@open-everywhere/core 0.1.0

package/dist/agent/routines/bound.js

@@ -0,0 +1,233 @@
+// THE JOB CEILING (OPE-248) — pure, deterministic, unit-tested (scripts/routine-bound-test.ts).
+// The impure half (persist the stop, write the forensic row, post the notice) is
+// routines/outcome-fold.ts retireExhaustedRoutine, exactly the lifecycle.ts / outcome-fold.ts split
+// the three-strike self-disable already uses.
+//
+// ── WHAT THIS CLOSES ────────────────────────────────────────────────────────────────────────────
+// A durable job (`sessionMode:"job"`) runs until its OWN session calls `complete_job`. NOTHING else
+// bounds it. Every other stop in the tree counts FAILURE:
+//
+//   • `consecutiveFailures` resets to 0 on any non-failed settlement (lifecycle.ts applyOutcome:51);
+//   • OPE-177's `report_run_failed` only reaches a run that KNOWS its work didn't work;
+//   • OPE-146's delivery-rejected fold only reaches a fire that could not be DELIVERED.
+//
+// A monitor that succeeds forever — polls, finds nothing, replies, repeats — is a correct run every
+// single time, so all three are structurally blind to it. It runs until somebody notices.
+//
+// ── WHY NOT A COST / TOKEN THRESHOLD ────────────────────────────────────────────────────────────
+// spend/checkpoint.ts is the obvious reach and it cannot do this. It gates CONSEQUENTIAL tools at
+// their execute() top (`requireSessionContinuation`), and its own card says so verbatim: "reads and
+// replies are unaffected either way". Reads and replies are the ENTIRE surface area of a polling
+// monitor, so a cheap poll never crosses it at any threshold — and it is opt-in, uncapped by default,
+// besides. The bound therefore lives on the ROUTINE and is denominated in fires and wall-clock, which
+// are the two things a monitor unavoidably consumes.
+//
+// ⚠️ THE CHECKPOINT IS STILL NOT IRRELEVANT HERE, and reading the paragraph above as "the checkpoint
+// has nothing to do with the ceiling" is what OPE-253 had to fix. A checkpoint cannot STOP a monitor,
+// but it can STALL one indefinitely — and a stalled job kept burning this ceiling while doing nothing,
+// then retired under a notice that said nothing had failed. So the verdict below carries a THIRD
+// dimension, `stalled`, evaluated first. routines/stall.ts holds that whole argument.
+//
+// ── WHERE THE NUMBERS COME FROM ─────────────────────────────────────────────────────────────────
+// An unjustified constant defended by a causal story nobody measured is the failure class this
+// repo has been burned by most, so each one below is DERIVED from something already in the tree,
+// and each is overridable by env (the `approvalTtlHours` fail-soft convention).
+//
+//   DEFAULT_JOB_MAX_DAYS = 7  — the deadline.
+//     Anchored on routines/fire-audit.ts FORENSIC_WINDOW_MS, which is 7 days and is the window
+//     EVERY routine-history read in the product uses (`list_routines`' fires7d/tokens7d, the
+//     operator CLI, the MCP view). Past it, a job's own run history has aged out of every reader
+//     OE ships — so the evidence a human needs to decide "re-arm this or not?" no longer exists.
+//     A ceiling that trips after its own evidence is gone is not a ceiling anybody can act on.
+//     It also has to be strictly INSIDE one billing period: the hard cap (spend/spend.ts) is a
+//     per-MONTH budget, so a job bound longer than a month would leave the cap as the only thing
+//     that ever stops a runaway — and the cap stops the whole SCOPE, not the runaway. 7 days is
+//     the human review period that sits comfortably inside that, spanning a full working week.
+//
+//   MIN_FIRES_BEFORE_DEADLINE = MAX_CONSECUTIVE_FAILURES (3) — the deadline's cadence floor.
+//     A flat 7 days would give a WEEKLY job exactly one fire, i.e. silently turn it into a `once`.
+//     So the deadline is stretched to at least this many periods. Three, because this codebase
+//     already holds that three tries is the number before you may conclude anything about a
+//     routine (lifecycle.ts MAX_CONSECUTIVE_FAILURES) — reusing it keeps ONE answer to "how many
+//     attempts is a fair sample" instead of inventing a second.
+//
+//   DEFAULT_JOB_MAX_FIRES = 200 — the runaway backstop.
+//     Derived from the deadline, not chosen. It must NOT bind a reasonably-configured job before
+//     the deadline does, and the fastest cadence anyone would call reasonable for an unattended
+//     monitor is hourly: 24 × 7 = 168 fires in the default week. 200 is the smallest round number
+//     strictly above that, so every cadence at or slower than hourly retires on its DEADLINE (the
+//     dimension that is meaningful there) and only faster ones retire on the COUNT. At the
+//     dispatcher floor (DISPATCH_TICK_MINUTES = 10 ⇒ 144 fires/day) 200 fires is ~33 hours, so the
+//     fastest job OE can physically run is bounded in under a day and a half rather than a week.
+//
+// ── THE CROSSOVER ───────────────────────────────────────────────────────────────────────────────
+//   every 10 min  → 200 fires in ~33h   → COUNT trips
+//   hourly        → 168 fires in 7d     → DEADLINE trips (at 168, just under the cap)
+//   daily         → 7 fires in 7d       → DEADLINE trips
+//   weekly        → deadline stretched to 21d, 3 fires → DEADLINE trips
+//
+// ── SCOPE ───────────────────────────────────────────────────────────────────────────────────────
+// Bounds are minted for DURABLE JOBS only. A plain `cron`/`interval` routine is SUPPOSED to run
+// forever — a daily digest that retired itself after a week would be a defect, not a fence. The
+// field is generic on the row so widening it later is a changed default, not a new column.
+// `once` needs none (it retires itself), and a job can never be `event`-triggered — create_routine
+// refuses that pairing outright — so the clock dispatcher is the COMPLETE evaluation site, not
+// merely the main one.
+import { MAX_CONSECUTIVE_FAILURES } from "./lifecycle.js";
+import { computeNextRun } from "./schedule.js";
+import { stallExhausted, stallReason } from "./stall.js";
+import { SETTINGS, getSettings } from "../settings/settings.js";
+/** Default wall-clock grace for a durable job, in days — see the header for the derivation.
+ *  IS the `routines.jobMaxDays` shipped default (override: `routines.jobMaxDays`). */
+export const DEFAULT_JOB_MAX_DAYS = SETTINGS.routines.jobMaxDays.shipped;
+/** Default cap on fires under one bound — see the header. IS the `routines.jobMaxFires` shipped
+ *  default (override: `routines.jobMaxFires`). */
+export const DEFAULT_JOB_MAX_FIRES = SETTINGS.routines.jobMaxFires.shipped;
+/** The deadline is stretched so a slow cadence still gets a fair sample of runs. Reuses the
+ *  three-strike constant rather than inventing a second answer to "how many attempts is fair". */
+export const MIN_FIRES_BEFORE_DEADLINE = MAX_CONSECUTIVE_FAILURES;
+const DAY_MS = 24 * 60 * 60_000;
+/** Wall-clock grace for a fresh job bound, in days. */
+export function jobBoundMaxDays() {
+    return getSettings().routines.jobMaxDays;
+}
+/** Fire cap for a fresh job bound. */
+export function jobBoundMaxFires() {
+    return getSettings().routines.jobMaxFires;
+}
+/**
+ * The trigger's period in ms, or undefined when it has none / can't be derived.
+ *
+ * Derived by asking {@link computeNextRun} for the next TWO instants and differencing them, rather
+ * than by reading `everyMinutes` and re-implementing cron — so a cron job's cadence comes from the
+ * same tested math the dispatcher schedules on, and there is no second parser to drift. `once` and
+ * `event` have no period by construction (computeNextRun returns null), which is the correct answer
+ * for both: a one-shot retires itself, and a job can never be event-triggered.
+ */
+export function triggerPeriodMs(trigger, from) {
+    const first = computeNextRun(trigger, from);
+    if (!first)
+        return undefined;
+    const second = computeNextRun(trigger, first);
+    if (!second)
+        return undefined;
+    const period = second.getTime() - first.getTime();
+    return period > 0 ? period : undefined;
+}
+/**
+ * Mint the bound a durable job is armed with. HOST-SIDE ONLY — called from the arm click
+ * (approvals/routine-create.ts) and the re-arm click (approvals/routine-lifecycle.ts), never from a
+ * tool input, so no model can name its own ceiling.
+ *
+ * The deadline is the flat default, STRETCHED to {@link MIN_FIRES_BEFORE_DEADLINE} periods when the
+ * cadence is slower than that — otherwise a weekly job would get exactly one fire and be a `once`
+ * wearing a job's clothes. A trigger with no derivable period (a cron that never matches again)
+ * gets the flat default: refusing to mint a bound there would leave the unbounded hole open in
+ * exactly the case least likely to be noticed.
+ */
+export function mintJobBound(trigger, from) {
+    const flat = jobBoundMaxDays() * DAY_MS;
+    const period = triggerPeriodMs(trigger, from);
+    const spanMs = Math.max(flat, period !== undefined ? period * MIN_FIRES_BEFORE_DEADLINE : 0);
+    return { until: new Date(from.getTime() + spanMs).toISOString(), maxFires: jobBoundMaxFires() };
+}
+/**
+ * The ceiling in RELATIVE terms, for the arming card — "after up to 200 runs or 7 days, whichever
+ * comes first". Relative rather than absolute ON PURPOSE: the card is frozen at PROPOSE time and the
+ * bound is minted at CLICK time (the same freshness split `nextRunAt` already takes in
+ * approvals/routine-create.ts), so an absolute date on the card would be falsified by any gap
+ * between the two. The SPAN is what the human is agreeing to, and the span does not move.
+ */
+export function describeBoundPolicy(trigger, from) {
+    const bound = mintJobBound(trigger, from);
+    const days = Math.round((Date.parse(bound.until ?? "") - from.getTime()) / DAY_MS);
+    return `stops itself after ${bound.maxFires} runs or ${days} day${days === 1 ? "" : "s"}, whichever comes first`;
+}
+/**
+ * A stored bound plus progress, for `list_routines` — "125/200 runs, or by 2026-08-05". Null for an
+ * unbounded routine, so the list view says nothing at all about ceilings for the rows that have
+ * none. A ceiling nobody can enumerate from the room is not governable from the room, which is the
+ * same argument the standing-rules and permissions fields on that view already rest on.
+ */
+export function describeBound(r) {
+    const bound = r.bound;
+    if (!bound)
+        return null;
+    const parts = [];
+    if (bound.maxFires !== undefined)
+        parts.push(`${r.fireCount ?? 0}/${bound.maxFires} runs`);
+    if (bound.until !== undefined)
+        parts.push(`until ${bound.until}`);
+    return parts.length > 0 ? parts.join(", or ") : null;
+}
+/**
+ * Has this routine exhausted its bound at `now`? PURE. An absent bound, an absent dimension, and a
+ * bound with neither component set all read as "not exhausted" — a routine with no ceiling is
+ * unbounded, which is what every pre-OPE-248 row and every plain routine is.
+ *
+ * FIRES ARE CHECKED FIRST because the count is the dimension that can be stated exactly ("it ran
+ * 200 times"), whereas a deadline reads as "it has been a week" — the same most-specific-first
+ * ordering spend/checkpoint.ts checkCheckpoint uses.
+ *
+ * The comparison is `>=` on both, so a bound of `maxFires: 1` means one fire happens and then the
+ * routine retires — never zero. The dispatcher increments the counter as part of the fire it is
+ * about to make, so a row read here has already been counted for every fire it actually got.
+ */
+export function checkBound(r, now) {
+    const bound = r.bound;
+    if (!bound)
+        return { exhausted: false };
+    // THE STALL (OPE-253) IS CHECKED FIRST, and that INVERTS the most-specific-first ordering the two
+    // dimensions below use — on purpose, because specificity is not the ranking criterion here,
+    // ACTIONABILITY is. A ceiling stop asks the operator for one thing (re-arm); a stall stop asks for
+    // that PLUS the thing that has to happen before it (answer the checkpoint card, or raise the
+    // checkpoint for this scope). A job can trip both — three stalled fires while also sitting at 200
+    // fires — and reporting "it ran 200 times" there sends the operator to re-arm a job that will stall
+    // again on its very next fire, which is "enable didn't work" in the one case we can see coming.
+    //
+    // It lives INSIDE the `bound` guard, so stall-reaping is keyed on carrying a ceiling — the same key
+    // `fireCount` is written under (schedules/dispatch.ts), which today is exactly the durable jobs. A
+    // plain routine still ACCUMULATES the counter (it is visible on the row and in `list_routines`), it
+    // just is not retired by it: its checkpoint crossing dies with its per-fire session anyway, and a
+    // daily digest is SUPPOSED to run forever. See routines/stall.ts for the whole asymmetry.
+    if (stallExhausted(r)) {
+        return { exhausted: true, dimension: "stalled", reason: stallReason(r) };
+    }
+    const fires = Number.isInteger(r.fireCount) && r.fireCount > 0 ? r.fireCount : 0;
+    if (bound.maxFires !== undefined && fires >= bound.maxFires) {
+        return {
+            exhausted: true,
+            dimension: "fires",
+            reason: `it ran ${fires} time${fires === 1 ? "" : "s"} without finishing (its ceiling is ${bound.maxFires} run${bound.maxFires === 1 ? "" : "s"})`,
+        };
+    }
+    if (bound.until !== undefined) {
+        const until = Date.parse(bound.until);
+        // A GARBAGE deadline is ignored rather than treated as expired: a hand-edited or migrated row
+        // must not be able to retire a live job by being unparseable. The fire cap above still binds.
+        if (Number.isFinite(until) && now.getTime() >= until) {
+            return {
+                exhausted: true,
+                dimension: "deadline",
+                reason: `it has been running since before ${bound.until} without finishing (its ceiling is that date)`,
+            };
+        }
+    }
+    return { exhausted: false };
+}
+/**
+ * The patch that retires an exhausted routine. Terminal in the same way the three-strike
+ * self-disable is — `status:"disabled"`, `nextRunAt:null`, kept for audit/list visibility, never
+ * deleted — and deliberately NOT `"done"`: `done` means the job declared its objective FINISHED
+ * (`complete_job`), and a job that hit a ceiling is precisely one that did not. Conflating them
+ * would make `enable_routine`'s "a completed job is terminal" refusal fire on the one case where
+ * re-arming is the correct move.
+ */
+export function boundExhaustedPatch(verdict) {
+    // The PREFIX names the class of stop, because `disabledReason` is what `list_routines`, the operator
+    // CLI, the `routine.disabled` row and the re-arm card all show, and "stopped at its ceiling" would
+    // be an actively wrong summary of a stall — the job never got to spend its ceiling.
+    const prefix = verdict.dimension === "stalled" ? "stopped because it was blocked" : "stopped at its ceiling";
+    return { status: "disabled", disabledReason: `${prefix} — ${verdict.reason}`, nextRunAt: null };
+}
+//# sourceMappingURL=bound.js.map

package/dist/agent/routines/bound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound.js","sourceRoot":"","sources":["../../../agent/routines/bound.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,iFAAiF;AACjF,oGAAoG;AACpG,8CAA8C;AAC9C,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,0DAA0D;AAC1D,EAAE;AACF,qGAAqG;AACrG,wFAAwF;AACxF,wFAAwF;AACxF,EAAE;AACF,oGAAoG;AACpG,0FAA0F;AAC1F,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,oGAAoG;AACpG,iGAAiG;AACjG,sGAAsG;AACtG,sGAAsG;AACtG,qDAAqD;AACrD,EAAE;AACF,qGAAqG;AACrG,sGAAsG;AACtG,uGAAuG;AACvG,iGAAiG;AACjG,sFAAsF;AACtF,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,iGAAiG;AACjG,gFAAgF;AAChF,EAAE;AACF,8CAA8C;AAC9C,+FAA+F;AAC/F,6FAA6F;AAC7F,iGAAiG;AACjG,iGAAiG;AACjG,+FAA+F;AAC/F,+FAA+F;AAC/F,iGAAiG;AACjG,gGAAgG;AAChG,+FAA+F;AAC/F,EAAE;AACF,6FAA6F;AAC7F,mGAAmG;AACnG,+FAA+F;AAC/F,4FAA4F;AAC5F,iGAAiG;AACjG,gEAAgE;AAChE,EAAE;AACF,wDAAwD;AACxD,iGAAiG;AACjG,gGAAgG;AAChG,kGAAkG;AAClG,kGAAkG;AAClG,2FAA2F;AAC3F,mGAAmG;AACnG,iGAAiG;AACjG,EAAE;AACF,mGAAmG;AACnG,sDAAsD;AACtD,sFAAsF;AACtF,yDAAyD;AACzD,wEAAwE;AACxE,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,gGAAgG;AAChG,2FAA2F;AAC3F,mGAAmG;AACnG,+FAA+F;AAC/F,uBAAuB;AAEvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEhE;sFACsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;AAEzE;kDACkD;AAClD,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC;AAE3E;kGACkG;AAClG,MAAM,CAAC,MAAM,yBAAyB,GAAG,wBAAwB,CAAC;AAElE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAEhC,uDAAuD;AACvD,MAAM,UAAU,eAAe;IAC7B,OAAO,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC3C,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,IAAU;IACjE,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAClD,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB,EAAE,IAAU;IAC9D,MAAM,IAAI,GAAG,eAAe,EAAE,GAAG,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAuB,EAAE,IAAU;IACrE,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;IACnF,OAAO,sBAAsB,KAAK,CAAC,QAAQ,YAAY,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,yBAAyB,CAAC;AACnH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,CAAuC;IACnE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACtB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,OAAO,CAAC,CAAC;IAC3F,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAiBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CACxB,CAAwD,EACxD,GAAS;IAET,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACtB,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAExC,kGAAkG;IAClG,4FAA4F;IAC5F,mGAAmG;IACnG,6FAA6F;IAC7F,kGAAkG;IAClG,oGAAoG;IACpG,gGAAgG;IAChG,EAAE;IACF,oGAAoG;IACpG,mGAAmG;IACnG,oGAAoG;IACpG,kGAAkG;IAClG,0FAA0F;IAC1F,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAK,CAAC,CAAC,SAAoB,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,SAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5D,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,UAAU,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,sCAAsC,KAAK,CAAC,QAAQ,OAAO,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;SACnJ,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,8FAA8F;QAC9F,8FAA8F;QAC9F,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC;YACrD,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,oCAAoC,KAAK,CAAC,KAAK,+CAA+C;aACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmD;IACrF,qGAAqG;IACrG,mGAAmG;IACnG,oFAAoF;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,wBAAwB,CAAC;IAC7G,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAClG,CAAC"}

package/dist/agent/routines/check-in.d.ts

@@ -0,0 +1,10 @@
+/** First self-check-in fires ~1 minute out (doc §A#4 "start ~1 min"). */
+export declare const CHECK_IN_START_MS = 60000;
+/** Hard ceiling on a self-check-in interval — it never backs off past ~5 minutes (doc §A#4/§D4
+ *  "hard cap ~5 min"). A wait longer than this just keeps re-checking every 5 minutes. */
+export declare const CHECK_IN_CAP_MS: number;
+/** The doctrine line the `create_routine` tool folds into its `at` (one-shot) description, so the
+ *  numbers live in ONE place (these constants) and prose can't drift from the cap the code enforces.
+ *  Teaches the model the self-check-in interval discipline for an in-flight wait. */
+export declare const CHECK_IN_DOCTRINE: string;
+//# sourceMappingURL=check-in.d.ts.map

package/dist/agent/routines/check-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-in.d.ts","sourceRoot":"","sources":["../../../agent/routines/check-in.ts"],"names":[],"mappings":"AAoCA,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAExC;0FAC0F;AAC1F,eAAO,MAAM,eAAe,QAAa,CAAC;AAI1C;;qFAEqF;AACrF,eAAO,MAAM,iBAAiB,QAKqC,CAAC"}

package/dist/agent/routines/check-in.js

@@ -0,0 +1,50 @@
+// Check-in timer doctrine — the interval discipline for a `once` routine used as a SELF-CHECK-IN
+// on in-flight work (OPE-40).
+//
+// Claude Tag's pattern: when the agent dispatches work it will wait on (a spawned worker, a PR it
+// asked someone to review), it arms a short self-check that fires, refreshes the live status, and
+// re-arms — starting ~1 min out and BACKING OFF to a HARD CAP of ~5 min so a long wait doesn't turn
+// into a tight busy-loop of check-ins. This is the SAME `once` primitive OE already ships
+// (routines/routine.ts kind:"once"; the subscribe_pr re-arm chain proves the "arm the next check
+// itself" shape) — this module adds only the INTERVAL CAP the doc specifies, as pure math.
+//
+// WHAT THIS MODULE IS, AFTER OPE-147: the DOCTRINE STRING and the two numbers it interpolates.
+// Nothing else. The `create_routine` tool folds {@link CHECK_IN_DOCTRINE} into its `at` description,
+// so prose and numbers cannot drift, and the model — which is the thing that arms a check-in — is
+// the consumer.
+//
+// 🔴 THE BACK-OFF MATH WAS DELETED HERE (OPE-147 / audit §"Retry/backoff"), and this note is the
+// point of the deletion. `nextCheckInDelayMs` / `nextCheckInAt` / `clampCheckInDelayMs` /
+// `clampCheckInMinutes` shipped with OPE-40, fully unit-tested, described in their own doc comment
+// as "the ENFORCE point a caller uses" — and no caller ever existed, in this module's whole
+// lifetime. The audit found them cited as the tree's only retry/backoff logic, which is exactly the
+// failure mode routines/lifecycle.ts records for `gcOrphaned`: a tested-but-uncalled mechanism reads
+// as EVIDENCE FOR a guarantee nothing actually provides.
+//
+// They were deleted rather than wired because the guarantee they claimed is already held, harder, by
+// something real: the dispatcher ticks every DISPATCH_TICK_MINUTES (10) and fires a routine on the
+// first tick at/after it is due (routines/schedule.ts), so a `once` armed for now+5s cannot produce
+// a tighter check-in than ten minutes whatever the model asks for. A 1-minute floor clamped on top
+// of a 10-minute floor enforces nothing. And the other half — exponential back-off between the
+// endpoints — is a MODEL behaviour by design: the model arms each next check itself (there is no
+// re-arm state to manage, which is the whole point of the `once` primitive), so the doctrine string
+// is the mechanism, and the doctrine string is live.
+//
+// If a future code path genuinely needs a back-off ladder — a host-driven retry of a failed fire,
+// say — it should be written against THAT path's semantics (a cron routine must not drift off its
+// grid to accommodate a retry), not resurrected from here on the strength of having once existed.
+/** First self-check-in fires ~1 minute out (doc §A#4 "start ~1 min"). */
+export const CHECK_IN_START_MS = 60_000;
+/** Hard ceiling on a self-check-in interval — it never backs off past ~5 minutes (doc §A#4/§D4
+ *  "hard cap ~5 min"). A wait longer than this just keeps re-checking every 5 minutes. */
+export const CHECK_IN_CAP_MS = 5 * 60_000;
+const MINUTE_MS = 60_000;
+/** The doctrine line the `create_routine` tool folds into its `at` (one-shot) description, so the
+ *  numbers live in ONE place (these constants) and prose can't drift from the cap the code enforces.
+ *  Teaches the model the self-check-in interval discipline for an in-flight wait. */
+export const CHECK_IN_DOCTRINE = `Self-check-in on in-flight work (waiting on a spawned worker, a review, a build): arm the FIRST ` +
+    `check ~${CHECK_IN_START_MS / MINUTE_MS} min out, and if you re-check, BACK OFF each time up to a ` +
+    `hard cap of ~${CHECK_IN_CAP_MS / MINUTE_MS} min — never tighter — so a long wait doesn't become a ` +
+    `busy-loop of check-ins. Each fire, refresh the status first and only post again if it finished, ` +
+    `stalled, or needs input; when the work is done, stop re-arming.`;
+//# sourceMappingURL=check-in.js.map

package/dist/agent/routines/check-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-in.js","sourceRoot":"","sources":["../../../agent/routines/check-in.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,8BAA8B;AAC9B,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,oGAAoG;AACpG,0FAA0F;AAC1F,iGAAiG;AACjG,2FAA2F;AAC3F,EAAE;AACF,+FAA+F;AAC/F,qGAAqG;AACrG,kGAAkG;AAClG,gBAAgB;AAChB,EAAE;AACF,iGAAiG;AACjG,0FAA0F;AAC1F,mGAAmG;AACnG,4FAA4F;AAC5F,oGAAoG;AACpG,qGAAqG;AACrG,yDAAyD;AACzD,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,oGAAoG;AACpG,mGAAmG;AACnG,+FAA+F;AAC/F,iGAAiG;AACjG,oGAAoG;AACpG,qDAAqD;AACrD,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAElG,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC;0FAC0F;AAC1F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC;AAE1C,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB;;qFAEqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAC5B,kGAAkG;IAClG,UAAU,iBAAiB,GAAG,SAAS,4DAA4D;IACnG,gBAAgB,eAAe,GAAG,SAAS,yDAAyD;IACpG,kGAAkG;IAClG,iEAAiE,CAAC"}

package/dist/agent/routines/collector.d.ts

@@ -0,0 +1,214 @@
+/**
+ * ONE DECLARED READ, as the deployment's tracked config spells it.
+ *
+ * `name` is what a routine names; `tool` + `args` are what the host actually calls. The split is
+ * the point: a routine (and therefore the model that proposed it, and the human who read its card)
+ * chooses from a menu written in Git, and cannot compose a read of its own.
+ */
+export interface RoutineCollectorDef {
+    /** The id a routine names. Lowercase letters, digits, `.`, `-`, `_`; 1–64 chars. */
+    readonly name: string;
+    /** The MCP tool this read calls, spelled exactly as the tool is called (`notion__search`). */
+    readonly tool: string;
+    /** The frozen arguments the tool is called with. A tracked literal — never model-authored. */
+    readonly args?: Readonly<Record<string, unknown>>;
+    /** One line naming what this read returns, for the routine's card and the capability doc. */
+    readonly describe: string;
+    /** How long this read may take before it is abandoned, in milliseconds. Absent ⇒
+     *  {@link COLLECTOR_DEFAULT_TIMEOUT_MS}; capped at {@link COLLECTOR_MAX_TIMEOUT_MS} at boot. A
+     *  tracked literal, like everything else here — a deadline a routine could name is not a deadline. */
+    readonly timeoutMs?: number;
+}
+/**
+ * How many collectors one routine may name. A pre-run collection is serial work on the dispatcher's
+ * own tick, ahead of a delivery that has to happen inside it, so the bound is on latency as much as
+ * on legibility — and a routine that needs a dozen reads to start is a routine whose prompt should
+ * be doing the reading. The same argument routines/declared-permissions.ts makes about a card a
+ * human will not read applies to the block a fire will not attend to.
+ *
+ * 🔴 IT BOUNDS THE COUNT; {@link COLLECTOR_MAX_TIMEOUT_MS} BOUNDS THE DURATION. Read them together:
+ * a count alone bounds nothing about a tick's lateness, because one hung read is unbounded on its
+ * own. The worst case one routine can add to a tick is this many reads at that deadline each.
+ */
+export declare const MAX_ROUTINE_COLLECTORS = 4;
+/** Ceiling on ONE collector's collected body, in characters. A fire's opening message is a prompt,
+ *  not a document store: an unbounded read would push the routine's own instruction — and the
+ *  standing-rules block above it — out of the model's attention with external bytes. Oversize is
+ *  TRUNCATED with a visible marker rather than dropped, because a silently shortened read and a
+ *  complete one must never look the same. */
+export declare const COLLECTOR_BODY_MAX_CHARS = 4000;
+/** Ceiling on the recorded CAUSE of a failed read, in characters. It reaches one audit row and no
+ *  model, so it is short by intent: an operator needs the first line of a stack or a status line, not
+ *  a page of vendor HTML in the audit chain. */
+export declare const COLLECTOR_DETAIL_MAX_CHARS = 300;
+/** How long a collector read may take when its entry declares nothing. Short by intent: this runs
+ *  inline on a tick that must reach every due routine on the deployment, and a read that has not
+ *  answered in ten seconds is one the run is better off being told it did not get. */
+export declare const COLLECTOR_DEFAULT_TIMEOUT_MS = 10000;
+/** The longest deadline a collector entry may declare. `MAX_ROUTINE_COLLECTORS` × this is the worst
+ *  case one routine can add to a tick, so the two bounds are read together: four collectors at a
+ *  minute each would be four minutes of one tick, which is not a bound anybody would recognise. */
+export declare const COLLECTOR_MAX_TIMEOUT_MS = 60000;
+/**
+ * REFUSE a collector declaration that could never run as one. Fail-loud at REGISTER time, which is
+ * boot: a deployment whose collector config is wrong should fail its build rather than discover it
+ * at 03:00 on a fire nobody is watching (the same posture `defineSurface` and `assertWebhooksValid`
+ * take for their own config-as-code).
+ *
+ * 🔴 THE READ-TIER CHECK IS THE LOAD-BEARING ONE. `classifyConnectorOpTier` fails CLOSED — an
+ * unrecognised verb classifies `destructive` — so this admits only a tool whose name the classifier
+ * positively recognises as a read. That is what makes "a collector is a declared READ" a checked
+ * property of the config rather than a promise in a comment, and it is checked on the deployment
+ * that will run it.
+ */
+export declare function assertCollectorDeclarable(def: RoutineCollectorDef): void;
+/**
+ * Register the deployment's collector menu, REPLACING whatever was registered before. Called once at
+ * boot from `agent/routines/collectors.ts` (the tracked config), and by tests that need their own
+ * menu.
+ *
+ * Replacing rather than merging is deliberate: the menu is one tracked literal in one file, so a
+ * second registration is either a test or a re-import, and in both cases the last value written is
+ * the whole truth. A merge would let a stale entry survive a config change that deleted it.
+ */
+export declare function registerRoutineCollectors(defs: readonly RoutineCollectorDef[]): void;
+/** The collector this name declares, or undefined. An unknown name is a real answer — a routine can
+ *  outlive the config entry it named — and {@link collectRoutineInputs} reports it as a FAILURE
+ *  rather than as an empty read. */
+export declare function resolveRoutineCollector(name: string): RoutineCollectorDef | undefined;
+/** Every registered collector, in registration order — for the capability doc and for the
+ *  create-time check that a routine names a collector this deployment actually has. */
+export declare function listRoutineCollectors(): readonly RoutineCollectorDef[];
+/** The declared permission a collector needs: the ordinary per-tool declaration, spelled exactly as
+ *  a human would read it on the routine's creation card. */
+export declare function collectorDeclaration(def: Pick<RoutineCollectorDef, "tool">): string;
+/**
+ * Validate a routine's PROPOSED collector list at CREATE time, against this deployment's registered
+ * menu and the permissions the same proposal declares. Throws, naming what is wrong and what the
+ * legal values are — the create-time-is-the-primary-gate posture `validateSubscription` and
+ * `declaredPermissionKinds` both take: a declaration that could never work must be refused where the
+ * author can fix it, never armed and left inert on the card.
+ *
+ * 🔴 THE PERMISSION CHECK HAPPENS HERE TOO, AND IT IS NOT A DUPLICATE OF THE FIRE-TIME ONE. This one
+ * reads the routine's own PROPOSED declaration list, so a card can never promise a collection the
+ * routine was never given the permission for — the human reads one coherent card. The fire-time
+ * check ({@link collectRoutineInputs}) reads the LIVE rows, so a permission later revoked stops its
+ * collector even though this one passed. Neither bounds the other: this one is about the card being
+ * honest, that one is about the run being permitted.
+ *
+ * Returns the trimmed, de-duplicated list to freeze onto the pending's args.
+ */
+export declare function validateRoutineCollectors(names: readonly string[], declaredPermissions: readonly string[]): string[];
+/** What actually performs a collector's read. Registered by the host at boot; core ships none, so a
+ *  deployment that has not wired one gets a NAMED failure per collector rather than a silent empty
+ *  read — which is the whole posture of this module.
+ *
+ *  🔴 `signal` FIRES AT THE COLLECTOR'S DEADLINE, and honouring it is the reader's half of the
+ *  bargain. {@link collectRoutineInputs} stops WAITING either way — it races the read, so the tick is
+ *  never held past the deadline — but only the reader can actually drop the socket. Pass it to
+ *  `fetch`, or to whatever transport the read uses. */
+export type RoutineCollectorReader = (input: {
+    readonly org: string;
+    readonly routineId: string;
+    readonly collector: RoutineCollectorDef;
+    readonly signal: AbortSignal;
+}) => Promise<string>;
+/** Register (or replace) the host's collector reader. */
+export declare function registerRoutineCollectorReader(reader: RoutineCollectorReader | undefined): void;
+/**
+ * ONE collector's outcome. A failure carries a reason and NEVER a body: a partial or error body is
+ * still external bytes, and the point of the failed arm is that the fire is told the read did not
+ * happen rather than handed something that looks like data.
+ *
+ * 🔴 `failure` IS HOST-COMPOSED AND MODEL-VISIBLE; `detail` IS EXTERNAL AND IS NOT. `failure` is one
+ * of {@link describeCollectorFailure}'s closed-set lines, so {@link renderCollectedBlock} may put it
+ * OUTSIDE the untrusted fence, where the run reads it as fact. `detail` is whatever a failing read
+ * threw — external text — so it reaches the `routine.collect_failed` audit row and nothing else. No
+ * renderer may ever read it.
+ */
+export type CollectedInput = {
+    readonly name: string;
+    readonly ok: true;
+    readonly describe: string;
+    readonly body: string;
+    readonly truncated: boolean;
+} | {
+    readonly name: string;
+    readonly ok: false;
+    readonly failure: string;
+    readonly detail?: string;
+};
+/** Why a collector produced no data. A closed set — the audit row and the fire's own block both
+ *  switch on it, and a free-form string here would be model-visible prose nobody could aggregate. */
+export type CollectorFailure = 
+/** The routine names a collector this deployment's tracked config does not declare. */
+"unknown_collector"
+/** The routine does not hold the declared permission the collector's tool needs. */
+ | "permission_refused"
+/** No reader is registered on this deployment, so nothing could perform the read. */
+ | "no_reader"
+/** The read did not answer inside the collector's declared deadline, so it was abandoned. */
+ | "timeout"
+/** The read ran and threw. */
+ | "read_failed"
+/** The collection STEP broke around the reads — the permission lookup, the registry, the loop —
+ *  so this read never ran at all. Distinct from `read_failed`, which is one reader's own throw:
+ *  this one is written for EVERY declared collector at once (routines/pre-fire.ts, OPE-1667). */
+ | "collection_failed";
+/**
+ * The one-line reason a failed collector carries into the fire's block and the audit row.
+ *
+ * 🔴 EVERY ARM IS HOST-COMPOSED, and the only interpolation is `configValue` — a TOOL NAME or a
+ * DECLARED DEADLINE, both off this deployment's own tracked config. Nothing an external system said
+ * may enter this string — see {@link CollectedInput} for where a failing read's cause goes instead.
+ */
+export declare function describeCollectorFailure(failure: CollectorFailure, configValue?: string | number): string;
+/**
+ * Run a routine's declared collectors, in the order the routine names them, and return one result
+ * each.
+ *
+ * 🔴 IT NEVER THROWS AND IT NEVER RETURNS A SHORT LIST. Every named collector produces exactly one
+ * result, ok or failed, so the caller cannot mistake "the read was refused" for "the routine named
+ * nothing" — and a collector that breaks can never stop a fire that would otherwise have happened.
+ * That direction is deliberate: a pre-run read is an INPUT to the run, and losing an input is a fact
+ * the run should be told, not a reason to cancel it. The CONDITION GATE (routines/gate.ts) is where
+ * a run is stopped, and it reads these results including their failures.
+ *
+ * `heldKinds` is the routine's LIVE declared-permission set — the raw memo kinds, from
+ * routines/declared-permissions.ts `routinePermissionKinds`. Passing the live set rather than the
+ * routine's frozen declaration list is what makes a REVOKED permission stop its collector on the
+ * very next fire.
+ */
+export declare function collectRoutineInputs(input: {
+    readonly org: string;
+    readonly routineId: string;
+    readonly names: readonly string[];
+    readonly heldKinds: readonly string[];
+}): Promise<readonly CollectedInput[]>;
+/** The block tag, named here so the renderer and its tests cannot drift. */
+export declare const COLLECTED_BLOCK_TAG = "[collected]";
+/** Did any collector return data? — what decides whether the fire carries external bytes, and
+ *  therefore whether the dispatch site stamps the fire TAINTED. A run whose every collector FAILED
+ *  carries only host-composed prose, so it is not tainted, for the same reason a `trigger-only`
+ *  webhook fire is not (access/taint-signal.ts taintedFireAttrs). */
+export declare function collectionCarriesData(results: readonly CollectedInput[]): boolean;
+/**
+ * The `[collected]` section of a fire's message: one trusted host-composed line per collector saying
+ * what it is and whether it worked, then the collected bodies inside ONE untrusted fence.
+ *
+ * 🔴 THE FAILURE LINES ARE OUTSIDE THE FENCE AND THE BODIES ARE INSIDE IT, and that split is the
+ * security property. A failure line is OURS — one of {@link describeCollectorFailure}'s closed-set
+ * lines, whose only interpolation is a tool name off this deployment's own tracked config — and a
+ * fire must be able to read "this read did not happen" as fact. A body is whatever an external
+ * system returned, so it sits below the fence with every other byte we did not write. Nothing here
+ * reads {@link CollectedInput.detail}, and nothing ever may: a failing read's cause is external
+ * text, and this region has neither a fence nor a taint stamp behind it. `wrapUntrusted` rather than `ingestUntrusted`
+ * because this renders on the DISPATCHER's tick, not inside the consuming turn: marking the
+ * dispatcher's own turn tainted would be meaningless, and the consuming turn is seeded instead from
+ * the host-set fire stamp (hooks/spawn-taint.ts TAINT_SEED_ATTRS).
+ *
+ * Empty string for a routine that named no collectors, so every fire without them renders
+ * byte-identically to its pre-OPE-151 shape.
+ */
+export declare function renderCollectedBlock(results: readonly CollectedInput[]): string;
+//# sourceMappingURL=collector.d.ts.map

package/dist/agent/routines/collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector.d.ts","sourceRoot":"","sources":["../../../agent/routines/collector.ts"],"names":[],"mappings":"AAiEA;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;0GAEsG;IACtG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;6CAI6C;AAC7C,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;gDAEgD;AAChD,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAE9C;;sFAEsF;AACtF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;mGAEmG;AACnG,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAM/C;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA6BxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,GAAG,IAAI,CAQpF;AAED;;oCAEoC;AACpC,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAErF;AAED;uFACuF;AACvF,wBAAgB,qBAAqB,IAAI,SAAS,mBAAmB,EAAE,CAEtE;AAED;4DAC4D;AAC5D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,MAAM,CAEnF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,mBAAmB,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CA+BpH;AAID;;;;;;;uDAOuD;AACvD,MAAM,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAItB,yDAAyD;AACzD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI,CAE/F;AAID;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAC3H;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtG;qGACqG;AACrG,MAAM,MAAM,gBAAgB;AAC1B,uFAAuF;AACrF,mBAAmB;AACrB,oFAAoF;GAClF,oBAAoB;AACtB,qFAAqF;GACnF,WAAW;AACb,6FAA6F;GAC3F,SAAS;AACX,8BAA8B;GAC5B,aAAa;AACf;;iGAEiG;GAC/F,mBAAmB,CAAC;AAExB;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAezG;AA6CD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAqCrC;AAID,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAEjD;;;qEAGqE;AACrE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAEjF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAmB/E"}