforeUpsert` is unsubscribed because nothing in this
+ *     repository calls `em.upsert`, and `em.nativeUpdate` fires no event at all;
+ *     both are recorded gaps rather than oversights, and both are reachable only
+ *     by code that would have to *set* an organization id by hand.
+ *
+ * ## What "no ambient context" does
+ *
+ * `isOrgInScope` delegates to `orgConstraintFor`, which raises
+ * `MissingTenantContextError` when no context is established — the same answer a
+ * *read* of the same class gets today (`filters.ts`). A write with no scope
+ * therefore fails closed for the same reason and with the same error, rather
+ * than through a second arm here that would have to decide how much of the
+ * fail-closed guarantee to keep.
+ */
+export class OrgWriteGuardSubscriber {
+    /**
+     * Which class names are `scope === 'org'`, recomputed when the registry grows.
+     *
+     * The registry is written by decorators at entity-import time, so its contents
+     * depend on which modules a composition loaded. Caching on its **length**
+     * keeps the lookup O(1) per write event without freezing an answer taken
+     * before the last module's entities were imported — a real risk here, because
+     * this subscriber is constructed while the ORM configuration is being built.
+     */
+    cache;
+    orgScopedClassNames() {
+        const rows = tenantClassifications();
+        if (!this.cache || this.cache.rows !== rows.length) {
+            this.cache = {
+                rows: rows.length,
+                names: new Set(rows.filter((meta) => meta.scope === 'org').map((meta) => meta.className)),
+            };
+        }
+        return this.cache.names;
+    }
+    /**
+     * The subscribed set, as classes out of the classification registry.
+     *
+     * MikroORM reads this **once**, when the `EventManager` registers the
+     * subscriber (`EventManager.registerSubscriber`), which is after the host has
+     * handed `mikroOrmConfigFrom` its entity list and therefore after every
+     * classification decorator has run.
+     *
+     * It is a narrowing for cost only, and never the guard's boundary: an empty
+     * array is how MikroORM spells *"every entity"* (`entities.size === 0` in
+     * `dispatchEvent`), so a registry this read too early would silently widen the
+     * subscription to `@GlobalEntity` classes that happen to carry an
+     * `organization_id` column — `Webhook`, `Promotion`, `MfaOrganizationPolicy`,
+     * `OrganizationSalesRepAssignment`, every one of them D-260/**B**'s territory
+     * and correctly classified. `assertInScope` therefore re-checks the class
+     * against the registry on each event, so the wide subscription is at worst
+     * wasted work and never a behaviour change.
+     */
+    getSubscribedEntities() {
+        const names = this.orgScopedClassNames();
+        return tenantClassifications()
+            .filter((meta) => names.has(meta.className))
+            .map((meta) => meta.target);
+    }
+    beforeCreate(args) {
+        this.assertInScope(args);
+    }
+    beforeUpdate(args) {
+        // `beforeUpdate` is what catches the **cross-organization move**: setting
+        // `organizationId = B` on a row legitimately loaded under org A. The read
+        // filter cannot see that write at all — the row was visible when it was
+        // loaded — and the changed value is on the entity by the time this runs.
+        this.assertInScope(args);
+    }
+    assertInScope(args) {
+        const entity = args.entity;
+        const className = args.meta?.className ?? entity.constructor.name;
+        if (!this.orgScopedClassNames().has(className))
+            return;
+        const organizationId = entity.organizationId;
+        if (typeof organizationId !== 'string')
+            return;
+        if (isOrgInScope(organizationId))
+            return;
+        throw new OrgWriteOutOfScopeError(className);
+    }
+}
+//# sourceMappingURL=org-write-guard.js.map

package/dist/tenancy/org-write-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-write-guard.js","sourceRoot":"","sources":["../../src/tenancy/org-write-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,OAAO,uBAAuB;IAClC;;;;;;;;OAQG;IACK,KAAK,CAA6E;IAElF,mBAAmB;QACzB,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,IAAI,CAAC,KAAK,GAAG;gBACX,IAAI,EAAE,IAAI,CAAC,MAAM;gBACjB,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;aAC1F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,qBAAqB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzC,OAAO,qBAAqB,EAAE;aAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;aAC3C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAA4B,CAAC,CAAC;IACtD,CAAC;IAED,YAAY,CAAC,IAAuB;QAClC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,YAAY,CAAC,IAAuB;QAClC,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAEO,aAAa,CAAC,IAAuB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO;QACvD,MAAM,cAAc,GAAI,MAAuC,CAAC,cAAc,CAAC;QAC/E,IAAI,OAAO,cAAc,KAAK,QAAQ;YAAE,OAAO;QAC/C,IAAI,YAAY,CAAC,cAAc,CAAC;YAAE,OAAO;QACzC,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;CACF"}