@open-everywhere/core 0.1.0

package/dist/agent/routines/fire-audit.js

@@ -0,0 +1,571 @@
+// Routine FORENSICS — the durable answer to "did my 03:00 routine actually run, and what did it
+// do?" (OPE-145). Before this module the entire dispatcher trail was `console.log`, and the only
+// durable traces a fire could leave were a `reply.post` row IF it posted (no routine id) and a
+// `usage_events` row (no routine id) — so a fire that stayed silent, was declined, or was lost in
+// delivery left ZERO rows, and one that DID post could only be attributed by correlating surface +
+// timestamp by hand.
+//
+// WHY THIS IS ALLOWED TO WRITE TO AN ACTIONS-ONLY LOG. The audit table is deliberately
+// ACTIONS-ONLY (audit/audit.ts auditSilencesEnabled — the "audit every silence" proposal was
+// superseded), and a fire is arguably a mechanism rather than an action. It gets rows anyway on one
+// narrow ground: an autonomous fire is the ONE class of work with no human in the room, so there is
+// no conversation to reconstruct it from — the row is not a record OF an action, it is the only
+// thing that makes "did it run?" answerable at all. Everything else here is kept to that bar:
+//
+//   • The 10-minutely tick writes NOTHING when nothing is due (schedules/dispatch.ts returns
+//     early). The tick is NOT the volume driver — the operator's own routines are, and every
+//     `routine.fire` row corresponds to a real model turn whose token cost dwarfs the row.
+//   • A DEFERRED routine (over the per-tick concurrency cap) writes nothing: it keeps its
+//     nextRunAt, stays due, and fires on a later tick. Not firing YET is not a skip.
+//   • Every "it didn't run" row goes through {@link auditRoutineSkip}, which is THROTTLED to one
+//     row per (routine, reason) per {@link SKIP_WINDOW_MS} with a carried `suppressed` count —
+//     the same shape (and the same rationale) as webhooks/reject-audit.ts. That matters most on
+//     the EVENT leg, which is driven by inbound webhook deliveries rather than by our own clock:
+//     an unbounded delivery stream must not become an unbounded stream of chained, per-org-
+//     serialised audit inserts. It also stops a permanently-misconfigured routine from writing
+//     144 identical rows a day off the clock leg.
+//
+// RECONCILED VOCABULARY. OPE-143 landed `routine.event_skipped` for the event fan-out's over-cap
+// drop. That is the same species of fact as the clock leg's over-budget decline and either leg's
+// unresolvable target — "a routine that was due/matched was NOT dispatched, for a reason" — so
+// there is ONE action, `routine.skip`, carrying `reason`, rather than a second skip vocabulary
+// alongside the first. The old name is gone; `reason: "fanout_cap"` is the event-cap case.
+//
+// The actions this module writes, in the existing `<subject>.<verb>` shape (audit vocabulary:
+// routine.create, routine.cancel, routine.complete, routine.expire):
+//
+//   routine.fire       a fired session ENDED. The ONLY row that can carry BOTH the routine id and
+//                      the session id — the dispatcher never learns the session id (`receive()`
+//                      does not return one), so this is written from hooks/routine-outcome.ts, the
+//                      one place holding the marker AND `ctx.session.id`. THIS IS THE JOIN: it is
+//                      what makes GET /control/v1/session/:id/transcript reachable from a routine.
+//   routine.skip       due/matched, NOT dispatched, with a machine-readable `reason`. Throttled.
+//   routine.fire_lost  dispatched, but `receive()` REJECTED — no session ever started, so there is
+//                      no session id to carry and the row says so. Without it this case is
+//                      indistinguishable from "never due".
+//   routine.disabled   the routine self-disabled (consecutive-failure threshold). Rare by
+//                      construction — at most once per routine, ever.
+//   routine.stalled    dispatched, a session ran, and it was REFUSED a consequential tool by a
+//                      configured spend checkpoint (OPE-253). Neither a fire that failed nor a fire
+//                      that worked, and previously the ONLY fire outcome that wrote nothing anywhere
+//                      after the first one (`checkpoint.trip` is written once per session, so a
+//                      durable job's 2nd..200th blocked fire left no trace at all).
+//   routine.eligibility_unresolved
+//                      a creator-eligibility check could NOT answer, so it did not block this fire
+//                      (OPE-1810). Throttled. Says the fire was not CHECKED, not that it ran — a
+//                      later gate on the tick can still decline it. The row exists because a
+//                      fail-open and a real pass otherwise leave the same trace, which is none.
+import { appendAudit, readAudit } from "../audit/audit.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { usageSummary } from "../spend/usage-events.js";
+import { isSilentRoutine } from "./routine.js";
+/** The routine-forensics audit actions. Values are the stable dotted keys readers join on. */
+export const ROUTINE_AUDIT = {
+    /** A fired session ended — carries routineId + sessionId + outcome (THE forensic join). */
+    fire: "routine.fire",
+    /** Due/matched but NOT dispatched, with a reason. Throttled. */
+    skip: "routine.skip",
+    /** Dispatch attempted, delivery rejected — no session started, so no sessionId exists. */
+    fireLost: "routine.fire_lost",
+    /** Self-disabled after the consecutive-failure threshold. */
+    disabled: "routine.disabled",
+    /**
+     * OPE-253: this fire was BLOCKED — a configured session cost checkpoint refused it a consequential
+     * tool (spend/checkpoint.ts requireSessionContinuation). One row per stalled FIRE, written the
+     * moment it happens rather than folded onto that fire's `routine.fire` row at session end, for two
+     * reasons: a job that cannot act is exactly the one whose session may not end cleanly, and the row
+     * is the only immediate signal in a story whose whole defect is silence.
+     *
+     * NOT throttled, unlike {@link ROUTINE_AUDIT.skip}: it is already at most once per fire (the
+     * dispatcher clears `lastStallAt` at fire, and the recorder writes only on the first refusal of a
+     * fire), and fires are at least DISPATCH_TICK_MINUTES apart — so the natural rate is already the
+     * one a throttle would impose, and one row per blocked run is exactly the resolution a reader
+     * asking "how long has this been stuck?" needs.
+     */
+    stalled: "routine.stalled",
+    /**
+     * OPE-147: a human asked for an OFF-SCHEDULE run (`run_routine_now`). Written at REQUEST time,
+     * by the requesting turn, so it is the one row that carries the REQUESTER — `routine.fire` is
+     * stamped with the synthetic {@link ROUTINE_DISPATCHER_PRINCIPAL} and structurally cannot say
+     * who asked. The run itself still produces its ordinary `routine.fire` row (carrying
+     * `manual: true`) when the fired session ends, so `fires7d` counts runs, not requests, and a
+     * request that never becomes a run — cancelled, over budget, target unresolvable — is visibly a
+     * request with no fire rather than a silently-missing one.
+     */
+    runNow: "routine.run_now",
+    /**
+     * OPE-151: one or more of this fire's declared PRE-RUN COLLECTORS did not collect — refused for a
+     * permission the routine does not hold, unknown to this deployment's config, or broken at the read
+     * (routines/collector.ts). The fire STILL HAPPENED, with the failure named in its own message, so
+     * this row is what makes "the run saw nothing" and "the run could not look" different facts after
+     * the event as well as during it.
+     *
+     * THROTTLED, exactly like {@link ROUTINE_AUDIT.skip} and for the same reason. It is at most once
+     * per FIRE, and on the CLOCK leg fires are at least DISPATCH_TICK_MINUTES apart — but the pre-fire
+     * step runs on the EVENT fan-out too (routines/pre-fire.ts), once per matched delivery, and a
+     * delivery stream has no such spacing. A routine whose collector is permanently refused would
+     * otherwise turn a 200-delivery push burst into 200 chained audit inserts.
+     *
+     * The detail carries collector NAMES and closed-set REASONS, plus the recorded CAUSE of a read
+     * that threw — external text, capped by routines/collector.ts COLLECTOR_DETAIL_MAX_CHARS, which
+     * reaches this row and no model. Never a byte of a collected BODY.
+     */
+    collectFailed: "routine.collect_failed",
+    /**
+     * OPE-1810: this fire's CREATOR-ELIGIBILITY room check could not answer, so the fire proceeded on
+     * the ruled fail-open. The row names which check and why it could not answer.
+     *
+     * 🔴 IT EXISTS BECAUSE A FAIL-OPEN AND A PASS OTHERWISE LEAVE THE SAME TRACE — none. The Teams
+     * room check addressed Graph with an id Graph does not take, so every fire took the fail-open arm
+     * silently and the leg read as a healthy, enforcing check for its whole life. An operator asking
+     * "is the creator check working?" now gets an answer from the rows THEMSELVES: a row means that
+     * fire was NOT checked, and its `suppressed` and `windowMs` fields say how many further fires in
+     * the window it stands for.
+     *
+     * 🔴 READ THE PRESENCE, NEVER THE ABSENCE. A fire with no row was not necessarily checked, and
+     * three arms make that so: this row is THROTTLED (below), so a standing unresolvable check writes
+     * one row an hour and the fires between it write none; the write is `.catch`-ed at the call site,
+     * so a store failure drops the row and keeps the fire; and schedules/dispatch.ts resolves a
+     * throwing eligibility probe to `{ eligible: true }`, which fires with no row at all.
+     * `docs/deploy/surfaces/teams.md` states the same direction for the operator.
+     *
+     * THROTTLED, exactly like {@link ROUTINE_AUDIT.skip} and for the same reason: the honest shape of
+     * this row is a standing condition — a missing Graph consent, a team whose group id will not
+     * resolve — which would otherwise write one row per fire, forever, saying the same thing.
+     */
+    eligibilityUnresolved: "routine.eligibility_unresolved",
+};
+/** At most ~one skip row per (routine, reason) per window. An hour: long enough that a standing
+ *  misconfiguration reports hourly rather than every tick/delivery, short enough that the count
+ *  stays legible. */
+export const SKIP_WINDOW_MS = 60 * 60_000;
+/**
+ * The routine's own partition segments, for an audit row about it. A routine's surfaceKey is
+ * `platform/workspace/surface` — the same split schedules/dispatch.ts partitionOf uses. (This
+ * replaces the local copy github-fanout.ts carried: one shape, one place.)
+ */
+export function routineAuditScope(r) {
+    const [platform = "", workspace = "", ...rest] = r.surfaceKey.split("/");
+    return { platform, workspace, surface: rest.join("/") };
+}
+/** Principal stamped on a routine-lifecycle row. A fire has NO acting human — the dispatcher is
+ *  the actor — so this is a synthetic, low-cardinality service identity, never the creator (who
+ *  did not act at fire time). The event leg passes its own (`github:webhook`). */
+export const ROUTINE_DISPATCHER_PRINCIPAL = "routine:dispatcher";
+/** Suppressed-since-last-row counts, per (routine, reason). In-process by design, exactly as
+ *  webhooks/reject-audit.ts argues: a durable counter would reintroduce the per-event write the
+ *  throttle exists to remove, and each serverless instance reporting its own share is the same
+ *  granularity the throttle itself has. */
+const suppressed = new Map();
+/** Test seam — drop all in-process suppression counters. */
+export function resetRoutineSkipThrottle() {
+    suppressed.clear();
+}
+/** The throttle identity. Both parts are OE-minted (`r-xxxxxxxx` from routines/store.ts
+ *  newRoutineId, and a closed reason set) — never a caller-supplied string, so a hostile delivery
+ *  stream cannot mint fresh keys to defeat the throttle (webhooks/reject-audit.ts §"THE THROTTLE
+ *  KEY MUST NOT CONTAIN AN ATTACKER-CHOSEN STRING"). */
+export function skipThrottleKey(routineId, reason) {
+    return `routineskip:${routineId}:${reason}`;
+}
+/** The throttle identity for {@link auditRoutineEligibilityUnresolved} (OPE-1810). Same
+ *  construction as every other key here: an OE-minted routine id plus a closed-set check name, so no
+ *  caller-supplied string can mint fresh keys and defeat the throttle. Keyed on the CHECK rather
+ *  than the cause, so a probe that alternates between two causes still reports once per window
+ *  instead of twice. */
+function eligibilityUnresolvedThrottleKey(routineId, check) {
+    return `routineeligibility:${routineId}:${check}`;
+}
+/** The throttle identity for {@link auditCollectorFailures} (OPE-151). Same construction and the
+ *  same reason: the only variable part is an OE-minted routine id, so a hostile delivery stream
+ *  cannot mint fresh keys to defeat the throttle. */
+export function collectFailedThrottleKey(routineId) {
+    return `routinecollect:${routineId}`;
+}
+/**
+ * Has this key already emitted a row inside {@link SKIP_WINDOW_MS}? Returns true when a row SHOULD
+ * be written, and counts a suppressed one onto the next emitted row otherwise.
+ *
+ * FAIL-OPEN on a throttle-store error — emit the row. The throttle and the audit write hit the SAME
+ * store, so a markEventSeen failure means the append is about to fail harmlessly anyway.
+ *
+ * Extracted so the skip row and the collector-failure row cannot drift into two throttles with two
+ * window lengths and two suppression counters (OPE-151).
+ */
+async function admitThrottled(org, key, nowIso, deps) {
+    let first = true;
+    try {
+        const markSeen = deps.markSeen ?? ((o, k, at, ttl) => getOperationalStore().markEventSeen(o, k, at, ttl));
+        first = await markSeen(org, key, nowIso, SKIP_WINDOW_MS);
+    }
+    catch {
+        first = true;
+    }
+    if (!first) {
+        suppressed.set(key, (suppressed.get(key) ?? 0) + 1);
+        return null;
+    }
+    const carried = suppressed.get(key) ?? 0;
+    suppressed.delete(key);
+    return carried;
+}
+async function write(entry, deps) {
+    // Best-effort by contract (appendAudit never throws), but an injected audit in a test might —
+    // and a forensics row must never break the fire it is recording.
+    await (deps.audit ?? appendAudit)(entry).catch(() => undefined);
+}
+/**
+ * A due/matched routine was NOT dispatched. THROTTLED: returns true when a row was emitted, false
+ * when it was suppressed (counted onto the next emitted row's `suppressed` field, so the throttle
+ * never hides its own existence).
+ *
+ * FAIL-OPEN on a throttle-store error — emit the row. The throttle and the audit write hit the
+ * SAME store, so a markEventSeen failure means the append is about to fail harmlessly anyway;
+ * failing closed would instead silence genuine skip auditing on any transient blip.
+ */
+export async function auditRoutineSkip(r, reason, extra = {}, deps = {}) {
+    const nowIso = (deps.now?.() ?? new Date()).toISOString();
+    const carried = await admitThrottled(r.org, skipThrottleKey(r.id, reason), nowIso, deps);
+    if (carried === null)
+        return false;
+    await write({
+        org: r.org,
+        ...routineAuditScope(r),
+        principalId: deps.principalId ?? ROUTINE_DISPATCHER_PRINCIPAL,
+        action: ROUTINE_AUDIT.skip,
+        detail: {
+            routineId: r.id,
+            reason,
+            ...extra,
+            // Present only when this row stands in for others — its absence means "exactly one".
+            ...(carried > 0 ? { suppressed: carried, windowMs: SKIP_WINDOW_MS } : {}),
+        },
+    }, deps);
+    return true;
+}
+/**
+ * THE CREATOR CHECK DID NOT BLOCK THIS FIRE (OPE-1810): a creator-eligibility check could not
+ * answer, and the ruling is that eligibility does not stop the fire on that arm. The row says the
+ * fire was not really CHECKED, never that it ran — a later gate on the same tick (the spend cap)
+ * can still decline it, and that decline writes its own `routine.skip`. `cause` is the probe's own closed-set reason (the Teams
+ * leg's `TeamsMembershipUnresolved`), so an operator reads WHY from the row — a missing Graph
+ * consent and a roster too large to finish are different problems with different remedies.
+ *
+ * Written only when a check was actually ATTEMPTED and came back unresolved. A fire whose creator
+ * was confirmed present writes nothing, and neither does a platform with no check at all, so the
+ * row's presence means "this fire was not really checked" rather than "this fire ran".
+ *
+ * Fail-soft and throttled like every other row here: recording that a check went unanswered must
+ * never break the fire it is recording, and a standing misconfiguration must not write a row a tick.
+ */
+export async function auditRoutineEligibilityUnresolved(r, detail, deps = {}) {
+    const nowIso = (deps.now?.() ?? new Date()).toISOString();
+    const carried = await admitThrottled(r.org, eligibilityUnresolvedThrottleKey(r.id, detail.check), nowIso, deps);
+    if (carried === null)
+        return false;
+    await write({
+        org: r.org,
+        ...routineAuditScope(r),
+        principalId: deps.principalId ?? ROUTINE_DISPATCHER_PRINCIPAL,
+        action: ROUTINE_AUDIT.eligibilityUnresolved,
+        detail: {
+            routineId: r.id,
+            check: detail.check,
+            cause: detail.cause,
+            // Present only when this row stands in for others — its absence means "exactly one".
+            ...(carried > 0 ? { suppressed: carried, windowMs: SKIP_WINDOW_MS } : {}),
+        },
+    }, deps);
+    return true;
+}
+/**
+ * A fire's PRE-RUN COLLECTORS did not all collect (OPE-151). Written once per fire, before the
+ * delivery, and only when at least one collector failed — a fire whose reads all worked writes
+ * nothing, so this row's existence is the signal.
+ *
+ * 🔴 NAMES AND REASONS ONLY, NEVER A BODY. A collected body is external content; the failure reason
+ * is host-composed prose about a read that did not happen (routines/collector.ts
+ * describeCollectorFailure), so it carries and the body never could. The same names/ids-only
+ * discipline `routine.fire_attrs_sent` and `turn.tool_gated` keep.
+ *
+ * Fail-soft like every other row here: recording that a read broke must never break the fire.
+ */
+export async function auditCollectorFailures(r, failures, deps = {}) {
+    if (failures.length === 0)
+        return false;
+    const nowIso = (deps.now?.() ?? new Date()).toISOString();
+    const carried = await admitThrottled(r.org, collectFailedThrottleKey(r.id), nowIso, deps);
+    if (carried === null)
+        return false;
+    await write({
+        org: r.org,
+        ...routineAuditScope(r),
+        principalId: deps.principalId ?? ROUTINE_DISPATCHER_PRINCIPAL,
+        action: ROUTINE_AUDIT.collectFailed,
+        detail: {
+            routineId: r.id,
+            failed: failures.map((f) => ({ collector: f.name, reason: f.failure, ...(f.detail ? { cause: f.detail } : {}) })),
+            count: failures.length,
+            // Present only when this row stands in for others — its absence means "exactly one".
+            ...(carried > 0 ? { suppressed: carried, windowMs: SKIP_WINDOW_MS } : {}),
+        },
+    }, deps);
+    return true;
+}
+/** THE JOIN. A fired session ended: this row names the routine AND the session, so a human (or the
+ *  agent itself, via list_routines) can go from "r-1a2b3c4d" to that fire's transcript.
+ *
+ *  `silent` (OPE-149) is stamped for a `report:{kind:"silent"}` routine, and it is what makes this
+ *  row LOAD-BEARING rather than merely useful. A silent routine posts nothing by design, so it can
+ *  never appear in the `lastPostedAt` join below — without the flag, a healthy silent fire and a
+ *  posting routine that has gone quiet look identical in the forensics, and "did the nightly job
+ *  run this week?" has no answer at all. Positive-only, so a posting routine's row is unchanged. */
+export async function auditRoutineFire(r, sessionId, outcome, extra = {}, deps = {}) {
+    await write({
+        org: r.org,
+        ...routineAuditScope(r),
+        principalId: deps.principalId ?? ROUTINE_DISPATCHER_PRINCIPAL,
+        action: ROUTINE_AUDIT.fire,
+        detail: { routineId: r.id, sessionId, outcome, ...(isSilentRoutine(r) ? { silent: true, reportKind: "silent" } : {}), ...extra },
+    }, deps);
+}
+/** A fire whose `receive()` was REJECTED. No session started, so there is no session id — the row
+ *  says so explicitly rather than omitting the field and reading as "we forgot to record it". */
+export async function auditRoutineFireLost(r, error, deps = {}) {
+    await write({
+        org: r.org,
+        ...routineAuditScope(r),
+        principalId: deps.principalId ?? ROUTINE_DISPATCHER_PRINCIPAL,
+        action: ROUTINE_AUDIT.fireLost,
+        detail: {
+            routineId: r.id,
+            // Bounded: the rejection text comes from an adapter/vendor, so it is not ours to trust as
+            // short. Ids and counts only otherwise — no prompt, no message text.
+            error: error.slice(0, 300),
+            sessionId: null,
+            note: "delivery rejected — no session started, so no sessionId exists for this fire",
+        },
+    }, deps);
+}
+/**
+ * THIS FIRE WAS BLOCKED (OPE-253) — a configured session cost checkpoint refused it a consequential
+ * tool. `tool` is the OE tool name the guard was called with (host-supplied, from a closed set of
+ * authored tool slugs — never model text); `reason` is the checkpoint's own host-composed line
+ * ("this session reached its cost checkpoint (…tokens)"), and `stalledFires` is the run this fire
+ * extends, so the row answers "is this the first time, or the third?" without a second read.
+ *
+ * There is no `sessionId` argument on purpose. The guard runs at a tool execute, which is inside
+ * `turnStep` — the same process that has `ctx.session.id` — but wiring it in would make the recorder's
+ * signature depend on the guard's ctx shape, and the `routine.fire` join row written at session end
+ * already carries the (routineId, sessionId) pair for this same fire. One join, one row that owns it.
+ */
+export async function auditRoutineStalled(r, detail, deps = {}) {
+    await write({
+        org: r.org,
+        ...routineAuditScope(r),
+        principalId: deps.principalId ?? ROUTINE_DISPATCHER_PRINCIPAL,
+        action: ROUTINE_AUDIT.stalled,
+        detail: {
+            routineId: r.id,
+            tool: detail.tool,
+            // Host-composed by spend/checkpoint.ts from the session's own numbers, but bounded anyway on
+            // the standing rule that a forensic row is not the place to discover a surprisingly long string.
+            reason: detail.reason.slice(0, 300),
+            stalledFires: detail.stalledFires,
+        },
+    }, deps);
+}
+/**
+ * A human asked for an off-schedule run (OPE-147). `requestedBy` is a REAL principal — the whole
+ * reason this row exists separately from `routine.fire`, which can only ever name the dispatcher.
+ * `nextRunAt` is the instant the request moved the routine to, so the row also answers "when will
+ * it actually happen" without a second lookup.
+ */
+export async function auditRoutineRunNow(r, requestedBy, nextRunAt, deps = {}) {
+    await write({
+        org: r.org,
+        ...routineAuditScope(r),
+        principalId: requestedBy,
+        action: ROUTINE_AUDIT.runNow,
+        detail: { routineId: r.id, requestedBy, nextRunAt, trigger: r.trigger.kind },
+    }, deps);
+}
+/** The routine self-disabled (consecutive-failure threshold). At most once per routine, ever.
+ *
+ *  `reason` is the HOST-composed `disabledReason` ("auto-disabled after 3 consecutive failures") —
+ *  it says the routine hit the threshold, not what was wrong. `extra` is where the answer to the
+ *  second question goes: OPE-177 passes `declaredFailure`, the final run's own words for why the
+ *  work did not happen, so the one row a human reads after "why did this stop?" carries a diagnosis
+ *  rather than only a count. Kept as a separate field, never merged into `reason`, because `reason`
+ *  is also what routines/disable-notice.ts POSTS INTO THE ROOM and it must stay host-composed. */
+export async function auditRoutineDisabled(r, reason, consecutiveFailures, sessionId, extra = {}, deps = {}) {
+    await write({
+        org: r.org,
+        ...routineAuditScope(r),
+        principalId: deps.principalId ?? ROUTINE_DISPATCHER_PRINCIPAL,
+        action: ROUTINE_AUDIT.disabled,
+        detail: { routineId: r.id, reason, consecutiveFailures, ...(sessionId ? { sessionId } : {}), ...extra },
+    }, deps);
+}
+// --- the READ side: turning those rows back into an answer -----------------------------------
+// Writing the rows is only half of OPE-145. The other half is that the CONVERSATIONAL view
+// (tools/list_routines.ts) was poorer than both the operator CLI and the MCP `routines_list`,
+// which already showed consecutiveFailures/disabledReason — backwards for a product whose whole
+// thesis is "the control plane is where people already are". This reader is what lets the agent
+// answer "did the 03:00 one run, what did it cost, and where's the transcript?" in the room.
+/** The seven-day forensic window every routine-history read uses. Long enough to cover a daily
+ *  routine's week and a weekly routine's last run; short enough that the underlying scans stay
+ *  cheap and well inside the usage_events retention floor (90 days). */
+export const FORENSIC_WINDOW_MS = 7 * 24 * 60 * 60_000;
+/** Row ceiling on each audit scan behind {@link readRoutineForensics}. Counts are therefore "over
+ *  at most the newest N rows in the window" — stated, not silently approximated. Generous enough
+ *  that a realistic surface never reaches it (a 15-minute routine fires 672 times a week). */
+export const FORENSIC_SCAN_LIMIT = 5000;
+const EMPTY_FORENSICS = { lastSessionId: null, lastFireAt: null, lastPostedAt: null, fires7d: 0, tokens7d: 0 };
+/** The zero reading — a routine with no durable trace in the window. */
+export function emptyRoutineForensics() {
+    return EMPTY_FORENSICS;
+}
+function detailString(detail, key) {
+    const v = detail?.[key];
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+/**
+ * Read the durable trace for every routine on ONE surface, keyed by routine id.
+ *
+ * SCOPING: every read is pinned to the caller's own (org, platform, workspace, surface) — the
+ * partition the caller already resolved. This function never widens, so it cannot be used to see
+ * another surface's or another org's routines. That is why extending list_routines with it does not
+ * touch the cross-org exposure OPE-146 item 3 tracks: that one is `routines_list` in
+ * control/server.ts over `listAllRoutines()`, a different code path with a different reader.
+ *
+ * FAIL-SOFT: any store error degrades to an EMPTY map rather than throwing — a forensics read must
+ * never break the tool that is merely decorating its output with it.
+ */
+export async function readRoutineForensics(scope, now = new Date()) {
+    const out = new Map();
+    const since = new Date(now.getTime() - FORENSIC_WINDOW_MS).toISOString();
+    const base = {
+        org: scope.org,
+        platform: scope.platform,
+        workspace: scope.workspace,
+        surface: scope.surface,
+        since,
+        limit: FORENSIC_SCAN_LIMIT,
+    };
+    try {
+        // 1. The fires themselves (newest-first, per readAudit's contract).
+        const fires = await readAudit({ ...base, action: ROUTINE_AUDIT.fire });
+        const acc = new Map();
+        for (const row of fires) {
+            const id = detailString(row.detail, "routineId");
+            if (id === undefined)
+                continue;
+            let a = acc.get(id);
+            if (!a) {
+                a = { lastSessionId: null, lastFireAt: null, fires: 0, sessions: new Set() };
+                acc.set(id, a);
+            }
+            a.fires++;
+            const sid = detailString(row.detail, "sessionId");
+            if (sid !== undefined)
+                a.sessions.add(sid);
+            // Newest-first ⇒ the FIRST row seen for an id is its latest fire.
+            if (a.lastFireAt === null) {
+                a.lastFireAt = row.ts;
+                a.lastSessionId = sid ?? null;
+            }
+        }
+        // 2. "Did it actually say anything?" — `reply.post` carries a sessionId but NO routine id
+        //    (channels/reply-post.ts ReplyAudit), so the join runs the other way: newest-first, the
+        //    first post whose session belongs to one of a routine's fires is that routine's last post.
+        const posted = new Map();
+        if (acc.size > 0) {
+            const posts = await readAudit({ ...base, action: "reply.post" });
+            for (const row of posts) {
+                const sid = detailString(row.detail, "sessionId");
+                if (sid === undefined)
+                    continue;
+                for (const [id, a] of acc) {
+                    if (!posted.has(id) && a.sessions.has(sid))
+                        posted.set(id, row.ts);
+                }
+            }
+        }
+        // 3. Cost, off the routine_id dimension this same ticket added to usage_events.
+        const tokens = new Map();
+        const rollup = await usageSummary(scope.org, { surfaceKeyPrefix: scope.surfaceKey, sinceTs: since });
+        for (const g of rollup) {
+            if (g.routineId === undefined)
+                continue;
+            tokens.set(g.routineId, (tokens.get(g.routineId) ?? 0) + g.inputTokens + g.outputTokens + g.cacheReadTokens + g.cacheWriteTokens);
+        }
+        for (const id of new Set([...acc.keys(), ...tokens.keys()])) {
+            const a = acc.get(id);
+            out.set(id, {
+                lastSessionId: a?.lastSessionId ?? null,
+                lastFireAt: a?.lastFireAt ?? null,
+                lastPostedAt: posted.get(id) ?? null,
+                fires7d: a?.fires ?? 0,
+                tokens7d: tokens.get(id) ?? 0,
+            });
+        }
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:routines] forensics read skipped for ${scope.surfaceKey}: ${String(err)}`);
+        return new Map();
+    }
+    return out;
+}
+/**
+ * The fires of ONE routine on ONE surface, newest-first — the resolver behind OPE-153's
+ * same-channel transcript read.
+ *
+ * 🔴 THIS FUNCTION IS AN AUTHORIZATION ORACLE, not a convenience reader, and two properties make it
+ * one:
+ *
+ *  1. IT IS PARTITION-PINNED, LIKE {@link readRoutineForensics}. Every fire row was written with the
+ *     firing routine's own (org, platform, workspace, surface) — so a routineId belonging to another
+ *     channel simply RESOLVES TO NOTHING here. The same-channel boundary is therefore the SCOPE OF
+ *     THE LOOKUP, not a comparison a caller could forget to make. That is deliberate: a check that
+ *     can be skipped eventually is, and a caller cannot skip the shape of a query.
+ *
+ *  2. IT FAILS CLOSED, WHERE ITS SIBLING FAILS SOFT. readRoutineForensics swallows store errors and
+ *     degrades to an empty map, because it only DECORATES a listing. This one gates a read, so a
+ *     store error must not be indistinguishable from "that routine never fired here" — it throws,
+ *     and the caller refuses. Returning `[]` on an error would be fail-closed in effect but would
+ *     tell the operator the wrong story about why.
+ *
+ * Window + scan ceiling are the shared forensic ones ({@link FORENSIC_WINDOW_MS} /
+ * {@link FORENSIC_SCAN_LIMIT}), so "what a transcript read can reach" is exactly "what the run
+ * history in `list_routines` already showed" — the tool can never see further back than the listing
+ * that told the model the routine exists.
+ */
+export async function listRoutineFires(scope, routineId, now = new Date()) {
+    const rows = await readAudit({
+        org: scope.org,
+        platform: scope.platform,
+        workspace: scope.workspace,
+        surface: scope.surface,
+        action: ROUTINE_AUDIT.fire,
+        since: new Date(now.getTime() - FORENSIC_WINDOW_MS).toISOString(),
+        limit: FORENSIC_SCAN_LIMIT,
+    });
+    const out = [];
+    for (const row of rows) {
+        if (detailString(row.detail, "routineId") !== routineId)
+            continue;
+        const sessionId = detailString(row.detail, "sessionId");
+        if (sessionId === undefined)
+            continue; // malformed row — never surface a fire with no transcript
+        out.push({
+            routineId,
+            sessionId,
+            at: row.ts,
+            outcome: detailString(row.detail, "outcome") ?? null,
+            silent: row.detail?.silent === true,
+        });
+    }
+    return out; // readAudit's contract is newest-first; the filter preserves order
+}
+//# sourceMappingURL=fire-audit.js.map

package/dist/agent/routines/fire-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-audit.js","sourceRoot":"","sources":["../../../agent/routines/fire-audit.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,iGAAiG;AACjG,+FAA+F;AAC/F,kGAAkG;AAClG,mGAAmG;AACnG,qBAAqB;AACrB,EAAE;AACF,uFAAuF;AACvF,6FAA6F;AAC7F,oGAAoG;AACpG,oGAAoG;AACpG,gGAAgG;AAChG,8FAA8F;AAC9F,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,2FAA2F;AAC3F,0FAA0F;AAC1F,qFAAqF;AACrF,iGAAiG;AACjG,+FAA+F;AAC/F,gGAAgG;AAChG,iGAAiG;AACjG,4FAA4F;AAC5F,+FAA+F;AAC/F,kDAAkD;AAClD,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,+FAA+F;AAC/F,+FAA+F;AAC/F,2FAA2F;AAC3F,EAAE;AACF,8FAA8F;AAC9F,qEAAqE;AACrE,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,2FAA2F;AAC3F,2DAA2D;AAC3D,0FAA0F;AAC1F,sEAAsE;AACtE,+FAA+F;AAC/F,oGAAoG;AACpG,qGAAqG;AACrG,gGAAgG;AAChG,oFAAoF;AACpF,mCAAmC;AACnC,mGAAmG;AACnG,iGAAiG;AACjG,6FAA6F;AAC7F,gGAAgG;AAEhG,OAAO,EAAE,WAAW,EAAE,SAAS,EAAmB,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAE7D,8FAA8F;AAC9F,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,2FAA2F;IAC3F,IAAI,EAAE,cAAc;IACpB,gEAAgE;IAChE,IAAI,EAAE,cAAc;IACpB,0FAA0F;IAC1F,QAAQ,EAAE,mBAAmB;IAC7B,6DAA6D;IAC7D,QAAQ,EAAE,kBAAkB;IAC5B;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,iBAAiB;IAC1B;;;;;;;;OAQG;IACH,MAAM,EAAE,iBAAiB;IACzB;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,EAAE,wBAAwB;IACvC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,qBAAqB,EAAE,gCAAgC;CAC/C,CAAC;AA2GX;;qBAEqB;AACrB,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAA8B;IAC9D,MAAM,CAAC,QAAQ,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;kFAEkF;AAClF,MAAM,CAAC,MAAM,4BAA4B,GAAG,oBAAoB,CAAC;AAWjE;;;2CAG2C;AAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE7C,4DAA4D;AAC5D,MAAM,UAAU,wBAAwB;IACtC,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAED;;;wDAGwD;AACxD,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,MAAyB;IAC1E,OAAO,eAAe,SAAS,IAAI,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED;;;;wBAIwB;AACxB,SAAS,gCAAgC,CAAC,SAAiB,EAAE,KAA2B;IACtF,OAAO,sBAAsB,SAAS,IAAI,KAAK,EAAE,CAAC;AACpD,CAAC;AAED;;qDAEqD;AACrD,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,kBAAkB,SAAS,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,MAAc,EAAE,IAAsB;IAC5F,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,EAAU,EAAE,GAAW,EAAE,EAAE,CAAC,mBAAmB,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3H,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,KAAiB,EAAE,IAAsB;IAC5D,8FAA8F;IAC9F,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,CAAU,EACV,MAAyB,EACzB,KAAK,GAAsC,EAAE,EAC7C,IAAI,GAAqB,EAAE;IAE3B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,KAAK,CACT;QACE,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,iBAAiB,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,4BAA4B;QAC7D,MAAM,EAAE,aAAa,CAAC,IAAI;QAC1B,MAAM,EAAE;YACN,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,MAAM;YACN,GAAG,KAAK;YACR,qFAAqF;YACrF,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E;KACF,EACD,IAAI,CACL,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,CAAU,EACV,MAA4F,EAC5F,IAAI,GAAqB,EAAE;IAE3B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAChH,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,KAAK,CACT;QACE,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,iBAAiB,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,4BAA4B;QAC7D,MAAM,EAAE,aAAa,CAAC,qBAAqB;QAC3C,MAAM,EAAE;YACN,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,qFAAqF;YACrF,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E;KACF,EACD,IAAI,CACL,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,CAAU,EACV,QAAkG,EAClG,IAAI,GAAqB,EAAE;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1F,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,KAAK,CACT;QACE,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,iBAAiB,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,4BAA4B;QAC7D,MAAM,EAAE,aAAa,CAAC,aAAa;QACnC,MAAM,EAAE;YACN,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjH,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,qFAAqF;YACrF,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E;KACF,EACD,IAAI,CACL,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;oGAOoG;AACpG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,CAAU,EACV,SAAiB,EACjB,OAAe,EACf,KAAK,GAAsC,EAAE,EAC7C,IAAI,GAAqB,EAAE;IAE3B,MAAM,KAAK,CACT;QACE,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,iBAAiB,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,4BAA4B;QAC7D,MAAM,EAAE,aAAa,CAAC,IAAI;QAC1B,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE;KACjI,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED;iGACiG;AACjG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,CAAU,EAAE,KAAa,EAAE,IAAI,GAAqB,EAAE;IAC/F,MAAM,KAAK,CACT;QACE,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,iBAAiB,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,4BAA4B;QAC7D,MAAM,EAAE,aAAa,CAAC,QAAQ;QAC9B,MAAM,EAAE;YACN,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,0FAA0F;YAC1F,qEAAqE;YACrE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC1B,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,8EAA8E;SACrF;KACF,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,CAAU,EACV,MAAyF,EACzF,IAAI,GAAqB,EAAE;IAE3B,MAAM,KAAK,CACT;QACE,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,iBAAiB,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,4BAA4B;QAC7D,MAAM,EAAE,aAAa,CAAC,OAAO;QAC7B,MAAM,EAAE;YACN,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,6FAA6F;YAC7F,iGAAiG;YACjG,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC;KACF,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,CAAU,EACV,WAAmB,EACnB,SAAiB,EACjB,IAAI,GAAqB,EAAE;IAE3B,MAAM,KAAK,CACT;QACE,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,iBAAiB,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE;KAC7E,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;kGAOkG;AAClG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,CAAU,EACV,MAAc,EACd,mBAA2B,EAC3B,SAA6B,EAC7B,KAAK,GAAsC,EAAE,EAC7C,IAAI,GAAqB,EAAE;IAE3B,MAAM,KAAK,CACT;QACE,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,iBAAiB,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,4BAA4B;QAC7D,MAAM,EAAE,aAAa,CAAC,QAAQ;QAC9B,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE;KACxG,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,2FAA2F;AAC3F,8FAA8F;AAC9F,gGAAgG;AAChG,gGAAgG;AAChG,6FAA6F;AAE7F;;wEAEwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAEvD;;8FAE8F;AAC9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAsBxC,MAAM,eAAe,GAAqB,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAEjI,wEAAwE;AACxE,MAAM,UAAU,qBAAqB;IACnC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,MAAqD,EAAE,GAAW;IACtF,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAMC,EACD,GAAG,GAAS,IAAI,IAAI,EAAE;IAEtB,MAAM,GAAG,GAAG,IAAI,GAAG,EAA4B,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG;QACX,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,mBAAmB;KAC3B,CAAC;IACF,IAAI,CAAC;QACH,oEAAoE;QACpE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6G,CAAC;QACjI,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjD,IAAI,EAAE,KAAK,SAAS;gBAAE,SAAS;YAC/B,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;gBACrF,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACjB,CAAC;YACD,CAAC,CAAC,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAClD,IAAI,GAAG,KAAK,SAAS;gBAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3C,kEAAkE;YAClE,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC1B,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC;gBACtB,CAAC,CAAC,aAAa,GAAG,GAAG,IAAI,IAAI,CAAC;YAChC,CAAC;QACH,CAAC;QAED,0FAA0F;QAC1F,4FAA4F;QAC5F,+FAA+F;QAC/F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACjE,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAClD,IAAI,GAAG,KAAK,SAAS;oBAAE,SAAS;gBAChC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;oBAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACrG,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YACxC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACpI,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;gBACV,aAAa,EAAE,CAAC,EAAE,aAAa,IAAI,IAAI;gBACvC,UAAU,EAAE,CAAC,EAAE,UAAU,IAAI,IAAI;gBACjC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI;gBACpC,OAAO,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC;gBACtB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,yDAAyD,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1G,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAeD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAKC,EACD,SAAiB,EACjB,GAAG,GAAS,IAAI,IAAI,EAAE;IAEtB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;QAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,aAAa,CAAC,IAAI;QAC1B,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE;QACjE,KAAK,EAAE,mBAAmB;KAC3B,CAAC,CAAC;IACH,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,SAAS;YAAE,SAAS;QAClE,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS,CAAC,0DAA0D;QACjG,GAAG,CAAC,IAAI,CAAC;YACP,SAAS;YACT,SAAS;YACT,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI;YACpD,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI;SACpC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,mEAAmE;AACjF,CAAC"}