@metaobjectsdev/cli 0.21.5 → 0.22.0-rc.1

package/src/lib/load-metaobjects-config.ts

@@ -35,8 +35,10 @@ const _require = createRequire(import.meta.url);
 // @metaobjectsdev/cli is this package itself, so it resolves directly from
 // _cliDir rather than through node_modules (which would be a non-existent
 // self-referential symlink).
+const CODEGEN_TS_PKG = "@metaobjectsdev/codegen-ts";
+const TS_POET_PKG = "ts-poet";
 const CLI_PKG_PATHS: Record<string, { dist: string; src: string }> = {
-  "@metaobjectsdev/codegen-ts": {
+  [CODEGEN_TS_PKG]: {
     dist: "node_modules/@metaobjectsdev/codegen-ts/dist/index.js",
     src: "node_modules/@metaobjectsdev/codegen-ts/src/index.ts",
   },
@@ -172,6 +174,26 @@ export async function loadMetaobjectsConfig(projectRoot: string): Promise<Metaob
     aliasMap[specifier] = resolveCliPkg(specifier);
   }
 
+  // ts-poet must resolve to the SAME physical copy @metaobjectsdev/codegen-ts uses.
+  // The scaffolded (ADR-0034 owned) generators compose ts-poet Code objects with the
+  // engine's render* primitives, and ts-poet recognizes nested Code/Import
+  // placeholders by `instanceof` — when the CLI tree and the project tree hold two
+  // physical ts-poet copies (globally-installed or linked CLI + the project-local
+  // devDependency `meta init` adds), a bare project-side `import ... from "ts-poet"`
+  // splits the class identity and every cross-boundary section renders standalone
+  // with its own import header (duplicate `import { eq } from "drizzle-orm"` —
+  // TS2300 on the adopter's first tsc). Newly scaffolded templates import the
+  // combinators from @metaobjectsdev/codegen-ts directly; this alias repairs
+  // EXISTING scaffolds that still import bare "ts-poet". In a flat single-tree
+  // install the alias resolves to the copy the project would load anyway (no-op).
+  // Gated by test/gen-split-tree-single-import.test.ts.
+  const codegenTsResolved = aliasMap[CODEGEN_TS_PKG];
+  if (codegenTsResolved !== undefined) {
+    try {
+      aliasMap[TS_POET_PKG] = createRequire(codegenTsResolved).resolve(TS_POET_PKG);
+    } catch { /* no ts-poet adjacent to codegen-ts — leave project resolution in place */ }
+  }
+
   // Pre-process the config file content to rewrite @metaobjectsdev/* import
   // specifiers to resolved absolute paths. This is the primary mechanism that
   // ensures the CLI's own copies are used: jiti's `alias` map is kept below as

package/src/lib/requirement-check.ts

@@ -0,0 +1,272 @@
+// `meta verify` — the requirement (capability) gate.
+//
+// Requirements are METADATA: `requirement.functional` / `requirement.architectural`
+// are registered metamodel types, declared in `metaobjects/` beside the entities
+// they describe. So this file parses NOTHING. It reads `requirement.*` nodes off
+// the already-loaded model and checks the things the loader cannot.
+//
+// Division of labour, and the reason for it:
+//
+//   LOADER (unconditional)   the `@status` enum via `allowedValues`, required
+//                            attrs, child rules, levels being integers.
+//   VERIFY  (conditional)    `@implementedBy` resolution, whose SEVERITY DEPENDS
+//                            ON `@status`. A loader `references` descriptor
+//                            always errors on an unresolved target, and an
+//                            `abandoned` requirement exists precisely to name
+//                            nodes that are gone — declaring it there would make
+//                            the entries carrying the mechanism's only controlled
+//                            evidence fail to load.
+//
+// Two kinds, opposite checks: `functional` fails when NOTHING implements it;
+// `architectural` fails when something VIOLATES it (v1: an empty claim set on a
+// live policy — claim-set arithmetic, deliberately not a predicate DSL).
+
+import {
+  TYPE_OBJECT,
+  TYPE_REQUIREMENT,
+  OBJECT_SUBTYPE_ENTITY,
+  PACKAGE_SEPARATOR,
+  REQUIREMENT_SUBTYPE_ARCHITECTURAL,
+  REQUIREMENT_LINK_FLOOR_LEVEL,
+  REQUIREMENT_MIN_LEVEL,
+  REQUIREMENT_MAX_LEVEL,
+  REQUIREMENT_LEVEL_MEMBER,
+  REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES,
+  resolveObjectRef,
+  didYouMeanHint,
+  type MetaData,
+  type MetaRequirement,
+  type RequirementStatus,
+} from "@metaobjectsdev/metadata";
+
+export type Severity = "error" | "warn";
+
+export interface Diagnostic {
+  severity: Severity;
+  code: string;
+  /** The requirement node's name, when the diagnostic belongs to one. */
+  name?: string;
+  message: string;
+}
+
+export const ERR_REQUIREMENT_LINK_ABOVE_FLOOR = "ERR_REQUIREMENT_LINK_ABOVE_FLOOR";
+export const ERR_REQUIREMENT_DANGLING_REF = "ERR_REQUIREMENT_DANGLING_REF";
+export const ERR_REQUIREMENT_BAD_LEVEL = "ERR_REQUIREMENT_BAD_LEVEL";
+export const ERR_REQUIREMENT_LEVEL_NESTING = "ERR_REQUIREMENT_LEVEL_NESTING";
+export const ERR_REQUIREMENT_L4_NOT_OBJECT = "ERR_REQUIREMENT_L4_NOT_OBJECT";
+export const ERR_REQUIREMENT_L5_NOT_MEMBER = "ERR_REQUIREMENT_L5_NOT_MEMBER";
+export const ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS = "ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS";
+export const WARN_REQUIREMENT_OBJECT_UNCLAIMED = "WARN_REQUIREMENT_OBJECT_UNCLAIMED";
+
+/** Severity of the object-coverage gate. Promotion to `"error"` is a one-line
+ *  flip here, which activates an already-written test rather than requiring new
+ *  authoring under release pressure.
+ *
+ *  It stays `"warn"`, and the reason is measured rather than cautious:
+ *
+ *  - On a real 120-file estate carrying a SINGLE requirement, this gate reports
+ *    93 unclaimed entities — every entity in the repository. At `"error"` a
+ *    project adopting requirements incrementally fails its first `verify` after
+ *    authoring one entry, which teaches people to delete the entry.
+ *  - The gate is satisfiable without being informative: `claimedObjects` below
+ *    counts a claim from any requirement at any level and any status, so
+ *    appending an FQN to an existing list clears it. Green proves an entity is
+ *    NAMED, never that it is understood.
+ *  - The experiment meant to settle whether forcing it yields real entries or
+ *    padding stopped at its ceiling probe: at `"warn"` agents already authored
+ *    proper L3/L4/L5 entries for what they added, so the arms could not differ.
+ *    That is not evidence promotion is useless — it is evidence that instrument
+ *    cannot see it.
+ *
+ *  spec/design-docs/2026-08-11-prereg-duplication-and-levels.md, "Round E result". */
+export const OBJECT_COVERAGE_SEVERITY: Severity = "warn";
+
+/**
+ * Split a member reference into its owning object ref and the dotted member path.
+ * `::` qualifies the ROOT-level node only, so the object ref ends at the FIRST
+ * `.` after the last `::`.
+ * `acme::sales::Order.total.display` -> `["acme::sales::Order", ["total","display"]]`
+ */
+export function splitMemberRef(ref: string): { owner: string; path: string[] } {
+  const pkgEnd = ref.lastIndexOf(PACKAGE_SEPARATOR);
+  const from = pkgEnd === -1 ? 0 : pkgEnd + PACKAGE_SEPARATOR.length;
+  const dot = ref.indexOf(".", from);
+  if (dot === -1) return { owner: ref, path: [] };
+  return { owner: ref.slice(0, dot), path: ref.slice(dot + 1).split(".") };
+}
+
+/** Walk dotted member segments by CHILD NAME from an object node. */
+function resolveMember(obj: MetaData, path: string[]): MetaData | undefined {
+  let cur: MetaData | undefined = obj;
+  for (const seg of path) {
+    if (cur === undefined) return undefined;
+    cur = cur.children().find((c) => c.name === seg);
+  }
+  return cur;
+}
+
+/** Every `requirement.*` node in the tree, at any nesting depth. Hierarchy IS
+ *  nesting — an L1 solution contains its L2 segments — so this is a walk, not a
+ *  scan of a flat list keyed by a `parent` string. */
+export function collectRequirements(root: MetaData): MetaRequirement[] {
+  const out: MetaRequirement[] = [];
+  const walk = (n: MetaData): void => {
+    for (const c of n.children()) {
+      if (c.type === TYPE_REQUIREMENT) out.push(c as MetaRequirement);
+      walk(c);
+    }
+  };
+  walk(root);
+  return out;
+}
+
+/**
+ * Check the requirement tree against the loaded model.
+ *
+ * What a clean run proves: referential integrity — links sit at or below the
+ * link floor, nesting agrees with levels, and references resolve. What it CANNOT
+ * prove: that a status is *true*, or that a node actually implements the
+ * requirement claiming it. No test can. That truth is the adopter's job.
+ */
+export function checkRequirements(root: MetaData): Diagnostic[] {
+  const out: Diagnostic[] = [];
+  const reqs = collectRequirements(root);
+  if (reqs.length === 0) return out; // opt-in by declaration — no requirements, nothing to say
+
+  const claimedObjects = new Set<string>();
+
+  for (const req of reqs) {
+    const architectural = req.subType === REQUIREMENT_SUBTYPE_ARCHITECTURAL;
+    const level = req.level();
+    const refs = req.implementedBy();
+
+    if (!architectural) {
+      if (level === undefined || !Number.isInteger(level)
+          || level < REQUIREMENT_MIN_LEVEL || level > REQUIREMENT_MAX_LEVEL) {
+        out.push({
+          severity: "error", code: ERR_REQUIREMENT_BAD_LEVEL, name: req.name,
+          message: `level must be an integer ${REQUIREMENT_MIN_LEVEL}-${REQUIREMENT_MAX_LEVEL} (got ${String(level)}). ` +
+            `L1 solution, L2 segment (app/library), L3 service, L4 object, L5 member.`,
+        });
+      }
+      // Nesting IS the hierarchy, so a child must sit strictly below its parent.
+      const parent = req.parent;
+      if (parent !== undefined && parent.type === TYPE_REQUIREMENT) {
+        const pl = (parent as MetaRequirement).level();
+        if (pl !== undefined && level !== undefined && level <= pl) {
+          out.push({
+            severity: "error", code: ERR_REQUIREMENT_LEVEL_NESTING, name: req.name,
+            message: `nested under "${parent.name}" (level ${pl}) but declares level ${level}. ` +
+              `Nesting is the hierarchy — a child sits strictly below its parent.`,
+          });
+        }
+      }
+    }
+
+    // -- the link boundary ----------------------------------------------------
+    if (refs.length > 0 && !req.mayReferenceModel()) {
+      out.push({
+        severity: "error", code: ERR_REQUIREMENT_LINK_ABOVE_FLOOR, name: req.name,
+        message: `'implementedBy' is legal at L${REQUIREMENT_LINK_FLOOR_LEVEL} (object) and ` +
+          `L${REQUIREMENT_MAX_LEVEL} (member) only. L1-L3 are organisational and never reference ` +
+          `the model — move the links to a nested L${REQUIREMENT_LINK_FLOOR_LEVEL} child.`,
+      });
+      continue;
+    }
+
+    for (const ref of refs) {
+      const { owner, path } = splitMemberRef(ref);
+      // referrerPkg is the requirement's own effective package, so a bare ref
+      // binds package-locally under the ADR-0042 contract — the loader's own
+      // resolver, never a parallel name scan (#228).
+      const referrerPkg = req.package ?? req.fileDefaultPackage ?? "";
+      const { node } = resolveObjectRef(root, owner, referrerPkg);
+      const isObjectRef = path.length === 0;
+
+      if (node !== undefined && (isObjectRef || resolveMember(node, path) !== undefined)) {
+        claimedObjects.add(node.resolutionKey());
+      }
+
+      if (!architectural && level === REQUIREMENT_LINK_FLOOR_LEVEL && !isObjectRef) {
+        out.push({
+          severity: "error", code: ERR_REQUIREMENT_L4_NOT_OBJECT, name: req.name,
+          message: `L${REQUIREMENT_LINK_FLOOR_LEVEL} references an object; '${ref}' names a member. ` +
+            `Move it to a nested L${REQUIREMENT_LEVEL_MEMBER} child, or reference the object itself.`,
+        });
+        continue;
+      }
+      if (!architectural && level === REQUIREMENT_LEVEL_MEMBER && isObjectRef) {
+        out.push({
+          severity: "error", code: ERR_REQUIREMENT_L5_NOT_MEMBER, name: req.name,
+          message: `L${REQUIREMENT_LEVEL_MEMBER} references a member (field, view or identity); ` +
+            `'${ref}' names an object. Move it to its L${REQUIREMENT_LINK_FLOOR_LEVEL} parent.`,
+        });
+        continue;
+      }
+
+      const resolved = node !== undefined && (isObjectRef || resolveMember(node, path) !== undefined);
+      if (!resolved) {
+        // Severity is CONDITIONAL ON STATUS, and the asymmetry inverts as a pair.
+        // On abandoned/superseded the nodes are SUPPOSED to be gone — that is the
+        // entry doing its job, and the reason this check cannot live in the loader.
+        if (req.requiresLiveNodes()) {
+          out.push({
+            severity: "error", code: ERR_REQUIREMENT_DANGLING_REF, name: req.name,
+            message: `'${ref}' does not resolve in the loaded model (status '${String(req.status())}' — ` +
+              `the model moved and the requirement is stale).` + didYouMeanHint(root, owner),
+          });
+        }
+      }
+    }
+
+    // -- architectural universality, v1: claim-set arithmetic -----------------
+    // A live policy claimed by nothing is the audited-base case: declared and
+    // applied to nothing. Deliberately NOT a violation-predicate DSL — that
+    // would be the registration this design already argued its way to, arriving
+    // a second time through the back door.
+    const status = req.status();
+    const live = status !== undefined
+      && REQUIREMENT_STATUSES_REQUIRING_LIVE_NODES.includes(status as RequirementStatus);
+    if (architectural && live && refs.length === 0) {
+      out.push({
+        severity: "error", code: ERR_REQUIREMENT_ARCH_NO_IMPLEMENTERS, name: req.name,
+        message: `architectural requirement is '${String(status)}' but nothing implements it. ` +
+          `Its check is universality — a claim set of zero means the policy is declared and unapplied.`,
+      });
+    }
+  }
+
+  // -- object coverage: adding an entity forces a requirement -----------------
+  // Binary per entity, never a ratio: a "% claimed" number measures what the
+  // schema can express, is biased against the hardest rules, and invites
+  // optimising the number.
+  //
+  // SCOPE, stated because it is a decision and not an oversight:
+  //
+  //   ENTITIES ONLY. `object.value` and `object.projection` are exempt. A value is a
+  //   shape (a DTO, a payload, a message) and a projection is DERIVED from an entity
+  //   that is itself claimable — requiring both to carry their own capability claim
+  //   would multiply entries without adding information.
+  //
+  //   OBJECT GRAIN ONLY. Fields, views, validators and identities are never required
+  //   to be claimed. Member-grain coverage is the "thousands of meaningless links"
+  //   failure `spec/capability-ledger.md` argues against: plumbing members are covered
+  //   by ARCHITECTURAL requirements with high fan-out (one uuid-PK rule claims every
+  //   entity), not by a per-member entry. L5 exists so a claim about a specific member
+  //   CAN be made when it carries real meaning — never so that every member must.
+  //
+  // So a green run means "every entity is claimed by something", not "every node is
+  // described". The stronger reading would be false.
+  for (const ent of root.children()) {
+    if (ent.type !== TYPE_OBJECT || ent.subType !== OBJECT_SUBTYPE_ENTITY) continue;
+    const key = ent.resolutionKey();
+    if (!claimedObjects.has(key)) {
+      out.push({
+        severity: OBJECT_COVERAGE_SEVERITY, code: WARN_REQUIREMENT_OBJECT_UNCLAIMED,
+        message: `no requirement claims '${key}'. Add it to an L${REQUIREMENT_LINK_FLOOR_LEVEL} requirement's 'implementedBy'.`,
+      });
+    }
+  }
+
+  return out;
+}

package/src/lib/verified-by-scan.ts

@@ -0,0 +1,190 @@
+// `meta verify` — the `@verifiedBy` check.
+//
+// A requirement's `@verifiedBy` names the tests that prove the behaviour. verify
+// checks each name EXISTS and is NOT SKIPPED; it never runs them. Running them is
+// the test runner's job, and a requirement gate that shelled out to one would be
+// slow, ecosystem-specific, and wrong in CI.
+//
+// Until this existed, `@verifiedBy` was registered vocabulary that nothing read —
+// the precise pattern ADR-0007 Amendment 2 and the `@role` shrink exist to punish.
+// An attribute the loader accepts and no consumer dispatches on teaches authors
+// that declaring is free and means nothing.
+//
+// PRECISION OVER RECALL, deliberately. The scan matches a name anywhere in the
+// test corpus, as a whole word, in any language. That is the most generous
+// possible reading, so a "missing" verdict means the name appears in NO test file
+// at all — which is a broken claim in any ecosystem. The repo's standing rule for
+// drift checks is to bias toward under-flagging, and a nagging gate gets disabled,
+// which costs more than the misses.
+//
+// FAIL-OPEN ON INABILITY. If the project has no test files this scan can see, it
+// says NOTHING rather than reporting every name missing. Absence of evidence is
+// not evidence of absence, and a monorepo whose tests live outside `--cwd` must
+// not be told its requirements are unverified.
+
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import {
+  TYPE_REQUIREMENT,
+  type MetaData,
+  type MetaRequirement,
+} from "@metaobjectsdev/metadata";
+
+export const ERR_REQUIREMENT_TEST_MISSING = "ERR_REQUIREMENT_TEST_MISSING";
+export const WARN_REQUIREMENT_TEST_SKIPPED = "WARN_REQUIREMENT_TEST_SKIPPED";
+
+export interface VerifiedByDiagnostic {
+  severity: "error" | "warn";
+  code: string;
+  name?: string;
+  message: string;
+}
+
+const IGNORE_SEGMENTS = new Set([
+  "node_modules", ".git", "dist", "build", "out", ".next", "coverage",
+  ".metaobjects", "generated", "target", "bin", "obj", "__pycache__", ".venv", "venv",
+]);
+
+/** Test files across the five ecosystems this project ports to. */
+const TEST_FILE = new RegExp(
+  [
+    "\\.(?:test|spec)\\.[cm]?[jt]sx?$", // bun / jest / vitest / mocha
+    "(?:^|[./_-])[Tt]est[^/]*\\.java$", // JUnit — TestFoo.java
+    "[A-Za-z0-9]Test(?:s)?\\.java$", //     JUnit — FooTest.java / FooTests.java
+    "[A-Za-z0-9]Tests?\\.cs$", //           xUnit / NUnit
+    "^test_[^/]*\\.py$", //                 pytest
+    "[^/]*_test\\.py$", //                  pytest, trailing convention
+    "[A-Za-z0-9]Test(?:s)?\\.kt$", //       Kotlin
+  ].join("|"),
+);
+
+/** Markers that a test exists but is disabled, across the same ecosystems. */
+const SKIP_MARKER = new RegExp(
+  [
+    "\\b(?:it|test|describe)\\.(?:skip|todo)\\b", // jest/vitest/bun
+    "\\bx(?:it|test|describe)\\b", //               mocha/jasmine
+    "@Disabled\\b", //                              JUnit 5
+    "@Ignore\\b", //                                JUnit 4 / Kotlin
+    "@pytest\\.mark\\.skip", //                     pytest
+    "\\[Ignore[\\](]", //                           MSTest / NUnit
+    "\\bSkip\\s*=", //                              xUnit  [Fact(Skip = "...")]
+  ].join("|"),
+);
+
+interface TestCorpus {
+  files: number;
+  /** rel path -> lines, kept so a skip marker can be located near the name. */
+  byFile: Map<string, string[]>;
+}
+
+function walk(dir: string, root: string, acc: TestCorpus, depth = 0): void {
+  if (depth > 12) return; // pathological trees; the scan is advisory, not exhaustive
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (e.isDirectory()) {
+      if (IGNORE_SEGMENTS.has(e.name) || e.name.startsWith(".")) continue;
+      walk(join(dir, e.name), root, acc, depth + 1);
+      continue;
+    }
+    if (!e.isFile() || !TEST_FILE.test(e.name)) continue;
+    const abs = join(dir, e.name);
+    try {
+      if (statSync(abs).size > 512 * 1024) continue;
+      acc.byFile.set(relative(root, abs).split(sep).join("/"), readFileSync(abs, "utf8").split("\n"));
+      acc.files++;
+    } catch {
+      /* unreadable file is not a finding */
+    }
+  }
+}
+
+/** Every `requirement.*` node in the tree, at any nesting depth. */
+function collect(root: MetaData): MetaRequirement[] {
+  const out: MetaRequirement[] = [];
+  const rec = (n: MetaData): void => {
+    for (const c of n.children()) {
+      if (c.type === TYPE_REQUIREMENT) out.push(c as MetaRequirement);
+      rec(c);
+    }
+  };
+  rec(root);
+  return out;
+}
+
+/**
+ * A whole-word match, so `OrderServiceTest` never satisfies a claim naming `Order`.
+ *
+ * `_` counts as a SEPARATOR, not a word character: pytest's `def test_OrderServiceTest`
+ * plainly is the test a claim naming `OrderServiceTest` means, and refusing it would
+ * emit the confident false error this scan is built to avoid. Camel-case boundaries
+ * stay strict, which is what actually prevents a short name matching a longer one.
+ */
+function wordRx(name: string): RegExp {
+  return new RegExp(`(?:^|[^A-Za-z0-9])${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9])`);
+}
+
+/**
+ * Check every `@verifiedBy` name against the project's test corpus.
+ *
+ * Severity mirrors `@implementedBy`: a broken claim is an ERROR on `live`/`partial`
+ * and silent on `abandoned`/`superseded`, because a retired requirement naming a
+ * deleted test is the entry doing its job, not drift.
+ */
+export function checkVerifiedBy(root: MetaData, cwd: string): VerifiedByDiagnostic[] {
+  const reqs = collect(root).filter((r) => r.verifiedBy().length > 0);
+  if (reqs.length === 0) return []; // opt-in by declaration
+
+  const corpus: TestCorpus = { files: 0, byFile: new Map() };
+  walk(cwd, cwd, corpus);
+  if (corpus.files === 0) return []; // fail open: nothing to judge against
+
+  const out: VerifiedByDiagnostic[] = [];
+  for (const req of reqs) {
+    for (const test of req.verifiedBy()) {
+      const rx = wordRx(test);
+      let foundIn: string | undefined;
+      let skippedAt: string | undefined;
+      for (const [file, lines] of corpus.byFile) {
+        for (let i = 0; i < lines.length; i++) {
+          if (!rx.test(lines[i] ?? "")) continue;
+          foundIn ??= file;
+          // a decorator/annotation sits above the declaration it disables
+          const window = lines.slice(Math.max(0, i - 3), i + 1).join("\n");
+          if (SKIP_MARKER.test(window)) skippedAt ??= `${file}:${i + 1}`;
+        }
+        if (foundIn !== undefined && skippedAt !== undefined) break;
+      }
+
+      if (foundIn === undefined) {
+        if (req.requiresLiveNodes()) {
+          out.push({
+            severity: "error",
+            code: ERR_REQUIREMENT_TEST_MISSING,
+            name: req.name,
+            message:
+              `'verifiedBy' names '${test}', which appears in none of the ` +
+              `${corpus.files} test file(s) found under this project. Either the test was ` +
+              `renamed or removed, or the claim was never true.`,
+          });
+        }
+        continue;
+      }
+      if (skippedAt !== undefined) {
+        out.push({
+          severity: "warn",
+          code: WARN_REQUIREMENT_TEST_SKIPPED,
+          name: req.name,
+          message:
+            `'verifiedBy' names '${test}', but it is disabled at ${skippedAt}. ` +
+            `A skipped test proves nothing — the requirement reads as verified and is not.`,
+        });
+      }
+    }
+  }
+  return out;
+}