@objectstack/plugin-reports 17.0.0-rc.6 → 17.1.0

package/dist/index.js

@@ -440,8 +440,7 @@ var ReportService = class {
   async unscheduleReport(scheduleId, context) {
     if (!scheduleId) throw new Error("VALIDATION_FAILED: scheduleId is required");
     const schedule = await this.loadScheduleRow(scheduleId);
-    if (!schedule) return;
-    const report = await this.loadReportRow(schedule.report_id);
+    const report = schedule ? await this.loadReportRow(schedule.report_id) : null;
     if (!this.canAccessReport(report, context)) {
       throw new Error(`REPORT_NOT_FOUND: ${scheduleId}`);
     }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/report-service.ts","../src/reports-plugin.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * @objectstack/plugin-reports\n *\n * Saved reports + scheduled email digests for ObjectStack.\n * Persists `sys_saved_report` definitions and `sys_report_schedule`\n * rows, then drives a dispatcher that runs due schedules and emails\n * the rendered output via the configured `email` service.\n */\n\nexport { SysSavedReport, SysReportSchedule } from '@objectstack/platform-objects/audit';\nexport {\n  ReportService,\n  renderReport,\n  type ReportEngine,\n  type ReportEmail,\n  type ReportClock,\n  type ReportServiceOptions,\n} from './report-service.js';\nexport {\n  ReportsServicePlugin,\n  type ReportsPluginOptions,\n} from './reports-plugin.js';\nexport type {\n  IReportService,\n  SavedReport,\n  ReportSchedule,\n  ReportQuery,\n  ReportRunResult,\n  ReportFormat,\n  SaveReportInput,\n  ScheduleReportInput,\n} from '@objectstack/spec/contracts';\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { withoutOperationPrivateKeys } from '@objectstack/core';\nimport type {\n  IReportService,\n  SavedReport,\n  ReportSchedule,\n  ReportQuery,\n  ReportRunResult,\n  ReportFormat,\n  SaveReportInput,\n  ScheduleReportInput,\n} from '@objectstack/spec/contracts';\n// [#7135] The full `resolveAuthzContext` envelope — what `IReportService`\n// declares for every one of these context parameters since #6523 (the #6206\n// ruling: enforcement adjudicates on the whole envelope, never a per-site\n// subset). A scheduled run resolves a REAL owner context through\n// `OwnerContextResolver`; naming the retired six-field shape here made this\n// file's own type say it could not see what that resolver returns.\nimport type { ExecutionContext } from '@objectstack/spec/kernel';\nimport { Cron } from 'croner';\n\n/**\n * Narrow engine surface — keeps the service testable without booting\n * a real ObjectQL kernel.\n */\nexport interface ReportEngine {\n  find(object: string, options?: any): Promise<any[]>;\n  findOne?(object: string, options?: any): Promise<any>;\n  insert(object: string, data: any, options?: any): Promise<any>;\n  update(object: string, idOrData: any, dataOrOptions?: any, options?: any): Promise<any>;\n  delete(object: string, options?: any): Promise<any>;\n}\n\n/**\n * Minimum email surface — implementations may pass the full\n * `IEmailService` instance straight through.\n */\nexport interface ReportEmail {\n  send(input: {\n    to: string | string[];\n    subject: string;\n    text?: string;\n    html?: string;\n    attachments?: Array<{ filename: string; content: string; contentType?: string }>;\n    relatedObject?: string;\n    relatedId?: string;\n  }): Promise<{ status: 'sent' | 'queued' | 'failed' }>;\n}\n\n/** Stamped only in tests / specialised callers to make `now` deterministic. */\nexport interface ReportClock { now(): Date }\n\nconst SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as const;\n\nconst DEFAULT_FORMAT: ReportFormat = 'csv';\nconst DEFAULT_INTERVAL_MIN = 1440;\nconst DEFAULT_LIMIT = 1000;\n\nfunction uid(prefix: string): string {\n  const g: any = globalThis as any;\n  if (g.crypto?.randomUUID) return `${prefix}_${g.crypto.randomUUID()}`;\n  return `${prefix}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;\n}\n\nfunction parseQuery(raw: unknown): ReportQuery {\n  if (!raw) return {};\n  if (typeof raw === 'string') {\n    try { return JSON.parse(raw) as ReportQuery; }\n    catch { return {}; }\n  }\n  if (typeof raw === 'object') return raw as ReportQuery;\n  return {};\n}\n\nfunction rowFromSaved(row: any): SavedReport {\n  return {\n    id: String(row.id),\n    name: String(row.name ?? ''),\n    description: row.description ?? undefined,\n    object_name: String(row.object_name ?? ''),\n    query: parseQuery(row.query_json),\n    format: (row.format as ReportFormat) ?? DEFAULT_FORMAT,\n    owner_id: row.owner_id ?? undefined,\n    last_run_at: row.last_run_at ?? undefined,\n    last_row_count: row.last_row_count ?? undefined,\n    created_at: row.created_at ?? undefined,\n    updated_at: row.updated_at ?? undefined,\n  };\n}\n\nfunction rowFromSchedule(row: any): ReportSchedule {\n  return {\n    id: String(row.id),\n    report_id: String(row.report_id),\n    name: row.name ?? undefined,\n    interval_minutes: row.interval_minutes ?? undefined,\n    cron_expression: row.cron_expression ?? undefined,\n    timezone: row.timezone ?? undefined,\n    active: row.active !== false,\n    recipients: String(row.recipients ?? ''),\n    format: row.format ?? undefined,\n    subject_template: row.subject_template ?? undefined,\n    owner_id: row.owner_id ?? undefined,\n    next_run_at: row.next_run_at ?? undefined,\n    last_sent_at: row.last_sent_at ?? undefined,\n    last_status: row.last_status ?? undefined,\n    last_error: row.last_error ?? undefined,\n  };\n}\n\n// ─── Rendering ─────────────────────────────────────────────────────\n\nfunction escapeCsvCell(v: unknown): string {\n  if (v == null) return '';\n  const s = typeof v === 'string' ? v : (typeof v === 'object' ? JSON.stringify(v) : String(v));\n  if (/[\",\\r\\n]/.test(s)) return `\"${s.replace(/\"/g, '\"\"')}\"`;\n  return s;\n}\n\nfunction pickFields(rows: any[], explicit?: string[]): string[] {\n  if (explicit && explicit.length > 0) return explicit;\n  const seen = new Set<string>();\n  for (const r of rows.slice(0, 50)) {\n    if (r && typeof r === 'object') for (const k of Object.keys(r)) seen.add(k);\n  }\n  return Array.from(seen);\n}\n\nfunction renderCsv(rows: any[], fields?: string[]): string {\n  const cols = pickFields(rows, fields);\n  const head = cols.join(',');\n  const body = rows.map(r => cols.map(c => escapeCsvCell(r?.[c])).join(',')).join('\\r\\n');\n  return body.length > 0 ? `${head}\\r\\n${body}` : head;\n}\n\nfunction renderJson(rows: any[]): string {\n  return JSON.stringify(rows, null, 2);\n}\n\nfunction escapeHtml(s: string): string {\n  return s.replace(/[&<>\"']/g, c => ({\n    '&': '&amp;', '<': '&lt;', '>': '&gt;', '\"': '&quot;', \"'\": '&#39;',\n  } as Record<string, string>)[c]);\n}\n\nfunction renderHtmlTable(rows: any[], fields?: string[]): string {\n  const cols = pickFields(rows, fields);\n  const th = cols.map(c => `<th style=\"text-align:left;padding:4px 8px;border-bottom:1px solid #ccc;\">${escapeHtml(c)}</th>`).join('');\n  const trs = rows.map(r => {\n    const tds = cols.map(c => {\n      const v = r?.[c];\n      const s = v == null ? '' : (typeof v === 'string' ? v : (typeof v === 'object' ? JSON.stringify(v) : String(v)));\n      return `<td style=\"padding:4px 8px;border-bottom:1px solid #eee;\">${escapeHtml(s)}</td>`;\n    }).join('');\n    return `<tr>${tds}</tr>`;\n  }).join('');\n  return `<table style=\"border-collapse:collapse;font-family:system-ui,Arial,sans-serif;font-size:13px;\">`\n    + `<thead><tr>${th}</tr></thead><tbody>${trs}</tbody></table>`;\n}\n\nexport function renderReport(rows: any[], format: ReportFormat, fields?: string[]): string {\n  switch (format) {\n    case 'json': return renderJson(rows);\n    case 'html_table': return renderHtmlTable(rows, fields);\n    case 'csv':\n    default: return renderCsv(rows, fields);\n  }\n}\n\n// ─── Subject templating (minimal {{var}}) ─────────────────────────\n\nfunction renderSubject(template: string | undefined, vars: Record<string, string>): string {\n  const tpl = template ?? '{{name}} — {{date}}';\n  return tpl.replace(/\\{\\{\\s*(\\w+)\\s*\\}\\}/g, (_m, k) => vars[String(k)] ?? '');\n}\n\n// ─── Caller envelope ──────────────────────────────────────────────\n\n/**\n * Why this module strips the operation-private keys before forwarding an\n * envelope — the LOCAL half of the argument.\n *\n * A report read asks about `report.object_name`, which is not necessarily the\n * object the caller's envelope last carried a `__`-prefixed depth for: a REST\n * request that touched another object before reaching `/reports/:id/run` hands\n * over an envelope plugin-security's middleware has already written into, and\n * that middleware only OVERWRITES `__readScope` when it resolves permission sets\n * for the new object (`if (permissionSets.length > 0)`). A stale depth therefore\n * survives into a question it was never resolved for.\n *\n * [#7204] The general rule — which keys those are, why they are dropped by\n * PREFIX rather than by a name list, and why the copy is load-bearing in both\n * directions — is `withoutOperationPrivateKeys` in `@objectstack/core`. It was\n * hand-copied into this file, `plugin-audit`'s comment kit and\n * `service-storage`'s attachment kit before #7284 gave it one owner; ⛔ import\n * it, never re-derive it locally (`operation-private-keys.pin.test.ts` catches\n * the fourth copy).\n */\n\n// ─── Service ──────────────────────────────────────────────────────\n\n/**\n * Resolves a saved report's owner (`owner_id`) into a real, RLS-bearing\n * `ExecutionContext` so a **scheduled** report executes under the owner's\n * authority — the same rows the owner would see interactively — instead of\n * bypassing RLS with a system context. Returns `null` when the owner cannot\n * be resolved (unknown/disabled user), in which case the scheduler fails the\n * run closed rather than running elevated (#2849 / #2980). Supplying this\n * resolver is the reports-surface consumer of ADR-0073's user-less identity\n * resolution.\n */\nexport type OwnerContextResolver = (\n  ownerId: string,\n) => Promise<ExecutionContext | null>;\n\nexport interface ReportServiceOptions {\n  engine: ReportEngine;\n  email?: ReportEmail;\n  clock?: ReportClock;\n  logger?: { info?: (msg: any, ...rest: any[]) => void; warn?: (msg: any, ...rest: any[]) => void; error?: (msg: any, ...rest: any[]) => void };\n  /** Cap rows per report to protect both DB and email size. */\n  maxRows?: number;\n  /**\n   * Resolves a report owner into an RLS-bearing context for scheduled runs\n   * (see {@link OwnerContextResolver}). When omitted, scheduled reports fail\n   * closed instead of running with RLS bypassed (#2980).\n   */\n  resolveOwnerContext?: OwnerContextResolver;\n  /**\n   * [#3544 / #3710] The user-level export axis —\n   * `ISecurityService.canExport(object, context)`, wired by the reports plugin\n   * from `getService('security')`.\n   *\n   * A report rendered as `csv`/`json` IS a bulk machine-readable copy of the\n   * object, so it is the same privilege `GET /data/:object/export` gates.\n   * Without this the axis had a side door: a caller refused at that route could\n   * save a report on the same object, run it as CSV — or schedule one to their\n   * own inbox — and receive the identical rows.\n   *\n   * Omitted (no `plugin-security`, so no permission sets exist anywhere) → the\n   * axis does not apply, matching the REST export route's own fail-open.\n   */\n  canExport?: (object: string, context: unknown) => Promise<boolean>;\n}\n\n/**\n * [#3544 / #3710] Report formats that constitute a BULK EXPORT rather than a\n * rendering.\n *\n * `csv`/`json` are machine-readable copies — re-importable elsewhere, and\n * exactly what `GET /data/:object/export` serves. `html_table` is a PRESENTED\n * view: the report equivalent of reading rows on screen, which any caller\n * holding `allowRead` may already do. Gating it would restrict reading rather\n * than exporting and would take the axis past what it is for.\n */\nconst BULK_EXPORT_FORMATS: ReadonlySet<string> = new Set(['csv', 'json']);\n\nexport class ReportService implements IReportService {\n  private readonly engine: ReportEngine;\n  private readonly email?: ReportEmail;\n  private readonly clock: ReportClock;\n  private readonly logger: NonNullable<ReportServiceOptions['logger']>;\n  private readonly maxRows: number;\n  private readonly resolveOwnerContext?: OwnerContextResolver;\n  private readonly canExportFn?: (object: string, context: unknown) => Promise<boolean>;\n\n  constructor(opts: ReportServiceOptions) {\n    this.engine = opts.engine;\n    this.email = opts.email;\n    this.clock = opts.clock ?? { now: () => new Date() };\n    this.logger = opts.logger ?? {};\n    this.maxRows = Math.max(1, opts.maxRows ?? 5000);\n    this.resolveOwnerContext = opts.resolveOwnerContext;\n    this.canExportFn = opts.canExport;\n  }\n\n  /**\n   * [#3544 / #3710] Gate a report rendering on the user-level export axis.\n   *\n   * Throws `EXPORT_NOT_PERMITTED` when the principal behind `context` may not\n   * take a bulk copy of `object`. A no-op for non-bulk formats (`html_table`),\n   * for a system context, and when no `canExport` is wired.\n   *\n   * Deliberately checked HERE — one place — rather than at each of the three\n   * callers (`runReport`, the ad-hoc run, and the scheduled dispatch): a gate\n   * per call site is how a fourth call site later ships ungated. `dispatchDue`\n   * routes through `executeReport` too, so the scheduled CSV is covered by the\n   * same line. (`scheduleReport` additionally pre-checks, so an author is\n   * refused when they create the schedule rather than silently at 3am — but\n   * that is UX, and THIS is the enforcement: a grant revoked after the schedule\n   * was created must still stop the delivery.)\n   *\n   * Fails CLOSED on a throw — it resolves permission sets to decide, and a\n   * resolution failure must never read as a grant (ADR-0049).\n   */\n  private async assertExportAllowed(\n    object: string,\n    format: string,\n    context: ExecutionContext | undefined,\n  ): Promise<void> {\n    if (!BULK_EXPORT_FORMATS.has(format)) return;\n    if (context?.isSystem) return;\n    if (!this.canExportFn) return;\n    let allowed: boolean;\n    try {\n      allowed = await this.canExportFn(object, context);\n    } catch (err) {\n      this.logger.warn?.('ReportService: canExport check failed — denying export', err);\n      allowed = false;\n    }\n    if (!allowed) {\n      throw new Error(\n        `EXPORT_NOT_PERMITTED: exporting '${object}' as ${format} is not permitted for this user`,\n      );\n    }\n  }\n\n  // ── Access control ─────────────────────────────────────────────\n\n  /**\n   * Authorization for a saved-report row. `sys_saved_report` is a\n   * protection-locked system object, so its rows are *read* with\n   * `SYSTEM_CTX`; the caller's right to see/mutate a specific report is\n   * enforced HERE, by owner match, not by the metadata read's own RLS —\n   * otherwise any authenticated caller could read/delete/overwrite any\n   * report by id (#2980). An explicit elevated context (`isSystem`) — the\n   * scheduler / server tooling — sees everything.\n   */\n  private canAccessReport(row: { owner_id?: unknown } | null | undefined, context: ExecutionContext | undefined): boolean {\n    if (!row) return false;\n    if (context?.isSystem) return true;\n    const userId = context?.userId;\n    return !!userId && row.owner_id === userId;\n  }\n\n  /** Raw metadata read of a saved report by id (no authz — callers gate). */\n  private async loadReportRow(reportId: string): Promise<any | null> {\n    const rows = await this.engine.find('sys_saved_report', {\n      where: { id: reportId }, limit: 1, context: SYSTEM_CTX,\n    });\n    return Array.isArray(rows) && rows[0] ? rows[0] : null;\n  }\n\n  /** Raw metadata read of a report schedule by id (no authz — callers gate). */\n  private async loadScheduleRow(scheduleId: string): Promise<any | null> {\n    const rows = await this.engine.find('sys_report_schedule', {\n      where: { id: scheduleId }, limit: 1, context: SYSTEM_CTX,\n    });\n    return Array.isArray(rows) && rows[0] ? rows[0] : null;\n  }\n\n  // ── Report CRUD ────────────────────────────────────────────────\n\n  async saveReport(input: SaveReportInput, context: ExecutionContext): Promise<SavedReport> {\n    if (!input.name) throw new Error('VALIDATION_FAILED: name is required');\n    if (!input.object) throw new Error('VALIDATION_FAILED: object is required');\n    if (!input.query) throw new Error('VALIDATION_FAILED: query is required');\n\n    const now = this.clock.now().toISOString();\n    // A non-system caller always owns what they create — a caller-supplied\n    // ownerId cannot assign the report to someone else (#2980). Only an\n    // explicit elevated context (server tooling / import) may set it.\n    const ownerId = context.isSystem ? (input.ownerId ?? context.userId ?? null) : (context.userId ?? null);\n    const payload: any = {\n      name: input.name,\n      description: input.description ?? null,\n      object_name: input.object,\n      query_json: JSON.stringify(input.query ?? {}),\n      format: input.format ?? DEFAULT_FORMAT,\n      owner_id: ownerId,\n      updated_at: now,\n    };\n\n    if (input.id) {\n      const existing = await this.loadReportRow(input.id);\n      if (existing) {\n        // An update to an existing report is a mutation — a caller may only\n        // overwrite a report they own (#2980). Not-found for others so the\n        // response doesn't leak that the id exists.\n        if (!this.canAccessReport(existing, context)) {\n          throw new Error(`REPORT_NOT_FOUND: ${input.id}`);\n        }\n        // Never let a non-system caller reassign ownership away from the row.\n        if (!context.isSystem) payload.owner_id = existing.owner_id ?? payload.owner_id;\n        await this.engine.update('sys_saved_report', { id: input.id, ...payload }, { context: SYSTEM_CTX });\n        return rowFromSaved({ ...existing, ...payload, id: input.id });\n      }\n    }\n\n    const id = input.id ?? uid('rpt');\n    const row = { id, ...payload, created_at: now };\n    await this.engine.insert('sys_saved_report', row, { context: SYSTEM_CTX });\n    return rowFromSaved(row);\n  }\n\n  async listReports(\n    filter: { object?: string; ownerId?: string } | undefined,\n    context: ExecutionContext,\n  ): Promise<SavedReport[]> {\n    const f: any = {};\n    if (filter?.object) f.object_name = filter.object;\n    // Owner scoping (#2980): a non-system caller sees ONLY their own reports —\n    // a caller-supplied ownerId can never widen past their own id. A caller\n    // with no identity sees nothing (fail closed). System/tooling sees all,\n    // honouring an explicit ownerId narrow.\n    if (context?.isSystem) {\n      if (filter?.ownerId) f.owner_id = filter.ownerId;\n    } else {\n      if (!context?.userId) return [];\n      if (filter?.ownerId && filter.ownerId !== context.userId) return [];\n      f.owner_id = context.userId;\n    }\n    const rows = await this.engine.find('sys_saved_report', {\n      where: f, limit: 500, orderBy: [{ field: 'updated_at', order: 'desc' }], context: SYSTEM_CTX,\n    });\n    return Array.isArray(rows) ? rows.map(rowFromSaved) : [];\n  }\n\n  async getReport(reportId: string, context: ExecutionContext): Promise<SavedReport | null> {\n    const row = await this.loadReportRow(reportId);\n    // Unauthorized reads are indistinguishable from a genuine miss (#2980).\n    if (!this.canAccessReport(row, context)) return null;\n    return rowFromSaved(row);\n  }\n\n  async deleteReport(reportId: string, context: ExecutionContext): Promise<void> {\n    if (!reportId) throw new Error('VALIDATION_FAILED: reportId is required');\n    const row = await this.loadReportRow(reportId);\n    if (!row) return; // idempotent — nothing to drop\n    // A caller may only delete a report they own (#2980); others get a\n    // not-found so the delete neither fires nor reveals the report's existence.\n    if (!this.canAccessReport(row, context)) {\n      throw new Error(`REPORT_NOT_FOUND: ${reportId}`);\n    }\n    // Cascade — drop attached schedules first.\n    const schedules = await this.engine.find('sys_report_schedule', {\n      where: { report_id: reportId }, limit: 500, context: SYSTEM_CTX,\n    });\n    for (const s of (schedules ?? [])) {\n      await this.engine.delete('sys_report_schedule', { where: { id: (s as any).id }, context: SYSTEM_CTX });\n    }\n    await this.engine.delete('sys_saved_report', { where: { id: reportId }, context: SYSTEM_CTX });\n  }\n\n  // ── Execution ───────────────────────────────────────────────────\n\n  async run(reportId: string, context: ExecutionContext): Promise<ReportRunResult> {\n    const report = await this.getReport(reportId, context);\n    if (!report) throw new Error(`REPORT_NOT_FOUND: ${reportId}`);\n    return this.executeReport(report, context);\n  }\n\n  async runAdHoc(input: SaveReportInput, context: ExecutionContext): Promise<ReportRunResult> {\n    if (!input.object) throw new Error('VALIDATION_FAILED: object is required');\n    if (!input.query) throw new Error('VALIDATION_FAILED: query is required');\n    const adhoc: SavedReport = {\n      id: '__adhoc__',\n      name: input.name ?? 'Ad-hoc report',\n      object_name: input.object,\n      query: input.query,\n      format: input.format ?? DEFAULT_FORMAT,\n    };\n    return this.executeReport(adhoc, context, /* stamp */ false);\n  }\n\n  private async executeReport(\n    report: SavedReport,\n    context: ExecutionContext,\n    stamp = true,\n  ): Promise<ReportRunResult> {\n    // [#3544 / #3710] The export axis, BEFORE any row is read — a refusal must\n    // not be reachable after the data has already been pulled.\n    await this.assertExportAllowed(report.object_name, report.format, context);\n    const q = report.query ?? {};\n    const limit = Math.min(q.limit ?? DEFAULT_LIMIT, this.maxRows);\n    const rows = await this.engine.find(report.object_name, {\n      where: q.filter,\n      fields: q.fields,\n      orderBy: q.orderBy,\n      limit,\n      // Reports execute with the caller's identity so sharing rules\n      // (if installed) apply. Falls back to system bypass only when\n      // the report definition was created by a system writer.\n      //\n      // [#7204] The WHOLE envelope, not a rebuilt subset of it — the #6206\n      // ruling (#6523): a read that adjudicates on the caller's identity\n      // adjudicates on the whole `resolveAuthzContext` envelope. The\n      // five-field projection this replaced (`userId` / `tenantId` /\n      // `positions` / `permissions` / `isSystem`) was doing two jobs, and\n      // only one of them was correct:\n      //\n      //  - dropping the middleware-private keys — CORRECT, and preserved\n      //    above by {@link withoutOperationPrivateKeys};\n      //  - dropping the PRINCIPAL fields — the defect. `accessible_org_ids`\n      //    (ADR-0105 D2) is the one that changes rows: `buildDriverOptions`\n      //    reads it BY NAME to widen the driver's native tenant scope to the\n      //    caller's membership union under the `group` posture, and an absent\n      //    set makes drivers \"fall back to equality: fail toward isolation\".\n      //    So the same query returned the union in an interactive list view\n      //    and collapsed to active-org equality inside a saved or scheduled\n      //    report — silently short rows, no error. `timezone` is read two\n      //    lines up in the same engine method (`hasTz`) and again by\n      //    `applyFormulaPlan` for read-time formula fields, and `posture`,\n      //    `org_user_ids`, `systemPermissions` and `onBehalfOf` went the same\n      //    way; they are forwarded now for the same reason — the envelope is\n      //    the contract's unit.\n      //\n      // The three defaults below are byte-for-byte what the projection\n      // produced for an envelope that omits them, and are kept so this change\n      // adds fields without changing any that were already there.\n      context: {\n        ...withoutOperationPrivateKeys(context as unknown as Record<string, unknown>),\n        positions: context.positions ?? [],\n        permissions: context.permissions ?? [],\n        isSystem: context.isSystem ?? false,\n      },\n    });\n    const list = Array.isArray(rows) ? rows : [];\n    const body = renderReport(list, report.format, q.fields);\n    const ranAt = this.clock.now().toISOString();\n\n    if (stamp && report.id !== '__adhoc__') {\n      try {\n        await this.engine.update('sys_saved_report', {\n          id: report.id,\n          last_run_at: ranAt,\n          last_row_count: list.length,\n          updated_at: ranAt,\n        }, { context: SYSTEM_CTX });\n      } catch (err) {\n        this.logger.warn?.('ReportService: failed to stamp last_run_at', err);\n      }\n    }\n\n    return {\n      reportId: report.id,\n      rowCount: list.length,\n      format: report.format,\n      body,\n      rows: list,\n      ranAt,\n    };\n  }\n\n  // ── Schedules ──────────────────────────────────────────────────\n\n  async scheduleReport(input: ScheduleReportInput, context: ExecutionContext): Promise<ReportSchedule> {\n    if (!input.reportId) throw new Error('VALIDATION_FAILED: reportId is required');\n    if (!input.recipients || input.recipients.length === 0) {\n      throw new Error('VALIDATION_FAILED: recipients must be a non-empty array');\n    }\n    const report = await this.getReport(input.reportId, context);\n    if (!report) throw new Error(`REPORT_NOT_FOUND: ${input.reportId}`);\n\n    // [#3544 / #3710] Refuse a bulk-format schedule the author could not run\n    // themselves, at CREATE time — otherwise the refusal only surfaces on the\n    // first silent 3am sweep. Advisory only: `executeReport` re-checks on every\n    // dispatch, which is what catches a grant revoked after this point.\n    await this.assertExportAllowed(report.object_name, input.format ?? 'html_table', context);\n\n    const now = this.clock.now();\n    const interval = input.intervalMinutes ?? DEFAULT_INTERVAL_MIN;\n    const cron = input.cronExpression?.trim() || null;\n    if (cron) {\n      // Validate eagerly so an author gets a clear error at schedule time\n      // instead of a schedule that silently falls back to interval on sweep.\n      try {\n        new Cron(cron, { timezone: input.timezone || 'UTC' });\n      } catch (err) {\n        throw new Error(`VALIDATION_FAILED: invalid cron_expression '${cron}': ${(err as Error).message}`);\n      }\n    }\n    const nextRun = this.nextRunAt(\n      { cron_expression: cron, interval_minutes: interval, timezone: input.timezone ?? 'UTC' },\n      now,\n    ).toISOString();\n    const id = uid('rsch');\n    const row: any = {\n      id,\n      report_id: input.reportId,\n      name: input.name ?? null,\n      interval_minutes: interval,\n      cron_expression: cron,\n      timezone: input.timezone ?? 'UTC',\n      active: input.active !== false,\n      recipients: input.recipients.join(','),\n      format: input.format ?? 'html_table',\n      subject_template: input.subjectTemplate ?? null,\n      owner_id: input.ownerId ?? context.userId ?? null,\n      next_run_at: nextRun,\n      created_at: now.toISOString(),\n      updated_at: now.toISOString(),\n    };\n    await this.engine.insert('sys_report_schedule', row, { context: SYSTEM_CTX });\n    return rowFromSchedule(row);\n  }\n\n  async unscheduleReport(scheduleId: string, context: ExecutionContext): Promise<void> {\n    if (!scheduleId) throw new Error('VALIDATION_FAILED: scheduleId is required');\n    const schedule = await this.loadScheduleRow(scheduleId);\n    if (!schedule) return; // idempotent — nothing to drop (mirrors deleteReport)\n    // A schedule is owned through its report (#2980): a caller may only delete\n    // the schedules of a report they own. Others get a not-found so the delete\n    // neither fires nor reveals the schedule's existence — deny-as-404, never a\n    // cross-owner 2xx.\n    const report = await this.loadReportRow(schedule.report_id);\n    if (!this.canAccessReport(report, context)) {\n      throw new Error(`REPORT_NOT_FOUND: ${scheduleId}`);\n    }\n    await this.engine.delete('sys_report_schedule', { where: { id: scheduleId }, context: SYSTEM_CTX });\n  }\n\n  async listSchedules(\n    filter: { reportId?: string } | undefined,\n    context: ExecutionContext,\n  ): Promise<ReportSchedule[]> {\n    // Schedules are owned through their report (#2980): a non-system caller may\n    // only list the schedules of a report they can access. The route always\n    // supplies the parent report id; a caller who cannot see that report gets an\n    // empty list — never another owner's recipients/cron — the same non-leaking\n    // posture as listReports. System/tooling (the dispatcher) still sees all.\n    if (!context?.isSystem) {\n      if (!filter?.reportId) return [];\n      if (!(await this.getReport(filter.reportId, context))) return [];\n    }\n    const f: any = {};\n    if (filter?.reportId) f.report_id = filter.reportId;\n    const rows = await this.engine.find('sys_report_schedule', {\n      where: f, limit: 500, orderBy: [{ field: 'next_run_at', order: 'asc' }], context: SYSTEM_CTX,\n    });\n    return Array.isArray(rows) ? rows.map(rowFromSchedule) : [];\n  }\n\n  // ── Dispatcher ─────────────────────────────────────────────────\n\n  async dispatchDue(now?: Date): Promise<{ fired: number; failed: number; skipped: number }> {\n    const ts = (now ?? this.clock.now()).toISOString();\n    const due = await this.engine.find('sys_report_schedule', {\n      where: { active: true },\n      limit: 200,\n      context: SYSTEM_CTX,\n    });\n    const list = (Array.isArray(due) ? due : []).map(rowFromSchedule)\n      .filter(s => !s.next_run_at || s.next_run_at <= ts);\n\n    let fired = 0, failed = 0, skipped = 0;\n    for (const schedule of list) {\n      try {\n        const row = await this.loadReportRow(schedule.report_id);\n        if (!row) {\n          skipped++;\n          await this.markSchedule(schedule.id, {\n            last_status: 'skipped',\n            last_error: `report ${schedule.report_id} missing`,\n          });\n          continue;\n        }\n        const report = rowFromSaved(row);\n\n        // Run the report under the OWNER's authority, not system (#2980).\n        // A scheduled run must not read rows the report's owner cannot see —\n        // that was a silent RLS bypass (a member's scheduled report emailed\n        // the target object's entire table). Resolve the owner to a real\n        // RLS-bearing context; if we can't (no resolver wired, or unknown/\n        // disabled owner), FAIL CLOSED rather than run elevated.\n        const ownerId = report.owner_id;\n        const runContext = ownerId && this.resolveOwnerContext\n          ? await this.resolveOwnerContext(ownerId).catch((err) => {\n              this.logger.warn?.('ReportService.dispatchDue: owner context resolution failed', err);\n              return null;\n            })\n          : null;\n        if (!runContext) {\n          failed++;\n          await this.markSchedule(schedule.id, {\n            last_status: 'failed',\n            last_error: ownerId\n              ? `owner '${ownerId}' context unavailable — refusing to run scheduled report with RLS bypassed (#2849/#2980)`\n              : 'report has no owner — refusing to run scheduled report with RLS bypassed (#2849/#2980)',\n          });\n          continue;\n        }\n\n        // Force the schedule's own format so the recipient gets what\n        // the admin configured (CSV attachment vs inline HTML table).\n        const fmt: ReportFormat = (schedule.format ?? 'html_table') as ReportFormat;\n        const result = await this.executeReport({ ...report, format: fmt }, runContext, false);\n\n        const recipients = schedule.recipients.split(',').map(s => s.trim()).filter(Boolean);\n        const subject = renderSubject(schedule.subject_template, {\n          name: schedule.name ?? report.name,\n          date: ts.slice(0, 10),\n          rows: String(result.rowCount),\n        });\n\n        if (this.email && recipients.length > 0) {\n          if (fmt === 'csv') {\n            await this.email.send({\n              to: recipients,\n              subject,\n              text: `Attached: ${result.rowCount} row(s).`,\n              attachments: [{\n                // Keep unicode letters (CJK schedule names) — only strip\n                // filesystem-hostile characters, else 周报 becomes `__`.\n                filename: `${(schedule.name ?? report.name).replace(/[^\\p{L}\\p{N}._-]+/gu, '_').replace(/^_+|_+$/g, '') || 'report'}-${ts.slice(0, 10)}.csv`,\n                content: result.body,\n                contentType: 'text/csv',\n              }],\n              relatedObject: 'sys_report_schedule',\n              relatedId: schedule.id,\n            });\n          } else {\n            await this.email.send({\n              to: recipients,\n              subject,\n              html: `<p>${escapeHtml(report.name)} — ${result.rowCount} row(s)</p>${result.body}`,\n              text: `${report.name} — ${result.rowCount} row(s)`,\n              relatedObject: 'sys_report_schedule',\n              relatedId: schedule.id,\n            });\n          }\n        } else if (!this.email) {\n          this.logger.warn?.('ReportService.dispatchDue: no email service — schedule fired but mail not sent');\n        }\n\n        await this.advanceSchedule(schedule, ts);\n        fired++;\n      } catch (err: any) {\n        failed++;\n        await this.markSchedule(schedule.id, {\n          last_status: 'failed',\n          last_error: String(err?.message ?? err ?? 'unknown').slice(0, 500),\n        });\n        this.logger.error?.('ReportService.dispatchDue: schedule failed', err);\n      }\n    }\n    return { fired, failed, skipped };\n  }\n\n  /**\n   * Compute the next fire time for a schedule. A `cron_expression` wins over\n   * `interval_minutes` (the documented `sys_report_schedule` contract) and is\n   * evaluated in the schedule's `timezone` (default UTC) via croner — the same\n   * library the job scheduler uses. Falls back to `from + interval_minutes` for\n   * interval schedules, and also if a cron expression is invalid or has no\n   * future occurrence (logged; never throws into the sweep). `from` is the\n   * reference instant (the injected clock), so `today()`-style boundaries honor\n   * the test clock.\n   */\n  private nextRunAt(\n    schedule: { cron_expression?: string | null; interval_minutes?: number | null; timezone?: string | null },\n    from: Date,\n  ): Date {\n    const cron = (schedule.cron_expression ?? '').trim();\n    if (cron) {\n      try {\n        const next = new Cron(cron, { timezone: schedule.timezone || 'UTC' }).nextRun(from);\n        if (next) return next;\n        this.logger.warn?.(`ReportService: cron '${cron}' has no next occurrence; falling back to interval`);\n      } catch (err) {\n        this.logger.warn?.(`ReportService: invalid cron '${cron}'; falling back to interval`, err);\n      }\n    }\n    const interval = schedule.interval_minutes ?? DEFAULT_INTERVAL_MIN;\n    return new Date(from.getTime() + interval * 60_000);\n  }\n\n  private async advanceSchedule(schedule: ReportSchedule, ranAt: string): Promise<void> {\n    const nextRun = this.nextRunAt(schedule, this.clock.now()).toISOString();\n    await this.engine.update('sys_report_schedule', {\n      id: schedule.id,\n      next_run_at: nextRun,\n      last_sent_at: ranAt,\n      last_status: 'ok',\n      last_error: null,\n      updated_at: ranAt,\n    }, { context: SYSTEM_CTX });\n  }\n\n  private async markSchedule(id: string, patch: Record<string, unknown>): Promise<void> {\n    try {\n      await this.engine.update('sys_report_schedule', {\n        id, ...patch, updated_at: this.clock.now().toISOString(),\n      }, { context: SYSTEM_CTX });\n    } catch (err) {\n      this.logger.warn?.('ReportService: failed to mark schedule', err);\n    }\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { Plugin, PluginContext } from '@objectstack/core';\nimport type {\n  IDataEngine,\n  IJobService,\n  ISecurityService,\n  SecurityContext,\n} from '@objectstack/spec/contracts';\nimport {\n  SysSavedReport,\n  SysReportSchedule,\n} from '@objectstack/platform-objects/audit';\nimport { ReportService, type ReportEngine, type ReportEmail } from './report-service.js';\n\nexport interface ReportsPluginOptions {\n  /**\n   * How often the dispatcher should poll `sys_report_schedule` for\n   * due rows. Defaults to 60 seconds — short enough to honour\n   * minute-grained schedules without flooding the DB.\n   */\n  dispatchIntervalMs?: number;\n  /** Cap rows per report. Mirrors ReportServiceOptions.maxRows. */\n  maxRows?: number;\n  /** Disable the dispatcher tick entirely. */\n  disableDispatcher?: boolean;\n}\n\n/**\n * ReportsServicePlugin — registers `sys_saved_report` /\n * `sys_report_schedule`, the `reports` service, and the dispatcher\n * loop that emails due schedules.\n *\n * The dispatcher uses `IJobService.schedule` when one is registered;\n * otherwise it falls back to a plain `setInterval` so single-kernel\n * deployments work without `service-job`.\n *\n * @example\n * ```ts\n * import { ReportsServicePlugin } from '@objectstack/plugin-reports';\n *\n * kernel.use(new ReportsServicePlugin({ dispatchIntervalMs: 60_000 }));\n * ```\n */\nexport class ReportsServicePlugin implements Plugin {\n  name = 'com.objectstack.service.reports';\n  version = '1.0.0';\n  type = 'standard';\n  dependencies = ['com.objectstack.engine.objectql'];\n\n  private readonly options: ReportsPluginOptions;\n  private service?: ReportService;\n  private intervalHandle?: ReturnType<typeof setInterval>;\n  private jobName?: string;\n  private jobService?: IJobService;\n\n  constructor(options: ReportsPluginOptions = {}) {\n    this.options = options;\n  }\n\n  async init(ctx: PluginContext): Promise<void> {\n    ctx.getService<{ register(m: any): void }>('manifest').register({\n      id: 'com.objectstack.service.reports',\n      name: 'Reports Service',\n      version: '1.0.0',\n      type: 'plugin',\n      scope: 'system',\n      defaultDatasource: 'cloud',\n      namespace: 'sys',\n      objects: [SysSavedReport, SysReportSchedule],\n    });\n    ctx.logger.info('ReportsServicePlugin: schemas registered');\n  }\n\n  async start(ctx: PluginContext): Promise<void> {\n    ctx.hook('kernel:ready', async () => {\n      // `IDataEngine`, not the whole engine: `ReportEngine` is a pure data-plane\n      // slice (find/findOne/insert/update/delete), so the narrow contract is the\n      // honest one for BOTH names — `objectql` strictly widens `data` (#4404),\n      // and nothing here reaches past the data plane.\n      let engine: IDataEngine | null = null;\n      try { engine = ctx.getService<IDataEngine>('objectql'); }\n      catch { try { engine = ctx.getService<IDataEngine>('data'); } catch { /* ignore */ } }\n      if (!engine) {\n        ctx.logger.warn('ReportsServicePlugin: no ObjectQL engine — service NOT registered');\n        return;\n      }\n\n      let email: ReportEmail | undefined;\n      // `ReportEmail` — the named surface this plugin consumes. `IEmailService`\n      // passes straight through it (see the declaration); naming the slice is\n      // what makes a drift in `send`'s shape a compile error here.\n      try { email = ctx.getService<ReportEmail>('email'); } catch { /* email is optional */ }\n      if (!email) {\n        ctx.logger.warn('ReportsServicePlugin: no email service — schedules will fire without delivery');\n      }\n\n      // [#3544 / #3710] The user-level export axis. A `csv`/`json` report is a\n      // bulk machine-readable copy of its object — the same privilege\n      // `GET /data/:object/export` gates — so the reports surface must ask the\n      // SAME question of the SAME authority, or it is a side door around the\n      // axis. Resolved lazily per call rather than captured here: `security` is\n      // registered by plugin-security's own `kernel:ready` hook and may not\n      // exist yet at construction time. Absent service (no plugin-security ⇒ no\n      // permission sets anywhere) → the axis does not apply, matching the REST\n      // export route's fail-open.\n      const canExport = async (object: string, context: unknown): Promise<boolean> => {\n        let security: ISecurityService | undefined;\n        try { security = ctx.getService<ISecurityService>('security'); } catch { return true; }\n        if (!security || typeof security.canExport !== 'function') return true;\n        // `ReportService` hands this callback an `unknown` context (it is the\n        // caller's execution envelope, opaque to reports); the security service\n        // types it as a partial `ExecutionContext`.\n        return await security.canExport(object, context as SecurityContext | undefined);\n      };\n\n      this.service = new ReportService({\n        engine: engine as ReportEngine,\n        email,\n        logger: ctx.logger,\n        maxRows: this.options.maxRows,\n        canExport,\n        // Scheduled reports run under the owner's resolved RLS context, not a\n        // system bypass (#2980). No owner-context resolver is wired yet — that\n        // is the reports-surface consumer of ADR-0073's user-less identity\n        // resolution (M2) — so until it lands, scheduled runs FAIL CLOSED\n        // (skipped + marked failed) rather than exfiltrate. Interactive runs\n        // (run/runAdHoc) are unaffected: they carry the caller's context.\n        resolveOwnerContext: undefined,\n      });\n      ctx.registerService('reports', this.service);\n\n      if (this.options.disableDispatcher) {\n        ctx.logger.info('ReportsServicePlugin: dispatcher disabled (disableDispatcher=true)');\n        return;\n      }\n\n      const intervalMs = Math.max(5_000, this.options.dispatchIntervalMs ?? 60_000);\n\n      // Prefer the platform job service when available — it lets ops\n      // see report dispatch alongside every other scheduled job.\n      try {\n        const job = ctx.getService<IJobService>('job');\n        if (job && typeof job.schedule === 'function') {\n          this.jobService = job;\n          this.jobName = 'reports.dispatch';\n          await job.schedule(this.jobName, { type: 'interval', intervalMs }, async () => {\n            try { await this.service?.dispatchDue(); }\n            catch (err) { ctx.logger.warn('ReportsServicePlugin: dispatch tick failed', err as any); }\n          });\n          ctx.logger.info('ReportsServicePlugin: dispatcher registered with job service', { intervalMs });\n          return;\n        }\n      } catch { /* fall through to setInterval */ }\n\n      this.intervalHandle = setInterval(() => {\n        this.service?.dispatchDue().catch(err => {\n          ctx.logger.warn('ReportsServicePlugin: dispatch tick failed', err);\n        });\n      }, intervalMs);\n      // Don't keep Node alive purely for the dispatcher — common\n      // mistake in tests / serverless. unref is a no-op in some\n      // runtimes which is fine.\n      (this.intervalHandle as any)?.unref?.();\n      ctx.logger.info('ReportsServicePlugin: dispatcher registered (setInterval fallback)', { intervalMs });\n    });\n  }\n\n  async stop(ctx: PluginContext): Promise<void> {\n    if (this.intervalHandle) clearInterval(this.intervalHandle);\n    this.intervalHandle = undefined;\n    if (this.jobService && this.jobName && typeof this.jobService.cancel === 'function') {\n      try { await this.jobService.cancel(this.jobName); }\n      catch (err) { ctx.logger.warn('ReportsServicePlugin: failed to cancel job', err as any); }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,IAAAA,gBAAkD;;;ACTlD,kBAA4C;AAkB5C,oBAAqB;AAiCrB,IAAM,aAAa,EAAE,UAAU,MAAM,WAAW,CAAC,GAAG,aAAa,CAAC,EAAE;AAEpE,IAAM,iBAA+B;AACrC,IAAM,uBAAuB;AAC7B,IAAM,gBAAgB;AAEtB,SAAS,IAAI,QAAwB;AACnC,QAAM,IAAS;AACf,MAAI,EAAE,QAAQ,WAAY,QAAO,GAAG,MAAM,IAAI,EAAE,OAAO,WAAW,CAAC;AACnE,SAAO,GAAG,MAAM,IAAI,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AACxF;AAEA,SAAS,WAAW,KAA2B;AAC7C,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI;AAAE,aAAO,KAAK,MAAM,GAAG;AAAA,IAAkB,QACvC;AAAE,aAAO,CAAC;AAAA,IAAG;AAAA,EACrB;AACA,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,SAAO,CAAC;AACV;AAEA,SAAS,aAAa,KAAuB;AAC3C,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,MAAM,OAAO,IAAI,QAAQ,EAAE;AAAA,IAC3B,aAAa,IAAI,eAAe;AAAA,IAChC,aAAa,OAAO,IAAI,eAAe,EAAE;AAAA,IACzC,OAAO,WAAW,IAAI,UAAU;AAAA,IAChC,QAAS,IAAI,UAA2B;AAAA,IACxC,UAAU,IAAI,YAAY;AAAA,IAC1B,aAAa,IAAI,eAAe;AAAA,IAChC,gBAAgB,IAAI,kBAAkB;AAAA,IACtC,YAAY,IAAI,cAAc;AAAA,IAC9B,YAAY,IAAI,cAAc;AAAA,EAChC;AACF;AAEA,SAAS,gBAAgB,KAA0B;AACjD,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,MAAM,IAAI,QAAQ;AAAA,IAClB,kBAAkB,IAAI,oBAAoB;AAAA,IAC1C,iBAAiB,IAAI,mBAAmB;AAAA,IACxC,UAAU,IAAI,YAAY;AAAA,IAC1B,QAAQ,IAAI,WAAW;AAAA,IACvB,YAAY,OAAO,IAAI,cAAc,EAAE;AAAA,IACvC,QAAQ,IAAI,UAAU;AAAA,IACtB,kBAAkB,IAAI,oBAAoB;AAAA,IAC1C,UAAU,IAAI,YAAY;AAAA,IAC1B,aAAa,IAAI,eAAe;AAAA,IAChC,cAAc,IAAI,gBAAgB;AAAA,IAClC,aAAa,IAAI,eAAe;AAAA,IAChC,YAAY,IAAI,cAAc;AAAA,EAChC;AACF;AAIA,SAAS,cAAc,GAAoB;AACzC,MAAI,KAAK,KAAM,QAAO;AACtB,QAAM,IAAI,OAAO,MAAM,WAAW,IAAK,OAAO,MAAM,WAAW,KAAK,UAAU,CAAC,IAAI,OAAO,CAAC;AAC3F,MAAI,WAAW,KAAK,CAAC,EAAG,QAAO,IAAI,EAAE,QAAQ,MAAM,IAAI,CAAC;AACxD,SAAO;AACT;AAEA,SAAS,WAAW,MAAa,UAA+B;AAC9D,MAAI,YAAY,SAAS,SAAS,EAAG,QAAO;AAC5C,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,KAAK,MAAM,GAAG,EAAE,GAAG;AACjC,QAAI,KAAK,OAAO,MAAM,SAAU,YAAW,KAAK,OAAO,KAAK,CAAC,EAAG,MAAK,IAAI,CAAC;AAAA,EAC5E;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,UAAU,MAAa,QAA2B;AACzD,QAAM,OAAO,WAAW,MAAM,MAAM;AACpC,QAAM,OAAO,KAAK,KAAK,GAAG;AAC1B,QAAM,OAAO,KAAK,IAAI,OAAK,KAAK,IAAI,OAAK,cAAc,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,MAAM;AACtF,SAAO,KAAK,SAAS,IAAI,GAAG,IAAI;AAAA,EAAO,IAAI,KAAK;AAClD;AAEA,SAAS,WAAW,MAAqB;AACvC,SAAO,KAAK,UAAU,MAAM,MAAM,CAAC;AACrC;AAEA,SAAS,WAAW,GAAmB;AACrC,SAAO,EAAE,QAAQ,YAAY,QAAM;AAAA,IACjC,KAAK;AAAA,IAAS,KAAK;AAAA,IAAQ,KAAK;AAAA,IAAQ,KAAK;AAAA,IAAU,KAAK;AAAA,EAC9D,GAA6B,CAAC,CAAC;AACjC;AAEA,SAAS,gBAAgB,MAAa,QAA2B;AAC/D,QAAM,OAAO,WAAW,MAAM,MAAM;AACpC,QAAM,KAAK,KAAK,IAAI,OAAK,6EAA6E,WAAW,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE;AACnI,QAAM,MAAM,KAAK,IAAI,OAAK;AACxB,UAAM,MAAM,KAAK,IAAI,OAAK;AACxB,YAAM,IAAI,IAAI,CAAC;AACf,YAAM,IAAI,KAAK,OAAO,KAAM,OAAO,MAAM,WAAW,IAAK,OAAO,MAAM,WAAW,KAAK,UAAU,CAAC,IAAI,OAAO,CAAC;AAC7G,aAAO,6DAA6D,WAAW,CAAC,CAAC;AAAA,IACnF,CAAC,EAAE,KAAK,EAAE;AACV,WAAO,OAAO,GAAG;AAAA,EACnB,CAAC,EAAE,KAAK,EAAE;AACV,SAAO,6GACW,EAAE,uBAAuB,GAAG;AAChD;AAEO,SAAS,aAAa,MAAa,QAAsB,QAA2B;AACzF,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAQ,aAAO,WAAW,IAAI;AAAA,IACnC,KAAK;AAAc,aAAO,gBAAgB,MAAM,MAAM;AAAA,IACtD,KAAK;AAAA,IACL;AAAS,aAAO,UAAU,MAAM,MAAM;AAAA,EACxC;AACF;AAIA,SAAS,cAAc,UAA8B,MAAsC;AACzF,QAAM,MAAM,YAAY;AACxB,SAAO,IAAI,QAAQ,wBAAwB,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,KAAK,EAAE;AAC7E;AAiFA,IAAM,sBAA2C,oBAAI,IAAI,CAAC,OAAO,MAAM,CAAC;AAEjE,IAAM,gBAAN,MAA8C;AAAA,EASnD,YAAY,MAA4B;AACtC,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAClB,SAAK,QAAQ,KAAK,SAAS,EAAE,KAAK,MAAM,oBAAI,KAAK,EAAE;AACnD,SAAK,SAAS,KAAK,UAAU,CAAC;AAC9B,SAAK,UAAU,KAAK,IAAI,GAAG,KAAK,WAAW,GAAI;AAC/C,SAAK,sBAAsB,KAAK;AAChC,SAAK,cAAc,KAAK;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAc,oBACZ,QACA,QACA,SACe;AACf,QAAI,CAAC,oBAAoB,IAAI,MAAM,EAAG;AACtC,QAAI,SAAS,SAAU;AACvB,QAAI,CAAC,KAAK,YAAa;AACvB,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,YAAY,QAAQ,OAAO;AAAA,IAClD,SAAS,KAAK;AACZ,WAAK,OAAO,OAAO,+DAA0D,GAAG;AAChF,gBAAU;AAAA,IACZ;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,oCAAoC,MAAM,QAAQ,MAAM;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,gBAAgB,KAAgD,SAAgD;AACtH,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,SAAS,SAAU,QAAO;AAC9B,UAAM,SAAS,SAAS;AACxB,WAAO,CAAC,CAAC,UAAU,IAAI,aAAa;AAAA,EACtC;AAAA;AAAA,EAGA,MAAc,cAAc,UAAuC;AACjE,UAAM,OAAO,MAAM,KAAK,OAAO,KAAK,oBAAoB;AAAA,MACtD,OAAO,EAAE,IAAI,SAAS;AAAA,MAAG,OAAO;AAAA,MAAG,SAAS;AAAA,IAC9C,CAAC;AACD,WAAO,MAAM,QAAQ,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI;AAAA,EACpD;AAAA;AAAA,EAGA,MAAc,gBAAgB,YAAyC;AACrE,UAAM,OAAO,MAAM,KAAK,OAAO,KAAK,uBAAuB;AAAA,MACzD,OAAO,EAAE,IAAI,WAAW;AAAA,MAAG,OAAO;AAAA,MAAG,SAAS;AAAA,IAChD,CAAC;AACD,WAAO,MAAM,QAAQ,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI;AAAA,EACpD;AAAA;AAAA,EAIA,MAAM,WAAW,OAAwB,SAAiD;AACxF,QAAI,CAAC,MAAM,KAAM,OAAM,IAAI,MAAM,qCAAqC;AACtE,QAAI,CAAC,MAAM,OAAQ,OAAM,IAAI,MAAM,uCAAuC;AAC1E,QAAI,CAAC,MAAM,MAAO,OAAM,IAAI,MAAM,sCAAsC;AAExE,UAAM,MAAM,KAAK,MAAM,IAAI,EAAE,YAAY;AAIzC,UAAM,UAAU,QAAQ,WAAY,MAAM,WAAW,QAAQ,UAAU,OAAS,QAAQ,UAAU;AAClG,UAAM,UAAe;AAAA,MACnB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM,eAAe;AAAA,MAClC,aAAa,MAAM;AAAA,MACnB,YAAY,KAAK,UAAU,MAAM,SAAS,CAAC,CAAC;AAAA,MAC5C,QAAQ,MAAM,UAAU;AAAA,MACxB,UAAU;AAAA,MACV,YAAY;AAAA,IACd;AAEA,QAAI,MAAM,IAAI;AACZ,YAAM,WAAW,MAAM,KAAK,cAAc,MAAM,EAAE;AAClD,UAAI,UAAU;AAIZ,YAAI,CAAC,KAAK,gBAAgB,UAAU,OAAO,GAAG;AAC5C,gBAAM,IAAI,MAAM,qBAAqB,MAAM,EAAE,EAAE;AAAA,QACjD;AAEA,YAAI,CAAC,QAAQ,SAAU,SAAQ,WAAW,SAAS,YAAY,QAAQ;AACvE,cAAM,KAAK,OAAO,OAAO,oBAAoB,EAAE,IAAI,MAAM,IAAI,GAAG,QAAQ,GAAG,EAAE,SAAS,WAAW,CAAC;AAClG,eAAO,aAAa,EAAE,GAAG,UAAU,GAAG,SAAS,IAAI,MAAM,GAAG,CAAC;AAAA,MAC/D;AAAA,IACF;AAEA,UAAM,KAAK,MAAM,MAAM,IAAI,KAAK;AAChC,UAAM,MAAM,EAAE,IAAI,GAAG,SAAS,YAAY,IAAI;AAC9C,UAAM,KAAK,OAAO,OAAO,oBAAoB,KAAK,EAAE,SAAS,WAAW,CAAC;AACzE,WAAO,aAAa,GAAG;AAAA,EACzB;AAAA,EAEA,MAAM,YACJ,QACA,SACwB;AACxB,UAAM,IAAS,CAAC;AAChB,QAAI,QAAQ,OAAQ,GAAE,cAAc,OAAO;AAK3C,QAAI,SAAS,UAAU;AACrB,UAAI,QAAQ,QAAS,GAAE,WAAW,OAAO;AAAA,IAC3C,OAAO;AACL,UAAI,CAAC,SAAS,OAAQ,QAAO,CAAC;AAC9B,UAAI,QAAQ,WAAW,OAAO,YAAY,QAAQ,OAAQ,QAAO,CAAC;AAClE,QAAE,WAAW,QAAQ;AAAA,IACvB;AACA,UAAM,OAAO,MAAM,KAAK,OAAO,KAAK,oBAAoB;AAAA,MACtD,OAAO;AAAA,MAAG,OAAO;AAAA,MAAK,SAAS,CAAC,EAAE,OAAO,cAAc,OAAO,OAAO,CAAC;AAAA,MAAG,SAAS;AAAA,IACpF,CAAC;AACD,WAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,YAAY,IAAI,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,UAAU,UAAkB,SAAwD;AACxF,UAAM,MAAM,MAAM,KAAK,cAAc,QAAQ;AAE7C,QAAI,CAAC,KAAK,gBAAgB,KAAK,OAAO,EAAG,QAAO;AAChD,WAAO,aAAa,GAAG;AAAA,EACzB;AAAA,EAEA,MAAM,aAAa,UAAkB,SAA0C;AAC7E,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,yCAAyC;AACxE,UAAM,MAAM,MAAM,KAAK,cAAc,QAAQ;AAC7C,QAAI,CAAC,IAAK;AAGV,QAAI,CAAC,KAAK,gBAAgB,KAAK,OAAO,GAAG;AACvC,YAAM,IAAI,MAAM,qBAAqB,QAAQ,EAAE;AAAA,IACjD;AAEA,UAAM,YAAY,MAAM,KAAK,OAAO,KAAK,uBAAuB;AAAA,MAC9D,OAAO,EAAE,WAAW,SAAS;AAAA,MAAG,OAAO;AAAA,MAAK,SAAS;AAAA,IACvD,CAAC;AACD,eAAW,KAAM,aAAa,CAAC,GAAI;AACjC,YAAM,KAAK,OAAO,OAAO,uBAAuB,EAAE,OAAO,EAAE,IAAK,EAAU,GAAG,GAAG,SAAS,WAAW,CAAC;AAAA,IACvG;AACA,UAAM,KAAK,OAAO,OAAO,oBAAoB,EAAE,OAAO,EAAE,IAAI,SAAS,GAAG,SAAS,WAAW,CAAC;AAAA,EAC/F;AAAA;AAAA,EAIA,MAAM,IAAI,UAAkB,SAAqD;AAC/E,UAAM,SAAS,MAAM,KAAK,UAAU,UAAU,OAAO;AACrD,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qBAAqB,QAAQ,EAAE;AAC5D,WAAO,KAAK,cAAc,QAAQ,OAAO;AAAA,EAC3C;AAAA,EAEA,MAAM,SAAS,OAAwB,SAAqD;AAC1F,QAAI,CAAC,MAAM,OAAQ,OAAM,IAAI,MAAM,uCAAuC;AAC1E,QAAI,CAAC,MAAM,MAAO,OAAM,IAAI,MAAM,sCAAsC;AACxE,UAAM,QAAqB;AAAA,MACzB,IAAI;AAAA,MACJ,MAAM,MAAM,QAAQ;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM;AAAA,MACb,QAAQ,MAAM,UAAU;AAAA,IAC1B;AACA,WAAO,KAAK;AAAA,MAAc;AAAA,MAAO;AAAA;AAAA,MAAqB;AAAA,IAAK;AAAA,EAC7D;AAAA,EAEA,MAAc,cACZ,QACA,SACA,QAAQ,MACkB;AAG1B,UAAM,KAAK,oBAAoB,OAAO,aAAa,OAAO,QAAQ,OAAO;AACzE,UAAM,IAAI,OAAO,SAAS,CAAC;AAC3B,UAAM,QAAQ,KAAK,IAAI,EAAE,SAAS,eAAe,KAAK,OAAO;AAC7D,UAAM,OAAO,MAAM,KAAK,OAAO,KAAK,OAAO,aAAa;AAAA,MACtD,OAAO,EAAE;AAAA,MACT,QAAQ,EAAE;AAAA,MACV,SAAS,EAAE;AAAA,MACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MA+BA,SAAS;AAAA,QACP,OAAG,yCAA4B,OAA6C;AAAA,QAC5E,WAAW,QAAQ,aAAa,CAAC;AAAA,QACjC,aAAa,QAAQ,eAAe,CAAC;AAAA,QACrC,UAAU,QAAQ,YAAY;AAAA,MAChC;AAAA,IACF,CAAC;AACD,UAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAC3C,UAAM,OAAO,aAAa,MAAM,OAAO,QAAQ,EAAE,MAAM;AACvD,UAAM,QAAQ,KAAK,MAAM,IAAI,EAAE,YAAY;AAE3C,QAAI,SAAS,OAAO,OAAO,aAAa;AACtC,UAAI;AACF,cAAM,KAAK,OAAO,OAAO,oBAAoB;AAAA,UAC3C,IAAI,OAAO;AAAA,UACX,aAAa;AAAA,UACb,gBAAgB,KAAK;AAAA,UACrB,YAAY;AAAA,QACd,GAAG,EAAE,SAAS,WAAW,CAAC;AAAA,MAC5B,SAAS,KAAK;AACZ,aAAK,OAAO,OAAO,8CAA8C,GAAG;AAAA,MACtE;AAAA,IACF;AAEA,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,MACjB,UAAU,KAAK;AAAA,MACf,QAAQ,OAAO;AAAA,MACf;AAAA,MACA,MAAM;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIA,MAAM,eAAe,OAA4B,SAAoD;AACnG,QAAI,CAAC,MAAM,SAAU,OAAM,IAAI,MAAM,yCAAyC;AAC9E,QAAI,CAAC,MAAM,cAAc,MAAM,WAAW,WAAW,GAAG;AACtD,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,UAAM,SAAS,MAAM,KAAK,UAAU,MAAM,UAAU,OAAO;AAC3D,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qBAAqB,MAAM,QAAQ,EAAE;AAMlE,UAAM,KAAK,oBAAoB,OAAO,aAAa,MAAM,UAAU,cAAc,OAAO;AAExF,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,UAAM,WAAW,MAAM,mBAAmB;AAC1C,UAAM,OAAO,MAAM,gBAAgB,KAAK,KAAK;AAC7C,QAAI,MAAM;AAGR,UAAI;AACF,YAAI,mBAAK,MAAM,EAAE,UAAU,MAAM,YAAY,MAAM,CAAC;AAAA,MACtD,SAAS,KAAK;AACZ,cAAM,IAAI,MAAM,+CAA+C,IAAI,MAAO,IAAc,OAAO,EAAE;AAAA,MACnG;AAAA,IACF;AACA,UAAM,UAAU,KAAK;AAAA,MACnB,EAAE,iBAAiB,MAAM,kBAAkB,UAAU,UAAU,MAAM,YAAY,MAAM;AAAA,MACvF;AAAA,IACF,EAAE,YAAY;AACd,UAAM,KAAK,IAAI,MAAM;AACrB,UAAM,MAAW;AAAA,MACf;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM,QAAQ;AAAA,MACpB,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,MACjB,UAAU,MAAM,YAAY;AAAA,MAC5B,QAAQ,MAAM,WAAW;AAAA,MACzB,YAAY,MAAM,WAAW,KAAK,GAAG;AAAA,MACrC,QAAQ,MAAM,UAAU;AAAA,MACxB,kBAAkB,MAAM,mBAAmB;AAAA,MAC3C,UAAU,MAAM,WAAW,QAAQ,UAAU;AAAA,MAC7C,aAAa;AAAA,MACb,YAAY,IAAI,YAAY;AAAA,MAC5B,YAAY,IAAI,YAAY;AAAA,IAC9B;AACA,UAAM,KAAK,OAAO,OAAO,uBAAuB,KAAK,EAAE,SAAS,WAAW,CAAC;AAC5E,WAAO,gBAAgB,GAAG;AAAA,EAC5B;AAAA,EAEA,MAAM,iBAAiB,YAAoB,SAA0C;AACnF,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,2CAA2C;AAC5E,UAAM,WAAW,MAAM,KAAK,gBAAgB,UAAU;AACtD,QAAI,CAAC,SAAU;AAKf,UAAM,SAAS,MAAM,KAAK,cAAc,SAAS,SAAS;AAC1D,QAAI,CAAC,KAAK,gBAAgB,QAAQ,OAAO,GAAG;AAC1C,YAAM,IAAI,MAAM,qBAAqB,UAAU,EAAE;AAAA,IACnD;AACA,UAAM,KAAK,OAAO,OAAO,uBAAuB,EAAE,OAAO,EAAE,IAAI,WAAW,GAAG,SAAS,WAAW,CAAC;AAAA,EACpG;AAAA,EAEA,MAAM,cACJ,QACA,SAC2B;AAM3B,QAAI,CAAC,SAAS,UAAU;AACtB,UAAI,CAAC,QAAQ,SAAU,QAAO,CAAC;AAC/B,UAAI,CAAE,MAAM,KAAK,UAAU,OAAO,UAAU,OAAO,EAAI,QAAO,CAAC;AAAA,IACjE;AACA,UAAM,IAAS,CAAC;AAChB,QAAI,QAAQ,SAAU,GAAE,YAAY,OAAO;AAC3C,UAAM,OAAO,MAAM,KAAK,OAAO,KAAK,uBAAuB;AAAA,MACzD,OAAO;AAAA,MAAG,OAAO;AAAA,MAAK,SAAS,CAAC,EAAE,OAAO,eAAe,OAAO,MAAM,CAAC;AAAA,MAAG,SAAS;AAAA,IACpF,CAAC;AACD,WAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,eAAe,IAAI,CAAC;AAAA,EAC5D;AAAA;AAAA,EAIA,MAAM,YAAY,KAAyE;AACzF,UAAM,MAAM,OAAO,KAAK,MAAM,IAAI,GAAG,YAAY;AACjD,UAAM,MAAM,MAAM,KAAK,OAAO,KAAK,uBAAuB;AAAA,MACxD,OAAO,EAAE,QAAQ,KAAK;AAAA,MACtB,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AACD,UAAM,QAAQ,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,eAAe,EAC7D,OAAO,OAAK,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE;AAEpD,QAAI,QAAQ,GAAG,SAAS,GAAG,UAAU;AACrC,eAAW,YAAY,MAAM;AAC3B,UAAI;AACF,cAAM,MAAM,MAAM,KAAK,cAAc,SAAS,SAAS;AACvD,YAAI,CAAC,KAAK;AACR;AACA,gBAAM,KAAK,aAAa,SAAS,IAAI;AAAA,YACnC,aAAa;AAAA,YACb,YAAY,UAAU,SAAS,SAAS;AAAA,UAC1C,CAAC;AACD;AAAA,QACF;AACA,cAAM,SAAS,aAAa,GAAG;AAQ/B,cAAM,UAAU,OAAO;AACvB,cAAM,aAAa,WAAW,KAAK,sBAC/B,MAAM,KAAK,oBAAoB,OAAO,EAAE,MAAM,CAAC,QAAQ;AACrD,eAAK,OAAO,OAAO,8DAA8D,GAAG;AACpF,iBAAO;AAAA,QACT,CAAC,IACD;AACJ,YAAI,CAAC,YAAY;AACf;AACA,gBAAM,KAAK,aAAa,SAAS,IAAI;AAAA,YACnC,aAAa;AAAA,YACb,YAAY,UACR,UAAU,OAAO,kGACjB;AAAA,UACN,CAAC;AACD;AAAA,QACF;AAIA,cAAM,MAAqB,SAAS,UAAU;AAC9C,cAAM,SAAS,MAAM,KAAK,cAAc,EAAE,GAAG,QAAQ,QAAQ,IAAI,GAAG,YAAY,KAAK;AAErF,cAAM,aAAa,SAAS,WAAW,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACnF,cAAM,UAAU,cAAc,SAAS,kBAAkB;AAAA,UACvD,MAAM,SAAS,QAAQ,OAAO;AAAA,UAC9B,MAAM,GAAG,MAAM,GAAG,EAAE;AAAA,UACpB,MAAM,OAAO,OAAO,QAAQ;AAAA,QAC9B,CAAC;AAED,YAAI,KAAK,SAAS,WAAW,SAAS,GAAG;AACvC,cAAI,QAAQ,OAAO;AACjB,kBAAM,KAAK,MAAM,KAAK;AAAA,cACpB,IAAI;AAAA,cACJ;AAAA,cACA,MAAM,aAAa,OAAO,QAAQ;AAAA,cAClC,aAAa,CAAC;AAAA;AAAA;AAAA,gBAGZ,UAAU,IAAI,SAAS,QAAQ,OAAO,MAAM,QAAQ,uBAAuB,GAAG,EAAE,QAAQ,YAAY,EAAE,KAAK,QAAQ,IAAI,GAAG,MAAM,GAAG,EAAE,CAAC;AAAA,gBACtI,SAAS,OAAO;AAAA,gBAChB,aAAa;AAAA,cACf,CAAC;AAAA,cACD,eAAe;AAAA,cACf,WAAW,SAAS;AAAA,YACtB,CAAC;AAAA,UACH,OAAO;AACL,kBAAM,KAAK,MAAM,KAAK;AAAA,cACpB,IAAI;AAAA,cACJ;AAAA,cACA,MAAM,MAAM,WAAW,OAAO,IAAI,CAAC,WAAM,OAAO,QAAQ,cAAc,OAAO,IAAI;AAAA,cACjF,MAAM,GAAG,OAAO,IAAI,WAAM,OAAO,QAAQ;AAAA,cACzC,eAAe;AAAA,cACf,WAAW,SAAS;AAAA,YACtB,CAAC;AAAA,UACH;AAAA,QACF,WAAW,CAAC,KAAK,OAAO;AACtB,eAAK,OAAO,OAAO,qFAAgF;AAAA,QACrG;AAEA,cAAM,KAAK,gBAAgB,UAAU,EAAE;AACvC;AAAA,MACF,SAAS,KAAU;AACjB;AACA,cAAM,KAAK,aAAa,SAAS,IAAI;AAAA,UACnC,aAAa;AAAA,UACb,YAAY,OAAO,KAAK,WAAW,OAAO,SAAS,EAAE,MAAM,GAAG,GAAG;AAAA,QACnE,CAAC;AACD,aAAK,OAAO,QAAQ,8CAA8C,GAAG;AAAA,MACvE;AAAA,IACF;AACA,WAAO,EAAE,OAAO,QAAQ,QAAQ;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYQ,UACN,UACA,MACM;AACN,UAAM,QAAQ,SAAS,mBAAmB,IAAI,KAAK;AACnD,QAAI,MAAM;AACR,UAAI;AACF,cAAM,OAAO,IAAI,mBAAK,MAAM,EAAE,UAAU,SAAS,YAAY,MAAM,CAAC,EAAE,QAAQ,IAAI;AAClF,YAAI,KAAM,QAAO;AACjB,aAAK,OAAO,OAAO,wBAAwB,IAAI,oDAAoD;AAAA,MACrG,SAAS,KAAK;AACZ,aAAK,OAAO,OAAO,gCAAgC,IAAI,+BAA+B,GAAG;AAAA,MAC3F;AAAA,IACF;AACA,UAAM,WAAW,SAAS,oBAAoB;AAC9C,WAAO,IAAI,KAAK,KAAK,QAAQ,IAAI,WAAW,GAAM;AAAA,EACpD;AAAA,EAEA,MAAc,gBAAgB,UAA0B,OAA8B;AACpF,UAAM,UAAU,KAAK,UAAU,UAAU,KAAK,MAAM,IAAI,CAAC,EAAE,YAAY;AACvE,UAAM,KAAK,OAAO,OAAO,uBAAuB;AAAA,MAC9C,IAAI,SAAS;AAAA,MACb,aAAa;AAAA,MACb,cAAc;AAAA,MACd,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,GAAG,EAAE,SAAS,WAAW,CAAC;AAAA,EAC5B;AAAA,EAEA,MAAc,aAAa,IAAY,OAA+C;AACpF,QAAI;AACF,YAAM,KAAK,OAAO,OAAO,uBAAuB;AAAA,QAC9C;AAAA,QAAI,GAAG;AAAA,QAAO,YAAY,KAAK,MAAM,IAAI,EAAE,YAAY;AAAA,MACzD,GAAG,EAAE,SAAS,WAAW,CAAC;AAAA,IAC5B,SAAS,KAAK;AACZ,WAAK,OAAO,OAAO,0CAA0C,GAAG;AAAA,IAClE;AAAA,EACF;AACF;;;AC5wBA,mBAGO;AAgCA,IAAM,uBAAN,MAA6C;AAAA,EAYlD,YAAY,UAAgC,CAAC,GAAG;AAXhD,gBAAO;AACP,mBAAU;AACV,gBAAO;AACP,wBAAe,CAAC,iCAAiC;AAS/C,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,MAAM,KAAK,KAAmC;AAC5C,QAAI,WAAuC,UAAU,EAAE,SAAS;AAAA,MAC9D,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,MACP,mBAAmB;AAAA,MACnB,WAAW;AAAA,MACX,SAAS,CAAC,6BAAgB,8BAAiB;AAAA,IAC7C,CAAC;AACD,QAAI,OAAO,KAAK,0CAA0C;AAAA,EAC5D;AAAA,EAEA,MAAM,MAAM,KAAmC;AAC7C,QAAI,KAAK,gBAAgB,YAAY;AAKnC,UAAI,SAA6B;AACjC,UAAI;AAAE,iBAAS,IAAI,WAAwB,UAAU;AAAA,MAAG,QAClD;AAAE,YAAI;AAAE,mBAAS,IAAI,WAAwB,MAAM;AAAA,QAAG,QAAQ;AAAA,QAAe;AAAA,MAAE;AACrF,UAAI,CAAC,QAAQ;AACX,YAAI,OAAO,KAAK,wEAAmE;AACnF;AAAA,MACF;AAEA,UAAI;AAIJ,UAAI;AAAE,gBAAQ,IAAI,WAAwB,OAAO;AAAA,MAAG,QAAQ;AAAA,MAA0B;AACtF,UAAI,CAAC,OAAO;AACV,YAAI,OAAO,KAAK,oFAA+E;AAAA,MACjG;AAWA,YAAM,YAAY,OAAO,QAAgB,YAAuC;AAC9E,YAAI;AACJ,YAAI;AAAE,qBAAW,IAAI,WAA6B,UAAU;AAAA,QAAG,QAAQ;AAAE,iBAAO;AAAA,QAAM;AACtF,YAAI,CAAC,YAAY,OAAO,SAAS,cAAc,WAAY,QAAO;AAIlE,eAAO,MAAM,SAAS,UAAU,QAAQ,OAAsC;AAAA,MAChF;AAEA,WAAK,UAAU,IAAI,cAAc;AAAA,QAC/B;AAAA,QACA;AAAA,QACA,QAAQ,IAAI;AAAA,QACZ,SAAS,KAAK,QAAQ;AAAA,QACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOA,qBAAqB;AAAA,MACvB,CAAC;AACD,UAAI,gBAAgB,WAAW,KAAK,OAAO;AAE3C,UAAI,KAAK,QAAQ,mBAAmB;AAClC,YAAI,OAAO,KAAK,oEAAoE;AACpF;AAAA,MACF;AAEA,YAAM,aAAa,KAAK,IAAI,KAAO,KAAK,QAAQ,sBAAsB,GAAM;AAI5E,UAAI;AACF,cAAM,MAAM,IAAI,WAAwB,KAAK;AAC7C,YAAI,OAAO,OAAO,IAAI,aAAa,YAAY;AAC7C,eAAK,aAAa;AAClB,eAAK,UAAU;AACf,gBAAM,IAAI,SAAS,KAAK,SAAS,EAAE,MAAM,YAAY,WAAW,GAAG,YAAY;AAC7E,gBAAI;AAAE,oBAAM,KAAK,SAAS,YAAY;AAAA,YAAG,SAClC,KAAK;AAAE,kBAAI,OAAO,KAAK,8CAA8C,GAAU;AAAA,YAAG;AAAA,UAC3F,CAAC;AACD,cAAI,OAAO,KAAK,gEAAgE,EAAE,WAAW,CAAC;AAC9F;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAAoC;AAE5C,WAAK,iBAAiB,YAAY,MAAM;AACtC,aAAK,SAAS,YAAY,EAAE,MAAM,SAAO;AACvC,cAAI,OAAO,KAAK,8CAA8C,GAAG;AAAA,QACnE,CAAC;AAAA,MACH,GAAG,UAAU;AAIb,MAAC,KAAK,gBAAwB,QAAQ;AACtC,UAAI,OAAO,KAAK,sEAAsE,EAAE,WAAW,CAAC;AAAA,IACtG,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,KAAK,KAAmC;AAC5C,QAAI,KAAK,eAAgB,eAAc,KAAK,cAAc;AAC1D,SAAK,iBAAiB;AACtB,QAAI,KAAK,cAAc,KAAK,WAAW,OAAO,KAAK,WAAW,WAAW,YAAY;AACnF,UAAI;AAAE,cAAM,KAAK,WAAW,OAAO,KAAK,OAAO;AAAA,MAAG,SAC3C,KAAK;AAAE,YAAI,OAAO,KAAK,8CAA8C,GAAU;AAAA,MAAG;AAAA,IAC3F;AAAA,EACF;AACF;","names":["import_audit"]}
+{"version":3,"sources":["../src/index.ts","../src/report-service.ts","../src/reports-plugin.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * @objectstack/plugin-reports\n *\n * Saved reports + scheduled email digests for ObjectStack.\n * Persists `sys_saved_report` definitions and `sys_report_schedule`\n * rows, then drives a dispatcher that runs due schedules and emails\n * the rendered output via the configured `email` service.\n */\n\nexport { SysSavedReport, SysReportSchedule } from '@objectstack/platform-objects/audit';\nexport {\n  ReportService,\n  renderReport,\n  type ReportEngine,\n  type ReportEmail,\n  type ReportClock,\n  type ReportServiceOptions,\n} from './report-service.js';\nexport {\n  ReportsServicePlugin,\n  type ReportsPluginOptions,\n} from './reports-plugin.js';\nexport type {\n  IReportService,\n  SavedReport,\n  ReportSchedule,\n  ReportQuery,\n  ReportRunResult,\n  ReportFormat,\n  SaveReportInput,\n  ScheduleReportInput,\n} from '@objectstack/spec/contracts';\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { withoutOperationPrivateKeys } from '@objectstack/core';\nimport type {\n  IReportService,\n  SavedReport,\n  ReportSchedule,\n  ReportQuery,\n  ReportRunResult,\n  ReportFormat,\n  SaveReportInput,\n  ScheduleReportInput,\n} from '@objectstack/spec/contracts';\n// [#7135] The full `resolveAuthzContext` envelope — what `IReportService`\n// declares for every one of these context parameters since #6523 (the #6206\n// ruling: enforcement adjudicates on the whole envelope, never a per-site\n// subset). A scheduled run resolves a REAL owner context through\n// `OwnerContextResolver`; naming the retired six-field shape here made this\n// file's own type say it could not see what that resolver returns.\nimport type { ExecutionContext } from '@objectstack/spec/kernel';\nimport { Cron } from 'croner';\n\n/**\n * Narrow engine surface — keeps the service testable without booting\n * a real ObjectQL kernel.\n */\nexport interface ReportEngine {\n  find(object: string, options?: any): Promise<any[]>;\n  findOne?(object: string, options?: any): Promise<any>;\n  insert(object: string, data: any, options?: any): Promise<any>;\n  update(object: string, idOrData: any, dataOrOptions?: any, options?: any): Promise<any>;\n  delete(object: string, options?: any): Promise<any>;\n}\n\n/**\n * Minimum email surface — implementations may pass the full\n * `IEmailService` instance straight through.\n */\nexport interface ReportEmail {\n  send(input: {\n    to: string | string[];\n    subject: string;\n    text?: string;\n    html?: string;\n    attachments?: Array<{ filename: string; content: string; contentType?: string }>;\n    relatedObject?: string;\n    relatedId?: string;\n  }): Promise<{ status: 'sent' | 'queued' | 'failed' }>;\n}\n\n/** Stamped only in tests / specialised callers to make `now` deterministic. */\nexport interface ReportClock { now(): Date }\n\nconst SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as const;\n\nconst DEFAULT_FORMAT: ReportFormat = 'csv';\nconst DEFAULT_INTERVAL_MIN = 1440;\nconst DEFAULT_LIMIT = 1000;\n\nfunction uid(prefix: string): string {\n  const g: any = globalThis as any;\n  if (g.crypto?.randomUUID) return `${prefix}_${g.crypto.randomUUID()}`;\n  return `${prefix}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;\n}\n\nfunction parseQuery(raw: unknown): ReportQuery {\n  if (!raw) return {};\n  if (typeof raw === 'string') {\n    try { return JSON.parse(raw) as ReportQuery; }\n    catch { return {}; }\n  }\n  if (typeof raw === 'object') return raw as ReportQuery;\n  return {};\n}\n\nfunction rowFromSaved(row: any): SavedReport {\n  return {\n    id: String(row.id),\n    name: String(row.name ?? ''),\n    description: row.description ?? undefined,\n    object_name: String(row.object_name ?? ''),\n    query: parseQuery(row.query_json),\n    format: (row.format as ReportFormat) ?? DEFAULT_FORMAT,\n    owner_id: row.owner_id ?? undefined,\n    last_run_at: row.last_run_at ?? undefined,\n    last_row_count: row.last_row_count ?? undefined,\n    created_at: row.created_at ?? undefined,\n    updated_at: row.updated_at ?? undefined,\n  };\n}\n\nfunction rowFromSchedule(row: any): ReportSchedule {\n  return {\n    id: String(row.id),\n    report_id: String(row.report_id),\n    name: row.name ?? undefined,\n    interval_minutes: row.interval_minutes ?? undefined,\n    cron_expression: row.cron_expression ?? undefined,\n    timezone: row.timezone ?? undefined,\n    active: row.active !== false,\n    recipients: String(row.recipients ?? ''),\n    format: row.format ?? undefined,\n    subject_template: row.subject_template ?? undefined,\n    owner_id: row.owner_id ?? undefined,\n    next_run_at: row.next_run_at ?? undefined,\n    last_sent_at: row.last_sent_at ?? undefined,\n    last_status: row.last_status ?? undefined,\n    last_error: row.last_error ?? undefined,\n  };\n}\n\n// ─── Rendering ─────────────────────────────────────────────────────\n\nfunction escapeCsvCell(v: unknown): string {\n  if (v == null) return '';\n  const s = typeof v === 'string' ? v : (typeof v === 'object' ? JSON.stringify(v) : String(v));\n  if (/[\",\\r\\n]/.test(s)) return `\"${s.replace(/\"/g, '\"\"')}\"`;\n  return s;\n}\n\nfunction pickFields(rows: any[], explicit?: string[]): string[] {\n  if (explicit && explicit.length > 0) return explicit;\n  const seen = new Set<string>();\n  for (const r of rows.slice(0, 50)) {\n    if (r && typeof r === 'object') for (const k of Object.keys(r)) seen.add(k);\n  }\n  return Array.from(seen);\n}\n\nfunction renderCsv(rows: any[], fields?: string[]): string {\n  const cols = pickFields(rows, fields);\n  const head = cols.join(',');\n  const body = rows.map(r => cols.map(c => escapeCsvCell(r?.[c])).join(',')).join('\\r\\n');\n  return body.length > 0 ? `${head}\\r\\n${body}` : head;\n}\n\nfunction renderJson(rows: any[]): string {\n  return JSON.stringify(rows, null, 2);\n}\n\nfunction escapeHtml(s: string): string {\n  return s.replace(/[&<>\"']/g, c => ({\n    '&': '&amp;', '<': '&lt;', '>': '&gt;', '\"': '&quot;', \"'\": '&#39;',\n  } as Record<string, string>)[c]);\n}\n\nfunction renderHtmlTable(rows: any[], fields?: string[]): string {\n  const cols = pickFields(rows, fields);\n  const th = cols.map(c => `<th style=\"text-align:left;padding:4px 8px;border-bottom:1px solid #ccc;\">${escapeHtml(c)}</th>`).join('');\n  const trs = rows.map(r => {\n    const tds = cols.map(c => {\n      const v = r?.[c];\n      const s = v == null ? '' : (typeof v === 'string' ? v : (typeof v === 'object' ? JSON.stringify(v) : String(v)));\n      return `<td style=\"padding:4px 8px;border-bottom:1px solid #eee;\">${escapeHtml(s)}</td>`;\n    }).join('');\n    return `<tr>${tds}</tr>`;\n  }).join('');\n  return `<table style=\"border-collapse:collapse;font-family:system-ui,Arial,sans-serif;font-size:13px;\">`\n    + `<thead><tr>${th}</tr></thead><tbody>${trs}</tbody></table>`;\n}\n\nexport function renderReport(rows: any[], format: ReportFormat, fields?: string[]): string {\n  switch (format) {\n    case 'json': return renderJson(rows);\n    case 'html_table': return renderHtmlTable(rows, fields);\n    case 'csv':\n    default: return renderCsv(rows, fields);\n  }\n}\n\n// ─── Subject templating (minimal {{var}}) ─────────────────────────\n\nfunction renderSubject(template: string | undefined, vars: Record<string, string>): string {\n  const tpl = template ?? '{{name}} — {{date}}';\n  return tpl.replace(/\\{\\{\\s*(\\w+)\\s*\\}\\}/g, (_m, k) => vars[String(k)] ?? '');\n}\n\n// ─── Caller envelope ──────────────────────────────────────────────\n\n/**\n * Why this module strips the operation-private keys before forwarding an\n * envelope — the LOCAL half of the argument.\n *\n * A report read asks about `report.object_name`, which is not necessarily the\n * object the caller's envelope last carried a `__`-prefixed depth for: a REST\n * request that touched another object before reaching `/reports/:id/run` hands\n * over an envelope plugin-security's middleware has already written into, and\n * that middleware only OVERWRITES `__readScope` when it resolves permission sets\n * for the new object (`if (permissionSets.length > 0)`). A stale depth therefore\n * survives into a question it was never resolved for.\n *\n * [#7204] The general rule — which keys those are, why they are dropped by\n * PREFIX rather than by a name list, and why the copy is load-bearing in both\n * directions — is `withoutOperationPrivateKeys` in `@objectstack/core`. It was\n * hand-copied into this file, `plugin-audit`'s comment kit and\n * `service-storage`'s attachment kit before #7284 gave it one owner; ⛔ import\n * it, never re-derive it locally (`operation-private-keys.pin.test.ts` catches\n * the fourth copy).\n */\n\n// ─── Service ──────────────────────────────────────────────────────\n\n/**\n * Resolves a saved report's owner (`owner_id`) into a real, RLS-bearing\n * `ExecutionContext` so a **scheduled** report executes under the owner's\n * authority — the same rows the owner would see interactively — instead of\n * bypassing RLS with a system context. Returns `null` when the owner cannot\n * be resolved (unknown/disabled user), in which case the scheduler fails the\n * run closed rather than running elevated (#2849 / #2980). Supplying this\n * resolver is the reports-surface consumer of ADR-0073's user-less identity\n * resolution.\n */\nexport type OwnerContextResolver = (\n  ownerId: string,\n) => Promise<ExecutionContext | null>;\n\nexport interface ReportServiceOptions {\n  engine: ReportEngine;\n  email?: ReportEmail;\n  clock?: ReportClock;\n  logger?: { info?: (msg: any, ...rest: any[]) => void; warn?: (msg: any, ...rest: any[]) => void; error?: (msg: any, ...rest: any[]) => void };\n  /** Cap rows per report to protect both DB and email size. */\n  maxRows?: number;\n  /**\n   * Resolves a report owner into an RLS-bearing context for scheduled runs\n   * (see {@link OwnerContextResolver}). When omitted, scheduled reports fail\n   * closed instead of running with RLS bypassed (#2980).\n   */\n  resolveOwnerContext?: OwnerContextResolver;\n  /**\n   * [#3544 / #3710] The user-level export axis —\n   * `ISecurityService.canExport(object, context)`, wired by the reports plugin\n   * from `getService('security')`.\n   *\n   * A report rendered as `csv`/`json` IS a bulk machine-readable copy of the\n   * object, so it is the same privilege `GET /data/:object/export` gates.\n   * Without this the axis had a side door: a caller refused at that route could\n   * save a report on the same object, run it as CSV — or schedule one to their\n   * own inbox — and receive the identical rows.\n   *\n   * Omitted (no `plugin-security`, so no permission sets exist anywhere) → the\n   * axis does not apply, matching the REST export route's own fail-open.\n   */\n  canExport?: (object: string, context: unknown) => Promise<boolean>;\n}\n\n/**\n * [#3544 / #3710] Report formats that constitute a BULK EXPORT rather than a\n * rendering.\n *\n * `csv`/`json` are machine-readable copies — re-importable elsewhere, and\n * exactly what `GET /data/:object/export` serves. `html_table` is a PRESENTED\n * view: the report equivalent of reading rows on screen, which any caller\n * holding `allowRead` may already do. Gating it would restrict reading rather\n * than exporting and would take the axis past what it is for.\n */\nconst BULK_EXPORT_FORMATS: ReadonlySet<string> = new Set(['csv', 'json']);\n\nexport class ReportService implements IReportService {\n  private readonly engine: ReportEngine;\n  private readonly email?: ReportEmail;\n  private readonly clock: ReportClock;\n  private readonly logger: NonNullable<ReportServiceOptions['logger']>;\n  private readonly maxRows: number;\n  private readonly resolveOwnerContext?: OwnerContextResolver;\n  private readonly canExportFn?: (object: string, context: unknown) => Promise<boolean>;\n\n  constructor(opts: ReportServiceOptions) {\n    this.engine = opts.engine;\n    this.email = opts.email;\n    this.clock = opts.clock ?? { now: () => new Date() };\n    this.logger = opts.logger ?? {};\n    this.maxRows = Math.max(1, opts.maxRows ?? 5000);\n    this.resolveOwnerContext = opts.resolveOwnerContext;\n    this.canExportFn = opts.canExport;\n  }\n\n  /**\n   * [#3544 / #3710] Gate a report rendering on the user-level export axis.\n   *\n   * Throws `EXPORT_NOT_PERMITTED` when the principal behind `context` may not\n   * take a bulk copy of `object`. A no-op for non-bulk formats (`html_table`),\n   * for a system context, and when no `canExport` is wired.\n   *\n   * Deliberately checked HERE — one place — rather than at each of the three\n   * callers (`runReport`, the ad-hoc run, and the scheduled dispatch): a gate\n   * per call site is how a fourth call site later ships ungated. `dispatchDue`\n   * routes through `executeReport` too, so the scheduled CSV is covered by the\n   * same line. (`scheduleReport` additionally pre-checks, so an author is\n   * refused when they create the schedule rather than silently at 3am — but\n   * that is UX, and THIS is the enforcement: a grant revoked after the schedule\n   * was created must still stop the delivery.)\n   *\n   * Fails CLOSED on a throw — it resolves permission sets to decide, and a\n   * resolution failure must never read as a grant (ADR-0049).\n   */\n  private async assertExportAllowed(\n    object: string,\n    format: string,\n    context: ExecutionContext | undefined,\n  ): Promise<void> {\n    if (!BULK_EXPORT_FORMATS.has(format)) return;\n    if (context?.isSystem) return;\n    if (!this.canExportFn) return;\n    let allowed: boolean;\n    try {\n      allowed = await this.canExportFn(object, context);\n    } catch (err) {\n      this.logger.warn?.('ReportService: canExport check failed — denying export', err);\n      allowed = false;\n    }\n    if (!allowed) {\n      throw new Error(\n        `EXPORT_NOT_PERMITTED: exporting '${object}' as ${format} is not permitted for this user`,\n      );\n    }\n  }\n\n  // ── Access control ─────────────────────────────────────────────\n\n  /**\n   * Authorization for a saved-report row. `sys_saved_report` is a\n   * protection-locked system object, so its rows are *read* with\n   * `SYSTEM_CTX`; the caller's right to see/mutate a specific report is\n   * enforced HERE, by owner match, not by the metadata read's own RLS —\n   * otherwise any authenticated caller could read/delete/overwrite any\n   * report by id (#2980). An explicit elevated context (`isSystem`) — the\n   * scheduler / server tooling — sees everything.\n   */\n  private canAccessReport(row: { owner_id?: unknown } | null | undefined, context: ExecutionContext | undefined): boolean {\n    if (!row) return false;\n    if (context?.isSystem) return true;\n    const userId = context?.userId;\n    return !!userId && row.owner_id === userId;\n  }\n\n  /** Raw metadata read of a saved report by id (no authz — callers gate). */\n  private async loadReportRow(reportId: string): Promise<any | null> {\n    const rows = await this.engine.find('sys_saved_report', {\n      where: { id: reportId }, limit: 1, context: SYSTEM_CTX,\n    });\n    return Array.isArray(rows) && rows[0] ? rows[0] : null;\n  }\n\n  /** Raw metadata read of a report schedule by id (no authz — callers gate). */\n  private async loadScheduleRow(scheduleId: string): Promise<any | null> {\n    const rows = await this.engine.find('sys_report_schedule', {\n      where: { id: scheduleId }, limit: 1, context: SYSTEM_CTX,\n    });\n    return Array.isArray(rows) && rows[0] ? rows[0] : null;\n  }\n\n  // ── Report CRUD ────────────────────────────────────────────────\n\n  async saveReport(input: SaveReportInput, context: ExecutionContext): Promise<SavedReport> {\n    if (!input.name) throw new Error('VALIDATION_FAILED: name is required');\n    if (!input.object) throw new Error('VALIDATION_FAILED: object is required');\n    if (!input.query) throw new Error('VALIDATION_FAILED: query is required');\n\n    const now = this.clock.now().toISOString();\n    // A non-system caller always owns what they create — a caller-supplied\n    // ownerId cannot assign the report to someone else (#2980). Only an\n    // explicit elevated context (server tooling / import) may set it.\n    const ownerId = context.isSystem ? (input.ownerId ?? context.userId ?? null) : (context.userId ?? null);\n    const payload: any = {\n      name: input.name,\n      description: input.description ?? null,\n      object_name: input.object,\n      query_json: JSON.stringify(input.query ?? {}),\n      format: input.format ?? DEFAULT_FORMAT,\n      owner_id: ownerId,\n      updated_at: now,\n    };\n\n    if (input.id) {\n      const existing = await this.loadReportRow(input.id);\n      if (existing) {\n        // An update to an existing report is a mutation — a caller may only\n        // overwrite a report they own (#2980). Not-found for others so the\n        // response doesn't leak that the id exists.\n        if (!this.canAccessReport(existing, context)) {\n          throw new Error(`REPORT_NOT_FOUND: ${input.id}`);\n        }\n        // Never let a non-system caller reassign ownership away from the row.\n        if (!context.isSystem) payload.owner_id = existing.owner_id ?? payload.owner_id;\n        await this.engine.update('sys_saved_report', { id: input.id, ...payload }, { context: SYSTEM_CTX });\n        return rowFromSaved({ ...existing, ...payload, id: input.id });\n      }\n    }\n\n    const id = input.id ?? uid('rpt');\n    const row = { id, ...payload, created_at: now };\n    await this.engine.insert('sys_saved_report', row, { context: SYSTEM_CTX });\n    return rowFromSaved(row);\n  }\n\n  async listReports(\n    filter: { object?: string; ownerId?: string } | undefined,\n    context: ExecutionContext,\n  ): Promise<SavedReport[]> {\n    const f: any = {};\n    if (filter?.object) f.object_name = filter.object;\n    // Owner scoping (#2980): a non-system caller sees ONLY their own reports —\n    // a caller-supplied ownerId can never widen past their own id. A caller\n    // with no identity sees nothing (fail closed). System/tooling sees all,\n    // honouring an explicit ownerId narrow.\n    if (context?.isSystem) {\n      if (filter?.ownerId) f.owner_id = filter.ownerId;\n    } else {\n      if (!context?.userId) return [];\n      if (filter?.ownerId && filter.ownerId !== context.userId) return [];\n      f.owner_id = context.userId;\n    }\n    const rows = await this.engine.find('sys_saved_report', {\n      where: f, limit: 500, orderBy: [{ field: 'updated_at', order: 'desc' }], context: SYSTEM_CTX,\n    });\n    return Array.isArray(rows) ? rows.map(rowFromSaved) : [];\n  }\n\n  async getReport(reportId: string, context: ExecutionContext): Promise<SavedReport | null> {\n    const row = await this.loadReportRow(reportId);\n    // Unauthorized reads are indistinguishable from a genuine miss (#2980).\n    if (!this.canAccessReport(row, context)) return null;\n    return rowFromSaved(row);\n  }\n\n  async deleteReport(reportId: string, context: ExecutionContext): Promise<void> {\n    if (!reportId) throw new Error('VALIDATION_FAILED: reportId is required');\n    const row = await this.loadReportRow(reportId);\n    if (!row) return; // idempotent — nothing to drop\n    // A caller may only delete a report they own (#2980); others get a\n    // not-found so the delete neither fires nor reveals the report's existence.\n    if (!this.canAccessReport(row, context)) {\n      throw new Error(`REPORT_NOT_FOUND: ${reportId}`);\n    }\n    // Cascade — drop attached schedules first.\n    const schedules = await this.engine.find('sys_report_schedule', {\n      where: { report_id: reportId }, limit: 500, context: SYSTEM_CTX,\n    });\n    for (const s of (schedules ?? [])) {\n      await this.engine.delete('sys_report_schedule', { where: { id: (s as any).id }, context: SYSTEM_CTX });\n    }\n    await this.engine.delete('sys_saved_report', { where: { id: reportId }, context: SYSTEM_CTX });\n  }\n\n  // ── Execution ───────────────────────────────────────────────────\n\n  async run(reportId: string, context: ExecutionContext): Promise<ReportRunResult> {\n    const report = await this.getReport(reportId, context);\n    if (!report) throw new Error(`REPORT_NOT_FOUND: ${reportId}`);\n    return this.executeReport(report, context);\n  }\n\n  async runAdHoc(input: SaveReportInput, context: ExecutionContext): Promise<ReportRunResult> {\n    if (!input.object) throw new Error('VALIDATION_FAILED: object is required');\n    if (!input.query) throw new Error('VALIDATION_FAILED: query is required');\n    const adhoc: SavedReport = {\n      id: '__adhoc__',\n      name: input.name ?? 'Ad-hoc report',\n      object_name: input.object,\n      query: input.query,\n      format: input.format ?? DEFAULT_FORMAT,\n    };\n    return this.executeReport(adhoc, context, /* stamp */ false);\n  }\n\n  private async executeReport(\n    report: SavedReport,\n    context: ExecutionContext,\n    stamp = true,\n  ): Promise<ReportRunResult> {\n    // [#3544 / #3710] The export axis, BEFORE any row is read — a refusal must\n    // not be reachable after the data has already been pulled.\n    await this.assertExportAllowed(report.object_name, report.format, context);\n    const q = report.query ?? {};\n    const limit = Math.min(q.limit ?? DEFAULT_LIMIT, this.maxRows);\n    const rows = await this.engine.find(report.object_name, {\n      where: q.filter,\n      fields: q.fields,\n      orderBy: q.orderBy,\n      limit,\n      // Reports execute with the caller's identity so sharing rules\n      // (if installed) apply. Falls back to system bypass only when\n      // the report definition was created by a system writer.\n      //\n      // [#7204] The WHOLE envelope, not a rebuilt subset of it — the #6206\n      // ruling (#6523): a read that adjudicates on the caller's identity\n      // adjudicates on the whole `resolveAuthzContext` envelope. The\n      // five-field projection this replaced (`userId` / `tenantId` /\n      // `positions` / `permissions` / `isSystem`) was doing two jobs, and\n      // only one of them was correct:\n      //\n      //  - dropping the middleware-private keys — CORRECT, and preserved\n      //    above by {@link withoutOperationPrivateKeys};\n      //  - dropping the PRINCIPAL fields — the defect. `accessible_org_ids`\n      //    (ADR-0105 D2) is the one that changes rows: `buildDriverOptions`\n      //    reads it BY NAME to widen the driver's native tenant scope to the\n      //    caller's membership union under the `group` posture, and an absent\n      //    set makes drivers \"fall back to equality: fail toward isolation\".\n      //    So the same query returned the union in an interactive list view\n      //    and collapsed to active-org equality inside a saved or scheduled\n      //    report — silently short rows, no error. `timezone` is read two\n      //    lines up in the same engine method (`hasTz`) and again by\n      //    `applyFormulaPlan` for read-time formula fields, and `posture`,\n      //    `org_user_ids`, `systemPermissions` and `onBehalfOf` went the same\n      //    way; they are forwarded now for the same reason — the envelope is\n      //    the contract's unit.\n      //\n      // The three defaults below are byte-for-byte what the projection\n      // produced for an envelope that omits them, and are kept so this change\n      // adds fields without changing any that were already there.\n      context: {\n        ...withoutOperationPrivateKeys(context as unknown as Record<string, unknown>),\n        positions: context.positions ?? [],\n        permissions: context.permissions ?? [],\n        isSystem: context.isSystem ?? false,\n      },\n    });\n    const list = Array.isArray(rows) ? rows : [];\n    const body = renderReport(list, report.format, q.fields);\n    const ranAt = this.clock.now().toISOString();\n\n    if (stamp && report.id !== '__adhoc__') {\n      try {\n        await this.engine.update('sys_saved_report', {\n          id: report.id,\n          last_run_at: ranAt,\n          last_row_count: list.length,\n          updated_at: ranAt,\n        }, { context: SYSTEM_CTX });\n      } catch (err) {\n        this.logger.warn?.('ReportService: failed to stamp last_run_at', err);\n      }\n    }\n\n    return {\n      reportId: report.id,\n      rowCount: list.length,\n      format: report.format,\n      body,\n      rows: list,\n      ranAt,\n    };\n  }\n\n  // ── Schedules ──────────────────────────────────────────────────\n\n  async scheduleReport(input: ScheduleReportInput, context: ExecutionContext): Promise<ReportSchedule> {\n    if (!input.reportId) throw new Error('VALIDATION_FAILED: reportId is required');\n    if (!input.recipients || input.recipients.length === 0) {\n      throw new Error('VALIDATION_FAILED: recipients must be a non-empty array');\n    }\n    const report = await this.getReport(input.reportId, context);\n    if (!report) throw new Error(`REPORT_NOT_FOUND: ${input.reportId}`);\n\n    // [#3544 / #3710] Refuse a bulk-format schedule the author could not run\n    // themselves, at CREATE time — otherwise the refusal only surfaces on the\n    // first silent 3am sweep. Advisory only: `executeReport` re-checks on every\n    // dispatch, which is what catches a grant revoked after this point.\n    await this.assertExportAllowed(report.object_name, input.format ?? 'html_table', context);\n\n    const now = this.clock.now();\n    const interval = input.intervalMinutes ?? DEFAULT_INTERVAL_MIN;\n    const cron = input.cronExpression?.trim() || null;\n    if (cron) {\n      // Validate eagerly so an author gets a clear error at schedule time\n      // instead of a schedule that silently falls back to interval on sweep.\n      try {\n        new Cron(cron, { timezone: input.timezone || 'UTC' });\n      } catch (err) {\n        throw new Error(`VALIDATION_FAILED: invalid cron_expression '${cron}': ${(err as Error).message}`);\n      }\n    }\n    const nextRun = this.nextRunAt(\n      { cron_expression: cron, interval_minutes: interval, timezone: input.timezone ?? 'UTC' },\n      now,\n    ).toISOString();\n    const id = uid('rsch');\n    const row: any = {\n      id,\n      report_id: input.reportId,\n      name: input.name ?? null,\n      interval_minutes: interval,\n      cron_expression: cron,\n      timezone: input.timezone ?? 'UTC',\n      active: input.active !== false,\n      recipients: input.recipients.join(','),\n      format: input.format ?? 'html_table',\n      subject_template: input.subjectTemplate ?? null,\n      owner_id: input.ownerId ?? context.userId ?? null,\n      next_run_at: nextRun,\n      created_at: now.toISOString(),\n      updated_at: now.toISOString(),\n    };\n    await this.engine.insert('sys_report_schedule', row, { context: SYSTEM_CTX });\n    return rowFromSchedule(row);\n  }\n\n  async unscheduleReport(scheduleId: string, context: ExecutionContext): Promise<void> {\n    if (!scheduleId) throw new Error('VALIDATION_FAILED: scheduleId is required');\n    // A schedule is owned through its report (#2980): a caller may only delete\n    // the schedules of a report they own. Others get a not-found so the delete\n    // neither fires nor reveals the schedule's existence — deny-as-404, never a\n    // cross-owner 2xx.\n    //\n    // [#7603] That intent used to have a hole one line wide. An id with no row\n    // behind it returned early and silently — `if (!schedule) return; //\n    // idempotent` — while another owner's id threw. The route maps those to 204\n    // and 404, so a caller who could delete neither still learned which of the\n    // two they had hit: an enumeration oracle over other owners' schedule ids,\n    // the same one #7523 closed on `DELETE /reports/:id` in its 500-vs-204\n    // costume. Idempotence is only harmless where every caller may see the row;\n    // here it was the tell.\n    //\n    // Both deny arms are now ONE decision, taken before the delete fires, by the\n    // predicate that is already blind to the difference between them:\n    // `canAccessReport` is false for a schedule that does not exist, for one\n    // whose report is gone, and for one owned by somebody else alike. A single\n    // throw site means a single message, so the route's single `handleValidation`\n    // call emits a single response — status and body cannot drift apart.\n    //\n    // Unlike `deleteReport`, this cannot be pre-empted in the route: the caller\n    // presents a scheduleId, and `IReportService` exposes no by-id schedule read\n    // to be blind with (`listSchedules` is keyed by reportId). The blinding has\n    // to live here, which is why the contract now states it as an obligation\n    // rather than leaving it to each implementation.\n    const schedule = await this.loadScheduleRow(scheduleId);\n    const report = schedule ? await this.loadReportRow(schedule.report_id) : null;\n    if (!this.canAccessReport(report, context)) {\n      throw new Error(`REPORT_NOT_FOUND: ${scheduleId}`);\n    }\n    await this.engine.delete('sys_report_schedule', { where: { id: scheduleId }, context: SYSTEM_CTX });\n  }\n\n  async listSchedules(\n    filter: { reportId?: string } | undefined,\n    context: ExecutionContext,\n  ): Promise<ReportSchedule[]> {\n    // Schedules are owned through their report (#2980): a non-system caller may\n    // only list the schedules of a report they can access. The route always\n    // supplies the parent report id; a caller who cannot see that report gets an\n    // empty list — never another owner's recipients/cron — the same non-leaking\n    // posture as listReports. System/tooling (the dispatcher) still sees all.\n    if (!context?.isSystem) {\n      if (!filter?.reportId) return [];\n      if (!(await this.getReport(filter.reportId, context))) return [];\n    }\n    const f: any = {};\n    if (filter?.reportId) f.report_id = filter.reportId;\n    const rows = await this.engine.find('sys_report_schedule', {\n      where: f, limit: 500, orderBy: [{ field: 'next_run_at', order: 'asc' }], context: SYSTEM_CTX,\n    });\n    return Array.isArray(rows) ? rows.map(rowFromSchedule) : [];\n  }\n\n  // ── Dispatcher ─────────────────────────────────────────────────\n\n  async dispatchDue(now?: Date): Promise<{ fired: number; failed: number; skipped: number }> {\n    const ts = (now ?? this.clock.now()).toISOString();\n    const due = await this.engine.find('sys_report_schedule', {\n      where: { active: true },\n      limit: 200,\n      context: SYSTEM_CTX,\n    });\n    const list = (Array.isArray(due) ? due : []).map(rowFromSchedule)\n      .filter(s => !s.next_run_at || s.next_run_at <= ts);\n\n    let fired = 0, failed = 0, skipped = 0;\n    for (const schedule of list) {\n      try {\n        const row = await this.loadReportRow(schedule.report_id);\n        if (!row) {\n          skipped++;\n          await this.markSchedule(schedule.id, {\n            last_status: 'skipped',\n            last_error: `report ${schedule.report_id} missing`,\n          });\n          continue;\n        }\n        const report = rowFromSaved(row);\n\n        // Run the report under the OWNER's authority, not system (#2980).\n        // A scheduled run must not read rows the report's owner cannot see —\n        // that was a silent RLS bypass (a member's scheduled report emailed\n        // the target object's entire table). Resolve the owner to a real\n        // RLS-bearing context; if we can't (no resolver wired, or unknown/\n        // disabled owner), FAIL CLOSED rather than run elevated.\n        const ownerId = report.owner_id;\n        const runContext = ownerId && this.resolveOwnerContext\n          ? await this.resolveOwnerContext(ownerId).catch((err) => {\n              this.logger.warn?.('ReportService.dispatchDue: owner context resolution failed', err);\n              return null;\n            })\n          : null;\n        if (!runContext) {\n          failed++;\n          await this.markSchedule(schedule.id, {\n            last_status: 'failed',\n            last_error: ownerId\n              ? `owner '${ownerId}' context unavailable — refusing to run scheduled report with RLS bypassed (#2849/#2980)`\n              : 'report has no owner — refusing to run scheduled report with RLS bypassed (#2849/#2980)',\n          });\n          continue;\n        }\n\n        // Force the schedule's own format so the recipient gets what\n        // the admin configured (CSV attachment vs inline HTML table).\n        const fmt: ReportFormat = (schedule.format ?? 'html_table') as ReportFormat;\n        const result = await this.executeReport({ ...report, format: fmt }, runContext, false);\n\n        const recipients = schedule.recipients.split(',').map(s => s.trim()).filter(Boolean);\n        const subject = renderSubject(schedule.subject_template, {\n          name: schedule.name ?? report.name,\n          date: ts.slice(0, 10),\n          rows: String(result.rowCount),\n        });\n\n        if (this.email && recipients.length > 0) {\n          if (fmt === 'csv') {\n            await this.email.send({\n              to: recipients,\n              subject,\n              text: `Attached: ${result.rowCount} row(s).`,\n              attachments: [{\n                // Keep unicode letters (CJK schedule names) — only strip\n                // filesystem-hostile characters, else 周报 becomes `__`.\n                filename: `${(schedule.name ?? report.name).replace(/[^\\p{L}\\p{N}._-]+/gu, '_').replace(/^_+|_+$/g, '') || 'report'}-${ts.slice(0, 10)}.csv`,\n                content: result.body,\n                contentType: 'text/csv',\n              }],\n              relatedObject: 'sys_report_schedule',\n              relatedId: schedule.id,\n            });\n          } else {\n            await this.email.send({\n              to: recipients,\n              subject,\n              html: `<p>${escapeHtml(report.name)} — ${result.rowCount} row(s)</p>${result.body}`,\n              text: `${report.name} — ${result.rowCount} row(s)`,\n              relatedObject: 'sys_report_schedule',\n              relatedId: schedule.id,\n            });\n          }\n        } else if (!this.email) {\n          this.logger.warn?.('ReportService.dispatchDue: no email service — schedule fired but mail not sent');\n        }\n\n        await this.advanceSchedule(schedule, ts);\n        fired++;\n      } catch (err: any) {\n        failed++;\n        await this.markSchedule(schedule.id, {\n          last_status: 'failed',\n          last_error: String(err?.message ?? err ?? 'unknown').slice(0, 500),\n        });\n        this.logger.error?.('ReportService.dispatchDue: schedule failed', err);\n      }\n    }\n    return { fired, failed, skipped };\n  }\n\n  /**\n   * Compute the next fire time for a schedule. A `cron_expression` wins over\n   * `interval_minutes` (the documented `sys_report_schedule` contract) and is\n   * evaluated in the schedule's `timezone` (default UTC) via croner — the same\n   * library the job scheduler uses. Falls back to `from + interval_minutes` for\n   * interval schedules, and also if a cron expression is invalid or has no\n   * future occurrence (logged; never throws into the sweep). `from` is the\n   * reference instant (the injected clock), so `today()`-style boundaries honor\n   * the test clock.\n   */\n  private nextRunAt(\n    schedule: { cron_expression?: string | null; interval_minutes?: number | null; timezone?: string | null },\n    from: Date,\n  ): Date {\n    const cron = (schedule.cron_expression ?? '').trim();\n    if (cron) {\n      try {\n        const next = new Cron(cron, { timezone: schedule.timezone || 'UTC' }).nextRun(from);\n        if (next) return next;\n        this.logger.warn?.(`ReportService: cron '${cron}' has no next occurrence; falling back to interval`);\n      } catch (err) {\n        this.logger.warn?.(`ReportService: invalid cron '${cron}'; falling back to interval`, err);\n      }\n    }\n    const interval = schedule.interval_minutes ?? DEFAULT_INTERVAL_MIN;\n    return new Date(from.getTime() + interval * 60_000);\n  }\n\n  private async advanceSchedule(schedule: ReportSchedule, ranAt: string): Promise<void> {\n    const nextRun = this.nextRunAt(schedule, this.clock.now()).toISOString();\n    await this.engine.update('sys_report_schedule', {\n      id: schedule.id,\n      next_run_at: nextRun,\n      last_sent_at: ranAt,\n      last_status: 'ok',\n      last_error: null,\n      updated_at: ranAt,\n    }, { context: SYSTEM_CTX });\n  }\n\n  private async markSchedule(id: string, patch: Record<string, unknown>): Promise<void> {\n    try {\n      await this.engine.update('sys_report_schedule', {\n        id, ...patch, updated_at: this.clock.now().toISOString(),\n      }, { context: SYSTEM_CTX });\n    } catch (err) {\n      this.logger.warn?.('ReportService: failed to mark schedule', err);\n    }\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { Plugin, PluginContext } from '@objectstack/core';\nimport type {\n  IDataEngine,\n  IJobService,\n  ISecurityService,\n  SecurityContext,\n} from '@objectstack/spec/contracts';\nimport {\n  SysSavedReport,\n  SysReportSchedule,\n} from '@objectstack/platform-objects/audit';\nimport { ReportService, type ReportEngine, type ReportEmail } from './report-service.js';\n\nexport interface ReportsPluginOptions {\n  /**\n   * How often the dispatcher should poll `sys_report_schedule` for\n   * due rows. Defaults to 60 seconds — short enough to honour\n   * minute-grained schedules without flooding the DB.\n   */\n  dispatchIntervalMs?: number;\n  /** Cap rows per report. Mirrors ReportServiceOptions.maxRows. */\n  maxRows?: number;\n  /** Disable the dispatcher tick entirely. */\n  disableDispatcher?: boolean;\n}\n\n/**\n * ReportsServicePlugin — registers `sys_saved_report` /\n * `sys_report_schedule`, the `reports` service, and the dispatcher\n * loop that emails due schedules.\n *\n * The dispatcher uses `IJobService.schedule` when one is registered;\n * otherwise it falls back to a plain `setInterval` so single-kernel\n * deployments work without `service-job`.\n *\n * @example\n * ```ts\n * import { ReportsServicePlugin } from '@objectstack/plugin-reports';\n *\n * kernel.use(new ReportsServicePlugin({ dispatchIntervalMs: 60_000 }));\n * ```\n */\nexport class ReportsServicePlugin implements Plugin {\n  name = 'com.objectstack.service.reports';\n  version = '1.0.0';\n  type = 'standard';\n  dependencies = ['com.objectstack.engine.objectql'];\n\n  private readonly options: ReportsPluginOptions;\n  private service?: ReportService;\n  private intervalHandle?: ReturnType<typeof setInterval>;\n  private jobName?: string;\n  private jobService?: IJobService;\n\n  constructor(options: ReportsPluginOptions = {}) {\n    this.options = options;\n  }\n\n  async init(ctx: PluginContext): Promise<void> {\n    ctx.getService<{ register(m: any): void }>('manifest').register({\n      id: 'com.objectstack.service.reports',\n      name: 'Reports Service',\n      version: '1.0.0',\n      type: 'plugin',\n      scope: 'system',\n      defaultDatasource: 'cloud',\n      namespace: 'sys',\n      objects: [SysSavedReport, SysReportSchedule],\n    });\n    ctx.logger.info('ReportsServicePlugin: schemas registered');\n  }\n\n  async start(ctx: PluginContext): Promise<void> {\n    ctx.hook('kernel:ready', async () => {\n      // `IDataEngine`, not the whole engine: `ReportEngine` is a pure data-plane\n      // slice (find/findOne/insert/update/delete), so the narrow contract is the\n      // honest one for BOTH names — `objectql` strictly widens `data` (#4404),\n      // and nothing here reaches past the data plane.\n      let engine: IDataEngine | null = null;\n      try { engine = ctx.getService<IDataEngine>('objectql'); }\n      catch { try { engine = ctx.getService<IDataEngine>('data'); } catch { /* ignore */ } }\n      if (!engine) {\n        ctx.logger.warn('ReportsServicePlugin: no ObjectQL engine — service NOT registered');\n        return;\n      }\n\n      let email: ReportEmail | undefined;\n      // `ReportEmail` — the named surface this plugin consumes. `IEmailService`\n      // passes straight through it (see the declaration); naming the slice is\n      // what makes a drift in `send`'s shape a compile error here.\n      try { email = ctx.getService<ReportEmail>('email'); } catch { /* email is optional */ }\n      if (!email) {\n        ctx.logger.warn('ReportsServicePlugin: no email service — schedules will fire without delivery');\n      }\n\n      // [#3544 / #3710] The user-level export axis. A `csv`/`json` report is a\n      // bulk machine-readable copy of its object — the same privilege\n      // `GET /data/:object/export` gates — so the reports surface must ask the\n      // SAME question of the SAME authority, or it is a side door around the\n      // axis. Resolved lazily per call rather than captured here: `security` is\n      // registered by plugin-security's own `kernel:ready` hook and may not\n      // exist yet at construction time. Absent service (no plugin-security ⇒ no\n      // permission sets anywhere) → the axis does not apply, matching the REST\n      // export route's fail-open.\n      const canExport = async (object: string, context: unknown): Promise<boolean> => {\n        let security: ISecurityService | undefined;\n        try { security = ctx.getService<ISecurityService>('security'); } catch { return true; }\n        if (!security || typeof security.canExport !== 'function') return true;\n        // `ReportService` hands this callback an `unknown` context (it is the\n        // caller's execution envelope, opaque to reports); the security service\n        // types it as a partial `ExecutionContext`.\n        return await security.canExport(object, context as SecurityContext | undefined);\n      };\n\n      this.service = new ReportService({\n        engine: engine as ReportEngine,\n        email,\n        logger: ctx.logger,\n        maxRows: this.options.maxRows,\n        canExport,\n        // Scheduled reports run under the owner's resolved RLS context, not a\n        // system bypass (#2980). No owner-context resolver is wired yet — that\n        // is the reports-surface consumer of ADR-0073's user-less identity\n        // resolution (M2) — so until it lands, scheduled runs FAIL CLOSED\n        // (skipped + marked failed) rather than exfiltrate. Interactive runs\n        // (run/runAdHoc) are unaffected: they carry the caller's context.\n        resolveOwnerContext: undefined,\n      });\n      ctx.registerService('reports', this.service);\n\n      if (this.options.disableDispatcher) {\n        ctx.logger.info('ReportsServicePlugin: dispatcher disabled (disableDispatcher=true)');\n        return;\n      }\n\n      const intervalMs = Math.max(5_000, this.options.dispatchIntervalMs ?? 60_000);\n\n      // Prefer the platform job service when available — it lets ops\n      // see report dispatch alongside every other scheduled job.\n      try {\n        const job = ctx.getService<IJobService>('job');\n        if (job && typeof job.schedule === 'function') {\n          this.jobService = job;\n          this.jobName = 'reports.dispatch';\n          await job.schedule(this.jobName, { type: 'interval', intervalMs }, async () => {\n            try { await this.service?.dispatchDue(); }\n            catch (err) { ctx.logger.warn('ReportsServicePlugin: dispatch tick failed', err as any); }\n          });\n          ctx.logger.info('ReportsServicePlugin: dispatcher registered with job service', { intervalMs });\n          return;\n        }\n      } catch { /* fall through to setInterval */ }\n\n      this.intervalHandle = setInterval(() => {\n        this.service?.dispatchDue().catch(err => {\n          ctx.logger.warn('ReportsServicePlugin: dispatch tick failed', err);\n        });\n      }, intervalMs);\n      // Don't keep Node alive purely for the dispatcher — common\n      // mistake in tests / serverless. unref is a no-op in some\n      // runtimes which is fine.\n      (this.intervalHandle as any)?.unref?.();\n      ctx.logger.info('ReportsServicePlugin: dispatcher registered (setInterval fallback)', { intervalMs });\n    });\n  }\n\n  async stop(ctx: PluginContext): Promise<void> {\n    if (this.intervalHandle) clearInterval(this.intervalHandle);\n    this.intervalHandle = undefined;\n    if (this.jobService && this.jobName && typeof this.jobService.cancel === 'function') {\n      try { await this.jobService.cancel(this.jobName); }\n      catch (err) { ctx.logger.warn('ReportsServicePlugin: failed to cancel job', err as any); }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,IAAAA,gBAAkD;;;ACTlD,kBAA4C;AAkB5C,oBAAqB;AAiCrB,IAAM,aAAa,EAAE,UAAU,MAAM,WAAW,CAAC,GAAG,aAAa,CAAC,EAAE;AAEpE,IAAM,iBAA+B;AACrC,IAAM,uBAAuB;AAC7B,IAAM,gBAAgB;AAEtB,SAAS,IAAI,QAAwB;AACnC,QAAM,IAAS;AACf,MAAI,EAAE,QAAQ,WAAY,QAAO,GAAG,MAAM,IAAI,EAAE,OAAO,WAAW,CAAC;AACnE,SAAO,GAAG,MAAM,IAAI,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AACxF;AAEA,SAAS,WAAW,KAA2B;AAC7C,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI;AAAE,aAAO,KAAK,MAAM,GAAG;AAAA,IAAkB,QACvC;AAAE,aAAO,CAAC;AAAA,IAAG;AAAA,EACrB;AACA,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,SAAO,CAAC;AACV;AAEA,SAAS,aAAa,KAAuB;AAC3C,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,MAAM,OAAO,IAAI,QAAQ,EAAE;AAAA,IAC3B,aAAa,IAAI,eAAe;AAAA,IAChC,aAAa,OAAO,IAAI,eAAe,EAAE;AAAA,IACzC,OAAO,WAAW,IAAI,UAAU;AAAA,IAChC,QAAS,IAAI,UAA2B;AAAA,IACxC,UAAU,IAAI,YAAY;AAAA,IAC1B,aAAa,IAAI,eAAe;AAAA,IAChC,gBAAgB,IAAI,kBAAkB;AAAA,IACtC,YAAY,IAAI,cAAc;AAAA,IAC9B,YAAY,IAAI,cAAc;AAAA,EAChC;AACF;AAEA,SAAS,gBAAgB,KAA0B;AACjD,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,MAAM,IAAI,QAAQ;AAAA,IAClB,kBAAkB,IAAI,oBAAoB;AAAA,IAC1C,iBAAiB,IAAI,mBAAmB;AAAA,IACxC,UAAU,IAAI,YAAY;AAAA,IAC1B,QAAQ,IAAI,WAAW;AAAA,IACvB,YAAY,OAAO,IAAI,cAAc,EAAE;AAAA,IACvC,QAAQ,IAAI,UAAU;AAAA,IACtB,kBAAkB,IAAI,oBAAoB;AAAA,IAC1C,UAAU,IAAI,YAAY;AAAA,IAC1B,aAAa,IAAI,eAAe;AAAA,IAChC,cAAc,IAAI,gBAAgB;AAAA,IAClC,aAAa,IAAI,eAAe;AAAA,IAChC,YAAY,IAAI,cAAc;AAAA,EAChC;AACF;AAIA,SAAS,cAAc,GAAoB;AACzC,MAAI,KAAK,KAAM,QAAO;AACtB,QAAM,IAAI,OAAO,MAAM,WAAW,IAAK,OAAO,MAAM,WAAW,KAAK,UAAU,CAAC,IAAI,OAAO,CAAC;AAC3F,MAAI,WAAW,KAAK,CAAC,EAAG,QAAO,IAAI,EAAE,QAAQ,MAAM,IAAI,CAAC;AACxD,SAAO;AACT;AAEA,SAAS,WAAW,MAAa,UAA+B;AAC9D,MAAI,YAAY,SAAS,SAAS,EAAG,QAAO;AAC5C,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,KAAK,MAAM,GAAG,EAAE,GAAG;AACjC,QAAI,KAAK,OAAO,MAAM,SAAU,YAAW,KAAK,OAAO,KAAK,CAAC,EAAG,MAAK,IAAI,CAAC;AAAA,EAC5E;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,UAAU,MAAa,QAA2B;AACzD,QAAM,OAAO,WAAW,MAAM,MAAM;AACpC,QAAM,OAAO,KAAK,KAAK,GAAG;AAC1B,QAAM,OAAO,KAAK,IAAI,OAAK,KAAK,IAAI,OAAK,cAAc,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,MAAM;AACtF,SAAO,KAAK,SAAS,IAAI,GAAG,IAAI;AAAA,EAAO,IAAI,KAAK;AAClD;AAEA,SAAS,WAAW,MAAqB;AACvC,SAAO,KAAK,UAAU,MAAM,MAAM,CAAC;AACrC;AAEA,SAAS,WAAW,GAAmB;AACrC,SAAO,EAAE,QAAQ,YAAY,QAAM;AAAA,IACjC,KAAK;AAAA,IAAS,KAAK;AAAA,IAAQ,KAAK;AAAA,IAAQ,KAAK;AAAA,IAAU,KAAK;AAAA,EAC9D,GAA6B,CAAC,CAAC;AACjC;AAEA,SAAS,gBAAgB,MAAa,QAA2B;AAC/D,QAAM,OAAO,WAAW,MAAM,MAAM;AACpC,QAAM,KAAK,KAAK,IAAI,OAAK,6EAA6E,WAAW,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE;AACnI,QAAM,MAAM,KAAK,IAAI,OAAK;AACxB,UAAM,MAAM,KAAK,IAAI,OAAK;AACxB,YAAM,IAAI,IAAI,CAAC;AACf,YAAM,IAAI,KAAK,OAAO,KAAM,OAAO,MAAM,WAAW,IAAK,OAAO,MAAM,WAAW,KAAK,UAAU,CAAC,IAAI,OAAO,CAAC;AAC7G,aAAO,6DAA6D,WAAW,CAAC,CAAC;AAAA,IACnF,CAAC,EAAE,KAAK,EAAE;AACV,WAAO,OAAO,GAAG;AAAA,EACnB,CAAC,EAAE,KAAK,EAAE;AACV,SAAO,6GACW,EAAE,uBAAuB,GAAG;AAChD;AAEO,SAAS,aAAa,MAAa,QAAsB,QAA2B;AACzF,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAQ,aAAO,WAAW,IAAI;AAAA,IACnC,KAAK;AAAc,aAAO,gBAAgB,MAAM,MAAM;AAAA,IACtD,KAAK;AAAA,IACL;AAAS,aAAO,UAAU,MAAM,MAAM;AAAA,EACxC;AACF;AAIA,SAAS,cAAc,UAA8B,MAAsC;AACzF,QAAM,MAAM,YAAY;AACxB,SAAO,IAAI,QAAQ,wBAAwB,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,KAAK,EAAE;AAC7E;AAiFA,IAAM,sBAA2C,oBAAI,IAAI,CAAC,OAAO,MAAM,CAAC;AAEjE,IAAM,gBAAN,MAA8C;AAAA,EASnD,YAAY,MAA4B;AACtC,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAClB,SAAK,QAAQ,KAAK,SAAS,EAAE,KAAK,MAAM,oBAAI,KAAK,EAAE;AACnD,SAAK,SAAS,KAAK,UAAU,CAAC;AAC9B,SAAK,UAAU,KAAK,IAAI,GAAG,KAAK,WAAW,GAAI;AAC/C,SAAK,sBAAsB,KAAK;AAChC,SAAK,cAAc,KAAK;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAc,oBACZ,QACA,QACA,SACe;AACf,QAAI,CAAC,oBAAoB,IAAI,MAAM,EAAG;AACtC,QAAI,SAAS,SAAU;AACvB,QAAI,CAAC,KAAK,YAAa;AACvB,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,YAAY,QAAQ,OAAO;AAAA,IAClD,SAAS,KAAK;AACZ,WAAK,OAAO,OAAO,+DAA0D,GAAG;AAChF,gBAAU;AAAA,IACZ;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,oCAAoC,MAAM,QAAQ,MAAM;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,gBAAgB,KAAgD,SAAgD;AACtH,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,SAAS,SAAU,QAAO;AAC9B,UAAM,SAAS,SAAS;AACxB,WAAO,CAAC,CAAC,UAAU,IAAI,aAAa;AAAA,EACtC;AAAA;AAAA,EAGA,MAAc,cAAc,UAAuC;AACjE,UAAM,OAAO,MAAM,KAAK,OAAO,KAAK,oBAAoB;AAAA,MACtD,OAAO,EAAE,IAAI,SAAS;AAAA,MAAG,OAAO;AAAA,MAAG,SAAS;AAAA,IAC9C,CAAC;AACD,WAAO,MAAM,QAAQ,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI;AAAA,EACpD;AAAA;AAAA,EAGA,MAAc,gBAAgB,YAAyC;AACrE,UAAM,OAAO,MAAM,KAAK,OAAO,KAAK,uBAAuB;AAAA,MACzD,OAAO,EAAE,IAAI,WAAW;AAAA,MAAG,OAAO;AAAA,MAAG,SAAS;AAAA,IAChD,CAAC;AACD,WAAO,MAAM,QAAQ,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI;AAAA,EACpD;AAAA;AAAA,EAIA,MAAM,WAAW,OAAwB,SAAiD;AACxF,QAAI,CAAC,MAAM,KAAM,OAAM,IAAI,MAAM,qCAAqC;AACtE,QAAI,CAAC,MAAM,OAAQ,OAAM,IAAI,MAAM,uCAAuC;AAC1E,QAAI,CAAC,MAAM,MAAO,OAAM,IAAI,MAAM,sCAAsC;AAExE,UAAM,MAAM,KAAK,MAAM,IAAI,EAAE,YAAY;AAIzC,UAAM,UAAU,QAAQ,WAAY,MAAM,WAAW,QAAQ,UAAU,OAAS,QAAQ,UAAU;AAClG,UAAM,UAAe;AAAA,MACnB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM,eAAe;AAAA,MAClC,aAAa,MAAM;AAAA,MACnB,YAAY,KAAK,UAAU,MAAM,SAAS,CAAC,CAAC;AAAA,MAC5C,QAAQ,MAAM,UAAU;AAAA,MACxB,UAAU;AAAA,MACV,YAAY;AAAA,IACd;AAEA,QAAI,MAAM,IAAI;AACZ,YAAM,WAAW,MAAM,KAAK,cAAc,MAAM,EAAE;AAClD,UAAI,UAAU;AAIZ,YAAI,CAAC,KAAK,gBAAgB,UAAU,OAAO,GAAG;AAC5C,gBAAM,IAAI,MAAM,qBAAqB,MAAM,EAAE,EAAE;AAAA,QACjD;AAEA,YAAI,CAAC,QAAQ,SAAU,SAAQ,WAAW,SAAS,YAAY,QAAQ;AACvE,cAAM,KAAK,OAAO,OAAO,oBAAoB,EAAE,IAAI,MAAM,IAAI,GAAG,QAAQ,GAAG,EAAE,SAAS,WAAW,CAAC;AAClG,eAAO,aAAa,EAAE,GAAG,UAAU,GAAG,SAAS,IAAI,MAAM,GAAG,CAAC;AAAA,MAC/D;AAAA,IACF;AAEA,UAAM,KAAK,MAAM,MAAM,IAAI,KAAK;AAChC,UAAM,MAAM,EAAE,IAAI,GAAG,SAAS,YAAY,IAAI;AAC9C,UAAM,KAAK,OAAO,OAAO,oBAAoB,KAAK,EAAE,SAAS,WAAW,CAAC;AACzE,WAAO,aAAa,GAAG;AAAA,EACzB;AAAA,EAEA,MAAM,YACJ,QACA,SACwB;AACxB,UAAM,IAAS,CAAC;AAChB,QAAI,QAAQ,OAAQ,GAAE,cAAc,OAAO;AAK3C,QAAI,SAAS,UAAU;AACrB,UAAI,QAAQ,QAAS,GAAE,WAAW,OAAO;AAAA,IAC3C,OAAO;AACL,UAAI,CAAC,SAAS,OAAQ,QAAO,CAAC;AAC9B,UAAI,QAAQ,WAAW,OAAO,YAAY,QAAQ,OAAQ,QAAO,CAAC;AAClE,QAAE,WAAW,QAAQ;AAAA,IACvB;AACA,UAAM,OAAO,MAAM,KAAK,OAAO,KAAK,oBAAoB;AAAA,MACtD,OAAO;AAAA,MAAG,OAAO;AAAA,MAAK,SAAS,CAAC,EAAE,OAAO,cAAc,OAAO,OAAO,CAAC;AAAA,MAAG,SAAS;AAAA,IACpF,CAAC;AACD,WAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,YAAY,IAAI,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,UAAU,UAAkB,SAAwD;AACxF,UAAM,MAAM,MAAM,KAAK,cAAc,QAAQ;AAE7C,QAAI,CAAC,KAAK,gBAAgB,KAAK,OAAO,EAAG,QAAO;AAChD,WAAO,aAAa,GAAG;AAAA,EACzB;AAAA,EAEA,MAAM,aAAa,UAAkB,SAA0C;AAC7E,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,yCAAyC;AACxE,UAAM,MAAM,MAAM,KAAK,cAAc,QAAQ;AAC7C,QAAI,CAAC,IAAK;AAGV,QAAI,CAAC,KAAK,gBAAgB,KAAK,OAAO,GAAG;AACvC,YAAM,IAAI,MAAM,qBAAqB,QAAQ,EAAE;AAAA,IACjD;AAEA,UAAM,YAAY,MAAM,KAAK,OAAO,KAAK,uBAAuB;AAAA,MAC9D,OAAO,EAAE,WAAW,SAAS;AAAA,MAAG,OAAO;AAAA,MAAK,SAAS;AAAA,IACvD,CAAC;AACD,eAAW,KAAM,aAAa,CAAC,GAAI;AACjC,YAAM,KAAK,OAAO,OAAO,uBAAuB,EAAE,OAAO,EAAE,IAAK,EAAU,GAAG,GAAG,SAAS,WAAW,CAAC;AAAA,IACvG;AACA,UAAM,KAAK,OAAO,OAAO,oBAAoB,EAAE,OAAO,EAAE,IAAI,SAAS,GAAG,SAAS,WAAW,CAAC;AAAA,EAC/F;AAAA;AAAA,EAIA,MAAM,IAAI,UAAkB,SAAqD;AAC/E,UAAM,SAAS,MAAM,KAAK,UAAU,UAAU,OAAO;AACrD,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qBAAqB,QAAQ,EAAE;AAC5D,WAAO,KAAK,cAAc,QAAQ,OAAO;AAAA,EAC3C;AAAA,EAEA,MAAM,SAAS,OAAwB,SAAqD;AAC1F,QAAI,CAAC,MAAM,OAAQ,OAAM,IAAI,MAAM,uCAAuC;AAC1E,QAAI,CAAC,MAAM,MAAO,OAAM,IAAI,MAAM,sCAAsC;AACxE,UAAM,QAAqB;AAAA,MACzB,IAAI;AAAA,MACJ,MAAM,MAAM,QAAQ;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM;AAAA,MACb,QAAQ,MAAM,UAAU;AAAA,IAC1B;AACA,WAAO,KAAK;AAAA,MAAc;AAAA,MAAO;AAAA;AAAA,MAAqB;AAAA,IAAK;AAAA,EAC7D;AAAA,EAEA,MAAc,cACZ,QACA,SACA,QAAQ,MACkB;AAG1B,UAAM,KAAK,oBAAoB,OAAO,aAAa,OAAO,QAAQ,OAAO;AACzE,UAAM,IAAI,OAAO,SAAS,CAAC;AAC3B,UAAM,QAAQ,KAAK,IAAI,EAAE,SAAS,eAAe,KAAK,OAAO;AAC7D,UAAM,OAAO,MAAM,KAAK,OAAO,KAAK,OAAO,aAAa;AAAA,MACtD,OAAO,EAAE;AAAA,MACT,QAAQ,EAAE;AAAA,MACV,SAAS,EAAE;AAAA,MACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MA+BA,SAAS;AAAA,QACP,OAAG,yCAA4B,OAA6C;AAAA,QAC5E,WAAW,QAAQ,aAAa,CAAC;AAAA,QACjC,aAAa,QAAQ,eAAe,CAAC;AAAA,QACrC,UAAU,QAAQ,YAAY;AAAA,MAChC;AAAA,IACF,CAAC;AACD,UAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAC3C,UAAM,OAAO,aAAa,MAAM,OAAO,QAAQ,EAAE,MAAM;AACvD,UAAM,QAAQ,KAAK,MAAM,IAAI,EAAE,YAAY;AAE3C,QAAI,SAAS,OAAO,OAAO,aAAa;AACtC,UAAI;AACF,cAAM,KAAK,OAAO,OAAO,oBAAoB;AAAA,UAC3C,IAAI,OAAO;AAAA,UACX,aAAa;AAAA,UACb,gBAAgB,KAAK;AAAA,UACrB,YAAY;AAAA,QACd,GAAG,EAAE,SAAS,WAAW,CAAC;AAAA,MAC5B,SAAS,KAAK;AACZ,aAAK,OAAO,OAAO,8CAA8C,GAAG;AAAA,MACtE;AAAA,IACF;AAEA,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,MACjB,UAAU,KAAK;AAAA,MACf,QAAQ,OAAO;AAAA,MACf;AAAA,MACA,MAAM;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIA,MAAM,eAAe,OAA4B,SAAoD;AACnG,QAAI,CAAC,MAAM,SAAU,OAAM,IAAI,MAAM,yCAAyC;AAC9E,QAAI,CAAC,MAAM,cAAc,MAAM,WAAW,WAAW,GAAG;AACtD,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,UAAM,SAAS,MAAM,KAAK,UAAU,MAAM,UAAU,OAAO;AAC3D,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qBAAqB,MAAM,QAAQ,EAAE;AAMlE,UAAM,KAAK,oBAAoB,OAAO,aAAa,MAAM,UAAU,cAAc,OAAO;AAExF,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,UAAM,WAAW,MAAM,mBAAmB;AAC1C,UAAM,OAAO,MAAM,gBAAgB,KAAK,KAAK;AAC7C,QAAI,MAAM;AAGR,UAAI;AACF,YAAI,mBAAK,MAAM,EAAE,UAAU,MAAM,YAAY,MAAM,CAAC;AAAA,MACtD,SAAS,KAAK;AACZ,cAAM,IAAI,MAAM,+CAA+C,IAAI,MAAO,IAAc,OAAO,EAAE;AAAA,MACnG;AAAA,IACF;AACA,UAAM,UAAU,KAAK;AAAA,MACnB,EAAE,iBAAiB,MAAM,kBAAkB,UAAU,UAAU,MAAM,YAAY,MAAM;AAAA,MACvF;AAAA,IACF,EAAE,YAAY;AACd,UAAM,KAAK,IAAI,MAAM;AACrB,UAAM,MAAW;AAAA,MACf;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM,QAAQ;AAAA,MACpB,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,MACjB,UAAU,MAAM,YAAY;AAAA,MAC5B,QAAQ,MAAM,WAAW;AAAA,MACzB,YAAY,MAAM,WAAW,KAAK,GAAG;AAAA,MACrC,QAAQ,MAAM,UAAU;AAAA,MACxB,kBAAkB,MAAM,mBAAmB;AAAA,MAC3C,UAAU,MAAM,WAAW,QAAQ,UAAU;AAAA,MAC7C,aAAa;AAAA,MACb,YAAY,IAAI,YAAY;AAAA,MAC5B,YAAY,IAAI,YAAY;AAAA,IAC9B;AACA,UAAM,KAAK,OAAO,OAAO,uBAAuB,KAAK,EAAE,SAAS,WAAW,CAAC;AAC5E,WAAO,gBAAgB,GAAG;AAAA,EAC5B;AAAA,EAEA,MAAM,iBAAiB,YAAoB,SAA0C;AACnF,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,2CAA2C;AA2B5E,UAAM,WAAW,MAAM,KAAK,gBAAgB,UAAU;AACtD,UAAM,SAAS,WAAW,MAAM,KAAK,cAAc,SAAS,SAAS,IAAI;AACzE,QAAI,CAAC,KAAK,gBAAgB,QAAQ,OAAO,GAAG;AAC1C,YAAM,IAAI,MAAM,qBAAqB,UAAU,EAAE;AAAA,IACnD;AACA,UAAM,KAAK,OAAO,OAAO,uBAAuB,EAAE,OAAO,EAAE,IAAI,WAAW,GAAG,SAAS,WAAW,CAAC;AAAA,EACpG;AAAA,EAEA,MAAM,cACJ,QACA,SAC2B;AAM3B,QAAI,CAAC,SAAS,UAAU;AACtB,UAAI,CAAC,QAAQ,SAAU,QAAO,CAAC;AAC/B,UAAI,CAAE,MAAM,KAAK,UAAU,OAAO,UAAU,OAAO,EAAI,QAAO,CAAC;AAAA,IACjE;AACA,UAAM,IAAS,CAAC;AAChB,QAAI,QAAQ,SAAU,GAAE,YAAY,OAAO;AAC3C,UAAM,OAAO,MAAM,KAAK,OAAO,KAAK,uBAAuB;AAAA,MACzD,OAAO;AAAA,MAAG,OAAO;AAAA,MAAK,SAAS,CAAC,EAAE,OAAO,eAAe,OAAO,MAAM,CAAC;AAAA,MAAG,SAAS;AAAA,IACpF,CAAC;AACD,WAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,eAAe,IAAI,CAAC;AAAA,EAC5D;AAAA;AAAA,EAIA,MAAM,YAAY,KAAyE;AACzF,UAAM,MAAM,OAAO,KAAK,MAAM,IAAI,GAAG,YAAY;AACjD,UAAM,MAAM,MAAM,KAAK,OAAO,KAAK,uBAAuB;AAAA,MACxD,OAAO,EAAE,QAAQ,KAAK;AAAA,MACtB,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AACD,UAAM,QAAQ,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,eAAe,EAC7D,OAAO,OAAK,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE;AAEpD,QAAI,QAAQ,GAAG,SAAS,GAAG,UAAU;AACrC,eAAW,YAAY,MAAM;AAC3B,UAAI;AACF,cAAM,MAAM,MAAM,KAAK,cAAc,SAAS,SAAS;AACvD,YAAI,CAAC,KAAK;AACR;AACA,gBAAM,KAAK,aAAa,SAAS,IAAI;AAAA,YACnC,aAAa;AAAA,YACb,YAAY,UAAU,SAAS,SAAS;AAAA,UAC1C,CAAC;AACD;AAAA,QACF;AACA,cAAM,SAAS,aAAa,GAAG;AAQ/B,cAAM,UAAU,OAAO;AACvB,cAAM,aAAa,WAAW,KAAK,sBAC/B,MAAM,KAAK,oBAAoB,OAAO,EAAE,MAAM,CAAC,QAAQ;AACrD,eAAK,OAAO,OAAO,8DAA8D,GAAG;AACpF,iBAAO;AAAA,QACT,CAAC,IACD;AACJ,YAAI,CAAC,YAAY;AACf;AACA,gBAAM,KAAK,aAAa,SAAS,IAAI;AAAA,YACnC,aAAa;AAAA,YACb,YAAY,UACR,UAAU,OAAO,kGACjB;AAAA,UACN,CAAC;AACD;AAAA,QACF;AAIA,cAAM,MAAqB,SAAS,UAAU;AAC9C,cAAM,SAAS,MAAM,KAAK,cAAc,EAAE,GAAG,QAAQ,QAAQ,IAAI,GAAG,YAAY,KAAK;AAErF,cAAM,aAAa,SAAS,WAAW,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACnF,cAAM,UAAU,cAAc,SAAS,kBAAkB;AAAA,UACvD,MAAM,SAAS,QAAQ,OAAO;AAAA,UAC9B,MAAM,GAAG,MAAM,GAAG,EAAE;AAAA,UACpB,MAAM,OAAO,OAAO,QAAQ;AAAA,QAC9B,CAAC;AAED,YAAI,KAAK,SAAS,WAAW,SAAS,GAAG;AACvC,cAAI,QAAQ,OAAO;AACjB,kBAAM,KAAK,MAAM,KAAK;AAAA,cACpB,IAAI;AAAA,cACJ;AAAA,cACA,MAAM,aAAa,OAAO,QAAQ;AAAA,cAClC,aAAa,CAAC;AAAA;AAAA;AAAA,gBAGZ,UAAU,IAAI,SAAS,QAAQ,OAAO,MAAM,QAAQ,uBAAuB,GAAG,EAAE,QAAQ,YAAY,EAAE,KAAK,QAAQ,IAAI,GAAG,MAAM,GAAG,EAAE,CAAC;AAAA,gBACtI,SAAS,OAAO;AAAA,gBAChB,aAAa;AAAA,cACf,CAAC;AAAA,cACD,eAAe;AAAA,cACf,WAAW,SAAS;AAAA,YACtB,CAAC;AAAA,UACH,OAAO;AACL,kBAAM,KAAK,MAAM,KAAK;AAAA,cACpB,IAAI;AAAA,cACJ;AAAA,cACA,MAAM,MAAM,WAAW,OAAO,IAAI,CAAC,WAAM,OAAO,QAAQ,cAAc,OAAO,IAAI;AAAA,cACjF,MAAM,GAAG,OAAO,IAAI,WAAM,OAAO,QAAQ;AAAA,cACzC,eAAe;AAAA,cACf,WAAW,SAAS;AAAA,YACtB,CAAC;AAAA,UACH;AAAA,QACF,WAAW,CAAC,KAAK,OAAO;AACtB,eAAK,OAAO,OAAO,qFAAgF;AAAA,QACrG;AAEA,cAAM,KAAK,gBAAgB,UAAU,EAAE;AACvC;AAAA,MACF,SAAS,KAAU;AACjB;AACA,cAAM,KAAK,aAAa,SAAS,IAAI;AAAA,UACnC,aAAa;AAAA,UACb,YAAY,OAAO,KAAK,WAAW,OAAO,SAAS,EAAE,MAAM,GAAG,GAAG;AAAA,QACnE,CAAC;AACD,aAAK,OAAO,QAAQ,8CAA8C,GAAG;AAAA,MACvE;AAAA,IACF;AACA,WAAO,EAAE,OAAO,QAAQ,QAAQ;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYQ,UACN,UACA,MACM;AACN,UAAM,QAAQ,SAAS,mBAAmB,IAAI,KAAK;AACnD,QAAI,MAAM;AACR,UAAI;AACF,cAAM,OAAO,IAAI,mBAAK,MAAM,EAAE,UAAU,SAAS,YAAY,MAAM,CAAC,EAAE,QAAQ,IAAI;AAClF,YAAI,KAAM,QAAO;AACjB,aAAK,OAAO,OAAO,wBAAwB,IAAI,oDAAoD;AAAA,MACrG,SAAS,KAAK;AACZ,aAAK,OAAO,OAAO,gCAAgC,IAAI,+BAA+B,GAAG;AAAA,MAC3F;AAAA,IACF;AACA,UAAM,WAAW,SAAS,oBAAoB;AAC9C,WAAO,IAAI,KAAK,KAAK,QAAQ,IAAI,WAAW,GAAM;AAAA,EACpD;AAAA,EAEA,MAAc,gBAAgB,UAA0B,OAA8B;AACpF,UAAM,UAAU,KAAK,UAAU,UAAU,KAAK,MAAM,IAAI,CAAC,EAAE,YAAY;AACvE,UAAM,KAAK,OAAO,OAAO,uBAAuB;AAAA,MAC9C,IAAI,SAAS;AAAA,MACb,aAAa;AAAA,MACb,cAAc;AAAA,MACd,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,GAAG,EAAE,SAAS,WAAW,CAAC;AAAA,EAC5B;AAAA,EAEA,MAAc,aAAa,IAAY,OAA+C;AACpF,QAAI;AACF,YAAM,KAAK,OAAO,OAAO,uBAAuB;AAAA,QAC9C;AAAA,QAAI,GAAG;AAAA,QAAO,YAAY,KAAK,MAAM,IAAI,EAAE,YAAY;AAAA,MACzD,GAAG,EAAE,SAAS,WAAW,CAAC;AAAA,IAC5B,SAAS,KAAK;AACZ,WAAK,OAAO,OAAO,0CAA0C,GAAG;AAAA,IAClE;AAAA,EACF;AACF;;;ACjyBA,mBAGO;AAgCA,IAAM,uBAAN,MAA6C;AAAA,EAYlD,YAAY,UAAgC,CAAC,GAAG;AAXhD,gBAAO;AACP,mBAAU;AACV,gBAAO;AACP,wBAAe,CAAC,iCAAiC;AAS/C,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,MAAM,KAAK,KAAmC;AAC5C,QAAI,WAAuC,UAAU,EAAE,SAAS;AAAA,MAC9D,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,MACP,mBAAmB;AAAA,MACnB,WAAW;AAAA,MACX,SAAS,CAAC,6BAAgB,8BAAiB;AAAA,IAC7C,CAAC;AACD,QAAI,OAAO,KAAK,0CAA0C;AAAA,EAC5D;AAAA,EAEA,MAAM,MAAM,KAAmC;AAC7C,QAAI,KAAK,gBAAgB,YAAY;AAKnC,UAAI,SAA6B;AACjC,UAAI;AAAE,iBAAS,IAAI,WAAwB,UAAU;AAAA,MAAG,QAClD;AAAE,YAAI;AAAE,mBAAS,IAAI,WAAwB,MAAM;AAAA,QAAG,QAAQ;AAAA,QAAe;AAAA,MAAE;AACrF,UAAI,CAAC,QAAQ;AACX,YAAI,OAAO,KAAK,wEAAmE;AACnF;AAAA,MACF;AAEA,UAAI;AAIJ,UAAI;AAAE,gBAAQ,IAAI,WAAwB,OAAO;AAAA,MAAG,QAAQ;AAAA,MAA0B;AACtF,UAAI,CAAC,OAAO;AACV,YAAI,OAAO,KAAK,oFAA+E;AAAA,MACjG;AAWA,YAAM,YAAY,OAAO,QAAgB,YAAuC;AAC9E,YAAI;AACJ,YAAI;AAAE,qBAAW,IAAI,WAA6B,UAAU;AAAA,QAAG,QAAQ;AAAE,iBAAO;AAAA,QAAM;AACtF,YAAI,CAAC,YAAY,OAAO,SAAS,cAAc,WAAY,QAAO;AAIlE,eAAO,MAAM,SAAS,UAAU,QAAQ,OAAsC;AAAA,MAChF;AAEA,WAAK,UAAU,IAAI,cAAc;AAAA,QAC/B;AAAA,QACA;AAAA,QACA,QAAQ,IAAI;AAAA,QACZ,SAAS,KAAK,QAAQ;AAAA,QACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOA,qBAAqB;AAAA,MACvB,CAAC;AACD,UAAI,gBAAgB,WAAW,KAAK,OAAO;AAE3C,UAAI,KAAK,QAAQ,mBAAmB;AAClC,YAAI,OAAO,KAAK,oEAAoE;AACpF;AAAA,MACF;AAEA,YAAM,aAAa,KAAK,IAAI,KAAO,KAAK,QAAQ,sBAAsB,GAAM;AAI5E,UAAI;AACF,cAAM,MAAM,IAAI,WAAwB,KAAK;AAC7C,YAAI,OAAO,OAAO,IAAI,aAAa,YAAY;AAC7C,eAAK,aAAa;AAClB,eAAK,UAAU;AACf,gBAAM,IAAI,SAAS,KAAK,SAAS,EAAE,MAAM,YAAY,WAAW,GAAG,YAAY;AAC7E,gBAAI;AAAE,oBAAM,KAAK,SAAS,YAAY;AAAA,YAAG,SAClC,KAAK;AAAE,kBAAI,OAAO,KAAK,8CAA8C,GAAU;AAAA,YAAG;AAAA,UAC3F,CAAC;AACD,cAAI,OAAO,KAAK,gEAAgE,EAAE,WAAW,CAAC;AAC9F;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAAoC;AAE5C,WAAK,iBAAiB,YAAY,MAAM;AACtC,aAAK,SAAS,YAAY,EAAE,MAAM,SAAO;AACvC,cAAI,OAAO,KAAK,8CAA8C,GAAG;AAAA,QACnE,CAAC;AAAA,MACH,GAAG,UAAU;AAIb,MAAC,KAAK,gBAAwB,QAAQ;AACtC,UAAI,OAAO,KAAK,sEAAsE,EAAE,WAAW,CAAC;AAAA,IACtG,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,KAAK,KAAmC;AAC5C,QAAI,KAAK,eAAgB,eAAc,KAAK,cAAc;AAC1D,SAAK,iBAAiB;AACtB,QAAI,KAAK,cAAc,KAAK,WAAW,OAAO,KAAK,WAAW,WAAW,YAAY;AACnF,UAAI;AAAE,cAAM,KAAK,WAAW,OAAO,KAAK,OAAO;AAAA,MAAG,SAC3C,KAAK;AAAE,YAAI,OAAO,KAAK,8CAA8C,GAAU;AAAA,MAAG;AAAA,IAC3F;AAAA,EACF;AACF;","names":["import_audit"]}

package/dist/index.mjs

@@ -412,8 +412,7 @@ var ReportService = class {
   async unscheduleReport(scheduleId, context) {
     if (!scheduleId) throw new Error("VALIDATION_FAILED: scheduleId is required");
     const schedule = await this.loadScheduleRow(scheduleId);
-    if (!schedule) return;
-    const report = await this.loadReportRow(schedule.report_id);
+    const report = schedule ? await this.loadReportRow(schedule.report_id) : null;
     if (!this.canAccessReport(report, context)) {
       throw new Error(`REPORT_NOT_FOUND: ${scheduleId}`);
     }