@connextar/house 0.9.0 → 0.11.0

package/README.md

@@ -60,6 +60,15 @@ is one right answer to that — which is exactly the shape of thing that belongs
 here and nowhere else. The module is the union of the five, not a copy of the
 best one.
 
+`jobs`, in 0.11.0, is the same case with two copies. AltEd and Quickie grew
+their scheduled jobs from one seed and each proved something the other lacked —
+AltEd a switch with a name and a date against it, Quickie a Run now fenced to the
+caller's own organisation — and both printed a job's result as its variable
+names, so production read "0 chargesRaised · 0 totalOutstanding", with an amount
+of money shown as a number of things. The module is their union, with that
+made impossible rather than fixed: a count reaches the screen only through a
+declaration that says its words and its kind.
+
 ## Modules
 
 ### `@connextar/house/errors`
@@ -712,11 +721,462 @@ rate was checked. **Where rates are kept is the app's decision**: AltEd and
 PharmaLine keep a dated table an operator can correct; a smaller app can price
 straight from the defaults. An unknown model is unpriced (`null`), never free.
 
+**In the browser, import `@connextar/house/ai/config`.** `/ai` carries both
+SDKs, which no client bundle should. `/ai/config` is everything that never calls
+a provider — `PROVIDER_LABELS` and the other provider names, the job-table and
+status types, `AI_IMAGE_TYPES` / `isAiImageType`, and the pricing arithmetic
+and defaults — and imports no package at all (a test follows the emitted
+imports to hold it to that). `/ai` re-exports all of it, so server code needs
+only the one import:
+
+```tsx
+"use client";
+import { PROVIDER_LABELS, isAiImageType } from "@connextar/house/ai/config";
+```
+
 `@anthropic-ai/sdk`, `openai` and `zod` are optional peer dependencies — only an
-app that imports `/ai` needs them. The SDKs refuse to run in a browser-like
+app that imports `/ai` needs them; `/ai/config` needs none. The SDKs refuse to run in a browser-like
 environment, so a Vitest suite that calls the harness needs
 `// @vitest-environment node` on the file.
 
+### `@connextar/house/jobs`, `/jobs/react`
+
+Scheduled jobs: declared once, run once per window, switched off and on by
+name, and honest about their health. `/jobs` is server code — the registry, the
+dispatcher, Run now, the switch, health, the words for counts and the tick
+route's secret check. `/jobs/react` is the health screen's list, and re-exports
+the wording and types a client component needs, so nothing in the browser ever
+imports `/jobs` (which reaches `node:crypto`; `src/jobs/entry-points.test.ts`
+holds both sides of that line against the built output).
+
+AltEd and Quickie each had this, from one seed. What each proved, and what each
+got wrong:
+
+| Concern                 | AltEd                                                                                        | Quickie                                                                                             | Here                                                                                                    |
+| ----------------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
+| Registry                | `JobSpec`: name, label, `when` in words, scope, `maxAgeMs`, `attempt` + `windowKey`, `run`   | The same, without `when`                                                                            | `defineJob`: id, label, cadence, one `window`, threshold, timeout, switchable, Run now rule, counts     |
+| Window and idempotency  | Unique `(job, windowKey)` claim; tracker keyed on the UK date after a twice-sent day         | The same claim; hour, day, six-hour and month keys                                                  | The same claim, one function instead of two; calendar helpers take a time zone and keep both apps' keys |
+| Missed window           | Weekly digest only on Monday — a failed Monday loses the week                                | Monthly report only on the 1st — a failed 1st loses the month                                       | `weekly` and `monthly` stay open (after `from` each day) until the period ends                          |
+| One job failing         | Isolated — but a failed claim or ledger write threw out of the loop                          | The same                                                                                            | Isolated, store failures included; each job's result says what happened                                 |
+| Ledger                  | `CronRun`: job, window, start, finish, ok, counts, error                                     | Identical table                                                                                     | The same eight columns plus `tenant_id` and `triggered_by`; the app owns it behind `JobStore`           |
+| Health states           | Paused · Never run · Errored · Stale · Healthy                                               | Never run · Errored · Stale · Healthy                                                               | Paused · Never run · **Running** · Failed · Stale · Healthy — derived, never stored                     |
+| A run in progress       | Shown as **Errored** (`ok` is false until it finishes); one cut off stays so, with no reason | The same                                                                                            | Running inside its timeout; past it, Failed — "never finished, probably cut off"                        |
+| Staleness               | Last OK older than `maxAgeMs` (strictly)                                                     | The same — and a tenant's Run now reset it for everyone                                             | Last successful _whole_ run older than the threshold; healthy exactly at it                             |
+| Pause / resume          | Per job, who and when, audited; harvest's switch shared with its own screen                  | None                                                                                                | Per job, who and when; platform authority; audit in the adapter's transaction; tick says it skipped     |
+| Run now                 | `runJobNow` exists but has no caller, and every job is `global`, so it would refuse them all | Owner-only, scoped to the caller's organisation; no cool-down, and `force` skips reminder throttles | `tenant` or `platform` scope, refused outside it, while paused, while running, and within a cool-down   |
+| Jobs on their own clock | Harvest (10 min) and imports (1 min): switchable, but record no runs, so no health           | —                                                                                                   | `schedule: "own"` + `runOwn`: the switch and the ledger, with or without a window                       |
+| Errors                  | Message stored; shown to administrators                                                      | Message stored; shown to **every** organisation's owner, whoever's data it came from                | Message stored; a tenant viewer sees whether a sweep failed, not its words or its numbers               |
+| `CRON_SECRET`           | Bearer or `?secret=`; `timingSafeEqual` after a length check                                 | Bearer (prefix optional) or `?secret=`; SHA-256 digests; dev secret refused in production           | Bearer required; digests; dev secret refused; `?secret=` only when a route asks                         |
+| Counts                  | `Record<string, number>` printed as keys; `totalOutstanding` is pounds shown as a count      | The same, in the card and the Run now toast ("3 remindersSent")                                     | Declared: words (singular and plural) and a kind — count, money (currency and unit) or duration         |
+| Legacy routes           | —                                                                                            | Three per-job routes still live, bypassing the ledger; `?force=1` sweeps every tenant               | One tick route; nothing else runs a tick job                                                            |
+
+**Declaring the jobs** — once, beside the store adapter, server-only:
+
+```ts
+// lib/jobs/index.ts
+import "server-only";
+import { createScheduler, daily, defineJob, defineJobs, hourly } from "@connextar/house/jobs";
+
+import { jobStore } from "./store";
+
+const HOUR = 60 * 60 * 1000;
+
+export const jobs = defineJobs([
+  defineJob({
+    id: "billing-housekeeping", // stored: never rename one
+    label: "Billing & payment reminders",
+    cadence: "Daily",
+    window: daily(),
+    staleAfterMs: 26 * HOUR,
+    counts: {
+      chargesRaised: { label: { one: "charge raised", other: "charges raised" } },
+      sent: { label: { one: "family reminded", other: "families reminded" } },
+      skipped: { label: "already reminded this week" },
+      totalOutstanding: { label: "outstanding", kind: "money", currency: "GBP", unit: "major" },
+    },
+    run: async ({ now }) => {
+      const { charged } = await rollUpCharges(now);
+      return { chargesRaised: charged, ...(await sendPaymentReminders(now)) };
+    },
+  }),
+  defineJob({
+    id: "payment-reminders",
+    label: "Payment reminders",
+    cadence: "Daily, from 09:00",
+    window: daily({ from: 9 }),
+    staleAfterMs: 26 * HOUR,
+    runNow: { scope: "tenant" }, // an owner sweeps their own organisation, and nobody else's
+    counts: { remindersSent: { label: { one: "reminder sent", other: "reminders sent" } } },
+    // `tenantId` is null for the schedule's sweep and always set for an owner's Run now.
+    run: async ({ now, tenantId }) => {
+      const { remindersSent } = await sendPaymentReminders(now, { organizationId: tenantId ?? undefined });
+      return { remindersSent };
+    },
+  }),
+  defineJob({
+    id: "harvest",
+    label: "Harvest",
+    cadence: "Every 10 minutes",
+    schedule: "own", // its own route and clock; the tick never runs it
+    staleAfterMs: HOUR,
+    counts: { sites: { label: { one: "site read", other: "sites read" } } },
+    run: async () => ({ sites: (await runHarvest({ budgetMs: 150_000, maxSites: 4 })).sites.length }),
+  }),
+]);
+
+export const scheduler = createScheduler({ jobs, store: jobStore });
+```
+
+`defineJobs` checks the list when the module loads and throws every problem at
+once (`jobDefinitionProblems` returns them as sentences, for a test). `defineJob`
+holds `run` to its counts at compile time: every declared count must be
+reported, and nothing undeclared may be. At run time an undeclared key is dropped
+before it is stored, and one in an old row is not shown — there is no fallback
+that could print a variable name.
+
+**The routes** — each app answers in its own envelope; the module returns
+decisions, not `Response`s:
+
+```ts
+// app/api/cron/tick/route.ts — the one entry in vercel.json's crons
+export async function GET(request: Request) {
+  const auth = checkCronRequest(request, { publicSecrets: ["dev-cron-secret"] });
+  if (!auth.ok) return apiError(auth.message, auth.status);
+  const results = await scheduler.tick();
+  return apiSuccess({ results }, summariseTick(results)); // "2 ran, 1 failed, 1 paused, 5 not due"
+}
+
+// app/api/cron/harvest/route.ts — a job on its own clock
+const result = await scheduler.runOwn("harvest");
+
+// app/api/cron/run/route.ts — Run now, behind the session
+const outcome = await scheduler.runNow(body.job, {
+  actor: { id: user.id, name: user.name },
+  platform: user.platformAdmin,
+  tenantId: user.organizationId,
+});
+if (outcome.status === "refused") return apiError(outcome.message, refusalStatus(outcome.reason));
+if (outcome.status === "failed") return apiError(outcome.message, 500);
+return apiSuccess(outcome, outcome.message); // "Ran Payment reminders — 3 reminders sent."
+
+// app/api/admin/cron/route.ts — the switch
+const outcome = await scheduler.setPaused(body.job, body.action === "pause", {
+  actor: { id: admin.id, name: admin.name },
+  platform: true,
+});
+if (outcome.status === "refused") return apiError(outcome.message, refusalStatus(outcome.reason));
+return apiSuccess(outcome, outcome.message);
+```
+
+**The screen** — the server works out the view for whoever is looking; the list
+draws it inside the app's own card:
+
+```tsx
+// app/dashboard/settings/page.tsx (server)
+const jobs = await scheduler.views({ platform: isAdmin, tenantId: user.organizationId });
+
+// components/settings/automation-card.tsx
+("use client");
+import { JobHealthList } from "@connextar/house/jobs/react";
+
+<JobHealthList
+  jobs={jobs}
+  onSwitch={async (job, on) => {
+    await commitApi("/api/admin/cron", { job, action: on ? "resume" : "pause" });
+  }}
+  onRunNow={(job) => commitApi("/api/cron/run", { job })}
+  onSettled={router.refresh}
+  extra={(job) => (job.id === "harvest" ? <Link href={routes.harvest}>What it searches next</Link> : null)}
+/>;
+```
+
+`onSwitch` and `onRunNow` throw to refuse — the ux layer's one failure
+contract. The switch is `useOptimisticValue`: it moves on the click, the badge
+moves with it (to the job's health as if on, which the view carries), and a
+refusal puts both back and reports the reason through the
+`ActionFeedbackProvider`. No other row is disabled while one saves. Run now is
+`useKeyedAction`: that row's button is busy (`data-busy`), the route's message is
+said, and the screen refreshes whether the run worked or not, since a failure is
+on the ledger too. Dates are drawn in `timeZone` (default `Europe/London`),
+never the runtime's own — the server draws the list in UTC and the browser
+again in BST, and two times in one element is a hydration error. `classNames`
+replaces any part's look.
+
+The rules it keeps:
+
+- **One run per job per window.** The window is `(now) => key | null`; the
+  store's unique index on `(job, windowKey)` is the idempotency. A second tick
+  in the window finds the key taken and says `already-ran`. `hourly`,
+  `everyHours`, `daily`, `weekly` and `monthly` produce the keys both apps
+  already store, so moving onto them runs nothing twice.
+- **One failure stops nothing else.** A job that throws, a store that cannot
+  claim, a window function with a bug — each is that job's `failed` result and
+  its error on the ledger, and the next job runs. A run whose result could not
+  be written says so rather than calling the work failed.
+- **A paused job's tick skips it and says so** ("switched off by AltEd Admin on
+  29 Sept 2026; not started"). Its window is not claimed, so switched back on
+  inside the same window it still runs. If the switches cannot be read at all, no
+  switchable job starts: a switch nobody can read must not send a job out
+  spending. `pausedFromStored` reads a stored value AltEd's way — a row that
+  exists but does not parse is _paused_.
+- **Switching takes platform authority** — it stops a job for every tenant — and
+  records who and when. `JobStore.writeSwitch` is where the audit entry goes,
+  in the same transaction as the switch. A switch to where it already is writes
+  nothing.
+- **Health is derived, in this order:** paused · never run · running · failed ·
+  stale · healthy. A run past its timeout (default 15 minutes) and still
+  unfinished is failed, and says it never finished. Stale means no successful
+  run over every tenant for longer than the threshold — exactly at the threshold
+  is still healthy — and a job with `staleAfterMs: null` (one that runs only
+  when there is work) is never stale.
+- **Run now is scoped and fenced.** `tenant` sweeps the caller's own tenant and
+  needs one; `platform` sweeps everything and needs platform authority. It is
+  refused while the job is off, while a run it would overlap is in flight (the
+  schedule's sweep covers the caller's tenant too), and within its cool-down
+  (default ten minutes, per job and scope) — a manual run sets `force`, so a
+  second press would otherwise send the whole batch again. `force` is for a
+  job's hour gates; a per-recipient throttle should stay on.
+- **A tenant sees their own.** To a tenant viewer, a sweep over every tenant
+  shows whether it ran and when, but not its numbers (which are everyone's) or
+  its error (which may name another organisation's data). Their own Run now
+  shows in full. Other tenants' runs never appear, and none of them resets the
+  job's staleness.
+- **Every count is declared.** A label (the words after the number; singular and
+  plural where they differ) and a kind: `count`, `money` (a currency _and_ a
+  unit — `major` for AltEd's pounds, `minor` for pence — because a default would
+  be out by a hundred for one of them), or `duration`. Money is formatted by
+  `Intl` in its currency, which also rounds away a summed decimal's float noise.
+- **The tick's door** (`checkCronRequest`): an unset `CRON_SECRET` refuses with
+  503; the secret is compared as SHA-256 digests with `timingSafeEqual`; the
+  Bearer scheme is required; `publicSecrets` (the committed development value)
+  are refused in production; `?secret=` is accepted only with
+  `allowQuery: true`, because an address lands in request logs.
+
+**Storage.** The package owns no schema. The app implements `JobStore` — claim,
+finish, latest run, read switches, write a switch — over its own tables. This is
+the reference model; both apps' existing `cron_run` tables are it minus two
+nullable columns, so every row they hold maps across as it is:
+
+```prisma
+/// One row per job per window: the claim that makes a second tick skip, and the result.
+model CronRun {
+  id          String    @id @default(cuid())
+  job         String    @db.VarChar(60)
+  /// The window, e.g. "2026-09-30", or "manual:tenant:<id>:<time>" for a Run now.
+  windowKey   String    @map("window_key") @db.VarChar(120)
+  /// Null: a run over every tenant. Otherwise the one tenant a Run now swept.
+  tenantId    String?   @map("tenant_id") @db.VarChar(64)
+  /// Who pressed Run now, by name. Null for the schedule.
+  triggeredBy String?   @map("triggered_by") @db.VarChar(120)
+  startedAt   DateTime  @default(now()) @map("started_at")
+  finishedAt  DateTime? @map("finished_at")
+  ok          Boolean   @default(false)
+  /// The declared counts, e.g. { "remindersSent": 3 }.
+  counts      Json?
+  error       String?   @db.Text
+
+  @@unique([job, windowKey])
+  @@index([job, startedAt])
+  @@index([job, tenantId, startedAt])
+  @@map("cron_run")
+}
+
+/// A job switched off or on — the latest change. No row means on.
+model CronSwitch {
+  job            String   @id @db.VarChar(60)
+  paused         Boolean
+  switchedAt     DateTime @map("switched_at")
+  switchedById   String?  @map("switched_by_id")
+  switchedByName String   @map("switched_by_name") @db.VarChar(120)
+
+  @@map("cron_switch")
+}
+```
+
+For an app that already has `cron_run`:
+
+```sql
+ALTER TABLE "cron_run" ADD COLUMN "tenant_id" VARCHAR(64), ADD COLUMN "triggered_by" VARCHAR(120);
+CREATE INDEX "cron_run_job_tenant_id_started_at_idx" ON "cron_run"("job", "tenant_id", "started_at");
+```
+
+```ts
+// lib/jobs/store.ts
+import "server-only";
+import type { JobStore } from "@connextar/house/jobs";
+
+import { Prisma } from "@/lib/db/generated/client";
+import { prisma } from "@lib/db/prisma";
+
+export const jobStore: JobStore = {
+  async claimRun({ job, windowKey, tenantId, by, startedAt }) {
+    try {
+      const row = await prisma.cronRun.create({ data: { job, windowKey, tenantId, triggeredBy: by, startedAt } });
+      return row.id;
+    } catch (error) {
+      // The unique index refusing a second claim is the answer "already ran", not a failure.
+      if (error instanceof Prisma.PrismaClientKnownRequestError && error.code === "P2002") return null;
+      throw error;
+    }
+  },
+  async finishRun(id, { finishedAt, ok, counts, error }) {
+    await prisma.cronRun.update({ where: { id }, data: { finishedAt, ok, error, ...(counts ? { counts } : {}) } });
+  },
+  async latestRun({ job, tenants, ok, manualOnly }) {
+    const row = await prisma.cronRun.findFirst({
+      where: {
+        job,
+        OR: tenants.map((tenantId) => ({ tenantId })), // `{ tenantId: null }` matches the whole-tenant runs
+        ...(ok ? { ok: true } : {}),
+        ...(manualOnly ? { windowKey: { startsWith: "manual:" } } : {}),
+      },
+      orderBy: { startedAt: "desc" },
+    });
+    return row && { ...row, by: row.triggeredBy };
+  },
+  async readSwitches() {
+    const rows = await prisma.cronSwitch.findMany();
+    return new Map(rows.map((r) => [r.job, { paused: r.paused, at: r.switchedAt, by: r.switchedByName }]));
+  },
+  async writeSwitch({ job, label, paused, at, by }) {
+    await prisma.$transaction([
+      prisma.cronSwitch.upsert({
+        where: { job },
+        create: { job, paused, switchedAt: at, switchedById: by.id, switchedByName: by.name },
+        update: { paused, switchedAt: at, switchedById: by.id, switchedByName: by.name },
+      }),
+      prisma.auditLog.create({
+        data: {
+          actorId: by.id,
+          actorName: by.name,
+          action: paused ? "cron.paused" : "cron.resumed",
+          entityType: "cron_job",
+          entityId: job,
+          summary: `${paused ? "Paused" : "Resumed"} ${label}`,
+        },
+      }),
+    ]);
+  },
+};
+```
+
+`createMemoryJobStore()` is the same contract in memory, unique index included,
+for the app's own tests of its binding. Prune the ledger in the app's
+housekeeping job like any other growing table, keeping more than the longest
+threshold — health reads the latest run and the latest success per job, so an
+older row is history, not state.
+
+**What should not be a scheduled job.**
+
+- **Anything a person is waiting for.** A report they asked for, a model call,
+  an import step with its page open — do it in the request or straight after it.
+  A tick is up to an hour away, and a spinner cannot wait that long.
+- **A reaction to an event.** A payment landing, a sign-up, a status change:
+  handle it where it happens. A sweep that looks for "anything that changed" is
+  a webhook written late and paid for on every tick.
+- **A job per record, or per tenant.** A reminder due seven days after an
+  invoice is one daily sweep over "due today", not a job per invoice. The
+  registry is a short list a person reads on one screen.
+- **Anything that must happen at a moment.** Windows are as coarse as the tick —
+  AltEd's runs hourly, Quickie's every fifteen minutes. "At 09:00 sharp" is a
+  queue with a due time, not a window.
+- **Work longer than one request.** A job that can outlive the platform's time
+  limit is cut off and reads as never finished. Give it a budget and let the
+  next window continue — AltEd's harvest stops starting new sites after two and
+  a half minutes — or give it its own runner with `schedule: "own"`.
+- **Housekeeping a query already does.** An expired row the reads already ignore
+  does not need deleting on a schedule unless something promises it will be
+  gone — a retention period in a privacy policy does, and is then a job.
+
+**Adopting it — AltEd.** Nothing changes in what runs or when:
+
+1. **Jobs.** Each `JobSpec` becomes a `defineJob`: `name` → `id` (unchanged, so
+   the ledger and the `cron:<name>` switches still match), `when` → `cadence`,
+   `maxAgeMs` → `staleAfterMs`, `attempt` + `windowKey` → one `window` with the
+   same key: `daily()` for billing and housekeeping (the UTC date),
+   `daily({ timeZone: "Europe/London" })` for the tracker and class sessions
+   (`todayKey`), `daily({ from: 7, timeZone: "Europe/London" })` for the admin
+   summary (its London date equals the UTC date from 07:00). The hourly
+   moderation sweep's key is `2026-09-30-14` where `hourly()` gives
+   `2026-09-30T14` — keep a one-line custom window, or accept one extra sweep in
+   the cutover hour (it re-reads flagged messages, which is harmless). The weekly
+   digest keeps ``(now) => (isMondayMorning(now) ? `digest-${todayKey(now)}` : null)``,
+   or moves to `weekly({ from: 7, timeZone: "Europe/London" })` — which also
+   catches up a missed Monday — cut over on any day but a Monday.
+2. **Counts.** Declare every key each job already returns, under the same name,
+   so every stored row reads: `totalOutstanding` as
+   `{ kind: "money", currency: "GBP", unit: "major" }` (it is pounds, summed from
+   the decimal column), the rest as counts with their words.
+3. **Run now.** `scope: "global"` becomes `runNow: false` — what it effectively
+   was, since `runJobNow` never had a caller. Where an administrator should be
+   able to run one (the admin summary, class sessions, the tracker), give it
+   `runNow: { scope: "platform" }` and add the run route; leave billing
+   scheduled-only.
+4. **Own schedules.** The harvest and the import runner become
+   `schedule: "own"` and their routes call `scheduler.runOwn(...)` after the
+   secret check — so both write runs and get health for the first time. The
+   harvest takes `staleAfterMs: HOUR`; imports take `null` (idle is not stale),
+   keep their cached nothing-to-do answer ahead of `runOwn`, and drop their own
+   `isJobPaused("imports")`.
+5. **Switches.** Keep `PlatformSetting`: `readSwitches` merges
+   `readJobSettings()` with `readHarvestSetting()` under `harvest`, exactly as
+   `jobSwitches()` does now, and `writeSwitch` calls
+   `writeHarvestSetting`/`writeJobSetting` and `recordJobSwitched`. The
+   round-23 rule is `pausedFromStored`.
+6. **Ledger.** Run the two-column SQL above. No backfill: there are no Run now
+   rows, because nothing ever called it
+   (`SELECT count(*) FROM cron_run WHERE window_key LIKE 'manual:%'` should say
+   0 before and after).
+7. **Routes and screen.** The tick, harvest and imports routes use
+   `checkCronRequest` — `?secret=` now needs `allowQuery: true`, and Vercel's
+   cron never sends it. `/api/admin/cron` calls `setPaused`. `AutomationCard`
+   keeps its card and description and renders `JobHealthList` with
+   `scheduler.views({ platform: true })`, the harvest link as `extra`.
+   `lib/repos/cron.repo.ts`, `lib/server/cron-auth.ts` and the dispatcher half of
+   `lib/services/cron.service.ts` go; `cron-switch.db.test.ts` stays as the test
+   of the binding.
+
+**Adopting it — Quickie.**
+
+1. **Jobs.** Every key it stores is one a helper makes, so the cutover runs
+   nothing twice: `hourly()` for the follow-up digest and review requests;
+   `daily({ from: 9 })`, `daily({ from: 17 })` and `daily({ from: 18 })` for
+   payment reminders, booking reminders and budget alerts; `daily()` for bank
+   consents and housekeeping; `everyHours(6)` for the bank feed;
+   `(now) => (now.getUTCDay() === 1 ? hourly()(now) : null)` for the finance
+   digest; `monthly()` for the monthly report, which now catches up a failed 1st
+   on the 2nd. `scope: "tenant"` → `runNow: { scope: "tenant" }`; housekeeping
+   → `runNow: false`.
+2. **Counts.** Declare each key (`orgsEmailed`, `emailsSent`,
+   `invoicesConsidered`, `remindersSent`, …) with its words; the Run now toast
+   and the guide stop saying "3 remindersSent".
+3. **Ledger.** Run the two-column SQL, then give the old Run now rows a tenant:
+   `UPDATE "cron_run" SET "tenant_id" = 'unrecorded' WHERE "window_key" LIKE 'manual:%';`
+   Every one was a single organisation's run, but which was never recorded.
+   Marked so, none of them counts as a whole run for staleness and none appears
+   on any owner's screen; nothing is deleted.
+4. **Switches.** Add `CronSwitch`, and write the audit entry in `writeSwitch`
+   with `organizationId: null` — a switch is a platform-level action, which
+   `AuditLog` already allows. The switch belongs to platform operators
+   (`User.platformAdmin`): an Automation page in the admin panel renders
+   `scheduler.views({ platform: true })` with `onSwitch`.
+5. **Owners.** Settings › Automation health renders
+   `scheduler.views({ platform: false, tenantId: user.organizationId })` with
+   `onRunNow` and no switch. `/api/cron/run` keeps its owner check and the bank
+   feed's rate limit, then calls `runNow` with `platform: false` and the
+   organisation. Owners now see their own runs in full and the platform's sweeps
+   without other organisations' numbers or errors.
+6. **Remove the three per-job routes** (`payment-reminders`, `finance-digest`,
+   `follow-up-digest`). Nothing schedules them, and anyone holding the secret
+   could run a sweep outside the ledger and its window — `?force=1` over every
+   organisation, ignoring the hour and the throttle.
+7. **The tick** calls `checkCronRequest(request, { publicSecrets: ["dev-cron-secret"] })`
+   and `scheduler.tick()`. Payment reminders' Run now should stop passing
+   `ignoreThrottle` — the cool-down stops a double press, but a throttle per
+   invoice is what stops a customer being chased twice in a day.
+8. **The guide** (`docs/guides/automation.md`): Errored is now Failed, a run in
+   progress says Running, and the counts read as words.
+
 ### Styles — `@connextar/house/house.css`
 
 What the components need that utility classes cannot say: rich text, the editor's

package/dist/ai/config-index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `@connextar/house/ai/config` — everything in `ai` that never calls a provider.
+ *
+ * Provider names, the job table, status shapes, image types and prices: what a
+ * settings screen, an upload form or a price table in the browser needs. Its own
+ * entry point because `@connextar/house/ai` carries both provider SDKs, which no
+ * client bundle should — so AltEd and PharmaLine each kept a copy of the labels
+ * and image types for their client components instead. `package-exports.test.ts`
+ * fails if anything reachable from here imports an SDK or Zod.
+ */
+export { AI_PROVIDERS, PROVIDER_KEY_VARS, PROVIDER_LABELS, aiStatus, chooseProvider, configuredProviders, modelFor, publicAiStatus, resolveAi, type AiEnv, type AiModelSpec, type AiProviderName, type AiStatus, type AiTaskSpec, type AiTaskTable, type ProviderChoice, type PublicAiStatus, type ResolvedAi, } from "./config.js";
+export { AI_IMAGE_TYPES, isAiImageType, type AiImage, type AiImageType } from "./images.js";
+export { DEFAULT_PRICES, costUsd, findPrice, modelFamily, type ModelPrice, type PriceRates, type TokenCounts, } from "./pricing.js";
+//# sourceMappingURL=config-index.d.ts.map

package/dist/ai/config-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-index.d.ts","sourceRoot":"","sources":["../../src/ai/config-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,QAAQ,EACR,cAAc,EACd,SAAS,EACT,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EACL,cAAc,EACd,OAAO,EACP,SAAS,EACT,WAAW,EACX,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,cAAc,CAAC"}

package/dist/ai/config-index.js

@@ -0,0 +1,14 @@
+/**
+ * `@connextar/house/ai/config` — everything in `ai` that never calls a provider.
+ *
+ * Provider names, the job table, status shapes, image types and prices: what a
+ * settings screen, an upload form or a price table in the browser needs. Its own
+ * entry point because `@connextar/house/ai` carries both provider SDKs, which no
+ * client bundle should — so AltEd and PharmaLine each kept a copy of the labels
+ * and image types for their client components instead. `package-exports.test.ts`
+ * fails if anything reachable from here imports an SDK or Zod.
+ */
+export { AI_PROVIDERS, PROVIDER_KEY_VARS, PROVIDER_LABELS, aiStatus, chooseProvider, configuredProviders, modelFor, publicAiStatus, resolveAi, } from "./config.js";
+export { AI_IMAGE_TYPES, isAiImageType } from "./images.js";
+export { DEFAULT_PRICES, costUsd, findPrice, modelFamily, } from "./pricing.js";
+//# sourceMappingURL=config-index.js.map

package/dist/ai/config-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-index.js","sourceRoot":"","sources":["../../src/ai/config-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,QAAQ,EACR,cAAc,EACd,SAAS,GAUV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAkC,MAAM,aAAa,CAAC;AAC5F,OAAO,EACL,cAAc,EACd,OAAO,EACP,SAAS,EACT,WAAW,GAIZ,MAAM,cAAc,CAAC"}

package/dist/ai/images.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The pictures a structured call can carry. Their own module, free of either SDK,
+ * so an upload form can check a file's type from `@connextar/house/ai/config`.
+ */
+/** The image types both providers accept inline. */
+export declare const AI_IMAGE_TYPES: readonly ["image/jpeg", "image/png", "image/gif", "image/webp"];
+export type AiImageType = (typeof AI_IMAGE_TYPES)[number];
+export declare function isAiImageType(value: string): value is AiImageType;
+export interface AiImage {
+    mediaType: AiImageType;
+    /** Base64, no data-URL prefix. */
+    base64: string;
+}
+//# sourceMappingURL=images.d.ts.map

package/dist/ai/images.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"images.d.ts","sourceRoot":"","sources":["../../src/ai/images.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,oDAAoD;AACpD,eAAO,MAAM,cAAc,iEAAkE,CAAC;AAC9F,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,WAAW,CAAC;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/ai/images.js

@@ -0,0 +1,10 @@
+/**
+ * The pictures a structured call can carry. Their own module, free of either SDK,
+ * so an upload form can check a file's type from `@connextar/house/ai/config`.
+ */
+/** The image types both providers accept inline. */
+export const AI_IMAGE_TYPES = ["image/jpeg", "image/png", "image/gif", "image/webp"];
+export function isAiImageType(value) {
+    return AI_IMAGE_TYPES.includes(value);
+}
+//# sourceMappingURL=images.js.map

package/dist/ai/images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"images.js","sourceRoot":"","sources":["../../src/ai/images.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAU,CAAC;AAG9F,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC"}

package/dist/ai/index.d.ts

@@ -1,4 +1,8 @@
-export { AI_PROVIDERS, PROVIDER_KEY_VARS, PROVIDER_LABELS, aiStatus, chooseProvider, configuredProviders, modelFor, publicAiStatus, resolveAi, type AiEnv, type AiModelSpec, type AiProviderName, type AiStatus, type AiTaskSpec, type AiTaskTable, type ProviderChoice, type PublicAiStatus, type ResolvedAi, } from "./config.js";
-export { AI_IMAGE_TYPES, AiServiceError, AiUnavailableError, AiUnusableAnswerError, OPENAI_MIN_OUTPUT_TOKENS, createAiHarness, isAiImageType, type AiCallResult, type AiHarness, type AiHarnessOptions, type AiImage, type AiImageType, type AiStructuredCall, type AiTextCall, } from "./provider.js";
-export { DEFAULT_PRICES, costUsd, findPrice, modelFamily, type ModelPrice, type PriceRates, type TokenCounts, } from "./pricing.js";
+/**
+ * `@connextar/house/ai` — the harness, and everything it is configured with.
+ * Server-only in practice: it carries both provider SDKs. A client component
+ * imports `@connextar/house/ai/config` instead.
+ */
+export * from "./config-index.js";
+export { AiServiceError, AiUnavailableError, AiUnusableAnswerError, OPENAI_MIN_OUTPUT_TOKENS, createAiHarness, type AiCallResult, type AiHarness, type AiHarnessOptions, type AiStructuredCall, type AiTextCall, } from "./provider.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/ai/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ai/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,QAAQ,EACR,cAAc,EACd,SAAS,EACT,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,OAAO,EACP,SAAS,EACT,WAAW,EACX,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ai/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC"}

package/dist/ai/index.js

@@ -1,4 +1,8 @@
-export { AI_PROVIDERS, PROVIDER_KEY_VARS, PROVIDER_LABELS, aiStatus, chooseProvider, configuredProviders, modelFor, publicAiStatus, resolveAi, } from "./config.js";
-export { AI_IMAGE_TYPES, AiServiceError, AiUnavailableError, AiUnusableAnswerError, OPENAI_MIN_OUTPUT_TOKENS, createAiHarness, isAiImageType, } from "./provider.js";
-export { DEFAULT_PRICES, costUsd, findPrice, modelFamily, } from "./pricing.js";
+/**
+ * `@connextar/house/ai` — the harness, and everything it is configured with.
+ * Server-only in practice: it carries both provider SDKs. A client component
+ * imports `@connextar/house/ai/config` instead.
+ */
+export * from "./config-index.js";
+export { AiServiceError, AiUnavailableError, AiUnusableAnswerError, OPENAI_MIN_OUTPUT_TOKENS, createAiHarness, } from "./provider.js";
 //# sourceMappingURL=index.js.map

package/dist/ai/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ai/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,QAAQ,EACR,cAAc,EACd,SAAS,GAUV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,aAAa,GAQd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,OAAO,EACP,SAAS,EACT,WAAW,GAIZ,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ai/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,GAMhB,MAAM,eAAe,CAAC"}

package/dist/ai/provider.d.ts

@@ -1,5 +1,6 @@
 import type { z } from "zod";
 import { type AiEnv, type AiProviderName, type AiStatus, type AiTaskTable, type PublicAiStatus, type ResolvedAi } from "./config.js";
+import type { AiImage } from "./images.js";
 /**
  * The one place either provider's SDK is called.
  *
@@ -66,15 +67,6 @@ export interface AiTextCall<Task extends string> {
      */
     timeoutMs?: number;
 }
-/** The image types both providers accept inline. */
-export declare const AI_IMAGE_TYPES: readonly ["image/jpeg", "image/png", "image/gif", "image/webp"];
-export type AiImageType = (typeof AI_IMAGE_TYPES)[number];
-export declare function isAiImageType(value: string): value is AiImageType;
-export interface AiImage {
-    mediaType: AiImageType;
-    /** Base64, no data-URL prefix. */
-    base64: string;
-}
 export interface AiStructuredCall<Task extends string, T> extends AiTextCall<Task> {
     schema: z.ZodType<T>;
     /** A name for the schema. OpenAI requires one; Anthropic ignores it. */

package/dist/ai/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/ai/provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EAKL,KAAK,KAAK,EACV,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,gEAAgE;AAChE,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,SAAkE;CAItF;AAED,0FAA0F;AAC1F,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;gBAExB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAK7C;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,kBAAkB;IAC3D,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;CAKjD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU,CAAC,IAAI,SAAS,MAAM;IAC7C,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,eAAO,MAAM,cAAc,iEAAkE,CAAC;AAC9F,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,WAAW,CAAC;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB,CAAC,IAAI,SAAS,MAAM,EAAE,CAAC,CAAE,SAAQ,UAAU,CAAC,IAAI,CAAC;IAChF,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AA2C7C,MAAM,WAAW,gBAAgB,CAAC,IAAI,SAAS,MAAM;IACnD,sDAAsD;IACtD,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACzB,kFAAkF;IAClF,GAAG,CAAC,EAAE,MAAM,KAAK,CAAC;CACnB;AAED,MAAM,WAAW,SAAS,CAAC,IAAI,SAAS,MAAM;IAC5C,sGAAsG;IACtG,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,GAAG,IAAI,CAAC;IACvC,uEAAuE;IACvE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,yDAAyD;IACzD,YAAY,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,wDAAwD;IACxD,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,4FAA4F;IAC5F,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,IAAI,SAAS,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAyIrG"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/ai/provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EAKL,KAAK,KAAK,EACV,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,gEAAgE;AAChE,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,SAAkE;CAItF;AAED,0FAA0F;AAC1F,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;gBAExB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAK7C;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,kBAAkB;IAC3D,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;CAKjD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU,CAAC,IAAI,SAAS,MAAM;IAC7C,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB,CAAC,IAAI,SAAS,MAAM,EAAE,CAAC,CAAE,SAAQ,UAAU,CAAC,IAAI,CAAC;IAChF,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AA2C7C,MAAM,WAAW,gBAAgB,CAAC,IAAI,SAAS,MAAM;IACnD,sDAAsD;IACtD,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACzB,kFAAkF;IAClF,GAAG,CAAC,EAAE,MAAM,KAAK,CAAC;CACnB;AAED,MAAM,WAAW,SAAS,CAAC,IAAI,SAAS,MAAM;IAC5C,sGAAsG;IACtG,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,GAAG,IAAI,CAAC;IACvC,uEAAuE;IACvE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,yDAAyD;IACzD,YAAY,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,wDAAwD;IACxD,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,4FAA4F;IAC5F,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,IAAI,SAAS,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAyIrG"}